Internet Week T31 itsuro@lac.co.jp http://www.lac.co.jp/security/ All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 POS POS Windows POS JSOC 2 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 1
3 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 4 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 2
http://www.johotsusintokei.soumu.go.jp/whitepaper/ja/h16/index.html 5 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 http://www.johotsusintokei.soumu.go.jp/whitepaper/ja/h16/index.html 6 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 3
http://www.johotsusintokei.soumu.go.jp/whitepaper/ja/h16/index.html 7 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 http://www.johotsusintokei.soumu.go.jp/whitepaper/ja/h16/index.html 8 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 4
(IT) IT) (ADSLCATV) 24 9 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 CERT/CC Statistics 1988-2003 http://www.cert.org/stats/cert_stats.html 10 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 5
16 1618 http://www.npa.go.jp/sousa/souni2/oreorejoukyou16-8.pdf 11 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 Informational Warning Critical Emergency Critical 12 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 6
: 2004 / 01 2004 / 09 CGIOpenProxy Spam JSOC 13 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 : 2004 / 01 2004 / 09 JSOC 14 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 7
JSOC Po rt Wo rm 445/tcp Gaobot, Sasser 135/tcp Blaster, Welchia 139/tcp Deloder 25/tcp Mydoom IRC Ga obot, Korgo 137/udp Bugbear 1434/udp Slammer 80/tcp Welcha 1025/tcp Keco 2745/tcp Beagle ICMP Welch ia 3127/tcp Welchia, Mydoom RPC 1024/tcp Randex 2500/tcp 3072/tcp 6129/tcp Mockbot 15 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 2004 / 04 2004 / 09 MS04-028 Microsoft GDI+ Malformed JPEG Buffer Overflow Vulnerability Web JSOC 16 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 8
/ 1/ 17 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 18 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 9
E 19 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 IT IT IT IT IT IT 20 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 10
IT IT Dream C I A IT 21 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 WEB WEB WEB CoderedNIMDA BlasterWelchia IDS IPS 22 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 11
A B C X A B C X 23 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 24 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 12
25 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 26 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 13
27 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 28 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 14
29 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 30 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 15
OS OS Flood ICMPUDP UDP SMTP 31 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 32 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 16
33 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 34 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 17
35 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 PSOC PSOC 36 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 18
ITIT PR 37 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 PSOC 38 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 19
IT IT 39 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 40 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 20
CISO PSOC 41 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 42 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 21
PSOC PSOC 43 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 44 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 22
Exploit 45 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 PSOC PSOC 46 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 23
47 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 48 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 24
IT 49 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 - - 50 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 25
51 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 52 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 26
53 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 54 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 27
PINGIP IPAP APDB PC PC AP Availability Availability 55 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 56 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 28
57 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 Active AttackRemote Exploit Passive AttackContents Exploit 58 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 29
59 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 RED Orange Yellow Green RED Orange Yellow Green / 60 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 30
RED Orange Yellow Green 61 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 DB DB 62 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 31
OS OS Flood ICMPUDP UDP SMTP 63 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 IDS IDS Drop 64 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 32
IDS IDS Accept Drop 65 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 ID/ ID/ PC PC 66 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 33
IDS Flood Smarf IDS Drop Drop 67 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 IDS IDS 68 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 34
DB 69 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 DMZ DMZ 70 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 35
IDS IDSP2P P2P IDSDB DB 71 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 IDS IDS DoS DoS IDSP2P P2P IDSDB DB 72 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 36
DoS DoS DoS DoS OS OS 73 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 IDS 74 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 37
75 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 76 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 38
C I A 77 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 FW FW FW FW FW FW FW FW FW 78 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 39
79 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 80 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 40
Drop Drop Drop 81 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 FW FW FW FW FW FW FW FW FW 82 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 41
83 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 Firewall P2P 84 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 42
IDS InboundDrop Destination Port 85 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 A. TCP or UDP B. Windows C. Windows P2P MTA 86 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 43
TCP Default Gateway Syn IDS IPIPSyn IPDrop IDS Accept 87 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 TCP TCP 88 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 44
Proxy Corered Firewall Firewall Firewall NAT IDS Nimda Slammer NAT IDS Proxy P2P P2P 89 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 A. Drop B. Drop IDS C.P2P Drop IDS IDS 90 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 45
91 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 RFCIDS RFC RFC RFC IDS SlammerCodered IDS 92 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 46
NIC Accept 93 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 P2P 94 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 47
IDS 95 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 IDS IDS RFC 96 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 48
IDS IDS IDS RFC IDS 97 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 IDS IDS EX. suxx 98 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 49
IDS IPS 99 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 IDS OS InHouse IDSFW IDSIDSIDS 100 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 50
IDS 101 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 102 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 51
103 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 104 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 52
105 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 106 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 53
107 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 Vertical VerticalIRT CSIRT CSIRTISP 108 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 54
109 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 110 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 55
IRT IRT Vertical VerticalHorizontal 111 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 112 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 56
113 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 ISP ISPCSIRT Yellow Yellow 114 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 57
115 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 116 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 58
Web Web 117 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 118 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 59
119 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 120 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 60
A B C D Box Red Orange Yellow Green Red Red Orange Orange 121 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 122 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 61
123 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 124 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 62
125 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 1 2 3 4 E- ISMS P 5 E- 126 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 63
1 2 3 4 5 127 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 1 GW 2 Firewall IPS or 3 4 Firewall Firewall LAN LANLANLAN IDS DB DB WindowsUpdate WindowsUpdate WindowsUpdate 5 Firewall IDS LAN LANLANLAN 128 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 64
129 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 130 All Rights Reserved, Copyright NISHIMOTO Itsuro, 2004 65