ã¡ãã£ã¢èšäº
GTAæ°äœãªãŒã¯ã«äœ¿ãããâå€èŠçŽ èªèšŒç²ãâæ»æãšã¯ã1æé以äžéç¥æ»ããåŸæ¥å¡ã®æ ¹è² ãçã
ããºãææ°ããŒã¯ 338
twitterã³ã¡ã³ã 175ä»¶äž 1ïœ100件
倧éã®éç¥ãåä¿¡ãç¶ãããŠãŒã¶ãŒã¯ããã®éã®å€ãã«å§åãããç²ãæãŠãäœãšãéç¥ãæ¢ããããšããå¿çãæªçšããŠãããšããããšã
ãªãã»ã©ãã
CY-SIRTãããå
šç€Ÿã«æ³šæåèµ·ãè¡ããŸããã
ãMFA FatigueïŒå€èŠçŽ èªèšŒç²ãïŒããšèšãããããããèµ·ããŠããæã¯ãID/Passwordãæ»æè
ã«æŒããŠãããšã¿ããããè³æ¥ãæäœã§ããã¹ã¯ãŒãã®å€æŽãè¡ãã¹ãã§ãããã
æ°ã«ãªãä»æ¥ã®ãã¥ãŒã¹
ã倩äºããä»äººã®é³æ¥œãæµãããã¹ããŒã«ãŒä»æ§ã«ãŠãŒã¶ãŒå°æ ã¢ã€ãªã¹ãªãŒã€ãããã¢ãªã³ã°å¶åŸ¡è¿œå ãæ€èšã
ã倩äºããä»äººã®é³æ¥œãæµãããã¹ããŒã«ãŒä»æ§ã«ãŠãŒã¶ãŒå°æ ã¢ã€ãªã¹ãªãŒã€ãããã¢ãªã³ã°å¶åŸ¡è¿œå ãæ€èšã
ããããã人ã®å¿çãäžæã䜿ã£ãŠããã
MFA Fatigueãå€èŠçŽ èªèšŒç²ããšèš³ããšã€ãã€ãæå³ãåããã«ããåé¡ããããªãããšãã£ãŠãã£ãšè¯ãæèš³ã¯æãã€ããªããã©ããããŒãã
ð
> æ æã«ãã°ã€ã³è©Šè¡ãç¹°ãè¿ãããšã§ç¢ºèªéç¥ãäœåºŠãå·æïŒãã€ããïŒã«åä¿¡ãããçžæãç²ãæãŠãããŠæ¿èªã«è¿œã蟌ãã
> æ æã«ãã°ã€ã³è©Šè¡ãç¹°ãè¿ãããšã§ç¢ºèªéç¥ãäœåºŠãå·æïŒãã€ããïŒã«åä¿¡ãããçžæãç²ãæãŠãããŠæ¿èªã«è¿œã蟌ãã
èŠãŠãïŒãåŸæ¥å¡ãå¯ãããšããŠããåå1æã«100åé»è©±ããããã°ã倧æµã¯åãå
¥ããããã®åŸæ¥å¡ãæ¿èªããã°ãMFAããŒã¿ã«ã«ã¢ã¯ã»ã¹ããŠãå¥ã®ç«¯æ«ãç»é²ã§ããã
ããã£ãŠAuthentificatorã¢ããªäœ¿ã£ãŠãã°å¯ŸåŠã§ãããã€ã㪠SMSèªèšŒã¯é§ç®ã£ãŠããšèãããšã€ããŒã®ãã¹ã¯ãŒãã¬ã¹èªèšŒãé§ç®ãªæ°ã
[ã¿ã¬]Uberãžã®äžæ£ã¢ã¯ã»ã¹ã¯ãMFA FatigueïŒå€èŠçŽ èªèšŒç²ãïŒãæ»æã ã£ã
å æ¥ãç±³Uber Technologiesãžã®äžæ£ã¢ã¯ã»ã¹è¢«å®³ãå ±ãããããããã®æ¹æ³ããMFA FatigueïŒå€èŠçŽ èªèšŒç²ãïŒãæ»æã ã£ãããšãå ±ããããŠãã
å æ¥ãç±³Uber Technologiesãžã®äžæ£ã¢ã¯ã»ã¹è¢«å®³ãå ±ãããããããã®æ¹æ³ããMFA FatigueïŒå€èŠçŽ èªèšŒç²ãïŒãæ»æã ã£ãããšãå ±ããããŠãã
æåŸã®ç Šã®ã¯ãã®äººãããã¯ãããŠãã®ããå€èŠçŽ èªèšŒã
ã§å¯Ÿçããã¹ã¯ãŒãæµåºæ°ãã€ããŸãããã¯ç¬ã£ãŠããŸããªãã
ã§å¯Ÿçããã¹ã¯ãŒãæµåºæ°ãã€ããŸãããã¯ç¬ã£ãŠããŸããªãã
ãã¯ãäžçªã®åŒ±ç¹ã¯äººéã»ã»ã»
-----âŠ
-----âŠ
ã¯ãã¿
ã )
ãªãã»ã©ãŒã確èªå¿ é ã ããã¿ã€ãã³ã°ãŠã£ã³ããŠãæããã«æ»ç¥éç¥ãå±±ã®ããã«éãã€ããããããšã§ãèªåãã¡ã®èšåãã代çæ»æãããã®ãâŠïŒã»Ïã»ïŒ
ãªãã»ã©ãŒã確èªå¿ é ã ããã¿ã€ãã³ã°ãŠã£ã³ããŠãæããã«æ»ç¥éç¥ãå±±ã®ããã«éãã€ããããããšã§ãèªåãã¡ã®èšåãã代çæ»æãããã®ãâŠïŒã»Ïã»ïŒ
ãªãŒã¯ãã人ã£ãŠã»ããŸã¯ãœããªã
ãã£ã±ãå€èŠçŽ èªèšŒãšããŠSMSã䜿ãã®ã¯çãæªããããããã10å以äžé£ç¶ã§èªèšŒã«å€±æããŠãããã¯ãããªãã·ã¹ãã ã¯èšèšãããããã
â
â
MFAãæªãã¿ãããªè©±ã«ãªããªãããããâŠâŠ
ïŒãããããã¹ã¯ãŒãçãããŠãæç¹ã§ãMFAããªããã°åæã§äŸµå ¥ãããŠãããã§ïŒ
ïŒãããããã¹ã¯ãŒãçãããŠãæç¹ã§ãMFAããªããã°åæã§äŸµå ¥ãããŠãããã§ïŒ
å
ã
ãã¹ã¯ãŒããæŒæŽ©ããããšãåå ã ãã©ããã¹ã¯ãŒããå€æŽãããã«ãå€èŠçŽ èªèšŒãå¿
èŠãšãã話ã --
å€èŠçŽ èªèšŒç²ãã£ãŠåããŠèãããã©æ°ãã€ããªããšãªãâŠ
MFAããã䜿ã£ãŠçªç Žããã®ããå«ãªãšãããçªããŠããã䟵ç¥è
ã¯ã¢ã€ãã¢ãã³ã ãªïŒè€ããŠãªãïŒãæ»æææ³ãç¥ãããšãé²è¡ã®äžæ©ãšæããã©ããã€ã§ãããã
MFA Fatigueã®æå£ã§ã¯ãããéæã«åããæ
æã«ãã°ã€ã³è©Šè¡ãç¹°ãè¿ãããšã§ç¢ºèªéç¥ãäœåºŠãå·æïŒãã€ããïŒã«åä¿¡ãããçžæãç²ãæãŠãããŠæ¿èªã«è¿œã蟌ãã
1çªè匱ãªã®ã¯äººéãšããããšã§ãã
> æ
æã«ãã°ã€ã³è©Šè¡ãç¹°ãè¿ãããšã§ç¢ºèªéç¥ãäœåºŠãå·æïŒãã€ããïŒã«åä¿¡ãããçžæãç²ãæãŠãããŠæ¿èªã«è¿œã蟌ãã
çµå±äººéãè匱
次ãã次ã«æãéãèãããã®ã ããã¹ã¯ãŒããæãããåæã«ã¯ãªããïŒæ°å2FAã«å€±æãããããã¯ããæéãææ°é¢æ°çã«å»¶ã°ããŠïŒå³æå¿çããªãããããããããã察çãæãæµ®ãã°ãªããªã
>ãåŸæ¥å¡ãå¯ãããšããŠããåå1æã«100åé»è©±ããããã°ã倧æµã¯åãå
¥ããããã®åŸæ¥å¡ãæ¿èªããã°ãMFAããŒã¿ã«ã«ã¢ã¯ã»ã¹ããŠãå¥ã®ç«¯æ«ãç»é²ã§ããã
ãã....ðš
å€èŠçŽ èªèšŒç²åŽæ»æâŠâŠå€èŠçŽ èªèšŒãèšå®ããŠããã¢ã«ãŠã³ãã«å¯ŸããŠãæ¿èªèŠæ±ã®ããã·ã¥éç¥ãéããŸããæ»æã
ãã¹ã¯ãŒãã¬ã¹èªèšŒãæ®åããå Žåã䜿ãããããªæ»æ
ãã¹ã¯ãŒãã¬ã¹èªèšŒãæ®åããå Žåã䜿ãããããªæ»æ
é ããããªãããã¯ãæ»æè
ã®æ¹ãèããŠããããå¯ãããšããŠããåå1æã«100åé»è©±ããããã°ã倧æµã¯åãå
¥ããã ã
âæ
æã«ãã°ã€ã³è©Šè¡ãç¹°ãè¿ãããšã§ç¢ºèªéç¥ãäœåºŠãå·æã«åä¿¡ãããçžæãç²ãæãŠãããŠæ¿èªã«è¿œã蟌ãâ
å€èŠçŽ èªèšŒã¯å®ç§ãªããã«èŠããŸããã人ã®å¿çãã€ããæ»æææ³ãããããã§ãã
é£ç¶ããèªèšŒèŠæ±ã®ãããã¯ãšããæ°ããªå¯ŸçãMFAã«ã¯å¿
èŠãªããã ãã
éç¥èªäœããªãã«ããŠãã®éã«ãã¹ã¯ãŒãå€ãããã¢ã«ãŠã³ããå€ãããªã©ããã°ããã£ãã®ã§ã¯
ããšã¯ã·ã¹ãã åŽã®DOS察çã«ãªããã
ããšã¯ã·ã¹ãã åŽã®DOS察çã«ãªããã
ããããªã
ãã®èšäºãããããããŸãã "
ããã¯çãããããªãâŠ
GTAã®æ°äœã®ç»åããœãŒã¹ã³ãŒãããªãŒã¯ããäºä»¶ã§äœ¿ãããã®ã¯ãå€èŠçŽ èªèšŒç²ããæ»æãšã®ããšã
è¿å¹Žã»ãã¥ãªãã£èªèšŒã¯é«åºŠã«ãªã£ãŠãããè€æ°ç«¯æ«ã§ã®èªèšŒãæãããããããæ·±å€ã«å€§éã«éããé¯ä¹±ãããç¶æ ã§æ¿èªããããšãã人éå¿çã«ã€ãããã æ»æã ãšããæã
è¿å¹Žã»ãã¥ãªãã£èªèšŒã¯é«åºŠã«ãªã£ãŠãããè€æ°ç«¯æ«ã§ã®èªèšŒãæãããããããæ·±å€ã«å€§éã«éããé¯ä¹±ãããç¶æ ã§æ¿èªããããšãã人éå¿çã«ã€ãããã æ»æã ãšããæã
å©çšè
åŽã§ãã¹ã¯ãŒãåèšå®ãå¯èœãªããããã§éç¥ã¯ãããŸãããã
å€èŠçŽ èªèšŒã解é€ããã®ã ãã¯ã絶察ã«é¿ããŸãããã解é€ãããšãã®ãŸãŸæ»æè ã«ãã°ã€ã³ãããŠããŸããŸãâŠ
å€èŠçŽ èªèšŒã解é€ããã®ã ãã¯ã絶察ã«é¿ããŸãããã解é€ãããšãã®ãŸãŸæ»æè ã«ãã°ã€ã³ãããŠããŸããŸãâŠ
ããåŸæ¥å¡ãå¯ãããšããŠããåå1æã«100åé»è©±ããããã°ã倧æµã¯åãå
¥ããããã®åŸæ¥å¡ãæ¿èªããã°ãMFAããŒã¿ã«ã«ã¢ã¯ã»ã¹ããŠãå¥ã®ç«¯æ«ãç»é²ã§ãããã
ãæ
æã«ãã°ã€ã³è©Šè¡ãç¹°ãè¿ãããšã§ç¢ºèªéç¥ãäœåºŠãå·æïŒãã€ããïŒã«åä¿¡ãããçžæãç²ãæãŠãããŠæ¿èªã«è¿œã蟌ãã
çµå±ã¯äººéã®è匱æ§
æéåœããã®éç¥åæ°ã®å¶çŽããéç¥ããã¿ã€ãã®å€èŠçŽ èªèšŒèªäœã®èŠçŽããå¿
èŠãããªã®ããªãTOTPãšãæ¿èªè
äž»å°ã®ããæ¹ã«ãã¹ããšããã®ã
éç¥ããŠèº«ã«èŠãããªããã¹ã¯ãŒãå€æŽããããšããŠãéç¥ãåãããŠãã¹ã¯ãŒãå€æŽããã§ããªããšãããã¯ãŒãã¬ã€ããããå®éããããããµããŒãã«é£çµ¡ãããããªãã®ããªïŒ
æã
ãå€é
ããŸã§èµ·ããŠããã®ã¯ããã®æã®æ»æðãèŠæããŠã®ããšã ã£ãŠã»ãã¥ãªãã£ãŒã®ãããèšã£ãŠãŸããã
âåŸæ¥å¡ãå¯ãããšããŠããåå1æã«100åé»è©±ããããã°ã倧æµã¯åãå ¥ããâ
âåŸæ¥å¡ãå¯ãããšããŠããåå1æã«100åé»è©±ããããã°ã倧æµã¯åãå ¥ããâ
ïŒæ¬¡ã«æ»æè
ã¯Uberã®ITæ
åœè
ãè£
ã£ãŠãã®åŸæ¥å¡ã«é£çµ¡ãåããéç¥ãæ¢ããããã°æ¿èªããããæ瀺ããïŒ
ãã£ã¡ãçãããæ··ä¹±ããŠãããšããã«ããããåŸã£ãŠããŸãã ãããªã
ãã£ã¡ãçãããæ··ä¹±ããŠãããšããã«ããããåŸã£ãŠããŸãã ãããªã
ãåŸæ¥å¡ãå¯ãããšããŠããåå1æã«100åé»è©±ããããã°ã倧æµã¯åãå
¥ããããã®åŸæ¥å¡ãæ¿èªããã°ãMFAããŒã¿ã«ã«ã¢ã¯ã»ã¹ããŠãå¥ã®ç«¯æ«ãç»é²ã§ããã
ãæ
æã«ãã°ã€ã³è©Šè¡ãç¹°ãè¿ãããšã§ç¢ºèªéç¥ãäœåºŠãå·æïŒãã€ããïŒã«åä¿¡ãããçžæãç²ãæãŠãããŠæ¿èªã«è¿œã蟌ããã
ããã...ã
"
ããã...ã
"
SMSã§éãããŠããæ¿èªURLãã¯ãªãã¯ããã¿ã€ãã®MFAã§ãã²ãããMFAãè©ŠããŠSMSãéã£ãæå¥ã«IT管çè
ãè£
ã£ãŠæ¿èªããã°æ¢ãŸãããšäŒããŠãšã©ããåºããããã
âããã足æããã«Uberã®VPNã«ã¢ã¯ã»ã¹ã確ç«ããèªåã®ç«¯æ«ãç»é²ããããã¯ãŒã¯å
éšã«äŸµå®³ãåºããŠãããå¥ã®åŒ±ç¹ãèŠã€ããŠç®¡çè
æš©éãä¹ã£åã£ããâãããããããäžæ
åœè
ã®ã¢ã«ãŠã³ããããããªããšã§ããã
MFA FatigueïŒå€èŠçŽ èªèšŒç²ãïŒæ»æâ
詳现
æ³å以äžã®é »åºŠã§ãããããã¹ã¿ããããããããµããŒãè£ ã£ãŠèªå°ããããŸããâŠ
æ³å以äžã®é »åºŠã§ãããããã¹ã¿ããããããããµããŒãè£ ã£ãŠèªå°ããããŸããâŠ
ãç²ããã£ãŠãµãŒãè² è·ãšããããªããŠäººéã«å¯ŸããŠãã
ãããªåæŒãã¿ãããªâŠâŠãšè¡æãåãã
察çã®ããã®ãã¹ã¯ãŒãå€æŽã®éç¥ãåããããšããã®ã¯èªåã§ãããããããã管çè
ã«é£çµ¡ããã°å€§æµã®ããŒã«ã¯ãã¹ã¯ãŒããªã»ãããªãã¢ã«ãŠã³ãäŒæ¢ãªãã§ãããéåæãæãããããçžè«ããã®ãè¯ãã
ã€ããïŒæ®µéèªèšŒã®çªå·çºè¡éç¥ãïŒåãšãïŒå以äžäœ¿ãããªãã£ãå Žåãããã¯ãããæ¹ãããããªã
ãããã³ã°ãããã¯ã©ãã¯ã³ã°ãšããã®ã¯äººéèŠçŽ ã«ãããã®ãªãã ãšããã®ãå°ã§è¡ããããªããæ¹ã ãªã
ãªãã»ã©ããããææ³ã
ID/PWã®èªèšŒãçªç ŽãããŠãŠé£ç¶æ»æåããæç¹ã§PWå€æŽãã¹ããPWå€æŽã®ããã®èªèšŒãåºå¥ã€ããªãâåºå¥ã€ãããã ãã©ããã
ãªãã»ã©ãããããæãããã®ãã èªåããITæ
åœè
ã«é£çµ¡ããŠãã¹ã¯ãŒããªã»ããããŠãããã®ãããããªã
ãããAuthyãšãã®ã³ãŒãåã®èªèšŒã¯å€§äžå€«ã ãšæããã ãã©ãã€ã³ã¹ã¿ã®ãªã»ããã®ãªã³ã¯ãšãã¯å±ãªããã ããªã
[ã¿ã¬]GTAæ°äœãªãŒã¯ã§çšãããããå€èŠçŽ èªèšŒç²ããæ»æ
æ»æè
ã¯Uberã®ITæ
åœè
ãè£
ã£ãŠãã®åŸæ¥å¡ã«é£çµ¡ãåããéç¥ãæ¢ããããã°æ¿èªããããæ瀺
ã©ããã®ã»ãã¥ãªãã£ã³ã³ãµã«ãå€èŠçŽ å¿
é ãšãèšã£ãŠãŸããããäžå
šã®ã»ãã¥ãªãã£å¯ŸçãããŠããæåŸã¯äººãå€æããããšã«ã¯å€ããããªããšãããè匱æ§ã§ããã
å€èŠçŽ èªèšŒç²ããã©ããªæè¡ã§ãçªç Žã§ãããšåãåããããéãèŠæ¹ã ãšMFAã¯æè¡ã ãã§ã¯çªç Žåºæ¥ãªããšããããšã§ããã
ãMFA Fatigueã¯ãæ»æåŽãã人éãã®åŒ±ããçªããŠããã®å¯Ÿçããããããæå£ãèŠã€ãåºããŠããçŸç¶ãç©èªããã
ããã·ã¥éç¥ã10åãšãé£ç¶ã§æ¥ãæç¹ã§ã·ã¹ãã åŽã§ã¢ã«ãŠã³ãããã¯ããŠå©çšè
ã«ã¡ãŒã«ãšãã§ããªãããããª
ç©çããŒãªãåé¡ãªãã®ã«ãã
é »ç¹ã«ãã°ã€ã³ç¢ºèªãããµãŒãã¹ã¯ãã®æ»æãã¿ãŠæ¹ããŠã»ãããYahooãšãã
ããã¯ã€ãã
æ°æã®ãœãŒã·ã£ã«ãããã³ã°ã ããªãããã€ã®æ代ã人éã1çªè匱
äžçªã®è匱æ§ã¯äººéãªãã ãªâŠãšçæããã
ãããã
ãã¹ã¯ãŒãèªèšŒå€±æ 5 å㧠1 æéããã¯ããã¿ãããªå®è£
ããå€èŠçŽ èªèšŒç¡èŠ 5 åã§ãå®è£
ããã°è¯ãã ãã§ã¯ïŒ
éçŸå®çãªããšãèšããšãã¹ããã®é»æºãåãã°éç¥ãé»è©±ãæ¥ãªããªããã
å
æ¥é
ä¿¡ããGTAã«é¢ä¿ãããã¥ãŒã¹èšäºãå€èŠçŽ èªèšŒç²ãã«ã€ããŠã觊ããããŠããŸããããã¹ã¯ãŒãæµåºæã®å¯Ÿçã培åºãããªã©ã泚ç®ãããŠããŸããð€
ðœé ä¿¡ðœ
ðœé ä¿¡ðœ
ãããšã°ãããªïœ
ïŒæ»æè
ã¯ããã·ã¥éç¥ã倧éã«éãâå€èŠçŽ èªèšŒç²ãâãæå£ã«å©çšããŠããã
ãããªãããããâŠ
ãããªãããããâŠ
SMS/é»è©±èªèšŒã¯æããå®å
šãšã¯èšãåããªãããšãææãããŠãããšæãããã¬ãŒããªããããããããMFAãSMSã§ã¯ãªãAuthenticatorãã¹ããŒãã«ãŒãã§è¡ãããã«ããããæ¹æ³ããªãããã
MFAãäžèœã§ã¯ãªãã®ãã
MFAã¯ä»®æ³MFAããã€ã¹ã«éããª
ç¥ãããã©
ç¥ãããã©
"å€èŠçŽ èªèšŒç²ã"æ»æãªããŠããã®ããŒ
(Ï)ïŸ
ã»ãã¥ãªãã£ããŒã«ã¯ãã€ã ã£ãŠäººé
å€èŠçŽ èªèšŒç²ãããŒ
ä»äœ¿ã£ãŠãããã蚌åžäŒç€Ÿãåºéããéã« Authenticator ã®ãã³ããŒãèŠæ±ããããŸã§ã¯ãããã ãã©ãã®åŸèªèšŒã¡ãŒã«éã£ãŠããŠãããã¯ãªãã¯ããªããšãã¡ã£ãŠãªã£ãŠãŠãã«ãã®æãåºãã
ä»äœ¿ã£ãŠãããã蚌åžäŒç€Ÿãåºéããéã« Authenticator ã®ãã³ããŒãèŠæ±ããããŸã§ã¯ãããã ãã©ãã®åŸèªèšŒã¡ãŒã«éã£ãŠããŠãããã¯ãªãã¯ããªããšãã¡ã£ãŠãªã£ãŠãŠãã«ãã®æãåºãã
粟ç¥æ»æw
ãã°ã€ã³åæ°å¶éãããããšãã
è²ã
èããããã ãªã
æã£ãŠãããã¢ããã°ã§ç¬ã
èå³æ·±ãèšäºãã©ããªã«å
ç¢æ§ãé«ããŠãçµå±ã¯å¯Ÿäººéããããã§ãçªç Žã§ããããã¯ãå€èŠçŽ èªèšŒã®ïŒèŠçŽ ã¯æ©èœããŠããªããæçŽãéèèªèšŒïŒWhat you areïŒã§ãªããšå±ãªãã
ãŸãããã ããª
管çãææ°ãªãŸãŸã ã£ãæMSã¢ã«ãŠã³ãã§ããããããããšãããã30ç§ã«1床Authenticaterã«éç¥ãæ¥ãŠå°çã ã£ããããããªãã®ãµãŒãã¹ã®èªèšŒãåããã察å¿ãéããã
SMSã ãšããŒã£ãšãããããã£ãã ããæããããªãã
é°é¬±ã
1æé以äžããã·ã¥éç¥ãåºç¶ããã®ã¯èŠçð±
æåŸã®ç Šã¯äººéã§ã
âŠ
æåŸã®ç Šã¯äººéã§ã
âŠ
æé«ã«å«ãããæ»æã ãª
ããã人éã®æ ¹è² ãã£ãŠãã¢ããã°ãªæ»æã ãªããã
[B!] ãã²ãã
å¿çãããŸãçªããŠãææ³
æ£é¢çªç ŽããŠããçºæ³ã¯é¢çœã
å㞠次ãž