Goなどで作る脆弱性対策ゲーム / go-bigbridge

@Fukuoka.go #11

https://fukuokago.connpass.com/event/87684/

Transcript

1. 6DIJP,POEP
   'VLVPLBHP
   (PͳͲͰ࡞Δ੬ऑੑରࡦήʔϜ
   

   View Slide

2. (.0ϖύϘγχΞϓϦϯγύϧ
   ۙ౻͏͓ͪ!VE[VSB
   044ϓϩμΫτ
   w NSVCZͷίϯςφϥϯλΠϜ)BDPOJXB
   w 3VCZͷ ZFU"OPUIFS
   0QFO4UBDLDMJFOU:BP
   3VCZ͸೥΄Ͳɺ(P͸೥͙Β͍ʁ
   ޷͖ͳϥΠϒϥϦIBTIJDPSQIDM
   ར༻ϒΩϓϥΠϜγϡʔλʔίϥϘ
   ηΩϡϦςΟ͸ษڧ࢝͠Ίͨ͹͔ΓͰ͢
   

   View Slide

3. "MTPB3VCZJTU
   

   View Slide

4. View Slide

5. 'VLVPLBSC
   !
   ԙϖύες
   

   View Slide

6. 8FCΞϓϦέʔγϣϯͷ
   ੬ऑੑ
   

   View Slide

7. View Slide

8. $43'
   

   View Slide

9. 42-
   *OKFDUJPO
   

   View Slide

10. ߈ܸ͞Εͨ͜ͱ
    ͋Γ·͔͢ʁ
    

    View Slide

11. ߈ܸΛ஌Γ͍ͨ
    ๷ޚ͍ͨ͠
    

    View Slide

12. ࿅शʢʁʣ͠Α͏
    

    View Slide

13. DG%78"
    w%BNO7VMOFSBCMF8FC"QQMJDBUJPO
    w͋͑ͯ੬ऑͳ࡞Γʹͨ͠΢ΣϒΞϓϦέʔγϣϯ
    w༷ʑͳ߈ܸΛ࣮ࡍʹߦ͏͜ͱͰɺ߈ܸଆͷؾ࣋ͪʹͳΓ

    ͦΕ͕։ൃʹ͓͍ͯ΋໾ʹཱͭ
    wΞϓϦέʔγϣϯͷ੬ऑ౓߹͍ΛઃఆͰ͖ͯศརʢʁʣ
    IUUQXXXEWXBDPVL
    

    View Slide

14. ߈ܸΛͯ͠ΈΔͱ
    

    View Slide

15. View Slide

16. ͜ΕΛࣗಈԽ͢Δͱ
    

    View Slide

17. ๷ޚଆͷ
    ࿅शʹ΋࢖͑ΔͷͰ͸ʁ
    

    View Slide

18. CJHCSJEHFϓϩδΣΫτʢԾʣ
    wೋͭͷίϯςφΛ࡞Δ߈ܸଆɺ๷ޚଆ
    w߈ܸଆ͸όΠφϦͰϒϥοΫϘοΫεͷϓϩάϥϜ
    w๷ޚଆ͸"QBDIFNPE@QIQͳ੬ऑͳΞϓϦέʔγϣϯ

    TTIͰௐࠪՄೳͳΑ͏ɺγεςϜίϯςφʹͳ͍ͬͯΔ
    

    View Slide

19. CJHCSJEHF
    IUUQTDTLZVTIVVBDKQFOQJUQSP
    

    View Slide

20. ߏ੒
    Binary
    Apache MySQL
    App
    
    (PHP)
    SSHD
    Attacker Defender
    

    View Slide

21. ๷ޚଆ͔ΒৄࡉΛɻ
    wTPWFSMBZͱ͍͏ɺ%PDLFS΍ίϯςφʹಛԽͨ͠γϯϓϧͳJOJUͷ࢓
    ૊ΈΛ࢖ͬͯγεςϜίϯςφΛ࡞Δɻ
    wTTIE ϩάͷͨΊSTZTMPH
    ɺBQBDIFɺ.Z42-Λࣂ͍ͬͯΔ
    wPDUPQBTTͰTTIϩάΠϯपΓΛ؆୯ʹ
    IUUQTHJUIVCDPNKVTUDPOUBJOFSTTPWFSMBZ
    

    View Slide

22. ߈ܸଆɻ
    wṖͷόΠφϦ͕͋Δ
    wઃఆʹ͸ɺ߈ܸઌͷΞυϨεͳͲͷ৘ใ͔͠౉ͤͳ͘ɺͲ͏͍͏߈ܸ
    Λ͍ͯ͠Δ͔͸Θ͔Βͳ͍
    wىಈ͢Δͱɺର৅΁ͷ߈ܸͷ੒ޭࣦഊ͚͕ͩΘ͔Δ
    wˠ๷ޚଆͷϩάͳͲΛ֬ೝ͠ɺΞϓϦΛվमͯ͠
    

    View Slide

23. ߈ܸϕϯνϚʔΫͷྲྀΕ
    w߈ܸଆͰόΠφϦىಈˠ๷ޚଆͰϩάͳͲΛ֬ೝ
    wˠ๷ޚଆͷઃఆΛมߋͨ͠ΓɺΞϓϦΛվम
    wˠ࠶౓߈ܸΛ͠ɺࣦഊͨ͠Β๷Ӵ੒ޭʂʂʂ̍
    

    View Slide

24. ṖͷόΠφϦ
    

    View Slide

25. ͦ͜ͰɺΛ࢖͏
    

    View Slide

26. ࣮૷ͷྫ
    

    View Slide

27. ໾ʹཱͭ΋ͷ
    wIFBE[PPTVSG
    wঢ়ଶΛอͭ͜ͱ͕Ͱ͖Δ΢ΣϒεΫϨΠύʔϥΠϒϥϦ
    IUUQTHJUIVCDPNIFBE[PPTVSG
    

    View Slide

28. EFNP
    wʢतۀͰ࢖͏ͱ͍͏͜ͱͰɺৄࡉ͸·ͩφΠγϣʣ
    

    View Slide

29. ࠓޙ΍Γ͍ͨ͜ͱ
    w߈ܸͷόϦΤʔγϣϯΛ૿΍͢
    w؆୯ͳରࡦͰ͋ͬͨΒ߈ܸଆͰݟൈ͔Εͯ͢Γൈ͚Δ΍ͭͱ͔
    w߈ܸόΠφϦΛ΋ͬͱ೉ಡԽ͢Δ
    w๷ޚଆɺ1)1Ҏ֎ͷݴޠϑϨʔϜϫʔΫΛ૿΍͢
    

    View Slide

30. จࣈྻΛӅ͍ͨ͠
    w(Pݴޠ੡ͷόΠφϦͰ΋ɺ΋ͪΖΜTUSJOHT
    ͳͲͰ߈ܸख๏ʹؔ
    ܎͢Δจࣈྻ͸ݟ͑ͯ͠·͏ɻ
    wจࣈσʔλΛ·ͱΊͯ֎෦͔Βఏڙͭͭɺ҉߸Խ͞ΕͨܗͰόΠφϦ
    ؚΉΑ͏ͳπʔϧΛ࡞ΕΔͱྑͦ͞͏ʁ
    wʢ΋ͪΖΜɺҰൠతͳ࿩ͰόΠφϦ಺ͷจࣈྻΛ҉߸Խͯ͠΋

    ɹͦΜͳʹηΩϡϦςΟରࡦʹ͸ͳΒͳ͍ɻΫΠζͷ೉қ౓తͳ࿩Ͱʣ
    

    View Slide

31. View Slide

32. PT&YJU
    
    

    View Slide