ディスプレイ広告の基礎とセキュリティ

 ディスプレイ広告の基礎とセキュリティ

2016/04/23のhttp2studyでの発表資料です

http2 勉強会 #7 - connpass
http://http2study.connpass.com/event/29813/

本文はこちら: https://gist.github.com/suzuken/5deb6c450db854ab7fe2fb2c299b0134

9c47f639b91a66ccf901724eaaf9043d?s=128

Kenta Suzuki

April 23, 2016
Tweet

Transcript

  1. σΟεϓϨΠ޿ࠂͷ جૅͱηΩϡϦςΟ @suzu_v VOYAGE GROUP 2016/04/23 at dots. #http2study

  2. ࢲʹ͍ͭͯ • ͚ͣ͢Μ https://github.com/suzuken @suzu_v • SSP http://fluct.jp Ͱιϑτ΢ΣΞΤϯδχΞ Λ͍ͯ͠·͢ɻGopherͰ͢ɻ

    • http2study͸ॳࢀՃͰ͢ɺ͓͡Ό·͠·͢
  3. ࠓ೔࿩͢͜ͱ • σΟεϓϨΠ޿ࠂ഑৴ͷ࢓૊Έ • SSLରԠ޿ࠂ഑৴ͱݱঢ় • Malvertising ൃදதͷ࣭໰΋͓ؾܰʹͲ͏ͧʂ

  4. σΟεϓϨΠ޿ࠂ഑৴ͷγεςϜ • ͨ͘͞Μͷഔମʹ޿ࠂΛ഑৴͢Δ࢓૊Έ • ༷ʑͳϓϨΠϠʔΛHTTP(S)Ͱͭͳ͛ͯ޿ࠂΛ ΍ΓऔΓ͢Δ • ඞͣ͠΋ࣗ෼ͷγεςϜʹೖߘ͞Εͨad͕ ग़ΔΘ͚Ͱ͸ͳ͍ʢωοτϫʔΫԽ͞Εͯ ͍ΔͷͰɺଞͷ޿ࠂ഑৴γεςϜ͔Βͷad

    ͕ग़Δʣ
  5. original: http://www.slideshare.net/shoho/ ss-36728773

  6. SSP΍ΞυωοτϫʔΫͰSSL ରԠͷ޿ࠂ഑৴ͬͯͰ͖ΔΜ Ͱ͔͢ʁ Ͱ͖·͢

  7. యܕతͳnested iframe • ৔߹ʹΑͬͯ͸5,6ஈ • ֎ͷۀऀͷ΋ͷ͸جຊతʹ ผυϝΠϯͷiframe • iframeͷதʹෳ਺ JavaScript

    + HTML + imgλ ά
  8. Demo: ղઆ • httpͰͷ޿ࠂ഑৴ͷྫ • SSLରԠ޿ࠂ഑৴ͷྫ

  9. mixed content?

  10. ϝσΟΞ͔Βݟͨ޿ࠂ഑৴ํ๏ Webϒϥ΢βͰݟΔϝσΟΞΛ૝ఆ͠·͢ • DFP, λάϚωʔδϟʔͳͲͷπʔϧܦ༝ • ࣗࣾ޿ࠂαʔόܦ༝ • JavaScriptλά or

    iframeλά௚షΓ
  11. SSLରԠ޿ࠂ഑৴: SSPͷ৔߹ • ର৅ͱͳΔഔମ΋͘͠͸࿮ͷ഑৴ઃఆͰɺSSL ରԠ͍ͯ͠ΔDSP, ADNWΛબ୒͢Δ • bid request΋͘͠͸޿ࠂϦΫΤετ࣌ʹഔମ ͕HTTPSͰserve͞Ε͍ͯΔ͜ͱΛ఻͑Δ

    • SSLରԠͷΫϦΤΠςΟϒ͕ग़Δ SSP͔ΒݟΔͱͪΌΜͱSSLରԠͷΫϦΤΠςΟϒ ͕ग़Δ͔Ͳ͏͔͸DSP, ADNWʹҕͶΒΕ·͢ɻ
  12. OpenRTB ޿ࠂΦʔΫγϣϯͷϓϩτίϧΛܾΊͨ΋ͷɻ 2.2 (2014/04) Ҏ߱: secureଐੑ͕௥Ճɻഔମଆ͕ HTTPSͷ৔߹ʹ໌ࣔతʹΫϦΤΠςΟϒ͕HTTPS URLͰ͋Δ͜ͱΛཁٻͰ͖ΔΑ͏ʹɻ Flag to

    indicate whether the impression requires secure HTTPS URL creative assets and markup. from: Real-Time Bidding (RTB) Project
  13. ࠷ۙͷ࿩: ࠃ಺ಈ޲ • ࠃ಺DSPʹ͍ͭͯ΋ঃʑʹSSLରԠ͕͞Ε͖͍ͯͯΔͷͰɺར༻Մೳͳ DSP΋૿͖͍͑ͯͯ·͢ • εϚϗ޲͚ͷ৔߹͸iOSͷATS͕͋ΓɺSSLରԠඞਢ • ୈࡾऀ഑৴αʔόͰHTTPݶఆͰ഑৴ઃఆ͞Ε͍ͯΔ΋ͷʹ͍ͭͯ͸ͦ ͪΒΛมߋ͢Δඞཁ͕͋Γ·͢

    • ޿ࠂ࿮͝ͱʹSSLར༻͢Δ͔͠ͳ͍͔ɺͱ͍͏ͷΛมߋ͢Δඞཁ͕͋ Δ͔΋͠Ε·ͤΜ • ྫ: ϩάΠϯޙͷϖʔδ͸͢΂ͯSSLରԠͷ޿ࠂ͔͠ग़͞ͳ͍Α͏ʹ͢ Δ • ͪͳΈʹฐࣾͷSSPͰ͸৽نλά͸શͯSSL഑৴ରԠͷ޿ࠂλάΛ഑ͬ ͍ͯ·͢
  14. mixed contentsରԠ mixed contentͷblock͸Ϣʔβͷબ୒ͱͯ͠ଥ౰ • SSLରԠͷad͕ਖ਼͘͠഑৴͞ΕΕ͹໰୊ͳ͍ • ͔͠͠ɺexchange΍SSP͕࠷ऴతʹadΛαʔϒ͢ ΔγεςϜ͕SSLରԠ͔൱͔Λ஌Δํ๏͸ͳ͍ •

    ࣮ࡍʹmixed contentʹΑΓad͕block͞ΕΔࣄྫ΋ աڈʹ͋ͬͨ • ֘౰͢ΔDSP / Ad Exchange͔Βͷ޿ࠂ഑৴Λ׬શ ʹఀࢭ͢ΔͳͲͷରԠΛͨ͠
  15. SSLରԠͱ޿ࠂɺͦͯ͠ऩӹੑ • SSLରԠ͸ϢʔβͱϝσΟΞͷཁٻɻ޿ࠂࣄۀऀ ͸͜ΕʹԠ͑Δඞཁ͕͋Γ·͢ɻ • SSLରԠͷ޿ࠂΛग़͢͜ͱ͸ٕज़తʹ΋ͪΖΜՄ ೳɻ • SSLରԠͷ޿ࠂࣄۀऀ͕૿͑ͳ͚Ε͹ϝσΟΞଆ ͷબ୒ࢶ͕ݮΔɻ

    • ରԠ͢Δ޿ࠂ഑৴ࣄۀऀ͕૿͑ͳ͍ͱ͍͚ͳ ͍
  16. Malvertising

  17. Malvertising original: http://www.anti-malvertising.com/

  18. Malvertisingࣄྫ • 2015೥9݄ ෆਖ਼޿ࠂ͕໿3,000 ͷࠃ಺େखαΠτΛԚ છɺ50ສϢʔβʹӨڹ | τϨϯυϚΠΫϩ ηΩϡϦςΟ ϒϩά

    • ද͚ࣔͨͩ͠ͰϑΝΠϧ͕μ΢ϯϩʔυ͞Εͯ͠·͏ • ߈ܸऀ͕ෆਖ਼ͳ޿ࠂΛւ֎ͷ޿ࠂ഑৴ۀऀʹೖߘɺ޿ ࠂ͕දࣔ͞Εͨஈ֊Ͱ߈ܸऀͷαʔόʹΞΫηεͤ͞Δ • ϒϥ΢β΍Flash PlayerͳͲͷ੬ऑੑΛར༻ͯ͠ exploit kitΛΠϯετʔϧͤ͞Δ
  19. PublisherଆͰͰ͖Δରࡦ શͯͷഔମɺ΋͘͠͸supply-sideͷPublisher͸ Ϛϧ΢ΣΞ࡞ऀͷඪతʹͳΔՄೳੑ͕͋Δɻ • ޿ࠂओΛݟఆΊΔ͜ͱ • LPͷυϝΠϯ͸৴པͰ͖Δ΋ͷ͔ʁ৽͗͢͠ͳ͍͔ʁࠃ֎ ͷ޿ࠂ͔ʁಉҰIPʹෳ਺޿ࠂओͷad͕αʔϒ͞Ε͍ͯͳ͍ ͔ʁ •

    શͯͷΫϦΤΠςΟϒʹܧଓతͳ஫ҙΛ෷͏͜ͱ • 2008೥: Google Online Security Blog: All Your iFrame Are Point to Us
  20. ͲͷΑ͏ʹMalvertisingΛ๷͙͔ • ޿ࠂ৹ࠪͰ༧๷͢Δ • ഑৴͞ΕΔ޿ࠂ͸ଥ౰ͳ಺༰͔ʁ: όφʔͷ಺༰ͱ LP(Landing Page)͕ဃ཭ͨ͠΋ͷͰ͸ͳ͍͔ɻ • ৴པͰ͖Δ޿ࠂओ͔ʁ

    • ೖߘ͞ΕΔΫϦΤΠςΟϒͷυϝΠϯ / ޿ࠂओΛ੍ݶ͢Δ ୈࡾऀͷ޿ࠂ഑৴γεςϜ͔Βෆਖ਼ͳ޿ࠂ͕ྲྀΕ Δ৔߹ɺ͜ΕΛࣗಈతʹഉআ͢Δ࢓૊Έ͕ٻΊΒ Ε͍ͯΔɻͰ͸AdBlock͔ʁ
  21. ҆શͳϒϥ΢δϯάͱAdBlock Ϣʔβͷߦಈ͸ৗʹ߹ཧత • ʮ޿ࠂΛϒϩοΫ͢Ε͹΢Πϧεʹ͸ײછ͠ͳ͍ʯͱͳΒͳ͍ Α͏ʹ • ऩӹʹෛͷӨڹ͕͋Δ / ޿ࠂΛ৴པͯ͠΋Β͏ͨΊͷऔΓ૊ ΈΛ͠ͳ͚Ε͹ͳΒͳ͍ɻ

    • ϢʔβΛةݥʹ͞Β͞ͳ͍Α͏ͳ޻෉ΛɻMalvertising͸޿ࠂࣄ ۀऀ͕औΓ૊Ή΂͖՝୊ɻ • AdBlock͞Ε͍ͯΔ͔Β࢓ํͳ͍ɺͰ͸ͳͯ͘Ϣʔβʹ৴པͯ͠ ΋Β͑ΔΑ͏ʹ޿ࠂۀքͱͯ͠΋ͷͮ͘Γͱӡ༻ΛॏͶ͍ͯ͘ ඞཁ͕͋Δɻ
  22. AdBlockͱऩӹੑɺͦͯ͠Ϛϧ΢ΣΞ • 2016/01/08 Forbes forces readers to turn off ad

    blockers, promptly serves malware | ExtremeTech • adblockΛ༗ޮʹ͍ͯ͠ΔϢʔβʹ͍ͭͯForbes.com͕ఏڙΛ ఀࢭͨ͠ɺ͔͠͠Ϛϧ΢ΣΞ͕αʔϒ͞Εͯ͠·ͬͨ • Cyphort | Malvertising Report 2015 ʹΑΔͱMalvertisingͰ΋ ߈ܸऀαʔό΁ͷ༠ಋʹhttpsͷϦμΠϨΫλ͕ར༻͞ΕΔΑ ͏ʹͳ͖͍ͬͯͯΔɻѱҙͷ͋ΔαΠτͷಛఆ͕೉͘͠ͳΔɻ • αΠτར༻ͷշదੑͱऩӹੑͷ݉Ͷ߹͍ • Ad͕ऩӹͷେ෦෼Λ͠ΊΔഔମͩͱAdblock͍ͯ͠ΔϢʔβ ͕૿͑Δͱड͚ೖΕ͕͍ͨ
  23. ·ͱΊ • SSLରԠ޿ࠂ഑৴͸Ͱ͖·͢ ޿ࠂࣄۀऀͱͯ͠ • Ϣʔβɺഔମʹ҆શʹ޿ࠂΛར༻ͯ͠΋Β͑Δ Α͏ʹద੾ͳํ๏Ͱ޿ࠂΛαʔϒ͢Δ͜ͱ͕Ҿ ͖ଓ͖ٻΊΒΕ͍ͯΔ • Ϣʔβͷ޿ࠂ΁ͷ৴པΛอͪɺऩӹੑΛ୲อ͠

    ͭͭɺ࣌ྲྀʹଈͨ͠޿ࠂ഑৴Λ͍ͯ͘͠ඞཁ͕ ͋Δ