Slide 1

Slide 1 text

.Z42-ͷ઀ଓΤϥʔͱ .Z42-ϦϦʔεϊʔτͰΘ͍Θ͍ݴ͏ษڧձ 'SJ !NJUB

Slide 2

Slide 2 text

.Z42-ͷ઀ଓΤϥʔ w %#΁ͷ઀ଓ͕ԿΒ͔ͷݪҼͰ੾Εͯ͠·ͬͨέʔε w ୅දతͳΤϥʔϝοηʔδʣ 
 &3303 ): .Z42-TFSWFSIBTHPOFBXBZ 
 &3303 ): -PTUDPOOFDUJPOUP.Z42-TFSWFSEVSJOHRVFSZ

Slide 3

Slide 3 text

ݪҼͷಛఆ͕೉͍͠ʜ w ొ৔ਓ෺͕ଟ͍ w /8εΠονɺ'8ɺϩʔυόϥϯαFUD w Τϥʔϝοηʔδ͕Θ͔Γʹ͍͘

Slide 4

Slide 4 text

ݪҼͷಛఆ͕೉͍͠ʜ w ొ৔ਓ෺͕ଟ͍ w /8εΠονɺ'8ɺϩʔυόϥϯαFUD w Τϥʔϝοηʔδ͕Θ͔Γʹ͍͘

Slide 5

Slide 5 text

Τϥʔϝοηʔδ w NZTRME͕མͪͨ w ʢԿͰ͠ΐ͏ʣ w XBJU@UJNFPVUͰλΠϜΞ΢τ w ʢԿͰ͠ΐ͏ʣ w NBY@BMMPXFE@QBDLFUͷ੍ݶ౸ୡ w ʢԿͰ͠ΐ͏ʣ

Slide 6

Slide 6 text

Τϥʔϝοηʔδ w NZTRME͕མͪͨ w &3303 ): .Z42-TFSWFSIBTHPOFBXBZ w XBJU@UJNFPVUͰλΠϜΞ΢τ w ʢԿͰ͠ΐ͏ʣ w NBY@BMMPXFE@QBDLFUͷ੍ݶ౸ୡ w ʢԿͰ͠ΐ͏ʣ

Slide 7

Slide 7 text

Τϥʔϝοηʔδ w NZTRME͕མͪͨ w &3303 ): .Z42-TFSWFSIBTHPOFBXBZ w XBJU@UJNFPVUͰλΠϜΞ΢τ w &3303 ): .Z42-TFSWFSIBTHPOFBXBZ w NBY@BMMPXFE@QBDLFUͷ੍ݶ౸ୡ w ʢԿͰ͠ΐ͏ʣ

Slide 8

Slide 8 text

Τϥʔϝοηʔδ w NZTRME͕མͪͨ w &3303 ): .Z42-TFSWFSIBTHPOFBXBZ w XBJU@UJNFPVUͰλΠϜΞ΢τ w &3303 ): .Z42-TFSWFSIBTHPOFBXBZ w NBY@BMMPXFE@QBDLFUͷ੍ݶ౸ୡ w &3303 ): .Z42-TFSWFSIBTHPOFBXBZ

Slide 9

Slide 9 text

ҟͳΔݪҼͳͷʹಉ͡Τϥʔ ϝοηʔδ͕ฦΔ

Slide 10

Slide 10 text

ҟͳΔݪҼͳͷʹಉ͡Τϥʔϝοηʔδ͕ฦΔ w +%#$ͳΜͰ΋͔ΜͰ΋ɺDPNNVOJDBUJPOMJOLGBJMVSF w ʢ$POOFDUPS+WFSTJPOͰ͸վળ͞Ε͍ͯΔ͔΋͠Ε·ͤΜʣ w ࢀߟʣ%JWFJOUP.Z42-&SSPS!ZPLV 
 IUUQTTQFBLFSEFDLDPNZPLVEJWFJOUPNZTRMFSSPSZBQDUPLZPCB[JZPO

Slide 11

Slide 11 text

ಉ͡ݪҼͰҟͳΔΤϥʔ͕ฦΔ w ͖ͬ͞ͱٯύλʔϯ w NBY@BMMPXFE@QBDLFUͷ੍ݶ౸ୡ $ for i in 1 2 3 4 5; do mysql -ur -h127.0.0.1 malw < ins600.dmp; don e ERROR 2006 (HY000) at line 1: MySQL server has gone awa y ERROR 2006 (HY000) at line 1: MySQL server has gone awa y ERROR 1153 (08S01) at line 1: Got a packet bigger than 'max_allowed_packet' byte s ERROR 2006 (HY000) at line 1: MySQL server has gone awa y ERROR 1153 (08S01) at line 1: Got a packet bigger than 'max_allowed_packet' bytes

Slide 12

Slide 12 text

ิ଍ w αʔόαΠυͷΤϥʔϩάͱরΒ͠߹ΘͤΕ͹ɺൺֱత੾Γ෼͚͸ͭ͘ w XBJU@UJNFPVU w 5IFXBJU@UJNFPVUQFSJPEXBTFYDFFEFE UIFJEMFUJNFTJODFMBTUDPNNBOEXBTUPPMPOH w NBY@BMMPXFE@QBDLFU w "CPSUFEDPOOFDUJPOUPECTCUFTUVTFSTZTCFIPTUMPDBMIPTU 
 (PUBQBDLFUCJHHFSUIBONBY@BMMPXFE@QBDLFUCZUFT

Slide 13

Slide 13 text

.Z42-

Slide 14

Slide 14 text

w XBJU@UJNFPVUͰ੾ΒΕͨ͜ͱ͕Θ͔Δ👏 w XBJU@UJNFPVU w ௕࣌ؒɺԿ΋ϦΫΤετ͠ͳ͍ͱɺαʔό͕ίωΫγϣϯΛ੾Δ ͷվળ mysql> select now() ; ERROR 4031 (HY000): The client was disconnected by the server because of inactivity. See wait_timeout and interactive_timeout for configuring this behavior . No connection. Trying to reconnect.. . Connection id: 1 4 Current database: *** NONE ***

Slide 15

Slide 15 text

ΫϥΠΞϯτ΋ཁ w .Z42-DMJFOU.Z42-TFSWFS w ˠ&3303 ): 5IFDMJFOUXBTEJTDPOOFDUFECZUIFTFSWFSCFDBVTFPGJOBDUJWJUZ w .Z42-DMJFOU.Z42-TFSWFS w ˠ&3303 ): -PTUDPOOFDUJPOUP.Z42-TFSWFSEVSJOHRVFSZ w .Z42-DMJFOU.Z42-TFSWFS w ˠ&3303 ): -PTUDPOOFDUJPOUP.Z42-TFSWFSEVSJOHRVFSZ

Slide 16

Slide 16 text

·ͱΊ w .Z42-ͰXBJU@UJNFPVUىҼͷ઀ଓΤϥʔ͔Ͳ͏͔ 
 ൑ఆ͠΍͘͢ͳͬͨΑʂ

Slide 17

Slide 17 text

͓͠·͍