KnotResolverへの毒入れ~世にも珍しいKashpureff型攻撃~ / Hack_to_KnotResolver

,OPU3FTPMWFS΁ͷಟೖΕ ͠Ύʔͱ !TIVUJOHS[ dੈʹ΋௝͍͠,BTIQVSF⒎ܕ߈ܸd

ࣗݾ঺հ w ͠Ύʔͱ !TIVUJOHS[ w ηΩϡϦςΟΤϯδχΞ೥໨ w ͣͬͱωοτϫʔΫηΩϡϦςΟ 40$
΍͚ͬͯͨͲ  ࠓ೥͔Βಥવ*P5ηΩϡϦςΟΛ΍Γ࢝ΊΔ

࠷ۙͷझຯ

֓ཁ w ,OPU3FTPMWFS d ʹಟೖΕͷ੬ऑੑ w $7& w $/".&࿈࠯ͷΩϟογϡաఔͰCBJMJXJDLνΣοΫ͕ແ͔ͬͨ w
ࠓճͷΑ͏ͳ%/4ಟೖΕ੬ऑੑ͸ۃΊͯϨΞέʔε w 1P$Λࣗ࡞͠੒ޭΛ֬ೝ w ͜ͷ੬ऑੑΛ௨ͯ͠ɺ%/4ಟೖΕͷ࠷΋جૅతͳ֓೦ ʮCBJMJXJDLʯͷॏཁੑΛઆ໌͠·͢

ಟೖΕͷݪཧ

4UVCSFTPMWFS XXXTIVUJOHS[DPNͷ*1ΞυϨε͸ʁ ͍ΘΏΔ1$ DBDIF 'VMMTFSWJDFSFTPMWFS XXXTIVUJOHS[DPN*/" `
` Ωϟογϡ֬ೝ BSPPUTFSWFSTOFU BHUMETFSWFSTOFU OTTIVUJOHS[DPN "VUIPSJUBUJWFTFSWFS "VUIPSJUBUJWFTFSWFS "VUIPSJUBUJWFTFSWFS XXXTIVUJOHS[DPN*/"ʁ DPN͸BHUMETFSWFSTOFUʹҕৡͯ͠Δ TIVUJOHS[DPN͸OTTIVUJOHS[DPNʹҕৡͯ͠Δ XXXTIVUJOHS[DPN*/"ʁ XXXTIVUJOHS[DPN*/"ʁ ` XXXTIVUJOHS[DPN*/" ˞Ұ෦؆ུԽ͍ͯ͠·͢ ࢀߟ ໊લղܾͷಈ࡞

4UVCSFTPMWFS XXXTIVUJOHS[DPNͷ*1ΞυϨε͸ʁ ͍ΘΏΔ1$ DBDIF 'VMMTFSWJDFSFTPMWFS XXXTIVUJOHS[DPN*/" BSPPUTFSWFSTOFU BHUMETFSWFSTOFU
OTTIVUJOHS[DPN "VUIPSJUBUJWFTFSWFS "VUIPSJUBUJWFTFSWFS "VUIPSJUBUJWFTFSWFS XXXTIVUJOHS[DPN*/"ʁ DPN͸BHUMETFSWFSTOFUʹҕৡͯ͠Δ TIVUJOHS[DPN͸OTTIVUJOHS[DPNʹҕৡͯ͠Δ XXXTIVUJOHS[DPN*/"ʁ XXXTIVUJOHS[DPN*/"ʁ ` XXXTIVUJOHS[DPN*/" %/4ΩϟογϡϙΠζχϯάͷݪཧ ` ߈ܸऀ ` ` Ωϟογϡ֬ೝ

ಟೖΕͷ৚݅ w ਖ਼نͷԠ౴ΑΓ΋ૣ͘Ϧκϧόʹ౸ୡ͢Δ͜ͱ w Ԡ౴͕໰͍߹Θͤͱ੔߹ੑ͕औΕ͍ͯΔ͜ͱ

͜Ε͕ಟೖΕͷݪཧ

͜Ε͕ಟೖΕͷݪཧ ͜Ε͚ͩ͡Ό͋Γ·ͤΜʂ

,BTIQVSF⒎ܕ߈ܸ

ಟೖΕ͸छྨʹେผ͞ΕΔ w ِ૷Ԡ౴ܕ w ΈΜͳ͕஌͍ͬͯΔ%/4ΩϟογϡϙΠζχϯά w ϓϩτίϧʹର͢Δ߈ܸ 3'$४ڌͰݪཧ্๷͛ͳ͍ w ,BNJOTLZܕ߈ܸख๏
ୈҰϑϥάϝϯτศ৐߈ܸ΋ຊ࣭͸͜Ε w ,BTIQVSF⒎ܕ w CBJMJXJDLνΣοΫෆඋʹΑΔΩϟογϡͱ͍͏࣮૷Λಥ͍ͨ߈ܸ  3'$ҧ൓ͳͷͰमਖ਼Մೳ

࣮ྫ FYQMPJUಈը

IUUQTUXJUUFSDPNTIVUJOHS[TUBUVT

͜ͷԠ౴ͷԿ͕حົͳͷ͔ʁ ྫBUUBDLFSDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴ FYQMPJU     26&45*0/4&$5*0/  BUUBDLFSDPN*/"  "/48&34&$5*0/  BUUBDLFSDPN*/$/".&HPPHMFDPN  "%%*5*0/"-4&$5*0/ 
HPPHMFDPN*/"

͜ͷԠ౴ͷԿ͕حົͳͷ͔ʁ ྫBUUBDLFSDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴ FYQMPJU     26&45*0/4&$5*0/  BUUBDLFSDPN*/"  "/48&34&$5*0/  BUUBDLFSDPN*/$/".&HPPHMFDPN  "%%*5*0/"-4&$5*0/ 
HPPHMFDPN*/" "%%*5*0/"-4&$5*0/ʹ PVUPGCBJMJXJDLͳԠ౴͕͋Δͷ͕حົ

CBJMJXJDL w ௚༁ͰʮͳΘ͹Γʯ w ֤κʔϯʹ͸ͦΕͧΕͷʮͳΘ͹Γʯ͕ଘࡏ͢Δ w κʔϯͷݖҖαʔό͕ฦͨ͠ʮͳΘ͹ΓʯͰ͸ͳ͍Ԡ౴͸ Ωϟογϡͯ͠͸͍͚ͳ͍ w ਌κʔϯͷݖҖαʔό͕ฦͨ͠ɺࢠκʔϯͷͳΘ͹ΓͰ͋Δ
Ԡ౴Λɺඞཁͳ৔߹Λআ͍ͯແࢹ͢Δ΂͖ 3'$ w ͋ΔκʔϯͷͳΘ͹ΓͰ͋Δ෦෼ΛʮJOCBJMJXJDLʯ  ͳΘ͹ΓͰͳ͍෦෼ΛʮPVUPGCBJMJXJDLʯͱݺͿ

CBJMJXJDL w ௚༁ͰʮͳΘ͹Γʯ w ֤κʔϯʹ͸ͦΕͧΕͷʮͳΘ͹Γʯ͕ଘࡏ͢Δ w κʔϯͷݖҖαʔό͕ฦͨ͠ʮͳΘ͹ΓʯͰ͸ͳ͍Ԡ౴͸ Ωϟογϡͯ͠͸͍͚ͳ͍ w ਌κʔϯͷݖҖαʔό͕ฦͨ͠ɺࢠκʔϯͷͳΘ͹ΓͰ͋Δ
Ԡ౴Λɺඞཁͳ৔߹Λআ͍ͯແࢹ͢Δ΂͖ 3'$ w ͋ΔκʔϯͷͳΘ͹ΓͰ͋Δ෦෼ΛʮJOCBJMJXJDLʯ  ͳΘ͹ΓͰͳ͍෦෼ΛʮPVUPGCBJMJXJDLʯͱݺͿ ˠྫ֎HMVFϨίʔυ ࠓճ͸ׂѪ %/4ಟೖΕରࡦͰ࠷΋ॏཁͳ֓೦

CBJMJXJDLͷྫ w લఏ  ɾFYBNQMFDPNκʔϯ͸DPNκʔϯͱͷؒͰ  κʔϯΧοτ͞Ε͍ͯΔ  ɾXXXFYBNQMFDPNκʔϯ͸ଘࡏ͠ͳ͍ w ྫ  XXXFYBNQMFDPN
OVMM DPN FYBNQMFDPN

CBJMJXJDLͷྫ w લఏ  ɾKQSTDPKQκʔϯ͸KQκʔϯͱͷؒͰκʔϯΧοτ ͞Ε͍ͯΔ  ɾXXXKQSTDPKQκʔϯ͸ଘࡏ͠ͳ͍ w ྫ  XXXKQSTDPKQ
OVMM KQ KQSTDPKQ ˞υοτ ͷ֤Ґஔͱκʔϯ͸ରԠ͠ͳ͍͜ͱʹཹҙ

CBJMJXJDLͷྫ w લఏ  ɾOJTDHPKQκʔϯ͸KQκʔϯͱͷؒͰκʔϯΧοτ͞Εͯ ͍Δ  ɾXXXOJTDHPKQκʔϯ͸OJTDHPKQκʔϯͱͷؒͰκʔϯ Χοτ͞Ε͍ͯΔ  ɹ XXXOJTDHPKQκʔϯͷ/4͸OT<>XXXOJTDHPKQ
w ྫ XXXOJTDHPKQ OVMM KQ OJTDHPKQ XXXOJTDHPKQ

໰୊Ͳ͕͜CBJMJXJDLͩʁ ྫFYBNQMFDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴    26&45*0/4&$5*0/  XXXFYBNQMFDPN*/"  "/48&34&$5*0/  XXXFYBNQMFDPN*/"  "65)03*5:4&$5*0/  FYBNQMFDPN*//4OTFYBNQMFDPN  "%%*5*0/"-4&$5*0/ 
OTFYBNQMFDPN*/" w ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ

໰୊Ͳ͕͜CBJMJXJDLͩʁ ྫFYBNQMFDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴    26&45*0/4&$5*0/  XXXFYBNQMFDPN*/"  "/48&34&$5*0/  XXXFYBNQMFDPN*/"  "65)03*5:4&$5*0/  FYBNQMFDPN*//4OTFYBNQMFDPN  "%%*5*0/"-4&$5*0/ 
OTFYBNQMFDPN*/" JOCBJMJXJDL PVUPGCBJMJXJDL JOCBJMJXJDL ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ

໰୊Ͳ͕͜CBJMJXJDLͩʁ ྫKQSTDPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴    26&45*0/4&$5*0/  XXXKQSTDPKQ*/"  "/48&34&$5*0/  XXXKQSTDPKQ*/"  "65)03*5:4&$5*0/  KQSTDPKQ*//4OTKQSTDPKQ  "%%*5*0/"-4&$5*0/ 
OTKQSTDPKQ*/" ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ

໰୊Ͳ͕͜CBJMJXJDLͩʁ JOCBJMJXJDL JOCBJMJXJDL JOCBJMJXJDL ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ ྫKQSTDPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴    26&45*0/4&$5*0/  XXXKQSTDPKQ*/"  "/48&34&$5*0/ 
XXXKQSTDPKQ*/"  "65)03*5:4&$5*0/  KQSTDPKQ*//4OTKQSTDPKQ  "%%*5*0/"-4&$5*0/  OTKQSTDPKQ*/"

໰୊Ͳ͕͜CBJMJXJDLͩʁ ྫXXXOJTDHPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴    26&45*0/4&$5*0/  XXXOJTDHPKQ*/"  "/48&34&$5*0/  XXXOJTDHPKQ*/"  "65)03*5:4&$5*0/  OJTDHPKQ*//4OTOJTDHPKQ  "%%*5*0/"-4&$5*0/ 
OTOJTDHPKQ*/" w ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ

໰୊Ͳ͕͜CBJMJXJDLͩʁ ྫXXXOJTDHPKQκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴    26&45*0/4&$5*0/  XXXOJTDHPKQ*/"  "/48&34&$5*0/  XXXOJTDHPKQ*/"  "65)03*5:4&$5*0/  OJTDHPKQ*//4OTOJTDHPKQ  "%%*5*0/"-4&$5*0/ 
OTOJTDHPKQ*/" w PVUPGCBJMJXJDL PVUPGCBJMJXJDL JOCBJMJXJDL ˞͋͘·ͰྫͰ͋Γ࣮ࡍͷωʔϜαʔό͸͜͏͍͏Ԡ౴Ͱ͸ͳ͍ͷͰ஫ҙ

࿩Λ໭ͯ͠

,OPU3FTPMWFSͷ੬ऑੑ ྫBUUBDLFSDPNκʔϯͷݖҖαʔόʹΑΔݖҖԠ౴ FYQMPJU     26&45*0/4&$5*0/  BUUBDLFSDPN*/"  "/48&34&$5*0/  BUUBDLFSDPN*/$/".&HPPHMFDPN  "%%*5*0/"-4&$5*0/ 
HPPHMFDPN*/" PVUPGCBJMJXJDLͳԠ౴ΛΩϟογϡͯ͠͸͍͚ͳ͍ ʢ౰ͨΓલͰ͸ɾɾɾʣ

,BTIQVSF⒎ܕ߈ܸͷ੒ཱ৚݅ w Ωϟογϡαʔό͕CBJMJXJDLνΣοΫෆඋͷ੬ऑੑΛ࣋ͭ w ߈ܸऀ͕༻ҙͨ͠υϝΠϯ໊ʹΞΫηεͤ͞Δ

,BTIQVSF⒎ܕ߈ܸͷ੒ཱ৚݅ w Ωϟογϡαʔό͕CBJMJXJDLνΣοΫෆඋͷ੬ऑੑΛ࣋ͭ w ߈ܸऀ͕༻ҙͨ͠υϝΠϯ໊ʹΞΫηεͤ͞Δ w Ωϟογϡαʔόͷར༻ऀʹ߈ܸυϝΠϯͷ63-Λ౿· ͤΔʁ

w $SPVE'MBSF͕ఏڙ͢Δ1VCMJD%/4αʔϏε w ,OPU3FTPMWFSΛ࢖ͬͯΔ w ͭ·Γ౰࣌Λ%/4αʔόʹઃఆͯͨ͠ਓ͸ɾɾɾ

͓ΘΓ

KnotResolverへの毒入れ~世にも珍しいKashpureff型攻撃~ / Hack_t...

KnotResolverへの毒入れ~世にも珍しいKashpureff型攻撃~ / Hack_to_KnotResolver

More Decks by shutingrz

Other Decks in Technology

Featured

Transcript