HTTP HTTP

Size: px

Start display at page:

Download "1 4 1.1..................................... 4 1.2..................................... 5 1.3..................................... 5 2 HTTP 7 2.1 HTTP"

あかりのたけ
7 years ago
Views:

1 2015 HTTP Web F036-1

2 HTTP HTTP HTTP GET Referer () User-Agent Accept HTTP HTTP HTTP Content-Type Drive-by-Download Drive-by-Download Blackhole Redkit JavaScript Web Detecting Malicious HTTP Redirections by User Browsing Activity

3.1 HTTP................................ 9 2.3.2 HTTP.......................... 9 2.3.3 Content-Type................................ 10 3 Drive-by-Download 11 3.1 Drive-by-Download.............................. 11 3.2 Blackhole.

1................................ 23 6.2..................................... 24 6.3 1............................... 24 6.4 2................................ 25 6.5 3......................... 25 6.6......................................... 26 7 30 7.

4 2.1 GET HTTP Drive-by-Download ( D) () ( ) ()

.................................... 20 5.5.................................... 21 5.6........................................ 22 5.7.................................. 22 6.

5 2.1 HTTP ( D)

3.................................... 25 6.4.................................. 26 6.

6 1 1.1 Web Web [1] iframe JavaScript [2] Web Drive-by-Download ( 3 ) Drive-by-Download Web Web Web IP [3] 5

7 1 1.2 HTTP Web HTTP URL Web 1 Web HTTP HTTP HTTP (Hypertext Transfer Protocol) 3 Drive-by-Download Web Drive-by-Download

8 1 7 7

9 2 HTTP 2.1 HTTP HTTP (Hypertext Transfer Protocol) HTML (HyperText Markup Language) HTTP HTTP HTTP URL HTTP ( 2.2 ) Web HTTP ( 2.2 ) HTTP ( ) HTTP ( 2.3 ) 2.2 HTTP GET URL GET 2.1 HTML GET 2.1 GET (Request Method: GET) URL index.html (Referer, ) (User-Agent ) HTTP (Accept-Encoding) GET 8

HTTP HTTP URL HTTP ( 2.2 ) Web HTTP ( 2.2 ) HTTP ( 2.3.2 ) HTTP ( 2.3 ) 2.2.1 GET URL GET 2.

10 2 HTTP GET /index.html HTTP/1.1 Accept: */* Referer: Accept-Language: ja Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (Compatible; MSIE 6.0; Windows NT 5.1;) Host: Connection: Keep-Alive 2.1: GET Referer () GET Referer () Referer URL Referer URL GET 2.1 Referer User-Agent User-Agent HTTP Web User-Agent Mozilla [4] Netscape Navigator Web User-Agent Mozilla PC Web User-Agent Mozilla Opera [4] Accept Accept HTTP (MIME ) HTTP 9

zzz Connection: Keep-Alive 2.1: GET 2.2.2 Referer () GET Referer () Referer URL Referer URL GET 2.1 Referer http://hoge.com/index.

11 2 HTTP HTTP Accept HTTP ( ) Accept */* HTTP HTTP 2.3 HTTP HTTP HTTP HTTP 2.2 HTTP HTTP HTTP 1 HTTP ( ) (Date) (Content-Length) (Content-Type, ) HTTP/ OK Server: Apache Last-Modified: Mon, 14 Oct :00:27 GMT Accept-Ranges: bytes Content-Length: 3296 Content-Type: application/zip Cache-Control: max-age=205 Expires: Mon, 14 Oct :08:35 GMT Date: Mon, 14 Oct :05:10 GMT Connection: keep-alive 2.2: HTTP HTTP HTTP HTTP 3 10

1 200 OK Server: Apache Last-Modified: Mon, 14 Oct 2013 13:00:27 GMT Accept-Ranges: bytes Content-Length: 3296

12 2 HTTP HTTP HTTP 200 OK 2.1: HTTP 1xx 2xx 3xx 4xx 5xx (e.g. 100 Continue ) (e.g. 200 OK ) (e.g. 301 Moved Permanently Location ) (e.g. 401 Unauthorized ) (e.g. 500 Internal Server Error ) Content-Type Content-Type / MIME JPEG Content- Type image/jpeg MIME 1 1 MIME 1 MIME Javascript application/javascript text/javascript MIME 11

3.3 Content-Type Content-Type / MIME JPEG Content- Type image/jpeg MIME 1 1 MIME 1

13 3 Drive-by-Download 3.1 Drive-by-Download Drive-by-Download Web Web iframe JavaScript Web Web [2] Drive-by-Download 3.1 HTTP Exploit kit Oracle Java Acrobat/Reader Adobe Flash Java Runtime Emviromnent [1, 2, 5] Web SQL ID PASSWROD Twitter (SNS) URL [6] 12

14 3 Drive-by-Download 3.1: Drive-by-Download 3.2 Blackhole Blackhole Web [5] Web PC PC Web Drive-by-Download [7]Blackhole Blackhole 2 Blackhole OS Web Blackhole 8 Blackhole Blackhole [8, 9] 2 13

15 3 Drive-by-Download 3.3 Redkit Redkit 2013 Blackhole PC Web Java Adobe PDF Flash Blackhole Redkit Java [9] 3.4 JavaScript JavaScript HTTP JavaScript alert( Hello, World!! ); [10] 3.2 eval(function(p,a,c,k,e,r){e=string;if(!.replace(/ˆ/,string)){while(c )r[c]=k[c] c;k=[function(e){return r[e]}];e=function(){return \\w+ };c=1}; while(c )if(k[c])p=p.replace(new RegExp( \\b +e(c)+ \\b, g ),k[c]);return p}( 0( 1, 2!! );,3,3, alert Hello World.split( ),0,{})) 3.2: eval String replace, split escape ASCII fromcharcode 14

$.replace(/ˆ/,string)){while(c )r[c]=k[c] c;k=[function(e){return r[e]}];e=function(){return \\w+ };c=1}; while(c )if(k[c])p=p.$

16 4 4.1 [11] URL 4.1 HTTP URL URL 4.1 URL HTTP HTTP (6) URL HTTP (6) HTTP URL HTTP 4.2 Web [12] Drive-by-Download 15

17 4 4.1: pdf swf BIN Content-type application/pdf application/x-shockwave-flash application/octet-stream application/x-msdowmload application/x-download application/x-msdos-program (1) URL URL HTTP (2) HTTP 3xx (3) HTTP URL (4) HTTP URL (5) (6) HTTP URL 4.1: Web URL HTML 0 1 (JavaScript CSS ) 2 URL 16

application/x-msdowmload application/x-download

18 4 4.3 Detecting Malicious HTTP Redirections by User Browsing Activity Mekky [13] ISP IDS 17

19 5 5.1 HTTP Web Web [11] HTTP Web HTTP HTTP [14] HTTP 5.1 URL 18

20 5 5.1: HTTP (4.1) HTTP URL URL HTTP URL URL HTTP Host header URL 5.3 ( 5.2 ) 5.3 ( D) ( D) Web ( D) Accuracy TPR 19

21 5 5.2: 5.3: ( D) 20

22 5 5.1: ( D) [%] [%] Accuracy TPR FPR Web 2 (4 ) [12] Mekky [13] 5.4: 21

23 HTTP Web HTTP Drive-by-Download D3M2015 [15] HTTP HTTP Web Web 5.5: [11] ( 4.1 ) (6) URL 22

24 5 X-Powered-By header [16] WEB Referrer header [17] (1) (NotUrl) (2) (TransPerTime) (3) X-Powered-By header (PhpVer) (4) Referrer header (Ref) (5) HTTP (Data) (6) (Trans) (7) (MalGrade) 5.6: MalGrade TransPerTime PhpVer Ref : 23

25 6 6.1 Web D3M2015 [15] NTT Web Marionette [18] Web Marionette OS Windows XP SP2 Web Internet Explorer6.0 Adobe Reader Flash player Win Zip Quick Time JRE Marionette 6.1 HTTP Accept ( ) User-Agent Mozilla, Opera ( ) User-Agent api, application, bat, bot, crawl, exe, hunny, pot, program 6.1: HTTP HTTP 24

26 6 HTTP ( D) 6.1: (D3M2015) 2014/ 4/11, 5/ 2, 2015/ 2/ /10/23, 11/ SVM (Support Vector Machine) Accuracy Accuracy 2 Accuracy TPR FPR Web SVM 5.1 ( D) ( ( D)) 6.2 Accuracy TPR (True Positive Rate) Web Web FPR (False Positive Rate) Web 25

27 6 6.2: [%] ( D) [%] Accuracy TPR FPR MalGrade ( ) 6 SVM Accuracy TPR FPR 6.3: Accuracy [%] NotUrl TransPerTime PhpVer Ref Data Trans Phpver (X-Powered-By header ) Accuracy Phpver Accuracy TPR FPR

28 6 6.4: [%] [%] Accuracy TPR FPR () / ( ) 6.5: ( D) TPR TPR ( D) ( D) TPR 2 3 Phpver Accuracy TPR 27

29 (%) (%) 6.2: () 3 () / ( ) () 24% 50% 28

30 100 (%) (%) 6.3: ( ) 29

31 100 (%) (%) 6.4: () 30

32 7 7.1 HTTP URL Web Web URL URL URL

33 MalGrade ( ) 32

34 33

35 [1] IBM Security Service 2015 Tokyo SOC IBM tokyo soc report2015 h1.pdf?lang=ja September 2015 [2] JPCERT Web JPCERT jp/at/2013/at html June 2013 [3] Independent Tests of Anti-Virus Software, [4] Kazuhiro Furuhata, useragent, OpenSpace, openspc2.org/useragent/, October, [5] McAfee 6 McAfee com/japan/security/monthly/pc asp June 2013 [6] 14.3 URL CNET Japan March 2011 [7] Nick Johnston Blackhole Exploit Kit Gets an Upgrade: Pseudo-random Domains Symantec June 2012 [8] Charlie Osborne Blackhole malware toolkit creator Paunch suspect arrested CBS Interactive. October

36 [9] SophosLabs 2014 Sophos ja-jp/medialibrary/pdfs/other/sophos-security-threat-report-2014.pdf January 2014 [10] /packer/, [11] F1 pp October [12] Web 2011 pp July 2011 [13] Hesham Mekky Ruben Torres Zhi-Li Zhang Sabyasachi Saha Antonio Nucci Detecting malicious HTTP redirections using trees of user browsing activity INFOCOM 2014 pp [14] HTTP Web p.180 March 2014 [15] 2015 (MWS2015), [16] Drive By Download HTTP pp.1 6 March 2013 [17] Yuta Takata Shigeki Goto and Tatsuya Mori Analysis of Redirection Caused by Webbased Malware Proceedings of the Asia-Pacific Advanced Network 2011 v.32 pp August 2011 [18] Mitsuaki Akiyama, et al: Design and Implementation of High Interaction Client Honeypot for Drive-by-download Attacks, IEICE Transactions on Communication, Vol.E93-B No.5 pp , May,

37 [19] HTTP Web 2013(1) pp March 2013 [20] 2011 (MWS2011), [21] 2012 (MWS2012), [22] MWS2013 MWS2013 Datasets [23] Microsoft Microsoft Security Intelligence Report Volume 18 Microsoft Corporation December 2014 [24] Mynavi Corporation - IBM Mynavi Corporation September 2015 [25] McAfee Labs McAfee Labs : McAfee http: // August 2015 [26] IBM IBM X-Force IBM software/jp/cmp/security report/ September 2015 [27] Mynavi Corporation IE JRE Mynavi Corporation http: //news.mynavi.jp/articles/2013/10/11/mcafee9/ October 2013 [28] Symantec Corporation : Symantec papers/ sr wp spam report 1301.pdf February

38 [29] Web 4 IBM Impress Watch Corporation, an Impress Group company watch.impress.co.jp/docs/news/ html August 2013 [30] TCPDUMP & LIBPCAP, [31] Wireshark, tshark, 37

2 [2] Flow Visualizer 1 DbD 2. DbD [4] Web (PV) Web Web Web 3 ( 1) ( 1 ) Web ( 2 ) Web Web ( 3 ) Web DbD DbD () DbD DbD DbD 2.1 DbD DbD URL URL Google

2 [2] Flow Visualizer 1 DbD 2. DbD [4] Web (PV) Web Web Web 3 ( 1) ( 1 ) Web ( 2 ) Web Web ( 3 ) Web DbD DbD () DbD DbD DbD 2.1 DbD DbD URL URL Google Drive-by Download 1,a) 1,b) Web Drive-by Download(DbD) DbD Web DbD HTTP DbD Web DbD, Drive-by Download The Network Visualization Tool for detecting the Drive-by Download attacks. Amako Katsuhiro 1,a) Takada