Upgrade to Pro — share decks privately, control downloads, hide ads and more …

KnotResolverへの毒入れ~世にも珍しいKashpureff型攻撃~ / Hack_to_KnotResolver

shutingrz
September 07, 2019

KnotResolverへの毒入れ~世にも珍しいKashpureff型攻撃~ / Hack_to_KnotResolver

shutingrz

September 07, 2019
Tweet

More Decks by shutingrz

Other Decks in Technology

Transcript

  1. ,OPU3FTPMWFS΁ͷಟೖΕ
    ͠Ύʔͱ
    !TIVUJOHS[

    dੈʹ΋௝͍͠,BTIQVSF⒎ܕ߈ܸd

    View Slide

  2. ࣗݾ঺հ
    w ͠Ύʔͱ !TIVUJOHS[

    w ηΩϡϦςΟΤϯδχΞ೥໨
    w ͣͬͱωοτϫʔΫηΩϡϦςΟ 40$
    ΍͚ͬͯͨͲ

    ࠓ೥͔Βಥવ*P5ηΩϡϦςΟΛ΍Γ࢝ΊΔ

    View Slide

  3. ࠷ۙͷझຯ

    View Slide

  4. ֓ཁ
    w ,OPU3FTPMWFS d
    ʹಟೖΕͷ੬ऑੑ
    w $7&
    w $/".&࿈࠯ͷΩϟογϡաఔͰCBJMJXJDLνΣοΫ͕ແ͔ͬͨ
    w ࠓճͷΑ͏ͳ%/4ಟೖΕ੬ऑੑ͸ۃΊͯϨΞέʔε
    w 1P$Λࣗ࡞͠੒ޭΛ֬ೝ
    w ͜ͷ੬ऑੑΛ௨ͯ͠ɺ%/4ಟೖΕͷ࠷΋جૅతͳ֓೦
    ʮCBJMJXJDLʯͷॏཁੑΛઆ໌͠·͢

    View Slide

  5. ಟೖΕͷݪཧ

    View Slide

  6. 4UVCSFTPMWFS

    XXXTIVUJOHS[DPNͷ*1ΞυϨε͸ʁ
    ͍ΘΏΔ1$
    DBDIF
    'VMMTFSWJDFSFTPMWFS

    XXXTIVUJOHS[DPN*/"
    ` `
    Ωϟογϡ֬ೝ
    BSPPUTFSWFSTOFU
    BHUMETFSWFSTOFU
    OTTIVUJOHS[DPN
    "VUIPSJUBUJWFTFSWFS
    "VUIPSJUBUJWFTFSWFS
    "VUIPSJUBUJWFTFSWFS

    XXXTIVUJOHS[DPN*/"ʁ

    DPN͸BHUMETFSWFSTOFUʹҕৡͯ͠Δ

    TIVUJOHS[DPN͸OTTIVUJOHS[DPNʹҕৡͯ͠Δ

    XXXTIVUJOHS[DPN*/"ʁ

    XXXTIVUJOHS[DPN*/"ʁ




    `
    XXXTIVUJOHS[DPN*/"



    ˞Ұ෦؆ུԽ͍ͯ͠·͢
    ࢀߟ
    ໊લղܾͷಈ࡞

    View Slide

  7. 4UVCSFTPMWFS

    XXXTIVUJOHS[DPNͷ*1ΞυϨε͸ʁ
    ͍ΘΏΔ1$
    DBDIF
    'VMMTFSWJDFSFTPMWFS

    XXXTIVUJOHS[DPN*/"
    BSPPUTFSWFSTOFU
    BHUMETFSWFSTOFU
    OTTIVUJOHS[DPN
    "VUIPSJUBUJWFTFSWFS
    "VUIPSJUBUJWFTFSWFS
    "VUIPSJUBUJWFTFSWFS

    XXXTIVUJOHS[DPN*/"ʁ

    DPN͸BHUMETFSWFSTOFUʹҕৡͯ͠Δ

    TIVUJOHS[DPN͸OTTIVUJOHS[DPNʹҕৡͯ͠Δ

    XXXTIVUJOHS[DPN*/"ʁ

    XXXTIVUJOHS[DPN*/"ʁ




    `
    XXXTIVUJOHS[DPN*/"



    %/4ΩϟογϡϙΠζχϯάͷݪཧ

    `

    ߈ܸऀ
    ` `
    Ωϟογϡ֬ೝ

    View Slide

  8. ಟೖΕͷ৚݅
    w ਖ਼نͷԠ౴ΑΓ΋ૣ͘Ϧκϧόʹ౸ୡ͢Δ͜ͱ
    w Ԡ౴͕໰͍߹Θͤͱ੔߹ੑ͕औΕ͍ͯΔ͜ͱ

    View Slide

  9. ͜Ε͕ಟೖΕͷݪཧ

    View Slide

  10. ͜Ε͕ಟೖΕͷݪཧ

    View Slide

  11. ͜Ε͕ಟೖΕͷݪཧ
    ͜Ε͚ͩ͡Ό͋Γ·ͤΜʂ

    View Slide

  12. ,BTIQVSF⒎ܕ߈ܸ

    View Slide

  13. ಟೖΕ͸छྨʹେผ͞ΕΔ
    w ِ૷Ԡ౴ܕ
    w ΈΜͳ͕஌͍ͬͯΔ%/4ΩϟογϡϙΠζχϯά
    w ϓϩτίϧʹର͢Δ߈ܸ 3'$४ڌͰݪཧ্๷͛ͳ͍
    w ,BNJOTLZܕ߈ܸख๏ ୈҰϑϥάϝϯτศ৐߈ܸ΋ຊ࣭͸͜Ε
    w ,BTIQVSF⒎ܕ
    w CBJMJXJDLνΣοΫෆඋʹΑΔΩϟογϡͱ͍͏࣮૷Λಥ͍ͨ߈ܸ

    3'$ҧ൓ͳͷͰमਖ਼Մೳ

    View Slide

  14. ࣮ྫ
    FYQMPJUಈը

    View Slide

  15. IUUQTUXJUUFSDPNTIVUJOHS[TUBUVT

    View Slide

  16. ͜ͷԠ౴ͷԿ͕حົͳͷ͔ʁ
    ྫBUUBDLFSDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴ FYQMPJU


    26&45*0/4&$5*0/

    BUUBDLFSDPN*/"

    "/48&34&$5*0/

    BUUBDLFSDPN*/$/".&HPPHMFDPN

    "%%*5*0/"-4&$5*0/

    HPPHMFDPN*/"

    View Slide

  17. ͜ͷԠ౴ͷԿ͕حົͳͷ͔ʁ
    ྫBUUBDLFSDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴ FYQMPJU


    26&45*0/4&$5*0/

    BUUBDLFSDPN*/"

    "/48&34&$5*0/

    BUUBDLFSDPN*/$/".&HPPHMFDPN

    "%%*5*0/"-4&$5*0/

    HPPHMFDPN*/"
    "%%*5*0/"-4&$5*0/ʹ
    PVUPGCBJMJXJDLͳԠ౴͕͋Δͷ͕حົ

    View Slide

  18. CBJMJXJDL
    w ௚༁ͰʮͳΘ͹Γʯ
    w ֤κʔϯʹ͸ͦΕͧΕͷʮͳΘ͹Γʯ͕ଘࡏ͢Δ
    w κʔϯͷݖҖαʔό͕ฦͨ͠ʮͳΘ͹ΓʯͰ͸ͳ͍Ԡ౴͸
    Ωϟογϡͯ͠͸͍͚ͳ͍
    w ਌κʔϯͷݖҖαʔό͕ฦͨ͠ɺࢠκʔϯͷͳΘ͹ΓͰ͋Δ
    Ԡ౴Λɺඞཁͳ৔߹Λআ͍ͯແࢹ͢Δ΂͖ 3'$

    w ͋ΔκʔϯͷͳΘ͹ΓͰ͋Δ෦෼ΛʮJOCBJMJXJDLʯ

    ͳΘ͹ΓͰͳ͍෦෼ΛʮPVUPGCBJMJXJDLʯͱݺͿ

    View Slide

  19. CBJMJXJDL
    w ௚༁ͰʮͳΘ͹Γʯ
    w ֤κʔϯʹ͸ͦΕͧΕͷʮͳΘ͹Γʯ͕ଘࡏ͢Δ
    w κʔϯͷݖҖαʔό͕ฦͨ͠ʮͳΘ͹ΓʯͰ͸ͳ͍Ԡ౴͸
    Ωϟογϡͯ͠͸͍͚ͳ͍
    w ਌κʔϯͷݖҖαʔό͕ฦͨ͠ɺࢠκʔϯͷͳΘ͹ΓͰ͋Δ
    Ԡ౴Λɺඞཁͳ৔߹Λআ͍ͯແࢹ͢Δ΂͖ 3'$

    w ͋ΔκʔϯͷͳΘ͹ΓͰ͋Δ෦෼ΛʮJOCBJMJXJDLʯ

    ͳΘ͹ΓͰͳ͍෦෼ΛʮPVUPGCBJMJXJDLʯͱݺͿ
    ˠྫ֎HMVFϨίʔυ ࠓճ͸ׂѪ

    %/4ಟೖΕରࡦͰ࠷΋ॏཁͳ֓೦

    View Slide

  20. CBJMJXJDLͷྫ

    w લఏ

    ɾFYBNQMFDPNκʔϯ͸DPNκʔϯͱͷؒͰ

    κʔϯΧοτ͞Ε͍ͯΔ

    ɾXXXFYBNQMFDPNκʔϯ͸ଘࡏ͠ͳ͍
    w ྫ

    XXXFYBNQMFDPN
    OVMM

    DPN
    FYBNQMFDPN

    View Slide

  21. CBJMJXJDLͷྫ

    w લఏ

    ɾKQSTDPKQκʔϯ͸KQκʔϯͱͷؒͰκʔϯΧοτ
    ͞Ε͍ͯΔ

    ɾXXXKQSTDPKQκʔϯ͸ଘࡏ͠ͳ͍
    w ྫ

    XXXKQSTDPKQ
    OVMM

    KQ
    KQSTDPKQ
    ˞υοτ
    ͷ֤Ґஔͱκʔϯ͸ରԠ͠ͳ͍͜ͱʹཹҙ

    View Slide

  22. CBJMJXJDLͷྫ

    w લఏ

    ɾOJTDHPKQκʔϯ͸KQκʔϯͱͷؒͰκʔϯΧοτ͞Εͯ
    ͍Δ

    ɾXXXOJTDHPKQκʔϯ͸OJTDHPKQκʔϯͱͷؒͰκʔϯ
    Χοτ͞Ε͍ͯΔ

    ɹ XXXOJTDHPKQκʔϯͷ/4͸OT<>XXXOJTDHPKQ

    w ྫ
    XXXOJTDHPKQ
    OVMM

    KQ
    OJTDHPKQ
    XXXOJTDHPKQ

    View Slide

  23. ໰୊Ͳ͕͜CBJMJXJDLͩʁ
    ྫFYBNQMFDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴


    26&45*0/4&$5*0/

    XXXFYBNQMFDPN*/"

    "/48&34&$5*0/

    XXXFYBNQMFDPN*/"

    "65)03*5:4&$5*0/

    FYBNQMFDPN*//4OTFYBNQMFDPN

    "%%*5*0/"-4&$5*0/

    OTFYBNQMFDPN*/"
    w
    ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ

    View Slide

  24. ໰୊Ͳ͕͜CBJMJXJDLͩʁ
    ྫFYBNQMFDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴


    26&45*0/4&$5*0/

    XXXFYBNQMFDPN*/"

    "/48&34&$5*0/

    XXXFYBNQMFDPN*/"

    "65)03*5:4&$5*0/

    FYBNQMFDPN*//4OTFYBNQMFDPN

    "%%*5*0/"-4&$5*0/

    OTFYBNQMFDPN*/"
    JOCBJMJXJDL
    PVUPGCBJMJXJDL
    JOCBJMJXJDL
    ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ

    View Slide

  25. ໰୊Ͳ͕͜CBJMJXJDLͩʁ
    ྫKQSTDPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴


    26&45*0/4&$5*0/

    XXXKQSTDPKQ*/"

    "/48&34&$5*0/

    XXXKQSTDPKQ*/"

    "65)03*5:4&$5*0/

    KQSTDPKQ*//4OTKQSTDPKQ

    "%%*5*0/"-4&$5*0/

    OTKQSTDPKQ*/"
    ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ

    View Slide

  26. ໰୊Ͳ͕͜CBJMJXJDLͩʁ
    JOCBJMJXJDL
    JOCBJMJXJDL
    JOCBJMJXJDL
    ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ
    ྫKQSTDPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴


    26&45*0/4&$5*0/

    XXXKQSTDPKQ*/"

    "/48&34&$5*0/

    XXXKQSTDPKQ*/"

    "65)03*5:4&$5*0/

    KQSTDPKQ*//4OTKQSTDPKQ

    "%%*5*0/"-4&$5*0/

    OTKQSTDPKQ*/"

    View Slide

  27. ໰୊Ͳ͕͜CBJMJXJDLͩʁ
    ྫXXXOJTDHPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴


    26&45*0/4&$5*0/

    XXXOJTDHPKQ*/"

    "/48&34&$5*0/

    XXXOJTDHPKQ*/"

    "65)03*5:4&$5*0/

    OJTDHPKQ*//4OTOJTDHPKQ

    "%%*5*0/"-4&$5*0/

    OTOJTDHPKQ*/"
    w
    ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ

    View Slide

  28. ໰୊Ͳ͕͜CBJMJXJDLͩʁ
    ྫXXXOJTDHPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴


    26&45*0/4&$5*0/

    XXXOJTDHPKQ*/"

    "/48&34&$5*0/

    XXXOJTDHPKQ*/"

    "65)03*5:4&$5*0/

    OJTDHPKQ*//4OTOJTDHPKQ

    "%%*5*0/"-4&$5*0/

    OTOJTDHPKQ*/"
    w
    PVUPGCBJMJXJDL
    PVUPGCBJMJXJDL
    JOCBJMJXJDL
    ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ

    View Slide

  29. ࿩Λ໭ͯ͠

    View Slide

  30. ,OPU3FTPMWFSͷ੬ऑੑ
    ྫBUUBDLFSDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴ FYQMPJU


    26&45*0/4&$5*0/

    BUUBDLFSDPN*/"

    "/48&34&$5*0/

    BUUBDLFSDPN*/$/".&HPPHMFDPN

    "%%*5*0/"-4&$5*0/

    HPPHMFDPN*/"
    PVUPGCBJMJXJDLͳԠ౴ΛΩϟογϡͯ͠͸͍͚ͳ͍
    ʢ౰ͨΓલͰ͸ɾɾɾʣ

    View Slide

  31. ,BTIQVSF⒎ܕ߈ܸͷ੒ཱ৚݅
    w Ωϟογϡαʔό͕CBJMJXJDLνΣοΫෆඋͷ੬ऑੑΛ࣋ͭ
    w ߈ܸऀ͕༻ҙͨ͠υϝΠϯ໊ʹΞΫηεͤ͞Δ

    View Slide

  32. ,BTIQVSF⒎ܕ߈ܸͷ੒ཱ৚݅
    w Ωϟογϡαʔό͕CBJMJXJDLνΣοΫෆඋͷ੬ऑੑΛ࣋ͭ
    w ߈ܸऀ͕༻ҙͨ͠υϝΠϯ໊ʹΞΫηεͤ͞Δ
    w Ωϟογϡαʔόͷར༻ऀʹ߈ܸυϝΠϯͷ63-Λ౿·
    ͤΔʁ

    View Slide


  33. w $SPVE'MBSF͕ఏڙ͢Δ1VCMJD%/4αʔϏε
    w ,OPU3FTPMWFSΛ࢖ͬͯΔ
    w ͭ·Γ౰࣌Λ%/4αʔόʹઃఆͯͨ͠ਓ͸ɾɾɾ

    View Slide

  34. ͓ΘΓ

    View Slide