¥Í¥Ã¥È¥ï¡¼¥¯¥×¥í¥°¥é¥ß¥ó¥°ÆÃÏÀ

Size: px

Start display at page:

Download "¥Í¥Ã¥È¥ï¡¼¥¯¥×¥í¥°¥é¥ß¥ó¥°ÆÃÏÀ"

つづるたみや
7 years ago
Views:

1 6 : JavaScript 2 : Web Web HTTPS : Web : Web, Internet Week 1 / 23

2 2 / 23

3 Web Web : HTTP: ( ) TCP: IP: ( ) Web 3 / 23

4 Basic (base64 ) ( ) Digest md5 Basic (nonce) hidden <input type="hidden" name="sessionid" value="nnnnn"> POST sessionid=nnnnn Cookie Set-Cookie: sessionid=nnnnn sessionid 4 / 23

5 Web XSS (Cross Site Scripting) CSRF (Cross Site Request Forgery) 5 / 23

6 URL ID Referer URL ID hidden POST Referer Cookie POST Cookie (MD5) MD5 MD5 6 / 23

7 Cookie Cookie + : ID ID ID Set-Cookie: secure cookie https (rails ) 7 / 23

8 XSS (Cross Site Scripting) : Cookie JavaScript API SQL ( ) 8 / 23

9 XSS (JSP): <% String comment=request.getparameter("comment"); %> <div> <%= comment =%> </div> : src=" : <div> <script src=" </div> script HTML DOM 9 / 23

: http:/.../?comment=<script src="http:/.

10 CSRF (Cross Site Request Forgery) Session Riding : 10 / 23

11 CSRF A: GET A/?comment=good cookie B: <a href=" bad JavaScript POST onload Cookie 11 / 23

12 CSRF ( POST ) POST hidden ID ( hidden ) (OK ) 12 / 23

13 : JSON JavaScript onerror setter <script src=...> script src JSON JSONP JS setter onerror 13 / 23

14 : <f,g> f(g(x))=x [ ] A 1 g f 2 g 4 ( ) 5 f B 3 g [ ( )] A B 1 f g 2 f 3 g = 4 + ( ) 5 f 6 14 / 23

15 : HTTPS HTTPS = HTTP over TLS (Transport Layer Security) HTTP TLS TCP HTTP identify TCP (Web ) (http GET https ) CA identification 15 / 23

16 TLS ( ) ( ) ID 16 / 23

17 TLS RFC 2246 (v1.0), 4346 (v1.1), 5246 (v1.2) 1 / 2 (= CA ) 3 4 HTTP 17 / 23

18 ( ) ClientHello > < ServerHello < Certificate < ServerHelloDone ClientKeyExchange > ChangeCipherSpec > Finished > < ChangeCipherSpec < Finished Application Data < > Application Data ClientHello: Session ID ServerHello: Session ID Certificate: ClientKeyExchange: ( ) ChangeCipherSpec: Finished: ( ) 18 / 23

ChangeCipherSpec <-------- Finished Application Data <-------> Application Data ClientHello:

19 ClientHello > < ServerHello < ChangeCipherSpec < Finished ChangeCipherSpec > Finished > Application Data < > Application Data Session ID ClientHello ServerHello Session ID Session ID 24 http 19 / 23

20 POODLE(Padding Oracle On Downgraded Legacy Encryption) SSLv3 : 1 P 1...P n C 1...C n 2 Padding +Padding 3 : P i=decrypt(c i) C i 1 : 1 C n Padding +Padding 2 Ci Cn 3 P n =Decrypt(C i ) P n 1 4 P n 1 Padding 1/ Decrypt(C i) = P n Pn 1 [ 1 ]! 7 P i =Decript(C i ) P i 1 [ 1 ]!! 8 P i 1 20 / 23

21 HTTPS 1:TCP 3-way handshake + TLS 3-way handshake 2:https - CSP : Session Resumption (Session Cache) Session Tickets: Stateless OCSP (Online Certificate Status Protocol) Stapling: False Start: ALPN? 21 / 23

22 EV (Extended Validation): https HSTS (HTTP Strict Transport Security): HTTPS Upgrade Insecure Requests: http https Opportunistic Security for HTTP: HTTP Let s Encrypt: 22 / 23

23 : HSTS super cookie sub_domain00.domain/ sub_domain01.domain/ sub_domain02.domain/... sub_domain1f.domain/ 32 HTTP 32bit 1 sub domain i HSTS https 32 http 0 https 1 23 / 23

第2回_416.ppt

第2回_416.ppt 3 2 2010 4 IPA Web http://www.ipa.go.jp/security/awareness/vendor/programming Copyright 2010 IPA 1 2-1 2-1-1 (CSRF) 2-1-2 ID 2-1-3 ID 2-1-4 https: 2-1-5 ID 2-1-6 2-1-7 2-2 2-2-1 2-2-2 2-3 2 2-3-1 Web Copyright