View Slide
et rpc B C Amo dK ilk y O h, 0 P W caS sn, 5 6 21 06 , 0
Wcd h hS Wcd p I n Ji ov d rPt SI AA +5 I 6 osh ub ae h u
) (ۭߓͰ͜Μͳ͜ͱ͋Γ·ͤΜ͔ʁ
৬Ͱ͜Μͳ͜ͱ͋Γ·ͤΜ͔8PSE1SFTTͳΜ͔ةͳ͘Ͷ
! M 5SW C P
) (%SVQBMةͳ͍ͱ͍͏ߟ͑ /(Ͳͷ$.4Ͱ੬ऑੑ͕͋Δ੬ऑੑͷରԠඞཁָͨͩ͠ʹ͢Δ͜ͱՄೳʁDrupal https://www.itmedia.co.jp/enterprise/articles/1902/28/news077.html
mi / A p. 1274 / A g tc j s7 A- 8 4381 2 4 4 8A4 1 82 4A 4 A ( 7e hfn dfkl7 A- 2 6 6 2 4 A 35 ) 06 0 608 :18 8 35r S a_r uoͳΔ͘ૣ͘ରԠʢͰ͖ͨΒࣗಈԽ͍ͨ͠ʣ
• 8PSE1SFTTͷϩάΠϯΛकΔ• ੬ऑੑใΛ֬ೝ͢Δ• ϓϥάΠϯͱςʔϚΛબͿ• 8PSE1SFTTͷؔΛ͏ཧऀ։ൃऀ͚ཧऀ ฤूऀ ߘऀ دߘऀ ߪಡऀ8PSE1SFTTΛ҆શʹ͏ํ๏ʂ Ͱ͖ΕָͳͭશϢʔβʴЋ ࣄނ͕͓ͬͨ͜Β
XML RPCwp-login.php ͜͜ͷϩάΠϯػೳ͕ૂΘΕ͍͢
ΨνΨνσϑΥϧτXQMPHJOQIQͷΞΫηε੍ݶʢ9.-31$ʣཁૉೝূɺΞΧϯτϩοΫύεϫʔυϙϦγʔͷ֬ೝϢʔβͲ͏͏͔Λߟ͑ͳ͕Βઃఆ͢Δ*1ΞυϨε͕ݻఆՄೳ͔ʁηΩϡϦςΟͷzෛՙzʢ໘ࣄʣΛ͓ئ͍Ͱ͖Δ͔ʁӡӦऀͷෛ୲ͲΕ͘Β͍ڐ༰Ͱ͖Δ͔ʁ
ΞΧϯτ໊ਪଌ͞Ε͍ͯΔBVUIPSͰΞΧϯτ͕ਪଌˠ͜͜Λมߋ͢Δͷ໘͍͘͞ୠ͠ύεϫʔυ໊ʹΞΧϯτΛೖΕͳ͍͜ͱॏཁ
αΠτͷอޢ ϗϫΠτϦετ8PSE1SFTTDPNͷ 440Λར༻
ސ٬͚ͷΞΧϯτཧ8PSE1SFTTͷʮ$VTUPNFSʯݖݶʢ8$ಠࣗʣͱͯ͠࡞͞ΕΔXQMPHJOQIQܦ༝ͰϩάΠϯͰ͖Δ͕ཧը໘ XQBENJOҎԼʹΞΫηεͰ͖ͳ͍• 8PSE1SFTTͷϩάΠϯϑΥʔϜͱಉ͡ڧ• ௨ৗϩάΠϯͱҧ͍ʮOPODFʯ͍͍ͭͯΔ͕ɺϫϯλΠϜͰͳ͍ͷͰϒϧʔτϑΥʔεରࡦʹඍົ• ϩάΠϯอޢܥͷϓϥάΠϯͦͷ··͑Δʢ-PHJO-PDL%PXO $SB[ZCPOF ͳͲͰݕͰ͖ͨʣ
Ϩϯλϧαʔόͷ߹ଞαΠτ ଞαΠτ.Z8PSE1SFTT͋ͳͨ'51αʔόڞ༻αʔό'51ΞΧϯτ81ΞΧϯτίϯύωΞΧϯταʔόܖใϗεςΟϯάձࣾͷೋཁૉೝূΛ༗ޮʹ͢ΔͦΕͧΕύεϫʔυΛ͍·Θ͞ͳ͍'51ΫϥΠΞϯτ࠷৽൛Λ͏ͳΔ͘'51Θͳ͍ίϯύω
714ΫϥυαʔϏεͷ߹͋ͳͨ71481ΞΧϯτίϯύωΞΧϯταʔόܖใϗεςΟϯάձࣾͷೋཁૉೝূΛ༗ޮʹ͢Δαʔόͷ44)ϩάΠϯެ։伴ೝূʢύεϫʔυແޮʣʹ͢ΔηΩϡϦςΟάϧʔϓͳͲઃఆίϯύω .Z8PSE1SFTT44)%αʔόΞΧϯτ
2աڈʹ XQMPHJOQIQ ʹΞΫηε͕͋ͬͨ*1ΞυϨεΛϒϩοΫ͍ͯ͠Δ͕ޮՌ͋Δͷ͔ʁΞΫηεϩάAttack IP.htaccessϩάΠϯը໘ʹ͘ΞΫηε͍ͯ͠Δ*1ͦͷมߋ͞ΕΔͨΊɺ*1ΞυϨεͷϒϥοΫϦετΛཧ͢Δͷ͍͠ɻ·ͨɺݱঢ়ւ֎ͷ*1ΞυϨεଳҬʹଟ͍͋Δ͕ɺࠓޙࠃ*1ΞυϨεͰͷεΩϟϯߟ͑ΒΕΔͨΊɺࠃ͝ͱͷΞΫηε੍ݶΛա৴͠ͳ͍Α͏ʹҙ͕ඞཁɻ
2ϩάΠϯը໘ʹ#BTJDೝূ͍ΕΔ͖ʁೖΕ͍͍͚ͯͲɺ໘ʹͯ͠·ͰͷϝϦοτͳ͍͔ʢಛʹฏจ௨৴Λߦ͍ͬͯΔαΠτةݥʣ81ͷػೳͰΧόʔͰ͖ΔͷͰϝϦοτΛڗडͰ͖ͳ͍σϝϦοτղܾ͍ͯ͠ͳ͍https://www.ipa.go.jp/security/awareness/vendor/programmingv2/contents/003.html
μογϡϘʔυʹ͋Δߋ৽ใཁ֬ೝ• ຊମ• ςʔϚ• ϓϥάΠϯ
ຊମςʔϚϓϥάΠϯΦʔτΞοϓσʔτͷରϝδϟʔΞοϓσʔτཧը໘͔ΒΦʔτΞοϓσʔτͷର֎ཧը໘͔ΒΦʔτΞοϓσʔτͷର֎ཧը໘͔Β
8PSE1SFTT͔ΒಋೖσϑΥϧτͰ༗ޮϚΠφʔΞοϓσʔτʢηΩϡϦςΟΞοϓσʔτʣͷΈରແޮʹ͢Δ͜ͱՄೳˠΑͬΆͲͷཧ༝͕ͳ͍ݶΓແޮʹ͠ͳ͍ 2018/12 2019/32019/2 2019/3ΦʔτΞοϓσʔτखಈΞοϓσʔτΦʔτΞοϓσʔτݪଇతʹαϙʔτ࠷৽൛Ͱ͋Δ͕ɺηΩϡϦςΟύον͕ग़Δ͜ͱ͋Δ
IUUQTXXXBTBIJDPNBSUJDMFT"4,#)4,#6-0#IUNM8PSE1SFTTͷ੬ऑੑରࡦʹ͍ͭͯIUUQTXXXJQBHPKQTFDVSJUZDJBESWVMXPSEQSFTTIUNMຊମӨڹड͚Δόʔδϣϯ ܥͦ͘͠ΕҎԼର֎मਖ਼ࡁΈͷόʔδϣϯΦʔτΞοϓσʔτର
ެతػؔ+1$&35$$ҙשىIUUQXXXKQDFSUPSKQBU+7/IUUQTKWOKQϗεςΟϯάձࣾҙשىϝʔϧ͜ͷ͋ͨΓʹग़ݱ͢Δใʹཁҙʂ
Ή͔͍ͣ͠ΑʔΘ͔ΒΜͱ͍͏ํͷͨΊʹ• ೝূͳ͠ʢԕִͷɺୈࡾऀʹΑΔʙʣ• ֎෦͔ΒʢϦϞʔτ͔Βʣ• ίʔυ࣮ߦʢ3$&3FNPUF$PEF&YFDVUJPOʣͳͲ͕ଗ͏ͱཁҙͪ͜Βͷ߲Ͱ߈ܸ͕؆୯͔Ͳ͏͔ͳͲΛ֬ೝ͢Δ·ͨΦʔτΞοϓσʔτͰରԠͰ͖͍ͯΔ͔Ͳ͏͔
• 1)1ͷόʔδϣϯ͕ݹ͗͢ͳ͍͔ˠ ͦͦ8PSE1SFTTಈ͔ͳ͘ͳΔ• 8FCαʔόʢ"QBDIF/HJOYʣͷόʔδϣϯ͕ݹ͗͢ͳ͍͔ˠ ZVNVQEBUF• ϑΝΠΞΥʔϧ JQUBCMFTηΩϡϦςΟάϧʔϓˠ ༻͍ͯ͠ͳ͍αʔϏε͕ىಈͨ͠··ʹͳ͍ͬͯͳ͍͔• ϩάϩʔςʔγϣϯ• 44-Խˠ ύεϫʔυɾݸਓใΛѻ͏໘͋ͬͨ΄͏͕͍͍ɻ4&0తʹɻΑ͘Θ͔Βͳ͍ɺ໘͍͘͞ͱ͍͏ਓϨϯλϧαʔό͘͠8PSE1SFTTDPNΛར༻͠·͠ΐ͏
Yuzo Related Posts Zero-Day Vulnerability Exploited in the Wildhttps://www.wordfence.com/blog/2019/04/yuzo-related-posts-zero-day-vulnerability-exploited-in-the-wild/੬ऑੑΛѱ༻͞ΕεΫϦϓτΛຒΊࠐ·ΕΔӾཡऀ͕࣮ߦ͢ΔͱٗαΠτʹ༠ಋ͞ΕΔͦͷޙϓϥάΠϯআ͞ΕΔ։ൃऀʹ௨͍͔ͳ͍ʂʁ
ͲͪΒٗαΠτʹ༠ಋ͞ΕΔ8PSE1SFTTϓϥάΠϯΛૂ͏߈ܸ͕׆ൃԽ͍ͯ͠Δ݅Λ·ͱΊͯΈͨIUUQTQJZPMPHIBUFOBEJBSZKQFOUSZ
੬ऑੑΛѱ༻͞Εҙίʔυ͕࣮ߦ͞ΕΔΞοϓσʔτʹͯ੬ऑੑରԠՄೳ• αΠτվ͟Μ• όοΫυΞຒΊࠐΈ• ϑΝΠϧআͳͲ• ϑΟογϯάαΠτԽ• ِαΠτͷ༠ಋͳΜͰͰ͖ΔDuplicator Update Patches Remote Code Execution Flawhttps://www.wordfence.com/blog/2018/09/duplicator-update-patches-remote-code-execution-flaw/
8PSE1SFTTͷࣄނରԠͰΑ͘ݟΔࣄྫ8FC4IFMMͱ͍͏πʔϧΛαʔόʹஔ͔ΕΔ͜ΕΛΩοΧέʹαʔόͰͷૢ࡞ΛߦΘΕΔ
मਖ਼ϝϯςφϯε͕Α͘ߦΘΕ͍ͯΔͷΛબͿظؒ์ஔ͞Ε͍ͯΔͷཁҙ੬ऑੑͷ߈ܸํ๏͕·͍ͬͯΔՄೳੑ͋ΓϓϥάΠϯςʔϚͷϖʔδͰ͜ͷΑ͏ͳදه͕ग़Δͱཁҙ
όοΫΞοϓେࣄ8PSE1SFTTͷඪ४తͳϩάڥ͚ͩͰɺ༗ࣄͷͱ͖ʹඃঢ়گΛѲ͢Δ͜ͱ͕͍͠ʢݪҼΛಛఆͨ͠͏͑Ͱʣฏৗ࣌ʹͯ͠͠·͏ํ͕ૣ͍͜ͱ͋ΔɾιʔεϑΝΠϧɾ%# %VNQϑΝΠϧͷόοΫΞοϓ͕͋ΕͳΜͱ͔ͳΔϓϥάΠϯΛ׆༻͢Δͷ0,੬ऑੑͱϥΠηϯεʹؾΛ͚ͭͯ
42-ΠϯδΣΫγϣϯ944ʢΫϩεɾαΠτɾεΫϦϓςΟϯάʣσʔλϕʔεͷ߈ܸσʔλϕʔεͷ࿙͍͑ॻ͖͑ͳͲୈࡾऀʹΑΔ +BWB4DSJQUͷ࣮ߦαΠτ๚ऀͷෆਖ਼αΠτͷ༠ಋɺϚϧΣΞμϯϩʔυͳͲ
8PSE1SFTT͕ఏڙ͢ΔؔΛ༻͍ΔThe WordPress Codex Is Your Friend…$wpdb->prepare ϓϨʔεϗϧμʔΛͬͨΫΤϦͷอޢwp_ksesesc_html / esc_attrୈࡾऀʹΑΔ+BWB4DSJQUͷ࣮ߦࢭHow to Prevent File Upload Vulnerabilitieshttps://www.wordfence.com/learn/how-to-prevent-file-upload-vulnerabilities/current_user_can('upload_files')ݱࡏͷϢʔβ͕ݖݶΛ͔ͭɻྫͰΞοϓϩʔυݖݶΛ͔ͭͲ͏͔wp_check_filetypeϑΝΠϧλΠϓΛνΣοΫ͢Δ.*/&λΠϓΛؚΊͯνΣοΫ͢Δඞཁ͕͋Δ
Q EC S 37 KdL E7 oi
8PSE1SFTTαΠτΛߏங͢Δͱ͍͘Β͔͔Δʁ ݟੵΓษڧձͰՁ֨Λग़ͯ͠ΈͨIUUQTUPZBPOFUXQXPSECFODI
8PSE1SFTTαΠτΛߏங͢Δͱ͍͘Β͔͔Δʁ ݟੵΓษڧձͰՁ֨Λग़ͯ͠ΈͨIUUQTUPZBPOFUXQXPSECFODI¥488,355
ͱϗεςΟϯάձ͔ࣾΒ࿈བྷΛड͚ͨͦͷͨΊαΠτఀࢭதαΠτࣗͷϏδωεΠϯύΫτ͍ͨΊఀࢭࣗମʹେ͖ͳӨڹͳ͍͕ɺݪҼඃঢ়گΛ֬ೝޙɺ҆શΛ֬ೝͨ͠͏͑ͰɺͳΔ͘ૣΊʹ࠶։͍ͤͨ͞2ηΩϡϦςΟϕϯμͷௐࠪඅ༻͍͘Β͍Ͱ͠ΐ͏ʮਆށΈͳͱࣃՊʯͷαΠτʹΞΫηε͢Δͱෆਖ਼ͳαΠτʹϦμΠϨΫτ͞ΕΔఆࣄҊ
ྨ ༰ Ձ֨ॳظௐࠪɾΞΫηεαʔόϩάௐࠪɾϑΝΠϧεΩϟϯʢෆਖ਼ͳϑΝΠϧ͕ͳ͍͔ʣɾݸਓใ࿙ӮϦεΫఆ= ηΩϡϦςΟஅɾηΩϡϦςΟஅʢπʔϧஅɺຊஅ͓Αͼ࠶அʣ= Φϓγϣϯ ɾΦϯαΠτใࠂ = ظؒɿ̍िؒఔʢஅΛআ͘ʣೲɿௐࠪใࠂॻ࡞Γ͢ͷͱ͔ΘΒΜʼʻ
υϝΠϯͱ͔ͱಉ͡Ͱ࠷ޙ·Ͱཧ͢Δ͜ͱΛతͱ͢ΔϦΞϧͳͩͱอकαʔϏεΛένΒͳ͍ཧͰ͖͍ͯͳ͍ΣϒαΠτดͷݕ౼ΛIUUQTXXXJQBHPKQTFDVSJUZDJBESWVMPMEDNTIUNM• ͓٬༷ɺؔ࿈اۀɺಜிͷઆ໌• 8"'ͳͲͷηΩϡϦςΟͱͷ৽نܖ• หޢ࢜අ༻• ࠶ߏஙඅ༻ɺۀऀ࠶બఆݕ౼߲࣮ࢪ߲͕
͜ͷεϥΠυϑΟΫγϣϯͰ͢ఘΊͯ࡞Γ͢΄͏͕҆͘Ͷʁ͓͔͚ۚͯௐࠪͯ݁͠ہݪҼ͕͔Βͳ͔ͬͨ͏ͪͰى͜ΔͱࢥΘͳ͔ͬͨɻөըͷΈ͍ͨͦ͏ͳΜͰ͕͢ɺ্ʹઆ໌͢Δͱ͔ͳΜͱ͔Ͱൃ͞ΕΔํ8PSE1SFTTͷඪ४తͳϩάͩͱಛఆ͍͜͠ͱ͋Γ·͢·͊͜ͷεϥΠυϑΟΫγϣϯͰ͔͢Β
• 8PSE1SFTTͷϩάΠϯΛकΔ• ੬ऑੑใΛ֬ೝ͢Δ• ϓϥάΠϯͱςʔϚΛબͿ• 8PSE1SFTTͷؔΛ͏• ηΩϡϦςΟΘʔ΄͘͠ͳ͍ʁʢ୭͔ʂ8PSE1SFTTΛ҆શʹ͏ํ๏ʂ Ͱ͖Εָͳͭ
a r u t 9? W a r9 9 9W sa r= Pe r ? = 914 oh P 1d oh s= 9
450 00 .