Satori 系ボットネット観察 Attack from Japan

2018年9月15日 IoTSecJP東京 Version4.0
@morihi_soc #IoTSecJP
https://iotsecjp.connpass.com/event/98193/

Transcript

1. 2018೥9݄15೔ IoTSecJP౦ژ Version4.0ൃදࢿྉ Satori ܥϘοτωοτ؍࡯ Attack from Japan @morihi_soc
2. Satori ܥϘοτωοτ؍࡯ Attack from Japan 
   XIPBNJ w ৿ٱ
   ࿨ত !NPSJIJ@TPD
   
   w ຊۀ͸ωοτϫʔΫηΩϡϦςΟΤϯδχΞɾΞφϦετ
   w झຯͰϋχʔϙοτͷӡ༻Λ͢Δϋχʔϙολʔ
   w ϒϩάˠ
   IUUQTXXXNPSJIJTPDOFU
   w ϋχʔϙολʔٕज़ަྲྀձ
   ओ࠵ऀ
   w IUUQTIBOJQPUFDIDPOOQBTTDPN 2 ࠓ·Ͱʹ͓ੈ࿩ʹͳͬͨΠϕϯτ(Ұ෦) ɾ*5,FZT ݱ4FD$BQ
   ɾωοτϫʔΫύέοτΛಡΉձ Ծ
   ɾ/*4$
   αΠόʔϋϩ΢Οϯ
   ɾ*OUFSOFU8FFL
   
   
   
   
   
   
   ɾ)BSEFOJOH
   ɾTTNKQ
   
   
   
   ɾ"*4FD
   
   
   ɾ4UVEZ$PEF
   ɾULUL
   ηΩϡϦςΟษڧձ
   ɾ૯ؔ੢αΠόʔηΩϡϦςΟ-5େձ
   ɾ08"41
   /BHPZB ग़൛ͨ͠ຊ΍ٕज़ಉਓࢽ NEW 2018೥8݄ˣ
3. Satori ܥϘοτωοτ؍࡯ Attack from Japan ࠓ೔ɺ఻͍͑ͨ͜ͱ w ษڧձ͕ऴΘͬͯؼ୐ͨ͠Βɺࣗ୐ͷϧʔλͷ ༷ࢠΛݟ͍ͯ͋͛ͯͩ͘͞ɻ
   w ϩάΠϯͰ͖Δ͔Ͳ͏͔
   w ਎ʹ͕֮͑ͳ͍ઃఆ͕͞Ε͍ͯͳ͍͔Ͳ͏͔
   w ͦͷଞɺؾʹͳΔ͜ͱ͕ͳ͍͔ 3
4. Satori ܥϘοτωοτ؍࡯ Attack from Japan ϋχʔϙοτ w ϋχʔϙοτ )POFZQPU ͱ͸ɺ͋͑ͯ߈ܸΛड͚Δ ͜ͱΛલఏͱͨ͠γεςϜͰ͢ɻ
   w ϋχʔϙοτΛӡ༻͢Δਓͷ͜ͱˠϋχʔϙολʔ
   w 8FC
   ʹಛԽͨ͠ϋχʔϙοτͷϩά͔Β
 4BUPSJ
   ϘοτωοτΛ؍࡯ͯ͠Έͨɻ
   w ˠ͓ߦّ͕ѱ͍ͷͰɺϩάΛऩू͠΍͍͢ɻ
   w σʔλιʔε͸ࣗ෼͕؅ཧ͍ͯ͠Δϋχʔϙοτͷ ΋ͷΛ࢖͍ͬͯ·͢ɻ 4
5. Satori ܥϘοτωοτ؍࡯ Attack from Japan ߈ܸ௨৴αϯϓϧ w %-JOL
   ࣾͷ
   %4-#
   ͷϧʔλΛૂͬͨ߈ܸɻ
   w 04
   ίϚϯυΠϯδΣΫγϣϯͰϑΝΠϧͷμ΢ϯ ϩʔυ͓Αͼ࣮ߦΛࢼΈ͍ͯΔɻ
   w )PTU
   ϔομ͸ɺॳظ͸ϧʔϓόοΫ
   *1
   ͕ࢦఆɻ
   w 6TFS"HFOU
   ϔομ͸ɺͨ·ʹมΘΔɻ 5
6. Satori ܥϘοτωοτ؍࡯ Attack from Japan 6TFS"HFOU
   ͍Ζ͍Ζ w Ϙοτωοτͷछྨ΍࣌ظʹΑΓগͣͭ͠ҟͳΔɻ
   w )BLBJ
   ʹࢸͬͯ͸ɺ04
   ίϚϯυ΋ؚΊ͍ͯΔɻ
   w 3POJO
   ΍
   4IJOLB
   ͳͲɺ೔ຊޠಡΈͰ͖Δ΋ͷ༗ɻ 6
7. Satori ܥϘοτωοτ؍࡯ Attack from Japan ߈ܸݕ஌ঢ়گ 7 ूܭظؒ:2018೥6݄15೔-8݄31೔
8. Satori ܥϘοτωοτ؍࡯ Attack from Japan ߈ܸݩ
   *1
   ΞυϨεͷࠃͰूܭ 8 IP ΞυϨεͷҐஔ৘ใ͸ɺMaxMind ͕࡞੒ͨ͠ GeoLite2 ͷσʔλ(http://www.maxmind.com)Λ࢖༻͠·ͨ͠ɻ ૹ৴ݩͷࠃ ݸ਺ ΤδϓτɾΞϥϒڞ࿨ࠃ   ϕτφϜ  ϩγΞ  ΠλϦΞڞ࿨ࠃ  ϒϥδϧ࿈๜ڞ࿨ࠃ  ೔ຊ  தࠃ  େؖຽࠃ  ΤΫΞυϧڞ࿨ࠃ  ϑϥϯεڞ࿨ࠃ 
9. Satori ܥϘοτωοτ؍࡯ Attack from Japan "UUBDL
   GSPN
   +BQBO w΋͔ͨ͠͠Βɺ͋ͳͨͷ਎ۙʹϘοτ
 ωοτͷҰ෦͕͍Δ͔΋͠Ε·ͤΜɻ
   w೔ຊͷૹ৴ݩΛूܭͯ͠Έͨɻ 9
10. Satori ܥϘοτωοτ؍࡯ Attack from Japan ೔ຊ͔Βͷ߈ܸݩ
    *1
    ΞυϨεͷ౎ಓ෎ݝͰूܭ 10 IP ΞυϨεͷҐஔ৘ใ͸ɺMaxMind ͕࡞੒ͨ͠ GeoLite2 ͷσʔλ(http://www.maxmind.com)Λ࢖༻͠·ͨ͠ɻ ૹ৴ݩͷ౎ಓ෎ݝ ݸ਺ ౦ژ౎  ਆಸ઒ݝ  େࡕ෎  ฌݿݝ  Ѫ஌ݝ  ෱Ԭݝ  ઍ༿ݝ  ࡛ۄݝ  ੩Ԭݝ  ෱ౡݝ  ࣛࣇౡݝ 
11. Satori ܥϘοτωοτ؍࡯ Attack from Japan ૹ৴ݩͷਖ਼ମ͸ w ϗετ໊ΛٯҾ͖͢ΔͱɺҰൠͷ͝ՈఉΈ͍ͨɻ 11 ձ৔ͷΈެ։
12. Satori ܥϘοτωοτ؍࡯ Attack from Japan ·ͱΊ w ϋχʔϙοτͰ
    4BUPSJ
    Ϙοτωοτ͔Βͷ߈ܸ͸
 ଟ਺ݕ஌Λ͍ͯ͠Δɻ
    w ੈքతʹ͸Τδϓτ͔Βͷ߈ܸ͕ଟ͍܏޲ʹ͋Δɻ
    w ೔ຊͷ
    *1
    ΞυϨε Ұൠͷ͝Ոఉ ͔Β΋߈ܸ͕
 গͳ͔Βͣདྷ͍ͯΔɻ
    w ೦ͷҝɺࣗ୐ͷϧʔλͷ༷ࢠΛݟͯΈ͍ͯͩ͘͞ɻ
 ˞ඞͣ͠΋ϧʔλ͕Ϛϧ΢ΣΞײછ͍ͯ͠Δ΋ͷͰ͸ͳ͍
    w *P5
    ػثΛΠϯλʔωοτʹ઀ଓ͢Δͱ͖͸
 े෼͝஫ҙ͍ͩ͘͞ɻ 12
13. Satori ܥϘοτωοτ؍࡯ Attack from Japan )BQQZ
    )POFZQPU 13 ←2018೥6݄9೔ ৽॓ޚԓ େԹࣨͰࡱӨ ৯஬২෺Ͱ͸ͳ͍ɻ ͓͠·͍