untitled

Size: px

Start display at page:

Download "untitled"

あいぞういいはた
6 years ago
Views:

2 UNIX 2

3 ZONE-H 90% Linux 3

4 Sendmail sendmail OpenSSH CERT Advisory CA Trojan Horse OpenSSH Distribution tcpdump / libpcap CERT Advisory CA Trojan Horse tcpdump and libpcap Distributions 4

5 CVS 2003/1/20 CVS contain a flaw that can be used by a remote attacker to execute arbitrary code on the server : Stable CVS Version Released! (security update) Full-Disclosure] Advisory 07/2004: CVS remote vulnerability More CVS woes cvshome.org <-- PLAY "FIND THE SUCKIT" (rootkit ) : Handler's Diary May 27th 2004 (SANS ISC) CVS cvshome.org namazu 5 28 Ruby 5

6 GNU/Debian Linux Linux GNU/Debian Linux SouceForge.jp SourceForge.jp GNOME LinuxGNOME MySQL MySQL 6

7 Yahoo DDoS (UNIX ) 7

8 UNIX 8

9 UNIX TOP10(SANS) U1 BIND Domain Name System U2 Web Server U3 Authentication U4 Version Control Systems U5 Mail Transport Service U6 Simple Network Management Protocol (SNMP) U7 Open Secure Sockets Layer (SSL) U8 Misconfiguration of Enterprise Services NIS/NFS U9 Databases U10 Kernel 9

10 U1 BIND Domain Name System U1 BIND Domain Name System CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN ( BIND Cache poisoning via negative responses: For the Denial of Service Vulnerability in ISC BIND 9: http// For the Denial of Service Vulnerability in ISC BIND 8: Running the BIND9 DNS Server securely Hardening the BIND v8 DNS Server Securing an Internet Name Server 10

11 U 2 1/2 Web Server U2 Web Server Apache CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CAN , CVE , CVE , CVE , CAN , CVE , CVE , CVE , CVE , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN iplanet/sun Java System Web Server CVE , CAN , CAN , CAN , CAN , CVE , CAN , CAN OpenSSL CAN , CAN , CAN PHP CVE , CAN , CAN Other CAN , CAN Free: Nessus, SARA Free Utilites(eEye) Products: Internet Scanner (ISS), Comercial Scanner(eEye) 11

12 U 2 2/2 Web Server cgi php mod_ssl, mod_proxy cgi-bin: PHP HTTP Securing PHP: Step-by-step Apache mod_security Cross Site Scripting(XSS), SQL Injection XSS, SQL Injection Nokto httpd chroot httpd mod_info 12

13 U 3 1/3 U3. Authentication (Default Password -1 Shadow Password /etc/shadow root NIS telnet, FTP ) 13

14 U 3 2/3-2 Npasswd PAM Crack, John the Ripper 14

15 U 3 3/3-3 telnet, FTP, HTTP, Berkeley r ssh(ssh, sftp, scp), SSL root root root (Wheel) sudo su/sudo 15

16 U4 Version Control Systems(CVS, Subversion) U 4 CAN , CAN , CAN , CAN , CAN , CAN , CAN pserver(2041/tcp), svn(3690/tcp) (cvs ver CVS stable release version CVS feature release version Subversion /tcp, 3690/tcp 16

17 U5 Mail Transport Agent MTA Internet Scanner Nesuss, SARA MTA MTA chroot U 5 17

18 U 6 SNMP U6 Simple Network Management Protocol (SNMP) CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN Using SNMP for Reconnaissance Internet Scanner, SNMPing, SNScan, Nesus SNMP SNMPv3 SNMP TCP-Wrapper/Xinetd MIB 18

19 U 7 Open Secure Sockets Layer(SSL) U7 Simple Network Management Protocol (SNMP) CVE , CVE , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN and CAN C 0.9.6I A ache CUPS Curl, OpenLDAP, Stunnel, Sendmail OpenSSL ipfillter/netfilter, FW 19

20 U 8 (NIS/NFS) 1/3 Misconfiguration Enterprise Services U8 Misconfiguration of Enterprise Services NIS/NFS NFS CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN NIS CVE , CVE , CVE , CVE CAN , CAN , CAN , CAN rpc.mountd version, ypserv --version NIS NIS map root DES Blowfish/MD5 NFS /etc/exports host, netgroup, permission showmount e SERVER_IPexport 20

21 U 8 (NIS/NFS) 2/3 Misconfiguration Enterprise Services NIS BIND NIS DBM YP_SECURE makedbm s /var/yp/securenets ypserv, ypxfrd NIS +:*:0:0::: SSH NIS Secure NFS and NIS via SSH Tunnel NFS /etc/exports Alias IP FQDN /etc/exports NFS NFS secure NFS Export» /home (ro) NFS root_squash 21

22 U 8 (NIS/NFS) 3/3 Misconfiguration Enterprise Services NFS Export all_squash NFSBug. Port MonitoringSolaris) /etc/systems set nfssrv:nfs_portmon = 1 NIS/NFS CERT UNIX Security Checklist NFS/NIS NFS/NIS 22

23 U 9 1/2 U9 Mail Transport Agent Oracle: CVE , CVE CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN MySQL: CVE , CVE , CVE , CVE , CVE CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN PostgreSQL: CVE CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN MySQL Network Scanner Nessus Foundstone, Quelys, eeye Retina APPSecInc, ISS Database Scanner 23

24 U 9 2/2 Oracle MySQL PostgreSQL ftp://ftp.postgresql.org/pub Oracle ( MySQL ( PostgreSQL ( Oracle»

25 U10 kernel U 10 1/3 CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN , CAN Internet Scanner, Nesuss 25

26 U 10 2/3 Solaris Tunable Parameters Reference Manual (Solaris 8) Solaris Tunable Parameters Reference Manual (Solaris 9) Solaris Operating Environment Network Settings for Security Solaris Kernel Tuning for Security or Linux Kernel Hardening The Linux Kernel Archives Linux Kernel Hardening AIX Kernel Tuning 26

27 U 10 3/3 HP-UX Kernel Tuning and Performance Guide FreeBSD Handbook (contains information on kernel tuning): OpenBSD: (for more info) NetBSD Tuning, Kernel Tuning 27

28 28

29 1 PDC Administrator root = root, Administrator = Administrator TELNET HSRP 29

30 2 DNS.. IP Public OS Resource Role 30

31 1 Default Accept SMB(NetBIOS), SQL, TFTP» MS Blast Nimda DMZ TELNET 31

32 2 Windows Rlogin.rhost /etc/rhosts + ~/.rhost /etc 32

33 Windows Update

34 IP IP OS DDoS P2P 34

35 SQL SQL Injection Chat(IRC) Web Mail IPv6 35

36 -1 36

37 -2 xxx = xxx SQL SQLIP 37

38 38

39 39

40 DMZ Firewall Internal Servers 40

41 DMZ FW FW 41

42 FW FW DMZ21 DMZ DMZ FW 42

43 DMZ DMZ 43

44 88% 44

45 45

46 46

47 UNIX Zone-H 99% UNIX Database, Web Application PC) UNIX PCWindows FW 47

48 48

untitled

untitled 200 7 19 JPCERT [2007 2 4 6 ] IPA JPCERT JPCERT/CC 2007 2 4 6 1 2 1. 2007 2 1 2007 4 1 6 30 IPA 46 95 141 2004 7 8 501 940 1,441 3 2 (1) 3 2004 7 8 1 2007 2 1.98 1 2005/1Q 2005/2Q 2005/3Q 2005/4Q 2006/1Q