Phishing対策のためのMutualアクセス認証 〜 MutualTestFoxの公開について 〜
|
|
|
- あまめ つくとの
- 9 years ago
- Views:
Transcription
1 Mozilla Party MutualTestFox Phishing Mutual Phishing MutualPhishing WebMutual BasicDigest HTML Form 2
2 3 4
3 MutualTestFox 3.0!5+draft02.0 (r718) mod_auth_mutual (r718) 5 8 (r736) J(pi) draft01 ISO FAQ 5 29 Firefox 3.0RC1 (r791) r736 6
4 Yahoo! JAPAN Phishing HTTP Mutual MutualTestFoxmod_auth_mutual IETF 7 Web Internet Draft (IETF) ( ) RFC
5 Phishing Firefox phishing 9! 10
6 11 12
7 PayPalphishing PayPal phishing spam PayPalspam PayPal phishing!! 13 14
8 15 16
9 spam 17 18
10 19 &'()! *+#$%! 1002/ / ,-.? 1003,-.?!"#$%! 20
11 Citibank Phish Spoofs 2-Factor Authentication (2006/7/10) Man-in-the-middle attack on Citibank users concerns experts (2006/7/14) Bank Systems & Technology: Phishers Beat Citi's Two-Factor Authentication (2006/7/18) FST US Article: Phishing and forward looking financial institutions Man-in-the-middle attacks Citi authentication system (2006/12/7) RSA Alert: New Universal Man-in-the-Middle Phishing Kit Discovered (2007/1/10) 21 Location Bar 22
12 23 VPN phishing Web TLS(SSL) phishing EV SSL 24
13 Mutual VPN Web 25 26
14 Mutual Mutual Mutual 27! 28
15 29 URL TLS 30
16 Chrome IE 6 SP1 Firefox 3 Location Bar 31 Basic Digest Mutual 32
17 HTTP RFC 2617, HTTP Authentication: Basic and Digest Access Authentication 1999 Basic Access Authentication Basic Digest Access Authentication (Digest RFC???? 20?? Mutual Access Authentication (Mutual 33 TLS TLS DNS spoofing TLS Mutual 34
18 35 Digest Digest PAKE PAKE TLS-SRP TLS-SRP 36
19 PAKE Mutual 37 NIST SP Appendix A PAKE 38
20 !"#$%&! request '()! (*+,(-) *+,(-! 401 Auth req ed 23sa wa Req-a1 (wa) 401-B1 (wb) wb (wa)./0(1 J(!) 23 sb (wb) z oa Req-A3 (oa) (oa) z oa ob = (ob) ('()./) 200-B4 (ob) ob = (!"#$%&./) (4567) 39 iso dl bit 256bit (H = SHA256) mod q, mod r u, p, h " " = H(algorithm h realm u p) DB J(") J(") = g" J : 40
21 TLS TLS TLS-SRP (RFC 5054) Web IMAP over TLS-SRP IETF Informational TLS 41 HTML Form XSS cookie Session Fixation HTTP CSRF (Cross-Site Request Forgery) 42
22 Basic UI Mutual 43 SSO auth-domain *.example.com SSO Liberty OpenID 44
23 DB Mutual DB 45 Firefox RFC IETF HTTPWeb Mutual MicrosoftInternet Explorer Yahoo! 6 46
第2回_416.ppt
3 2 2010 4 IPA Web http://www.ipa.go.jp/security/awareness/vendor/programming Copyright 2010 IPA 1 2-1 2-1-1 (CSRF) 2-1-2 ID 2-1-3 ID 2-1-4 https: 2-1-5 ID 2-1-6 2-1-7 2-2 2-2-1 2-2-2 2-3 2 2-3-1 Web Copyright
Flash Player ローカル設定マネージャー
ADOBE FLASH PLAYER http://help.adobe.com/ja_jp/legalnotices/index.html iii................................................................................................................. 1...........................................................................................................
untitled
PC Internet Explorer Windows SafariMac OS X Mozilla FireFoxWindows / Macintosh Google ChromeWindows / Macintosh IE + Google Windows 1 Internet Explorer 10.x (O)(A) Internet Explorer (O) (B) (B) (B) 2 Web
ict8.key
Cookie Web HTTP HTTP stateless HTTP A A B, C B C cookie (RFC2965/6265) HTTP Javascript URL Web Web Cookie HTTP Cookie Cookie Cookie 1 Cookie Cookie Cookie Cookie Cookie Cookie Cookie Cookie 1) Web Cookie
2.1... 1 2.1.1.1... 1 (1). 1 (2)... 1 (3)... 1 2.1.1.2... 1 (1)... 1 (2)... 1 (3)... 1 2.1.1.3... 1 (1)... 1 (2)... 1 (3)... 1 2.1.1.4... 2 2.1.1.5... 2 2.2... 3 2.2.1... 3 2.2.1.1... 3... 3... 3 (1)...
Microsoft PowerPoint - 情報システム20131127.pptx
2013 11 27 NTT ISP IP 32 8. FTTH OLT ONU( ) ADSL DSLAM ADSL (ISDN) WiMAX ISP i sp ISP LAN ISP IP PPPoE FTTH ADSL BAS ID IP PPP RAS ID IP DHCP DHCP IP PPPoE ID ID ISP @ IP IPCP ID PC PC WAN LAN PC PPPoE
Google Apps Google Apps for Work Education Government Drive for Work Google Apps Unlimited
Google for Work Google for Work Google Apps Google Apps for Work Education Government Drive for Work Google Apps Unlimited 1 Google 2 4 6 10 ISO 27001 SOC 2/3 FISMA 11 Google Google Apps 12 14 EU EU EU
内閣官房情報セキュリティセンター（NISC）
( ) ...1 1.1.1...1 (1)..1 (2)...1 (3)...1 1.1.2...2 (1)...2 (2)...2 (3)...2 (4)...3 (5)...3 (6)...3 1.1.3...4...10 2.1...10 2.1.1...10...10...10 (1)...10 (2)... 11 (3)... 11 (4)...12 (5)...13 (6)...13
Cisco Configuration Professional（CCP）Express 3.3 による Cisco 841M J シリーズ初期設定ガイド
Cisco Configuration Professional CCP Express 3.3 Cisco 841M J WAN/LAN Cisco Configuration Professional CCP Express 3.3 p3 CCP Express 3.3 p4 Cisco Configuration Professional ExpressCCP Express 3.3 Cisco
Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 3 Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved.
2006 12 14 Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 2 Copyright 2006 Mitsui Bussan Secure Directions, Inc. All Rights Reserved. 3 Copyright 2006 Mitsui Bussan Secure Directions,
untitled
3sweb ASP & 2009/5/18 DN01 _1 DN02)_1 URL Web Favicon DN03 _1 Web Favicon DN04)_1 ( ) DN05 _1 EXCEL DN06)_1 EXCEL DN07 _1 URL DN08)_1 DN09 _1 ( ) (DN10)_1 ( ) DN11 _1 ( ) (DN12)_1 ( ) DN13 _1 (DN14)_1
TLS _final
TLS 1.3 IoT 2018/12/06, [email protected] wolfssl Japan GK 1 woflssl 2 3 : 200 E H : 200 I N Q : 2 / MSJ Q : 20. : 2.. # I N TC L. 00 0 L P : 2 T T 4 5 6 wolfssl Japan 7 108-6028 2-15-1 A 28F 050-3698-1916
... 33 34 Google Apps / Gmail... 35 2
Google Apps/Gmail 2009 11 27.... 2 3... 4 /... 5 Google Apps / Gmail? 6... 7 :... 8 9... 10... 11?... 12 Google Apps / Gmail 13 GoogleAppsAcademicEdition... 14 SAML... 15 IMAP/POP.... 16... 17 SPAM...
IP S ( :H ) ( ) ( :H22 4
90 30 440 8515 4 101 0532 54 5111 0532 53 1379 IP 1. 2. 3. 11 1 1. 2. 12 0 1 2 3 8 0 8 0 8 S 5 5 0 5 2 1 13 0 5 0 4 (:H22 4 28 ) 1 1 0 5 () (:H22 4 28 ) 1 2 5 0 (: ) ー (: ) ー1 0 0 0 0 (: ) 1/26 50P7 21
untitled
25 486 1 17 3 1641 1 OA OA 1F 726 2F 662 F 1F 137 2F 1,321 3F 1,312 1,513 F 1,292 2F 1,155 1F 747 2F 747 40 2,770 3F 1,415 F F 1,494 18 508 EV EV ) ) 40kw 2~3 30m 777 16 1 16 16 7 16 800,000 790,000
shio_20041004.PDF
JPNIC JPCERT/CC 2004 Web 2004 10 4 Web Web Web WASC Web Application Security Consortium 7 Web Security Threat Classification Web URL 2 ...?? It depends!? It depends!??? 3 ? It depends!...
/02/ /09/ /05/ /02/ CA /11/09 OCSP SubjectAltName /12/02 SECOM Passport for Web SR
for Web SR Certificate Policy Version 2.50 2017 5 23 1.00 2008/02/25 1.10 2008/09/19 1.20 2009/05/13 5 1.30 2012/02/15 5.6 CA 1.40 2012/11/09 OCSP SubjectAltName 2.00 2013/12/02 SECOM Passport for Web
FirePass Edge Client TM Edge Client LAN Edge Client 7.0 Edge Client Edge Client Edge Client Edge Client Edge Client Edge Client LAN Edge Client VPN Wi
Security FirePass SSL VPN FirePass SSL VPN Virtual Edition VE) 1 Web E 11 12 icontrol SSL VPN API 12 FirePass FirePass Edge Client TM Edge Client LAN Edge Client 7.0 Edge Client Edge Client Edge Client
5-5_arai_JPNICSecSemi_XssCsrf_CM_ PDF
XSS + CSRF JPNIC JPCERT/CC 2005 Web 2005 10 6 IS Copyright 2005 SECOM Co., Ltd. All rights reserved. 1 XSS + CSRF Web Web Web (Web, DB, ) Copyright 2005 SECOM Co., Ltd. All rights reserved. 2 SQL XSS Copyright
untitled
e-parcel VCN-AX 3.0 for Windows April, 2017 e-parcel VCN-AX3.0 Installation Manual EP-PM-MN-0316 Copyright e-parcel Corporation All rights reserved. 1 e-parcel VCN-AX3.0 Installation Manual EP-PM-MN-0316
H1-2-3-4.indd
1 1 1 2 3 9 9 10 10 12 12 14 14 16 16 17 18 19 21 28 1 26 11 22 26 11 23 26 11 24 Web 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 4 4 8 2 2 4 20 4 4 8 4 4 8 2 2 4 4 4 32 4 4 12 4 4 4 4 4 4 4 4 8 2
1 1 1 1 Web 1 1 Web 1 java Web 1 1 2
100 Google Google Web1 1 1 1 1 1 Web 1 1 Web 1 java Web 1 1 2 3 SEO SEO SEO SEO Search Engine Optimizing Search Engine Optimizing Web Web Web SEO YST Google YST Yahoo Search Technology Yahoo Google Google
1 3 1.1..................................... 3 1.2..................................... 4 1.3.................................... 4 2 DNS 5 2.1 DNS...
2015 User-AgentDNS 2016 2 1 5114F058-7 1 3 1.1..................................... 3 1.2..................................... 4 1.3.................................... 4 2 DNS 5 2.1 DNS......................................
金融機関のセキュリティ対策の動向について
19214 FISC 2 FISC FISC 3 FISC FISC 4 FISC FISC 5 FISC FISC 1985.12 2006.0372007.03) 1994.01 2006.03 1987.07 22000.07 32007.03 1999.01 FISC 6 FISC FISC 7 FISC FISC 8 FISC WG FISC 9 FISC FISC 10 FISC 181127
31 Jul.2012 API Application Program Interface Markup SEMANTICS OFFLINE & STORAGE DEVICE ACCESS CONNECTIVITY MULTIMEDIA 3D, GRAPHICS EFFECTS PERFORMANCE INTEGRATION CSS3 HTML5 CSS3 JavaScript WHATWG
atama.dvi
1 1 1 2 1.1..................................... 2 1.2 WWW....................................... 3 1.3......................................... 3 1.4................................... 3 1.5..............................
Windows Oracle -Web - Copyright Oracle Corporation Japan, All rights reserved.
Windows Oracle -Web - Copyright Oracle Corporation Japan, 2004. All rights reserved. Agenda Oracle Windows Windows Oracle 1 / Active Directory/Enterprise User Security 1-1 Windows 1-2 Kerberos 1-3 Enterprise
LAN
LAN 2003 6 4 LAN Hotel LAN LAN IEEE802.11a IEEE802.11b 802.11b 11Mbps Copyright (c) 2003 NPO Page 3 FREESPOT FREESPOT HOTSPOT NTT ( ) MZONE ( )NTT Mobile ( ) Yahoo! BB ( ) MapFanWeb http://www.mapfan.com/musen/
2
2 485 1300 1 6 17 18 3 18 18 3 17 () 6 1 2 3 4 1 18 11 27 10001200 705 2 18 12 27 10001230 705 3 19 2 5 10001140 302 5 () 6 280 2 7 ACCESS WEB 8 9 10 11 12 13 14 3 A B C D E 1 Data 13 12 Data 15 9 18 2
untitled
25 10 12 11 24 (1) 14 (2) 26 10 44 (3) (4) (5) 27 10 68 (6) (7) (8) 25 10 ( ) (1) (2) (3) ) city.yokohama.lg.jp city.yokohama.jp WEB WEB WEB WEB WEB WEB 1 25 10 WEB WEB (1) (2) (3) (4) 25 10 (1) WEB (2)
untitled
1...1 1.1... 1 1.2... 3 1.2.1 IP-VPN...4 1.2.2 VPN...6 1.2.3...9 1.3... 11 1.4... 12 1.4.1 PC... 12 1.4.2... 15 1.4.3... 16 1.4.4... 17 1.4.5... 18 2...19 2.1... 19 2.1.1... 20 2.1.2 IDS/IPS... 22 2.1.3...
BIG‑IP Access Policy Manager | F5 Datasheet
2 3 5 7 8 Secure Web Gateway 10 12 BIG-IP APM 13 F5 Global Services 13 13 BIG-IP Access Policy Manager (APM) LAN BIG-IP APM IT LAN 1 Web OAM XenApp Exchange Web Web Web Web Web web BIG-IP APM LAN IT /
ver.10 v6 v6 v6 v6 v6 Copyright 2007-2015 Copyright 1995-2015 Trend Micro Incorporated. All Rights Reserved. 2015 7 1 3 2 4 3 10 3.1 10 3.2 23 4 31 5 38 6 40 7 41 8 45 9 46 10 51 54 58 63 65 動作環境の確認 1.
YMS-VPN1_User_Manual
YAMAHA VPN YMS-VPN1 2007 12 YAMAHA VPN YMS-VPN1 YMS-VPN1 RT Windows PC IPsec VPN 2000-2002 SSH Communications Security Corp 2004-2007 SafeNet Inc. 2004-2007 dit Co., Ltd. 2006-2007 YAMAHA CORPORATION MicrosoftWindows
Kaspersky Anti-Virus 2010
1 Kaspersky Kaspersky Anti-Virus 2010... 1 1... 1 1... 1 4... 1 5 2... 2 1... 2 3... 2 3... 2 4... 2 13... 2 13 3... 3 1... 3 2... 3 2... 3 2... 3 4... 3 5... 3 5... 3 7... 3 7 4... 4 1... 4 1... 4 1...
sp c-final
NIST SP 800-63C - Federation and Assertions - Nov Matake Nov Matake OpenID Foundation Japan WG #idcon OAuth.jp YAuth.jp LLC 800-63-3 Federation Assurance Level (FAL) Federation Assurance Level Federation
Mac OS X Server QuickTime Streaming Server 5.0 の管理（バージョン 10.3 以降用）
Mac OS X Server QuickTime Streaming Server 5.0 Mac OS X Server 10.3 apple Apple Computer, Inc. 2003 Apple Computer, Inc. All rights reserved. QuickTime Streaming Server Apple Apple Computer, Inc. Apple
/07/ /10/12 I
Certificate Policy Version 1.10 2018 10 12 1.00 2018/07/24 1.10 2018/10/12 I 1.... 1 1.1... 1 1.2... 1 1.3 PKI... 2 1.3.1 CA... 2 1.3.2 RA... 2 1.3.3... 2 1.3.3.1... 2 1.3.3.2... 3 1.3.4... 3 1.3.5...
(O) (N) (V) (N) kuins-pptp (N) 2
2005 6 14 1 2 (LAN) LAN LAN (UTP ) ( ) Web http://www.ipse.media.kyoto-u.ac.jp/getaccount.html PPTP SSH 2 PPTP 2005 6 1 PPTP(Microsoft Point to Pont Tunneling Protocol) Web http://www.kuins.kyoto-u.ac.jp/announce/pptp-service.html
Cisco Configuration Professional（CCP）Express による Cisco 841M J シリーズ初期設定ガイド
Cisco Configuration Professional CCP Express 3.5.1 Cisco 841M J WAN/LAN Cisco Configuration Professional CCP Express 3.5.1 p3 CCP Express 3.5.1 p4 Cisco Configuration Professional ExpressCCP Express 3.5.1
untitled
CAVIN SR 2002 2002/10/12-14 2 http://www.npa npa.go..go.jp/police_j.htm 2002/10/12-14 3 2002/10/12-14 4 1 2 3 4 5 6 7 2002/10/12-14 5 2002/10/12-14 6 1 1 2 3 4 5 6 7 2002/10/12-14 7 2002/10/12-14 8 IT
untitled
IT IT IT IT 1 IT 2 Software as a Service (SaaS 3 ) IT SaaS 4 SaaS SaaS PC SaaS SaaS Web SaaS ID IT SaaS IT 1 2 3 Software as a Service ASP(Application Service Provider) SaaS 4 ASPIC SaaS SaaS SaaS SaaS
Macintosh HD:Users:ks91:Documents:lect:nm2002s:nm2002s03.dvi
3 [email protected] April 22, 2002 1 2 1. over IP ( : Voice over IP; IP Internet Protocol ) over IP??? : 2002/4/20 23:59 JST : http://www.soi.wide.ad.jp/report/ 3 32 11 (4/22 ) 4 () 3 2 1? 4 ...... A.C.
![宅建練馬表478号1_4ol [更新済み].eps](/thumbs/39/20197934.jpg "宅建練馬表478号1_4ol [更新済み].eps")
4 15 4.1..................................... 15 4.2....................................... 15 4.2.1................................... 15 4.2.2......
2011 1 26 1 3 2 3 2.1......................................... 3 2.2..................................... 3 2.3 QRedit................................. 4 2.3.1..................................... 5 2.3.2
HTTP2 HTTP2 http2fuzz ATS Firefox NodeJS
HTTP/2 Stuart Larsen John Villamil Yahoo! HTTP2 HTTP2 http2fuzz ATS Firefox NodeJS Stuart Larsen https://c0nrad.io John Villamil @day6reak HTTP/1.1 1999 HTML Java Script Web ISP Web SSL HTTP/2 HTTP/2 よこんにちは
橡ファミリー企業の分析020806
2002 8 6 1 700 OB 2000 700 ( 40 ) 82 5 613 2 700 5,000 2 1,000 700 3 87 4,542 2,533 (82 5 ) 700 OB 405 ( ) 2,500 ( ) (660 40 ) 4 82 5 700 82 5 613 5 30 30 30 30 6 (2001 ) ( ) 1,174 1,023 113 1,136 100
4 5 Y40 706050 70 14 29 C 8 A 2 M 5 E 11 W D 2 60 24 40 C 8 A 3 M 14 E 7 W 3 D 4 Y 50 34 99 C 16 A 15 M 17 E 17 W 12 D 12 Y 6 K 4 11 3 14 21 3 23 22 20 12 17 10 5 15 5 21 3 42 11 8 OB 62 42 104 261
Microsoft Windows, Windows CE, Microsoft Corporation Citrix ICA Citrix Presentation Server Citrix Systems, Inc IBM IBM Corporation
CE(Windows CE) Version 2.0.1 Microsoft Windows, Windows CE, Microsoft Corporation Citrix ICA Citrix Presentation Server Citrix Systems, Inc IBM IBM Corporation 2.0.1 2009 1 2009 2 APTi (CE ) APTi (CE )
07_経営論集2010 小松先生.indd
19 1 2009 105 123 Web Web Web Web World Wide Web WWW OS 1990 WWW Web HTML CSS JavaScript Web 1 WWW 2 Web Web 3 Web 4 HTML5 5 Web Web 3 1970 WWW HTML Web WWW WWW WWW WWW WWW 105 Web WWW 2 Web 1 1 NTT NTT
SAML
2003 6 2 XML Consortium SWG ( )NTT ( ) Copyright XML Consortium 2003/06/02 1 Copyright XML Consortium 2003/06/02 2 2002 2003 7 8 9 10 11 12 1 2 3 4 5 6 3/5 6/2 Copyright XML Consortium 2003/06/02 3 Copyright
Orion ネットワークコンフィグレーションマネージャ紹介
SolarWinds 2010/05/25 2015/06/18 2010/05/25 Orion NCM ver. 5.5 2010/08/06 Orion NCM ver. 6 2011/04/18 Orion NCM ver. 6.1 2011/07/20 2011/09/14 2012/01/24 Orion NCM ver.7 2016/06/18 SolarWinds SolarWinds.com
Web...1 1....2 1.1....2 1.2....3 1.3. STEPS...4 2. Web...5 2.1. Web...5 2.2....5 2.3. Form Cookie...6 2.4....7 2.5. HTTP...7 3. STEPS Web...8 3.1....8
2001/1/11 Web Simplified Techniques for Econometric Plannings & Simulations for WWW Fujiwara Takamichi 97-5075 N-23 Web...1 1....2 1.1....2 1.2....3 1.3. STEPS...4 2. Web...5 2.1. Web...5 2.2....5 2.3.
Lync Server 2010 Lync Server Topology Builder BIG-IP LTM Topology Builder IP Lync 2010 BIG IP BIG-IP VE Virtual Edition BIG-IP SSL/TLS BIG-IP Edge Web
1.1 Microsoft Lync Server 2010 BIG-IP LTM 2 4 5 BIG-IP : Lync 6 BIG-IP : Lync 7 BIG-IP : - 8 BIG-IP : - 9 A: BIG-IP Microsoft Lync Server 2010 Microsoft Lync Server 2010 Office Communications Server BIG-IP
/
/ 6 / 1 / セキュリティ対策ツールサポート情報 http://f-security.jp/ 1....6 2....8 3.... 14 4.... 18 5.... 20 6.... 22 7.... 25 8.... 27 9. Web... 29 10.... 40 11.... 42 12.... 45 13.... 48 14.... 52 15. OS... 56 16....
