
äŒæ¥ãã€ã³ã¿ãŒããããæŽ»çšããããã«ãªã£ãŠä¹ ããæšä»ãæ·±å»ãªåé¡ãšãªã£ãŠããã®ãäŒæ¥ã®ããŒã ããŒãžãçã£ããµã€ããŒæ»æã§ãããããŠè¿å¹Žããã®è¢«å®³ã¯å€§äŒæ¥ããäžå°äŒæ¥ãŸã§åºãããèŠããŠããŸãã
ããã§ãä»åã®èšäºã§ã¯ãäž»ã«äžå°äŒæ¥ãåäººäºæ¥äž»ã察象ã«ãããŒã ããŒãžã»ã»ãã¥ãªãã£ã®å¯Ÿçæ³ãšãµã€ããŒæ»æã®ãªã¹ã¯ãå®äŸãšããããŠè§£èª¬ããŠãããŸãã
åŒç€Ÿã§ã¯ãçŸåšãŸã§8,772瀟ïŒ2019幎2æçŸåšïŒã®ããŒã ããŒãžãå¶äœããŠãŸãããŸããããä»åã¯æ¥é ã®çµéšãšç¥èãæŽ»ããã貎瀟ã®å€§åãªããŒã ããŒãžãå®ãããã®å ·äœçãªå¯Ÿçã玹ä»ããŸãã
æ¬èšäºããèªã¿ããã ããã°ãã»ãã¥ãªãã£å¯Ÿçã®æèãé«ããå®è¡ãå¯èœãªæœçãç¥ãããšãã§ããŸããæ¬èšäºãåèã«ãã§ããããšããä»ãã察çãå§ããŸãããã
ç®æ¬¡
- ä»ããèŠå¯ŸçïŒãäžå°äŒæ¥ã®ããŒã ããŒãžãçãããïŒã€ã®çç±
- éèšãšåæã«å§ãããããŒã ããŒãžã»ã»ãã¥ãªãã£å¯Ÿç
- äŒæ¥ããŒã ããŒãžãçã£ããµã€ããŒæ»æã®ïŒå€§è¢«å®³
- äŒæ¥ããŒã ããŒãžãçã£ããµã€ããŒæ»æã®æå£
- ãç¡æãã§ä»ããå®å šæ§ããã§ãã¯ã§ããWebãµã€ã
- ãäžå°äŒæ¥åããç¡æã§åŠã¹ãã¬ã€ãããã¯2éž
- ãŸãšã
ä»ããèŠå¯ŸçïŒãäžå°äŒæ¥ã®ããŒã ããŒãžãçãããïŒã€ã®çç±
ãµã€ããŒæ»æã®æšçãå€§äŒæ¥ããäžå°äŒæ¥ã«åãã£ãŠããããšãããããïŒã€ã®ããŒã¿ããããŸããæ
å ±ã»ãã¥ãªãã£ãµãŒãã¹ã®å€§æã»ã·ãã³ããã¯ç€Ÿãçºè¡šãã調æ»çµæã§ãã
å ±åã§ã¯ããµã€ããŒæ»æãåããäŒç€Ÿã®ãã¡å€§äŒæ¥ãå ããå²åãå¹Žã æžå°ããŠããã®ã«å¯ŸããåŸæ¥å¡250人以äžã®å°èŠæš¡äŒæ¥ã®å²åã2011幎ããïŒå¹Žéã§ïŒå以äžã«äžæããŠããããšã瀺ãããŠããŸãã
æããã«ä»ãäžå°äŒæ¥ã®ããŒã ããŒãžã»ã»ãã¥ãªãã£å¯Ÿçã®å¿ èŠæ§ãé«ãŸã£ãŠããŸãã
åèïŒ æ»æè ã¯æšçäŒæ¥ã®èŠæš¡ãåããªãïŒã·ãã³ããã¯ïŒPDFïŒ
äŸãã°ã2016幎ã«äº¬éœã®å¥åº·é£å販売äŒç€Ÿãäžæ£ã¢ã¯ã»ã¹ãããã±ãŒã¹ã§ã¯ã被害ã«éã£ãäŒæ¥ã®åŸæ¥å¡ããã10åã§ããã
åèïŒçãããäžå°äŒæ¥ãåŸæ¥å¡10人ãªã®ã«ãæšçãã«âŠ
ãªãããã®ãããªå°ããªäŒæ¥ãŸã§ããã¿ãŒã²ããã«ãªã£ãŠããŸã£ãã®ã§ããããïŒ
äžå°äŒæ¥ãçãããããã«ãªã£ãçç±ã¯äžèšã®ïŒç¹ã§ãã
ïŒïŒäžå°äŒæ¥ã¯ãã»ãã¥ãªãã£å¯ŸçãäžååãªãŸãŸæŸçœ®ãããŠããã±ãŒã¹ãå€ããã
äžå°äŒæ¥ããµã€ããŒæ»æã®æšçã«ãªã£ãŠããçç±ã®ã²ãšã€ã¯ãå€§äŒæ¥ãšæ¯ã¹ãŠã»ãã¥ãªãã£å¯Ÿçãååã«æŽåãããŠããªãããšãå€ããæ»ãããããšããããšããããããŸãã
å€ãã®äžå°äŒæ¥ã§ã¯èªç€Ÿã®å¯Ÿçãååã§ã¯ãªãããšãèªèãã€ã€ãã»ãã¥ãªãã£å¯Ÿçã«ããŠãè²»çšãšäººå¡ã«äœè£ããªããçµæçã«æ°å¥œã®æšçã«ãªã£ãŠããŸãã®ã§ãã
ïŒïŒå€§äŒæ¥ãçããããäžå°äŒæ¥ã®æ¹ãå¹çããææãåŸããããã
è¿å¹Žãå€§äŒæ¥ãäžå€®å®åºã®ã»ãã¥ãªãã£å¯Ÿçãåäžããããšã圱é¿ããŠããŸãã
2016幎ã«KPMGã³ã³ãµã«ãã£ã³ã°ç€Ÿãçºè¡šãã調æ»çµæã«ãããšã売äžé«500åå以äžã®åœå äŒæ¥ã®ïŒå²ããã»ãã¥ãªãã£å¯Ÿçã«1,000äžå以äžã®æè³ãããŠããããšãæããã«ãªããŸããããå°ããªäŒæ¥ã§ã¯å®è¡å¯èœãªã»ãã¥ãªãã£å¯ŸçãéãããŠããŸãã
å€§äŒæ¥ãšäžå°äŒæ¥ã®ã»ãã¥ãªãã£å¯Ÿçã«ã¯å€§ããªã²ããããããå¹çããäžå°äŒæ¥ãçãèããåºãã£ãŠããã®ã§ãã
ïŒïŒäžå°äŒæ¥ãçªç Žå£ã«ãããšå€§äŒæ¥ãæ»æãããããã
èªç€Ÿã«ã¯ãããã³ã°ãããŠãå°ããããªæ
å ±ããªããã倧äžå€«ã ãšèããŠããäŒæ¥ããããŸãããããã¯å¿
ãããæ»æããããªãçç±ã«ã¯ãªããŸããã
å ãã»ãã¥ãªãã£ã®å€§äŒæ¥ãæ£é¢ããæ»æããã®ãé¿ããã»ãã¥ãªãã£ã®çãäžå°äŒæ¥ãå€§äŒæ¥ã«äŸµå ¥ããããã®çªç Žå£ãšããŠãå€§äŒæ¥ã®é¡§å®¢æ å ±ãå¶æ¥æ©å¯ãçãã±ãŒã¹ãããã®ã§ãã
ãŸããæ»æè ã®ææ³ã幎ã 倿§åã»å·§åŠåããŠããŠããããã€ãŸã§ãå€ãã»ãã¥ãªãã£æèã§ã¯ãã€èªç€Ÿã®ããŒã ããŒãžã被害ã«éã£ãŠãäžæè°ã§ã¯ãããŸããã
èªç€Ÿã®ã»ãã¥ãªãã£ã®çãããéèŠæ å ±ãæŒæŽ©ãããŠããŸããšãååŒå ã顧客ããã®ä¿¡é Œã倱ã£ãŠããŸãããã®å埩ã¯å®¹æã§ã¯ãããŸãããå Žåã«ãã£ãŠã¯è³ åãæ±ããããå ŽåãâŠã
ãã®ãããªè¢«å®³ã«éããªãããã«ã¯ãæ©æ¥ã«ã»ãã¥ãªãã£å¯ŸçãèŠçŽãå¿ èŠãããã§ãããã
éèšãšåæã«å§ãããããŒã ããŒãžã»ã»ãã¥ãªãã£å¯Ÿç
äŒæ¥ã®ããŒã ããŒãžãçã£ããµãŒããŒæ»æã®ãªã¹ã¯ã¯ããã£ããŠå°ããªãã®ã§ã¯ãããŸããã
ãµã€ããŒç¯çœªãå·§åŠåããŠãããªãã§ãå€§äŒæ¥ã§ã¯ãç倧ãªè¢«å®³ã®ãªã¹ã¯ã«åããŠãã»ãã¥ãªãã£å¯Ÿçã«å·šé¡ã®æè³ãããããšãçãããªããªããŸããã
ã§ã¯äžå°äŒæ¥ãçã£ããµã€ããŒæ»æã«å¯ŸããŠãã©ã®ãããªå¯Ÿçãè¬ããã°ããã®ã§ããããã
ããããã¯ãäžèšã®ãããªè¢«å®³ã«éããªãããã®å¯Ÿçæ³ãïŒæ®µéã®ã¬ãã«ã«åãã§ã玹ä»ããŸãã
ãSTEP.ïŒãåºæ¬ã®ãã»ç€Ÿå¡ã®ã»ãã¥ãªãã£æèãé«ãã
ãµã€ããŒæ»æããäŒæ¥ãå®ãããã«ã¯ããŸãã¯ããã§åã瀟å¡ã®ã»ãã¥ãªãã£ã«å¯Ÿããæèãé«ããããšãæ±ããããŸããïŒäººã²ãšãã«ããŒã ããŒãžã»ã»ãã¥ãªãã£ã®éèŠæ§ãçè§£ããŠããããäžèšã®ãããªåãçµã¿ã培åºããã°ã被害ã®ãªã¹ã¯ãäžããããšãã§ããŸãã
â»ãSTEP.ïŒãã¯ãåæ©çãªå 容ã§ãã®ã§ãæ¢ã«ããŒã ããŒãžã»ã»ãã¥ãªãã£ã«åãçµãŸããŠããæ¹ã¯ãèªã¿é£ã°ããŠé ããŠãçµæ§ã§ãã
ïŒïŒOSããŠã€ã«ã¹å¯ŸçãœãããŠã§ã¢ãªã©ã¯ãåžžã«ææ°ã®ç¶æ ã«ä¿ã€
æ¥åã§äœ¿ã£ãŠããããœã³ã³ã®æŽæ°ããã°ã©ã ãã¢ããããŒãéç¥ãããããããã«ææ°ã®ç¶æ
ã«ããŸããããå€ããŸãŸã§ã¯ã»ãã¥ãªãã£äžã®è匱æ§ãäžå
·åã«å¯Ÿå¿ã§ããªãã±ãŒã¹ããããŸãã
æ¥åã§äœ¿ã£ãŠããããŒã«ã®ã¢ããããŒãéç¥ãã¹ããã®ãœãããŠã§ã¢ãOSã®ããŒãžã§ã³ã¢ãããåæ§ã§ãã
ãŠã€ã«ã¹å¯Ÿçãœãããå°å ¥åŸã¯ããŠã€ã«ã¹ã®å®çŸ©ãã¡ã€ã«ãææ°ã«ä¿ã€ããšããå¿ããªãïŒ
ïŒïŒãã¹ã¯ãŒãã®åŒ·åãè¡ã
ã123456ãããpasswordããçå¹Žææ¥ãèªçæ¥ãªã©ãæšæž¬ããããããã¹ã¯ãŒãã¯æ»æè ã«çªç Žãããããã®ã§é¿ããŸãããããŸããè€æ°ã®WebãµãŒãã¹ã§åããã¹ã¯ãŒãã䜿ããšã IDã»ãã¹ã¯ãŒããæµåºããŠããŸã£ãéãèã¥ãåŒã«äžæ£ãã°ã€ã³ãããã±ãŒã¹ãå€ãå±éºã§ãã
ïŒïŒå ±æèšå®ãèŠçŽã
ã€ã³ã¿ãŒãããäžã«ããŒã¿ãä¿åã§ããã¯ã©ãŠããµãŒãã¹ã瀟å ã§å ±æããŠããããŒããã£ã¹ã¯ã䜿ã£ãŠããäŒæ¥ã§ã¯ãããŒã¿ä¿ç®¡å ãžã®ãã°ã€ã³ããã¡ã€ã«é²èŠ§ã®æš©éãèŠçŽããŸãããã
瀟å¡ãéè·ããå Žåã¯ãå¿ ãå ±æç¯å²ã®èšå®ããã§ãã¯ããŠæš©éã®å€æŽãã¢ã«ãŠã³ãã®åé€ãªã©ãéæè¡ãªããŸãããã
ãSTEP.ïŒãïŒæ¹åããã®å¯Ÿçã§éå£ã®ã»ãã¥ãªãã£ãç®æãïŒ
STEP.ïŒã§ã¯ãäŒæ¥ã®ããŒã ããŒãžãããŸããŸãªæ»æããå®ãããã«ããWebã¢ããªã±ãŒã·ã§ã³ããWebãµãŒããŒãããããã¯ãŒã¯ãã®ïŒæ¹åããã®å¯Ÿçã§ãã
ïŒïŒãWebã¢ããªã±ãŒã·ã§ã³ãã®ã»ãã¥ãªãã£å¯Ÿç
Webã¢ããªã±ãŒã·ã§ã³ãšã¯ããã©ãŠã¶ããå©çšã§ããã¢ããªã±ãŒã·ã§ã³ã»ãµãŒãã¹ãæããŸãã
ããããWebã¢ããªã±ãŒã·ã§ã³ã«é¢é£ããã»ãã¥ãªãã£å¯Ÿçã¯ä»¥äžã®éãã§ãã
- Webã¢ããªã±ãŒã·ã§ã³ã¯åžžã«ææ°ã®ç¶æ
ã«ãã
Webã¢ããªã±ãŒã·ã§ã³ã®ããŒãžã§ã³ã¢ããã»ããŒã¿ã宿çã«ãã§ãã¯ããåžžã«ææ°ã®ç¶æ ã«æŽæ°ããŸããããæŽæ°ãæ ããšãã·ã¹ãã å ã«æœãè匱æ§ãæŸçœ®ããããšã«ã€ãªããããµã€ããŒæ»æãåãããããªããŸããäŸãã°ããWord Pressããªã©ã®CMSãWebã¢ããªã±ãŒã·ã§ã³ã®ã²ãšã€ããªãŒãã³ãœãŒã¹ã®ããè匱æ§ãåºããããšããåŽé¢ããããŸãã®ã§ãã¢ããããŒãã®éç¥ããããçŽãã«å¯ŸåŠããŸãããã
- å
¬éãã¹ãã§ãªããã¡ã€ã«ãäžèŠãªWebãµã€ããå
¬éããªã
å人æ å ±ãªã©ããŒã ããŒãžã®èšªåè ã«èŠããå¿ èŠã®ãªãããŒãžããã¡ã€ã«ã¯ãã€ã³ã¿ãŒãããããã¢ã¯ã»ã¹ã§ããªãå Žæã«ä¿ç®¡ããããã«ããäžèŠãªãã¡ã€ã«ã¯åé€ããŸãããããŸãäžèŠã«ãªã£ãããŒãžãWebãµã€ãããã®ãŸãŸã«ããŠãããšç®¡çãè¡ãå±ããªããªããæ»æã®å¯Ÿè±¡ã«ãªãå¯èœæ§ãããã®ã§åé€ããŸãããã
ïŒïŒãWebãµãŒããŒãã®ã»ãã¥ãªãã£å¯Ÿç
WebãµãŒããŒã«ã¯ãæ¥åžžã®æ¥åã«å¿
èŠãªããŸããŸãªããŒã¿ãèç©ãããŠããŸãã
æ»æãåããã°ã倧åãªæ¥åæ å ±ã®æ¶å€±ãå人æ å ±ã®å€§éæŒãããæããããŸããã
- OSããµãŒããŒãœãããŠã§ã¢ãããã«ãŠã§ã¢ãããŒãžã§ã³ã¢ãããã
OSããµãŒããŒãœãããŠã§ã¢ãããã«ãŠã§ã¢ã®ãã¿ãããªããŒãžã§ã³ã¢ããã¯ãã»ãã¥ãªãã£å¯Ÿçã®åºæ¬ã§ããWebã¢ããªã±ãŒã·ã§ã³ãªã©ãšåæ§ã«ãä¿®æ£ããã°ã©ã ãå ¬è¡šãããéã¯ããã«å¯Ÿå¿ããŸãããããã ããããŒãžã§ã³ã¢ãããããšãä»ãŸã§åäœããŠããã¢ããªã±ãŒã·ã§ã³ãæ£åžžã«åäœããªããªãå Žåãããã®ã§ã泚æãå¿ èŠã§ãã
- äžèŠãªã¢ã«ãŠã³ãã¯åé€ãã
WebãµãŒããŒã«äžèŠãªã¢ã«ãŠã³ããç»é²ãããŠããå Žåã¯åé€ããŸããããæ°ä»ãã¬ãã¡ã«ã䜿çšãããŠããªãã¢ã«ãŠã³ããå¢ããŠããããšã¯ãããã¡ã§ãããæªçšãé¿ããããã«åé€ããŸããããã¢ã«ãŠã³ãäžèŠ§è¡šãäœãã管çãããšãªã¹ã¯ãäžããããŸãã
- äžèŠãªãµãŒãã¹ãã¢ããªã±ãŒã·ã§ã³ã¯åé€ãã
çŸåšå©çšããŠããªãã¢ããªã±ãŒã·ã§ã³ããµãŒãã¹ãªã©ããæªçšãããæããããã®ã§ãå¿ èŠãªãã®ä»¥å€ã¯åé€ããŸãããã
ïŒïŒããããã¯ãŒã¯ãã®ã»ãã¥ãªãã£å¯Ÿç
- ã«ãŒã¿æ©åšãå©çšããŠããããã¯ãŒã¯å¢çã®äžå¯©ãªéä¿¡ã鮿ãã
å¢çã«ãŒã¿ãªã©ã®æ©åšãçšããã°ãå€éšããå éšãžåããäžæ£ãªã¢ã¯ã»ã¹ããããã¯ããããšãã§ããŸããæ»æè ã«å éšã«äŸµå ¥ããããšãæ å ±ãæã¡åºããæªçšãããå¯èœæ§ãé«ãŸããŸãã
- ãã¡ã€ã¢ãŠã©ãŒã«ãå©çšããŠãéä¿¡ããã£ã«ã¿ãªã³ã°ãã
ãã¡ã€ã¢ãŠã©ãŒã«ãšã¯ããããããèšå®ããã«ãŒã«ã«åºã¥ããŠãéããŠã¯ãããªãéä¿¡ããããã¯ããæ©èœãæããŸããç¹å®ã®IPã¢ãã¬ã¹ã ããæåŠããããå€éšããã®æ»æã黿¢ãããã§ããŸãã
ãSTEP.ïŒããµã€ããŒæ»æããäŒæ¥ããŒã ããŒãžãå®ãïŒã€ã®æè³
ã
ã»ãã¥ãªãã£å¯Ÿçãã³ã¹ãã ãšæããŠåãçµããšãã©ãããŠãæ¶æ¥µçã«ãªããã¡ã§ãã
ãµã€ããŒæ»æããäŒæ¥ãå®ãããã®æè³ã ãšæããŠã被害ã«éããªããéãããªãç°å¢äœããé²ããŠãããŸãããã
1ïŒãåžžæSSLãã§èšªåè ã®å人æ å ±ãCookieã®çé£ãé²ã
åžžæSSLïŒAlways On SSLïŒãšã¯ãããŒã ããŒãžå
ã®ç¹å®ã®ããŒãžã ãã§ãªãããã®ä»ãã¹ãŠã®ããŒãžãã€ã³ã¿ãŒãããäžã§ããŒã¿ãæå·åããŠéåä¿¡ããä»çµã¿ã«ããããšã§ãã
ããã«ãã£ãŠã第äžè ãéä¿¡ã®äžèº«ãçã¿èŠããããããã°ã€ã³æ å ±ãªã©ã®Cookieæ å ±ãçãŸããããã被害ãé²ãããšãã§ããŸãã
ãŸãããhttpãã§ã¯ãªããhttpsããšè¡šç€ºãããŠããURLã¯ãåžžæSSLåãããå®å šãªããŒã ããŒãžã ãšèªèãããã®ã§ãSEOã®è©äŸ¡ãäžãããŸããç¹ã«å人æ å ±ãå ¥åããããŒãžãããããŒã ããŒãžã§ã¯ãSSLæªå¯Ÿå¿ã®ããŒã ããŒãžã¯èšªåè ã«æ¬é ãããå¯èœæ§ããããŸãã
ãªããåžžæSSLåããéã«ååŸãå¿ èŠãªãSSLãµãŒããŒèšŒææžãã«ã¯ãïŒã€ã®ã¬ãã«ããããããããäŸ¡æ Œãç°ãªããŸããããã¡ã€ã³èªèšŒåïŒDVïŒãã§ããã°ãïŒçš®é¡ã®äžã§ãã¡ã°ãäœäŸ¡æ Œã§ããã€åäººäºæ¥äž»ã§ãååŸå¯èœã§ãã
èšŒææžã®ååŸè²»çšã¯ãå¹³åççžå Žã§å¹Žéæ°ååãããšãªã£ãŠããŸãã
ïŒïŒã¯ã©ãŠãåãWAFããå°å ¥ããããŒã ããŒãžã®è匱æ§ãè£ã
WAFïŒWeb Application FirewallïŒã¯ãïŒãšã¯ãWebãµã€ãäžã®ã¢ããªã±ãŒã·ã§ã³ã®ããã®ãã¡ã€ã¢ãŠã©ãŒã«ã§ãããŒã ããŒãžãšãŠãŒã¶ãŒéã®éä¿¡ããªã¢ã«ã¿ã€ã ã§ãã§ãã¯ããŠãå人æ
å ±ã®è©åãäžæ£ãã°ã€ã³ãšãã£ãéä¿¡ãèªåçã«æ€ç¥ããŠé®æãããã®ã§ãã
ãã€ãŠã¯ãWAFãå°å ¥ããã«ã¯ãæ°çŸäžåãã®åæè²»çšããããããã«ãå°éã®ã¹ã¿ãããéãå¿ èŠãããããªããªãæ®åãé²ã¿ãŸããã§ãããããããè¿å¹Žã«ãªã£ãŠã¯ã©ãŠãåã®WAFãç»å Žããæ°äžåã®åæè²»çšããæè»œã«å°å ¥ã§ããããã«ãªããŸããã
ããã¡ã€ã¢ãŠã©ãŒã«ãããIPSïŒIDSããšãã£ãäžæ£ã¢ã¯ã»ã¹ãç£èŠããä»ã®ã»ãã¥ãªãã£å¯ŸçãšåãããŠéçšããããšã§ããã匷åºã«ãµã€ããŒæ»æãé²ãããšãã§ããŸãã
ïŒïŒãIPSããIDSããå°å ¥ããDoSæ»æãªã©ããããŒã ããŒãžãé²åŸ¡ãã
IDSïŒäžæ£äŸµå
¥æ€ç¥ã·ã¹ãã ïŒã¯äŒæ¥ããŒã ããŒãžãžã®ã¢ã¯ã»ã¹ãç£èŠããããç°åžžãããã°ç®¡çè
ãžéç¥ãããã®ãIPSïŒäŸµå
¥é²æ¢ã·ã¹ãã ïŒã¯ãDoSæ»æãªã©ã®å
åããããšéç¥ããã ãã§ãªããèªåçã«ãã®éä¿¡ã鮿ãããã®ã§ãã
ãã¡ã€ã¢ãŠã©ãŒã«ã ãã§ã¯é²ãããšã®ã§ããªããDoSæ»æãããã¯ãŒã æ»æããšãã£ããµãŒããŒæ»æãIPSãªãäžæ£äŸµå ¥ãé£ãæ¢ããããšãã§ããŸãã
å°å ¥è²»çšã®çžå Žã¯æ°åäžåãããšãªã£ãŠããŸãã
äŒæ¥ããŒã ããŒãžãçã£ããµã€ããŒæ»æã®ïŒå€§è¢«å®³
äŒæ¥ã®ããŒã ããŒãžããµã€ããŒæ»æãåãããšãå®éã«ã©ã®ãããªè¢«å®³ãåãŒãã®ã§ãããããæ¹ããŠããã®ãªã¹ã¯ãç¥ããããŒã ããŒãžã»ã»ãã¥ãªãã£ãžã®æèãé«ããŠãããŸãããã
被害å 容ã¯ã倧ãã以äžã®ïŒã€ã«åããããŸãã
ïŒïŒããŒã ããŒãžã®æ¹ãããæ¶å»
ããŒã ããŒãžãæ¹ããããããšããŠãŒã¶ãŒã«äŒãããæ å ±ãäŒããããªããªããèŠèŸŒã¿å®¢ãžã®ã¢ããŒã«ãã§ããªããªããŸãããŸãæ¹ãããããããŒã ããŒãžã«ã¢ã¯ã»ã¹ãããŠãŒã¶ãŒããä»ã®Webãµã€ãã«èªå°ããäžæ£ããã°ã©ã ãããŠã³ããŒãããŠããŸãã±ãŒã¹ããããŸãã
ïŒïŒããŒã ããŒãžãããŠã³ããããã
DoSæ»æãªã©ã«ãã£ãŠWebãµãŒããŒã«éå°ãªè² è·ãããããããšãã¢ã¯ã»ã¹ãã«ããç¶æ ã«é¥ããŸããçµæçã«ãµãŒããŒããŠã³ãåŒãèµ·ããããµãŒãã¹ãæäŸã§ããªããªãçµæžçãã¡ãŒãžãåããŠããŸããŸãã
ïŒïŒããŒã ããŒãžãä»ããŠæ å ±ãçãŸãã
ããŒã ããŒãžã«äžæ£ã¢ã¯ã»ã¹ãããµãŒããŒäžã«ä¿åããŠããå人æ å ±ãªã©ã®ããŒã¿ãçãŸãã被害ãè¿å¹Žå€ãçºçããŠããŸãã
çãŸããæ å ±ã¯æªè³ªãªæ¥è ã®æã«æž¡ãå¯èœæ§ããããéèŠæ å ±ã®æŒãããçºèŠããã°ãäŒæ¥ã®ä¿¡é Œå埩ã¯å®¹æã§ã¯ãããŸããããŸã顧客ãžã®èª¬æãè£åãçºçããå ŽåããããŸãã
äŒæ¥ããŒã ããŒãžãçã£ããµã€ããŒæ»æã®æå£
次ã«ãæ»æè ãã©ã®ãããªæå£ã§äŒæ¥ã®ããŒã ããŒãžãæ»æããŠããã®ãã代衚çãªãã®ãã説æããŸãããã®ãããªæå£ãç¥ã£ãŠããã°ãäºåã«è¢«å®³ãé²ãããšãã§ãã被害ã«éã£ãéã«ãå·éã«å¯ŸåŠããããšãã§ããã§ãããã
氎飲ã¿å Žåæ»æ
ãã®æ»æã¯ã察象ãšãªããŠãŒã¶ãŒãæ®æ®µã¢ã¯ã»ã¹ããããŒã ããŒãžïŒæ°Žé£²ã¿å ŽïŒãæ¹ãããããŠãŒã¶ãŒã«æ°ä»ãããªãããã«ã©ã³ãµã ãŠã§ã¢ïŒPCãããã¯ãå
ã«æ»ãããšãšåŒãæãã«èº«ä»£éãèŠæ±ããïŒãªã©ã®ãã«ãŠã§ã¢ã«ææãããããšããæ»æã§ãã
èé£åç©ãç²ç©ãæãããéã«ã氎飲ã¿å Žã®è¿ãã§ç²ç©ãåŸ ã¡äŒãããŠããããšãããã®åãä»ããããŸããã
èªç€Ÿã®Webãµã€ããæ°Žé£²ã¿å Žã«ãªããæ»æã«äœ¿ãããªãããã«ããããã«ã¯ã宿çã«ãµã€ãã®èšºæãå¿ èŠã§ããããŒã ããŒãžãåžžæSSLåããŠããããšã广çã§ãã
ïŒè¢«å®³äŸïŒ
2013幎8æãã9æã«ãããŠãå°æ¹èªæ²»äœã®ãã¥ãŒã¹ãªã©ãæäŸããWebãµã€ãã47è¡æ¿ãžã£ãŒãã«ããäœè ãã«æ°Žé£²ã¿å Žåæ»æãããããµã€ãã¯æ¹ããã«ãã£ãŠäžæ£ãªã³ãŒããåã蟌ãŸããã¢ã¯ã»ã¹ãããŠãŒã¶ãŒã¯ãã«ãŠã§ã¢ã«ææããå¯èœæ§ã«è ããããã
åèïŒ å ±åéä¿¡ãéå¶ã®ã47è¡æ¿ãžã£ãŒãã«ãæ¹ãã被害ïŒãã€ãããã¥ãŒã¹ïŒ
DoSæ»æã»DDoSæ»æã»DRDoSæ»æ
ãããã®æ»æã¯ãã³ã³ãã¥ãŒã¿ãã倧éã®ããŒã¿ãéãã€ããŠå¯Ÿè±¡ãéè² è·ç¶æ
ã«é¥ãããæå£ã§ããåœå
åãã®ããŒã ããŒãžã§ããã°ããµã€ããŒæ»æã®å€ãæµ·å€ããã®ã¢ã¯ã»ã¹ã鮿ããã®ãæå¹ãªå¯ŸçãšãªããŸãã
ïŒè¢«å®³äŸïŒ
2015幎11æ21æ¥ãåçåŽåçã®ããŒã ããŒãžãåœéããã«ãŒéå£ãã¢ãããã¹ããšæããã人ç©ããDDoSæ»æãåããäžæé²èЧã§ããªããªã£ããååŽçã¯æ»æããã·ã¹ãã ãå®ããããµãŒããŒã忢ããããšãšãªã£ãããç¿2016幎ã«ãåæ§ã®è¢«å®³ã«éã£ãã
åèïŒ ååŽçã«ãµã€ããŒæ»æãããã€ãã¿ãŒã«ã¢ãããã¹ïŒïŒææ¥æ°èDIGITALïŒ
ãã«ãŒããã©ãŒã¹ã¢ã¿ãã¯ïŒç·åœããæ»æïŒ
ãã®æ»æã¯ããïŒã«ã䜿ã£ãŠIDãšãã¹ã¯ãŒãã®ãã¹ãŠã®çµã¿åããã詊ããŠèªèšŒã®çªç Žã詊ã¿ãæ¹æ³ã§ããããããŠäžæ£ãã°ã€ã³ãããçµæãééãæ
å ±ãçªåããããããŒã ããŒãžãæ¹ããããããããŸããè€éã§é·ã匷åºãªãã¹ã¯ãŒããèšå®ããããšã§ãæ»æãé²ã广ããããŸãã
ïŒè¢«å®³äŸïŒ
2018幎ã«12æã«çºçããã¯ã¬ãžããã«ãŒãã®äžæ£å©çšäºä»¶ã§ã¯ãã«ãŒãæ å ±ãå ¥åããéã«ç¹°ãè¿ãééããŠãããã¯ããããæ©èœããªãã£ãããããã«ãŒããã©ãŒã¹ã¢ã¿ãã¯ã§ã¯ãªãããšææãããããã®äºä»¶ãåããŠãå ¥ååæ°ã«å¶éãèšãããªã©ã®å¯Ÿçãè¡ãããã
åèïŒ PayPayã®ãã¯ã¬ãžããã«ãŒãäžæ£å©çšãã¯ãªãèµ·ããã®ãïŒïŒITmediaïŒ
ã¯ãªãã¯ãžã£ããã³ã°
ãã®æ»æã¯ãããŒã ããŒãžäžã«ãéæã§èŠããªãç¶æ
ã«ãããªã³ã¯ããã¿ã³ããã¶ããŠãæå³ããªãã¯ãªãã¯ãããããã®ã§ããçµæãšããŠãäžæ£ãªããã°ã©ã ãå®è¡ãããããããæå³ããªãWebãµã€ããžé£ã°ããããããããšãã£ã被害ããããããŸãã
ãã®ãããªè¢«å®³ãé²ã察çãšããŠã¯ããã©ãŠã¶ã§JavaScriptãFlashãªã©ãç¡å¹ã«ããããšãOSãªã©ã®ææ°ã®ã»ãã¥ãªãã£ã¢ããããŒããé©çšããããšããããŸãã
ïŒè¢«å®³äŸïŒ
2009幎ãTwitteräžã«ãã¯ãªãã¯ããŠã¯ãããªãããšããã¡ãã»ãŒãžä»ãã®ãªã³ã¯ããTwitterã¢ã«ãŠã³ãã«æ²èŒããã被害ãçžæ¬¡ãã ããªã³ã¯ã«ã¯ã¯ãªãã¯ãžã£ããã³ã°ã®ä»æããæœãããŠããããªã³ã¯ãã¯ãªãã¯ãããšãèªåã®Twitterã¢ã«ãŠã³ãã«ãåããªã³ã¯ãæ²èŒãã被害ãåºãã£ãã
åèïŒ ãã¯ãªãã¯ããŠã¯ãããªããââTwitterã§æšªè¡ããæå£ïŒITmediaïŒ
ãç¡æãã§ä»ããå®å šæ§ããã§ãã¯ã§ããWebãµã€ã
ããã§ã¯ã念ã®ããèªç€Ÿã®ããŒã ããŒãžã®å®å šæ§ããã§ãã¯ããŠã¿ãŸãããã
äžèšã®Webãµã€ãã§ã¯ãç¡æã§æè»œã«ãã§ãã¯ããããšãã§ããŸããäžãäžãã«ãŠã§ã¢ã«ææããŠããããç¥ãããŠãããã®ã§ãã²ãšãŸãå©çšããŠã¿ãŠã¯ãããã§ããããã
VirusTotal
VirusTotal ã¯ãç¡æã®ãã«ãŠã§ã¢ãã§ãã¯ãµãŒãã¹ã§ãããŠã€ã«ã¹ãã¯ãŒã ãããã€ã®æšéЬãããããçš®é¡ã®ãã«ãŠã§ã¢ãçŽ æ©ãæ€åºã§ããŸããäœ¿ãæ¹ã¯ãURLãå ¥åããŠïŒ»ã¹ãã£ã³ïŒœãã¯ãªãã¯ããã®ã¿ã§ã該åœWebãµã€ãã®å®å šæ§ã蚺æããŠãããŸãã
ïœredïŒã°ã¬ããïŒ
ç¡æã§ã§ããããŒã ããŒãžã®ã»ãã¥ãªãã£ãã§ãã¯ã®Webãµã€ãã®ïŒã€ã«ãgredããããŸãã ã»ãã¥ãªãã£ãã§ãã¯äŒç€Ÿã®ã»ãã¥ã¢ãã¬ã€ã³ç€ŸããææãµãŒãã¹ã®äžéšãç¡æã§å ¬éããŠããŸãã
ãäžå°äŒæ¥åããç¡æã§åŠã¹ãã¬ã€ãããã¯2éž
ã€ã³ã¿ãŒãããããç¡æã§ããŠã³ããŒãã»é²èЧã§ãããã³ãããã¯ãèªããšãäŒæ¥ã®æ å ±ã»ãã¥ãªãã£ã€ããŠããçè§£ãæ·±ããããšãåºæ¥ãŸããäžèšã«ç޹ä»ããïŒåã¯ãã©ã¡ããäžå°äŒæ¥åãã«ããããèšèã§æžãããŠããã®ã§ãçè§£ããããå 容ã«ãªã£ãŠããŸãã
ãå°ããªäžå°äŒæ¥ãšNPOåãæ å ±ã»ãã¥ãªãã£ãã³ãããã¯Ver.1.00ã
ãã¡ãã®ã¬ã€ãããã¯ã¯ããå
é£ãµã€ããŒã»ãã¥ãªãã£ã»ã³ã¿ãŒïŒNISCïŒãã®ããŒã ããŒãžããç¡æã§ããŠã³ããŒãã»é²èЧãå¯èœã§ããå°èŠæš¡ãªäºæ¥è
ããã»ãã¥ãªãã£æ
åœè
ã眮ãããšãé£ããäŒæ¥ãæ³äººã«åããŠããµã€ããŒã»ãã¥ãªãã£ããããããã解説ããäžåã§ãã
åèïŒãå°ããªäžå°äŒæ¥ãšNPOåãæ å ±ã»ãã¥ãªãã£ãã³ãããã¯Ver.1.00ã
ãäžå°äŒæ¥åããµã€ããŒã»ãã¥ãªãã£å¯Ÿçã®æ¥µæã
ãã¡ãã¯ããæ±äº¬éœç£æ¥åŽåå±ããé
åžããŠãããåå¿è
åãã®å
容ãç¶²çŸ
ããã¬ã€ãããã¯ã§ããå
·äœçãªè¢«å®³å®äŸãããã³ã¬ã䜿ã£ãŠã¹ããŒãªãŒåœ¢åŒã§ç޹ä»ããŠããã®ãç¹åŸŽãå°éçšèªã䜿ããã«æžãããŠããŸãã®ã§ãã©ãªãã§ãèªã¿ãããã§ãããã
åèïŒãäžå°äŒæ¥åããµã€ããŒã»ãã¥ãªãã£å¯Ÿçã®æ¥µæã
ãŸãšã
ä»åã¯äž»ã«äžå°äŒæ¥ãåäººäºæ¥äž»ã«åããŠãå®è·µå¯èœãªããŒã ããŒãžã»ã»ãã¥ãªãã£å¯Ÿçãšãµã€ããŒæ»æã®å®äŸãã玹ä»ããŸããããããã§ããã§ããããïŒ
åé ã§ã玹ä»ããããã«ãåŸæ¥å¡10åã»ã©ã®äŒæ¥ã§ããµã€ããŒæ»æã®ã¿ãŒã²ããã«ãªãæä»£ãã€ã³ã¿ãŒãããã»ã»ãã¥ãªãã£ã®åãçµã¿ãããããã«ããŠããã°ããã€èªç€Ÿãæ»æã®å¯Ÿè±¡ã«ãªã£ãŠãäžæè°ã§ã¯ãããŸããã
ãã®ãããªè¢«å®³ã«éããªãããã«ã¯ãæ¥é ããããŒã ããŒãžã»ã»ãã¥ãªãã£ã®ç¥èãæ·±ããã§ãã察çããã£ãããšç¶ç¶ããŠããããšã倧åã§ãã
æèãªWEBã»ãã¥ãªãã£ãžã®ãµã€ããŒæ»æãå¯èŠåïŒé®æïŒãæ»æé®æããã
ãæ»æé®æãããã¯ãWEBãµã€ããWEBãµãŒããžã®æ»æã鮿ããæ å ±æŒãããWEBæ¹ããããµãŒããŒããŠã³ãªã©ã®è åšãããŠãŒã¶ãŒãšäŒæ¥ãå®ãã¯ã©ãŠãåWAF補åã§ããNTTãã³ã¢ã»SBI蚌åžã»å®å ¬åºã»å€§æéèæ©é¢ãªã©ããµãŒãã¹å°å ¥æ°ã¯åœå ãããã¯ã©ã¹ã§5,000ãµã€ã以äžãããŸãã
ãæ»æé®æããããå°å ¥ããã°ãéçºã»éçšã»ãµããŒããŸã§ã®å šãŠãäžè²«ãã察å¿ã«ãã£ãŠãä¿å®ã»éçšã«æéãæããããšãªãã24æé365æ¥ã®é«ã»ãã¥ãªãã£ãå®çŸã§ããŸãããæ»æé®æãããã«ã¯ã以äžã®ãããªç¹åŸŽããããŸãã
ã»æå€§1000äžåãä¿èšŒãããµã€ããŒä¿éºãæäŸ
ã»24æé365æ¥ãµããŒãäžã€å®å
𿥿¬èªå¯Ÿå¿
ã»é²åŸ¡ãã¿ãŒã³ãèªåã¢ããããŒããæ
åœè
ãªãã§æé©ãªã»ãã¥ãªãã£ã·ã¹ãã ãæ§ç¯å¯èœ
ä»åã¯ãæ»æé®æãããã®ãµãŒãã¹æŠèŠè³æãç¹å¥ã«ãçšæããã®ã§ããã²ããŠã³ããŒãããŠã¿ãŠãã ããã