-----BEGIN PGP SIGNED MESSAGE----- ====================================================================== JPCERT-PR-2006-0002 JPCERT/CC JPCERT/CC $B3hF035MW(B [ 2006$BG/(B1$B7n(B1$BF|(B $B!A(B 2006$BG/(B3$B7n(B31$BF|(B ] $BH/9TF|(B: 2006$BG/(B04$B7n(B21$BF|(B ====================================================================== $B!x(B1. $B%$%s%7%G%s%HJs9p(B http://www.jpcert.or.jp/ir/ $B>pJs%7%9%F%`$K$*$1$k%$%s%7%G%s%H$H$O!"@5Ev$J8"8B$r$b$?$J$$?M$,%3%s(B $B%T%e!<%?$rit@5$kmxmq$9$k$h$&$j%3%s%t%e!<%?$n%;%-%e%j%f%#$k4x$o$k;v7o!"(b $B=PMh;v$NA4HL$r;X$7$^$9!#$3$N$h$&$J%$%s%7%G%s%H$,H/@8$7$?>l9g!"$=$NHo32(B $B$N3HBg$r:G>.8B$K$9$k$?$a$N9TF0$r!"2f!9$O%$%s%7%G%s%HBP1~(B ($B%l%9%]%s%9(B) $B$H8F$s$G$$$^$9!#(B JPCERT/CC $B$G$O!"9-$/3'MM$K%$%s%7%G%s%H$K4X$9$k>pJsDs6!$N$46(NO$r$*4j$$(B $B$7$F!"%$%s%7%G%s%HBP1~$N%5!<%s%9$r9t$c$f$*$j$^$9!#(b JPCERT/CC $B$,(B 2006$BG/(B1$B7n(B1$BF|$+$i(B2006$BG/(B3$B7n(B31$BF|$^$G$N4V$K$C$F!"(B $Be$N4|4V$KEO$k%"%/%;%9$NMWLs%l%]!<%h$b4^$^$l$k$?$a!"%"%/%;(b $B%9$N2s?t$HJs9p7o?t$b0lHL$KBP1~$7$^$;$s!#$^$?!"Js9p85$K$O!"9qFb30(B $B$N%5%$%H$,4^$^$l$^$9!#(B I. $B%$%s%7%G%s%HJs9p$NAw?.85$K$h$kJ,N`(B JPCERT/CC $B$,IT?3$J%"%/%;%9(B (scan) JPCERT/CC $B$G$O!"KI8f$K@.8y$7$?%"%?%C%/$d!"%3%s%T%e!<%?(b/$b%5!<%s%9(b/$b$NIT?3$J%"%/%;%9Ey!"%7%9%F%`$N%"%/%;%9(B $B8"$K$*$$$F1F6A$,@8$8$J$$!"$^$?$O!"L5;k$G$-$k%"%/%;%9$K$D$$$F(B 501$B7o$NJs(B $B9p$re$NH$/$@$5$$!#(B 22 (ssh) 145$B7o(B (*1) 1023 41$B7o(B (*1) 9898 (monkeycom) 40$B7o(B 5554 (sgi-esphttp) 39$B7o(B (*1) 80 (http) 16$B7o(B (*1) 445 (microsoft-ds) 11$B7o(B (*1) 15118 9$B7o(B 3410 (networklenss) 7$B7o(B 1026 (cap) 6$B7o(B 21 (ftp) 5$B7o(B 6346 (gnutella-svc) 4$B7o(B 443 (https) 4$B7o(B (*1) 41523 4$B7o(B 1027 4$B7o(B $BAm9gE*$J%W%m!<%v!"%9%-%c%s(b 177$B7o(B (*2) (*1) $B%o!<%`$k$h$k46@w$n;n$_$d%o!<%`$j$i$k$h$c$f@_cv$5$l$?%p%c%/%i%"(b $B$+$i$N?/F~$N;n$_$H;W$o$l$k%"%/%;%9$,Js9p$5$l$F$$$^$9!#;29MJ88%(B [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] $B$r$4;2>H$/$@$5$$!#(B $B$^$?!"0J2<$n(b URL $B$b$4;2>H$/$@$5$$!#(B TCP 1025$BHV%]!<%h$x$n%9%-%c%s$na}2c$k4x$9$kcm0u4-5/(b http://www.jpcert.or.jp/at/2005/at050012.txt Microsoft $B@=IJ$N@HpJs$r$^$H$a$F$4Js9p(B $B$$$?$@$$$?$b$N$G$9!#(B (2) $BAw?.%X%C%@$r:>>N$7$?EE;R%a!<%k$ng[aw(b (forged) JPCERT/CC $B$G$O!":9=P?M%"%I%l%9$J$I$NAw?.%X%C%@$r:>>N$7$?EE;R%a!<%k$n(b $BG[Aw$K$D$$$F(B 125$B7o$NJs9p$r>N$7$F!"%a!<%k$ncf7q$k$o4xm?$7$f$$$j$$bh;0(b $B$N%5%$%H$X$N%a!<%kg[aw$,9t$j$o$l$f$$$^$9!#$3$n7k2l!"b?nl$n%(%i!<%a!<%k(b $B$,:n@.$5$l!"7W;;5!;q8;$d%M%C%H%o!<%/nn0h$,>CHq$5$l$k2DG=@-$,$"$j$^$9!#(B $B$^$?!":9=P?M%"%I%l%9$r:>>N$5$l$?>l9g!"$3$l$i$N%a!<%k$nh/?.85$g$"$k$h(b $B$$$&5?$$$r$b$?$l$k2DG=@-$,$"$j$^$9!#Aw?.%X%C%@$r:>>N$7$?EE;R%a!<%k$ng[(b $BAw$K$D$$$F$O;29MJ88%(B [20] [22] [29] $B$r$4;2>H$/$@$5$$!#(B (3) $B%7%9%F%`$X$N?/F~(B (intrusion) JPCERT/CC $B$G$O!"4IM}l9g$r4^$`%7%9%F%`$X$N?/(B $BF~$K$D$$$F(B 6$B7o$NJs9p$rl9g$NBP1~$K$D$$$F$O!"0J2<$n(b URL $B$G8x3+$7$F$$$kJ8=q!V%3(B $B%s%T%e!<%?%;%-%e%j%f%#%$%s%7%g%s%h$x$nbp1~!w$n(b V. $B$*$h$S(B VI. $B$r;2>H$7(B $B$F$/$@$5$$!#(B $B%3%s%T%e!<%?%;%-%e%j%f%#%$%s%7%g%s%h$x$nbp1~(b http://www.jpcert.or.jp/ed/2002/ed020002.txt $B:#2sR2p$7$^$9!#(B - $BEv3:%5%$%H$r7PM3$7$?B>%5%$%H$X$N%"%/%;%9(B ($B%o!<%`$r4^$`(b) - $B%7%9%F%`$N2~$6$s(B ($B%U%!%$%k$NCV$-49$(!"%m%0$N>C5n!"(BWeb $B%Z!<%8$n2~(b $B$6$s$J$I(B) (4) Web $B56Au:>5=(B (phishing) JPCERT/CC $B$G$O!"6d9T$J$I$N%5%$%H$G$"$k$H:>>N$7$F!"(BWeb $B$N%U%)!<%`$j$i(b $B$+$iF~NO$5$l$?8}:BHV9f$d%-%c%C%7%e%+!<%i$n0e>ZHV9f$H$$$C$?8D?M>pJs$rEp(B $B$_5=$K$D$$$F(B 84$B7o$NJs9p$r5=$KMQ$$$k(B web $B%5%$%H$N9=C[$rL\E*$H$7$?9T0Y$K$O!"%7%9%F%`(B $B$X?/F~$9$k!"%I%a%$%s$r>h$C5=(B (phishing) $B$NF'$_Bf%5!<%p$k4x$9$kcm0u4-5/(b http://www.jpcert.or.jp/at/2005/at050002.txt DNS $B%5!<%p$n@_dj$h%i%a%$%sl>$NEPO?$K4X$9$kCm0U4-5/(B http://www.jpcert.or.jp/at/2005/at050005.txt $B%7%9%F%`$,(B Web $B56Au:>5=$KMQ$$$i$l$?>l9g$NBP1~$K$D$$$F$O!"0J2<$n(b URL $B$G8x3+$7$F$$$kJ8=q!V%3%s%T%e!<%?%;%-%e%j%f%#%$%s%7%g%s%h$x$nbp1~!w$n(b V. $B$*$h$S(B VI.$B$r;2>H$7$F$/$@$5$$!#(B $B%3%s%T%e!<%?%;%-%e%j%f%#%$%s%7%g%s%h$x$nbp1~(b http://www.jpcert.or.jp/ed/2002/ed020002.txt $B$^$?!"(BWeb $B56Au:>5=$KBP$9$k(B Web $B%V%i%&%6$N@_Dj$K4X$7$F$O!";29MJ88%(B [30] $B$r$4;2>H$/$@$5$$!#(B (5) $B$=$NB>(B (other) JPCERT/CC $B$G$O!">e5-(B (1) $B$+$i(B (4) $B$K4^$^$l$J$$%$%s%7%G%s%H(B ($B%5!<%s%9(b $B1?MQK832(B "DoS"$B!"%3%s%T%e!<%?%&%#%k%9$d(b SPAM $B%a!<%k$n$K4X$9$kLd$$9g$o$;$J$I(B) $B$K$D$$$F(B 78$B7o$NJs9p$re(B (1) $B$+$i(B (5) $B$r$^$H$a$?$b$N$,!"0J2<$ni=$g$9!#(b scan forged intrusion phishing other Total ----------------------------------------------------------------- 1$B7n(B 199 120 4 27 39 389 2$B7n(B 145 3 1 31 22 202 3$B7n(B 157 2 1 26 17 203 ----------------------------------------------------------------- 501 125 6 84 78 794 scan : $B%W%m!<%v!"%9%-%c%s!"$=$nb>IT?3$J%"%/%;%9(B forged : $BAw?.%X%C%@$r:>>N$7$?EE;R%a!<%k$ng[aw(b intrusion : $B%7%9%F%`$X$N?/F~(B phishing : $BG'>Z>pJsEy$NIT@5(B $B!x(B2. $B%$%s%?!<%m%c%hdje@4qb,%7%9%f%`(b (ISDAS) $B1?MQ(B http://www.jpcert.or.jp/isdas/ $B%$%s%?!<%m%c%h>e$K@_CV$7$?J#?t$N%;%s%5!<$+$if@$i$l$k>pJs$r2r@O$9$k$H(B $B$H$b$K!"@$$NCf$KN.I[$9$k%;%-%e%j%F%#@HpJs$J$I$r$"$o$;$FAm9gE*$KI>(B $B2A$7$?>e$G!"%;%-%e%j%F%#M=KI4QB,$K4X$9$k>pJs$rDs6!$9$k%5!<%s%9$r9t$j$c(b $B$F$$$^$9!#(B I. $B%$%s%?!<%m%c%hdje@4qb,%7%9%f%`$n2~ni(b 2006$BG/(B3$B7n(B27$BF|$h$j!"DjE@4QB,%7%9%F%`(B (ISDAS) $B$N?7%7%9%F%`$X$N0\9T$re(B $B0lIt$N%;%s%5!<$nfc0[$j4qb,7k2l$ra4bn$kh?1g$7$j$$$h$&5!g=2~a1$r9t(b $B$$$^$7$?!#(B 2. $B8x3+%0%i%U$N4|4V5Z$S!"99?7IQEY$NJQ99(B $B8x3+%0%i%U$N4|4V$r;0%v7n$*$h$S0lG/$KJQ99$7!"99?74V3V$r0l=54V$KJQ(B $B99$7$^$7$?!#(B 3. $B4XO">pJs$N8x3+(B $B%$%s%7%G%s%HH/@8;~$J$I4QB,>u67$KBg$-$JJQ2=$,$"$C$?>l9g!">e5-$N8x(B $B3+%0%i%U$H$OJL$K4XO">pJs$r8x3+$7$^$9!#(B $B$^$?!"(B2004$BG/(B12$B7n(B1$BF|$h$j8x3+$7$F$^$$$j$^$7$?4QB,%G!<%?$n(b CSV $B%U%!%$%k(B $B$K$h$k8x3+$O!"%7%9%F%`0\9T$KH<$$(b 2006$BG/(B3$B7n(B31$BF|$r$b$C$F=*N;$5$;$F$$$?$@(B $B$-$^$7$?!#$4MxMQ$$$?$@$-$^$7$F@?$K$"$j$,$H$&$4$6$$$^$7$?!#(B II. $B%]!<%h%9%-%c%s3567(b $B%$%s%?!<%m%c%hdje@4qb,%7%9%f%`$n4qb,7k2l$o%9%-%c%s?d0\$ri=$9%0%i%u$h(b $B$7$F(B JPCERT/CC $B$N(B Web $B%Z!<%8$rdl$8$f8x3+$7$f$$$^$9!#(b $B%"%/%;%9@h%]!<%h(b $BJL%0%i%U$O%9%-%c%s%m%0$r%"%/%;%9@h%]!<%hjl$k=87w$7!"am7w$r%;%s%5!<$nbf(b $B?t$G3d$C$?J?6QCM$rMQ$$:n@.$7$F$$$^$9!#(B JPCERT/CC$B%$%s%?!<%m%c%hdje@4qb,%7%9%f%`$n@bl@(b http://www.jpcert.or.jp/isdas/readme.html 2006$BG/(B1$B7n(B1$BF|$+$i(B2006$BG/(B3$B7n(B31$BF|$^$G$N4V$K(B ISDAS $B$G4QB,$5$l$?%"%/%;%9@h(B $B%]!<%h$k4x$9$kj?6qcm$n>e0L(B1$B0L!A(B5$B0L!"(B6$B0L!A(B10$B0L$^$G$N?d0\$r0J2<$n%0%i%u(b $B$K<($7$^$9!#(b - $B%"%/%;%9@h%]!<%hjl%0%i%u(b top1-5 (2006$BG/(B1$B7n(B1$BF|(B-3$B7n(B31$BF|(B) http://www.jpcert.or.jp/isdas/2006/2006q1top1-5_port.png - $B%"%/%;%9@h%]!<%hjl%0%i%u(b top6-10 (2006$BG/(B1$B7n(B1$BF|(B-3$B7n(B31$BF|(B) http://www.jpcert.or.jp/isdas/2006/2006q1top6-10_port.png $B$^$?!"$h$jD94|4V$N%9%-%c%s?d0\$rI=$9%0%i%U$H$7$F!"(B2005$BG/(B4$B7n(B1$BF|$+$i(B 2006$BG/(B3$B7n(B31$BF|$^$G$N4|4V$K$*$1$k!"%"%/%;%9@h%]!<%h$k4x$9$kj?6qcm$n>e0L(B1 $B0L!A(B5$B0L!"(B6$B0L!A(B10$B0L$^$G$N?d0\$r0J2<$n%0%i%u$k<($7$^$9!#(b - $B%"%/%;%9@h%]!<%hjl%0%i%u(b top1-5 (2005$BG/(B4$B7n(B1$BF|(B-2006$BG/(B3$B7n(B31$BF|(B) http://www.jpcert.or.jp/isdas/2006/2006q1top1-5_port_year.png - $B%"%/%;%9@h%]!<%hjl%0%i%u(b top6-10 (2005$BG/(B4$B7n(B1$BF|(B-2006$BG/(B3$B7n(B31$BF|(B) http://www.jpcert.or.jp/isdas/2006/2006q1top6-10_port_year.png III. $B$*$b$J%$%s%7%G%s%H$K$*$1$k4QB,>u67(B $B9-HO0O$K1F6A$9$k82Cx$J%$%s%7%G%s%H$O$"$j$^$;$s$G$7$?!#$^$?!"%"%/%;%9(B $B85CO0hJL$N4QB,798~$K$D$$$F$bF1MM$K82Cx$J%$%s%7%G%s%H$O4QB,$5$l$^$;$s$G(B $B$7$?!#$?$@$7(B ISDAS $B%7%9%F%`$G$O0MA3$H$7$F%o!<%`ey$,860x$h9m$($i$l$kb?(b $B?t$N%9%-%c%s$r4QB,$7B3$1$F$*$j!"Dj>oE*$JCm0U$HKI1R$,I,MW$G$9!#(B VI. $B$=$NB>(B (1) eCSIRT.net IDS $B%M%C%H%o!<%/$x$n6(no(b JPCERT/CC $B$G$O!"%h!<%m%c%q$n(b CSIRT $B%3%_%e%K%F%#(B TF-CSIRT $B$G9T$J$o$l(B $B$F$$$k(B IDS $B%M%C%H%o!<%/$x$n5;=q6(no$r$7$f$$$^$9!#>\:Y$K$D$-$^$7$F$O0J(B $B2<$n;29mj88%(b [31] [32] $B$r$4;2>H$/$@$5$$!#(B $B!x(B3. $B@HpJsN.DL(B http://www.jpcert.or.jp/vh/ JPCERT/CC $B$G$O!"@HpJs$rE,@Z$JHO0O$K3+<($7!"bp:v$nb%?j$r?^$k$?(b $B$a$N3hF0$r9T$J$C$F$$$^$9!#9qFb$G$O!"7P:Q;:6H>J9p<(!v%=%u%h%&%'%"ey@hpJspJs$NN.DLBP:v6HL3(B $B$r?J$a$F$$$^$9!#(B I. $B%3!<%g%#%m!<%7%g%s$r9t$$8x3+$7$?@hpJs$*$h$SBP1~>u67(B 2006$BG/(B1$B7n(B1$BF|$+$i(B2006$BG/(B3$B7n(B31$BF|$^$G$N4V$K!"(BJPCERT/CC $B$,F|K\9qFb$N@=IJ(B $B3+H/pJs$*$h$SBP1~>u67$O(B 11$B7o$G$9!#(B $B$3$N$&$A!"7P:Q;:6H>J9p<(!v%=%u%h%&%'%"ey@hpJs$C(B $B$F!"FHN)9T@/K!?M>pJs=hM}?d?J5!9=(B (IPA) $B$KJs9p$5$l!"8x3+$5$l$?@Hp(B $BJs$*$h$SBP1~>u67$O(B 8$B7o$G$9!#(B JVN#6CA72ADB: $BD9:j8)EE;R8)D#%7%9%F%`$K$*$1$kG'>Z>pJs$K4X$9$k@HZ=hM}$K4X$9$k@HpJs$N07$$$K4X$9$kLdBj(B JVN#41550845: $BD9:j8)EE;R8)D#%7%9%F%`$K$*$1$k(B SQL $B%$%s%8%'%/%7%g%s$N@HpJs$r8x3+$7$^$7$?!#(B JVNVU#693909: PAM-MySQL $B$K%5!<%s%91?mqk832(b (DoS) $B967b$r:3J$K4X$9$k@HpJsN.DL6(NOBN@)$N9=C[!"9q:]E*$J3hF0(B JPCERT/CC $B$G$O!"9q:]E*$JOHAH$_$K$*$1$k@HpJs$N1_3j$JN.DL$N$?(B $B$a!"3$30$N(B CSIRT $B$N6(NO4X78$r9=C[!"6/2=$7$F$$$^$9!#6qBNE*$K$O!"Js9p$5(B $B$l$?@HpJs$N6&M-!"%Y%s%@$X$NDLCN$N6&F1%*%Z%l!<%7%g%s!"8x3+f|$n(b $BD4@0!"3F9q%Y%s%@>pJsEy8x3+>pJs$N6&M-$r9T$C$F$$$^$9!#$^$?!">pJsN.DL$r8z(B $BN(2=$9$k$?$a$N6&DL%,%$%I%i%$%s$d%7%9%F%`9=C[!"%G!<%?8r49%u%)!<%^%c%h!"(b $B%"%I%P%$%6%j$NI8=`%U%)!<%^%c%h$n:vdjey$r6&f1$g?j$a$f$$$^$9!#(b $B\:Y$K(B $B$D$$$F$O;29MJ88%(B [33] [34] $B$r$4;2>H$/$@$5$$!#$^$?0J2<$n(b URL $B$b$4;2>H$/(B $B$@$5$$!#(B $B@HpJs%3!<%g%#%m!<%7%g%s35mw(b http://www.jpcert.or.jp/vh/ III. $BF|K\9qFb$N@HpJsN.DLBN@)$N@0Hw(B JPCERT/CC $B$G$O!"7P:Q;:6H>J9p<(!v%=%u%h%&%'%"ey@hpJs$C$F!"F|K\9qFb$N@HpJsN.DLBN@)$r@0Hw$7$F$$$^$9!#(B $BK\4p=`$K$D$$$F$O;29MJ88%(B [35] $B$r$4;2>H$/$@$5$$!#$^$?0J2<$n(b URL $B$b$4;2(B $B>H$/$@$5$$!#(B $B@HpJs%3!<%g%#%m!<%7%g%s35mw(b http://www.jpcert.or.jp/vh/ $B!V>pJs%;%-%e%j%F%#Aa4|7Y2|%Q!<%h%j!<%7%c%w!w$n1?mq$r3+;o(b http://www.jpcert.or.jp/press/2004/0708.txt $B>pJs%;%-%e%j%F%#Aa4|7Y2|%Q!<%h%j!<%7%c%w%,%$%i%i%$%s(b http://www.jpcert.or.jp/vh/partnership_guide.pdf $B>pJs%;%-%e%j%F%#Aa4|7Y2|%Q!<%h%j!<%7%c%w%,%$%i%i%$%s(b($b2~d{hg(b) http://www.jpcert.or.jp/vh/partnership_guide2005.pdf JPCERT/CC $B@HpJspJs=hM}?d?J5!9=(B (IPA) $B$H$NO"7H(B $BK\4p=`$G$O!"pJs8r49$r9T$C$F$$$^$9!#$^$?!"(B $B@HZ%D!<%k$k4x$7$f$b(b IPA $B$H$NO"7H$N$b$HJ,@O$r9T$C$F$$$^$9!#(BIPA $B$N>\:Y$K$D$$$F$O;29MJ88%(B [36] $B$r$4;2>H$/$@$5$$!#(B $BK\4p=`$K$*$1$k(B IPA $B$N3hF0$*$h$S;MH>4|Kh$NFO=P>u67$K$D$$$F$O!";29MJ8(B $B8%(B [37] $B$r$4;2>H$/$@$5$$!#(B (2) $BF|K\9qFb%Y%s%@$H$NO"7H(B $BK\4p=`$G$O!"(BJPCERT/CC $B$,@HpJs$rDs6!$9$k@h$H$7$F!"F|K\9qFb$N%Y%s(B $B%@%j%9%H(B($B@=IJ3+H/pJs$r@0Hw$9$k$3$H(B $B$,<($5$l$f$$$^$9!#(bjpcert/cc $B$G$O!"O"Mm@h>pJs$N@0Hw$K:]$7!"%Y%s%@$N3'MM(B $B$K@=IJ3+H/\:Y$K$D$$$F$O!"0J2<(b $B$N(B URL $B$r$4;2>H$/$@$5$$!#$J$*!"(B2006$BG/(B3$B7n(B31$BF|$N;~E@$G(B 121$BpJs$K4X$7$FF|K\9qFb$N@=IJ3+H/u67(B $B$r8x3+$9$k%5%$%H$G$9!#$3$l$i$N@HpJs$K$O!"K\OHAH$_$K;22C$7$F$$$kF|(B $BK\9qFb$N@=IJ3+H/u67$b4^$^$l$F$$$^$9!#(BJVN $B$K$D$$$F$O0J2<$n(b URL $B$r$4;2>H$/$@$5$$!#(B JP Vendor Status Notes (JVN) http://jvn.jp/ JVN $B$G$O>e5-!V(BI. $B%3!<%g%#%m!<%7%g%s$r9t$$8x3+$7$?@hpJs$*$h$SBP(B $B:v>u67!W0J30$KEv3:4|4VCf$K(B 16$B7o$N@HpJs$r8x3+$7$^$7$?!#(B JVNVU#181038: Windows $B%a%?%U%!%$%k%O%s%I%i$G8F$S=P$5$l$k(B GDI Escape $B%U%!%s%/%7%g%s$K@HZ5!9=$K@HpJs%O%s%I%j%s%0%o!<%/%7%g%c%w$n3+:e(b JPCERT/CC $B@=IJ3+H/pJs%O%s%I%j%s%0%o!<%/%7%g%c%w$r(b $B3+:E$7$^$7$?!#$3$3$G$O@HpJs%O%s%I%j%s%06HL3$d4XO"3hF0$N:G?7>u(B $B67$r>R2p$9$k$H$H$b$K!"%Y%s%@C4EvpJs$NMxMQ>u67$dFbMF$K4X$9$k4|BT!"MWK>$r(B Web $B$K$h$k%"%s%1!<%h$gd4::$7$^$7$?!#(b $BD4::4|4V(B: 2006$BG/(B2$B7n(B8$BF|(B($B?e(B)$B!A(B20$BF|(B($B7n(B)$B!"(B3$B7n(B23$BF|(B($B?e(B)$B!A(B27$BF|(B($B7n(B) $BK\%"%s%1!<%h$nd4::7k2l$r$b$h$k(b JVN $B$N2~A1$K8~$1$F!"8=:_=`Hw$r?J$a$F$$(B $B$^$9!#(B $B!x(B4. $B8x3+J8=q(B 2006$BG/(B1$B7n(B1$BF|$+$i(B2006$BG/(B3$B7n(B31$BF|$^$G$N4V$K(B JPCERT/CC $B$,8x3+$7$?J8=q$O!"(B $BCm0U4-5/(B 4$B7o!"5;=Q%a%b(B 1$B7o!"(BJPCERT/CC $B%l%]!<%h(b 12$B7o!"5Z$SBh(B4$B;MH>4|$N3h(B $BF035MW$G$9!#>\:Y$O0J2<$ndl$j$g$9!#(b I. $BCm0U4-5/(B 4$B7o(B http://www.jpcert.or.jp/at/ 2006$BG/(B01$B7n(B06$BF|(B Microsoft Windows $B%a%?%U%!%$%k=hM}$N@HpJsO3$($$Ey$N6<0r$k$d$$$f(b III. JPCERT/CC $B%l%]!<%h(b 12$B7o(B http://www.jpcert.or.jp/wr/ JPCERT/CC $B%l%]!<%hfb$g07$c$?%;%-%e%j%f%#4xo">pJs$N9`L\?t$O9g7W$7$F(B 68$B7o$G$9!#$=$N$&$A(B 12$B7o$O!V:#=5$N0l8}%a%b!W$N%3!<%j!<$g>R2p$7$?>pJs$G(B $B$9!#(B IV. $B3hF035MW(B 1$B7o(B http://www.jpcert.or.jp/pr/ 2006$BG/(B01$B7n(B16$BF|(B JPCERT/CC $B3hF035MW(B [ 2005$BG/(B10$B7n(B1$BF|(B $B!A(B 2005$BG/(B12$B7n(B31$BF|(B ] $B!x(B5. $B$=$NB>$N3hF0(B 2006$BG/(B1$B7n(B1$BF|$+$i(B2006$BG/(B3$B7n(B31$BF|$^$G$N4V$K(B JPCERT/CC $B$,e5-(B $B!x(B1.$B!A(B4. $B0J30$N3hF0$O0J2<$ndl$j$g$9!#(b I. $BBh(B2$B2s%+!<%m%.!<%a%m%sbg3xf|k\9;!&(bjpcert/cc $B%;%-%e%j%F%#%;%_%J!<(b 1$B7n(B23$BF|$K?@8M%O!<%p!<%i%s%i%;%s%?!<%s%k$g%;%-%e%j%f%#%;%_%j!<$r3+:e(b $B$7$^$7$?!#JF9q(B CERT/CC $B$N%(%-%9%Q!<%h$r9v;u$k7^$(!"@hc<>pJs%;%-%e%j%F%#(B $B650i!&71N}%$%K%7%"%A%V$H9q:]E83+$N>R2p!"$*$h$S9qFb$G$N(B JPCERT/CC $B$N3h(B $BF0$r>R2p$9$k%;%_%J!<$r3+:e$7$^$7$?!#>\:Y$O;29MJ88%(B [38] [39] $B$r$4;2>H(B $B$/$@$5$$!#(B II. $B=EMW%$%s%U%i;v6HpJs%;%-%e%j%F%#%;%_%J!<(b 3$B7n(B23$BF|$K?7=I$N5~2&%W%i%6%[%F%k$G!"(BJPCERT/CC $B$HFHN)9T@/K!?M>pJs=hM}(B $B?d?J5!9=(B(IPA)$B$H6&:E$G=EMW%$%s%U%i;v6HpJs%;%-%e%j%F%#%;%_%J!<(b $B$r3+:E$7$^$7$?!#(B140$BL>7BT5R$r>7$-!"9qFb30$N>pJs%;%-%e%j%F%#4XO"$N(B $B%(%-%9%Q!<%h$r9v;u$k7^$(!"=emw%$%s%u%i;v6hR2p!"9q:]E*$J>pJs$K78(B $B$k=EMW%$%s%U%iKI8nEy$NF08~$J$I$r$4>R2p$9$k%;%_%J!<$r3+:e$7$^$7$?!#>\:Y(B $B$O;29MJ88%(B [40] $B$r$4;2>H$/$@$5$$!#(B III. APCERT $B;vL36I1?1D(B http://www.jpcert.or.jp/english/secretariat.html $B%"%8%"B@J?MNCO0h$N(B CSIRT $B$N=8$^$j$G$"$k!"(BAPCERT (Asia Pacific Computer Emergency Response Team) $B$N;vL36I$rC4Ev$7$F$$$^$9!#>\:Y$O;29M(B $BJ88%(B [41] $B$r$4;2>H$/$@$5$$!#$^$?;vL36I$H$7$F!"0J2<$n3hf0$r9t$$$^$7$?!#(b (1) APCERT 2006 $B3+:E(B 3$B7n(B28$BF|$+$i(B31$BF|$K!"Cf9q(B CNCERT/CC $B$H6&:E$G(B APCERT $B$NG/\:Y$O;29MJ88%(B [42] [43] $B$r$4;2>H$/$@$5$$!#(B (2) APCERT Web $B%j%K%e!<%"%k(b APCERT $B$N(B Web $B%5%$%H$N%G%6%$%s$r0l?7$7$^$7$?!#>\:Y$O;29MJ88%(B [41] $B$r(B $B$4;2>H$/$@$5$$!#(B IV. FIRST $B%l%W%j%+%5!<%p$n1?mq(b FIRST (Forum of Incident Response and Security Teams) $B$N(B Web $B%5!<%p(b www.first.org $B$N%l%W%j%+%5!<%p(b ($B%_%i!<%5!<%p(b) $B$r1?MQ$7!"(BFIRST $B$N3hF0$K(B $B9W8%$7$F$$$^$9!#(BFIRST $B$N>\:Y$K$D$$$F$O;29MJ88%(B [44] $B$r$4;2>H$/$@$5$$!#(B V. FIRST Steering Committee $B$X$N;22h(B FIRST Steering Committee $B$N%a%s%P!<$h$7$f!"(bjpcert/cc $B$N?&0w$,A*=P$5(B $B$l!"(BFIRST $B$N1?1D$K6(NO$7$F$$$^$9!#(BFIRST Steering Committee $B$K$D$$$F$O(B $B;29MJ88%(B [45] $B$r$4;2>H$/$@$5$$!#(B VI. $B$=$NB>9V1i$J$I(B (1) $B>pJs%;%-%e%j%F%#8)L1%;%_%J!<(b (2006$BG/(B2$B7n(B22$BF|(B) $BpJs650i5!9=(B $B>\:Y$K$D$$$F$O;29MJ88%(B [46] $B$r$4;2>H$/$@$5$$!#(B (2) $BoAm2qJs9p8e9V1i2q(B (2006$BG/(B3$B7n(B3$BF|(B) $B>\:Y$K$D$$$F$O;29MJ88%(B [47] [48] $B$r$4;2>H$/$@$5$$!#(B __________ Appendix. $B;29MJ88%(B [1] IN-98.02: New Tools Used For Widespread Scans http://www.cert.org/incident_notes/IN-98.02.html [2] IN-98.04: Advanced Scanning http://www.cert.org/incident_notes/IN-98.04.html [3] IN-98.05: Probes with Spoofed IP Addresses http://www.cert.org/incident_notes/IN-98-05.html [4] IN-98.06: Automated Scanning and Exploitation http://www.cert.org/incident_notes/IN-98-06.html [5] IN-99-01: "sscan" Scanning Tool http://www.cert.org/incident_notes/IN-99-01.html [6] Packet Filtering for Firewall Systems http://www.cert.org/tech_tips/packet_filtering.html [7] CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow in IIS Indexing Service DLL http://www.cert.org/advisories/CA-2001-19.html [8] CA-2001-26 Nimda Worm http://www.cert.org/advisories/CA-2001-26.html [9] IN-2002-04: Exploitation of Vulnerabilities in Microsoft SQL Server http://www.cert.org/incident_notes/IN-2002-04.html [10] CA-2002-27 Apache/mod_ssl Worm http://www.cert.org/advisories/CA-2002-27.html [11] AL-2002.12 W32/BUGBEAR@MM Virus http://www.auscert.org.au/render.html?it=2447 [12] AU-2002.008 Updated Information Regarding BugBear Virus http://www.auscert.org.au/render.html?it=2452 [13] IN-2002-06: W32/Lioten Malicious Code http://www.cert.org/incident_notes/IN-2002-06.html [14] IN-2003-01: Malicious Code Propagation and Antivirus Software Updates http://www.cert.org/incident_notes/IN-2003-01.html [15] CA-2003-04 MS-SQL Server Worm http://www.cert.org/advisories/CA-2003-04.html [16] CA-2003-08 Increased Activity Targeting Windows Shares http://www.cert.org/advisories/CA-2003-08.html [17] CA-2003-09 Buffer Overflow in Core Microsoft Windows DLL http://www.cert.org/advisories/CA-2003-09.html [18] CA-2003-28 Buffer Overflow in Windows Workstation Service http://www.cert.org/advisories/CA-2003-28.html [19] CERT/CC Current Activity W32/Welchia Worm http://www.cert.org/current/archive/2003/08/18/archive.html#welchia [20] IN-2004-01: W32/Novarg.A Virus http://www.cert.org/incident_notes/IN-2004-01.html [21] TA04-041A: Multiple Vulnerabilities in Microsoft ASN.1 Library http://www.us-cert.gov/cas/techalerts/TA04-041A.html [22] TA04-028A: W32/MyDoom.B Virus http://www.us-cert.gov/cas/techalerts/TA04-028A.html [23] Sasser $B%o!<%`$k$d$$$f$n$*cn$i$;(b http://www.microsoft.com/japan/security/incident/sasser.mspx [24] Microsoft Windows $B$N%;%-%e%j%F%#=$@5%W%m%0%i%`(B (835732) (MS04-011) http://www.microsoft.com/japan/technet/security/bulletin/MS04-011.mspx [25] US-CERT Current Activity: W32/Sasser http://www.us-cert.gov/current/archive/2004/06/24/archive.html#sasser [26] US-CERT Vulnerability Note VU#909678 http://www.kb.cert.org/vuls/id/909678 [27] US-CERT Current Activity: Santy Worm http://www.us-cert.gov/current/archive/2004/12/21/archive.html#Santy [28] US-CERT Vulnerability Note VU#497400 http://www.kb.cert.org/vuls/id/497400 [29] Email Bombing and Spamming http://www.cert.org/tech_tips/email_bombing_spamming.html [30] Frequently Asked Questions About Malicious Web Scripts Redirected by Web Sites http://www.cert.org/tech_tips/malicious_code_FAQ.html [31] TERENA - TF-CSIRT - Collaboration of Security Incident Response Teams http://www.terena.nl/tech/task-forces/tf-csirt/ [32] The European CSIRT Network http://www.ecsirt.net/ [33] CERT Coordination Center (CERT/CC) http://www.cert.org/ [34] National Infrastructure Security Co-ordination Centre (NISCC) http://www.niscc.gov.uk/ [35] $B@HpJspJs=hM}?d?J5!9=(B http://www.ipa.go.jp/ [37] $B>pJs=hM}?d?J5!9=%;%-%e%j%F%#%;%s%?!<(b $B@HpJs$NpJs%;%-%e%j%F%#%;%_%J!<(b http://www.ipa.go.jp/security/event/2005/infra-sem/ [41] Asia Pacific Computer Emergency Response Team (APCERT) http://www.apcert.org/ [42] APCERT & CNCERT 2006 CONFERENCE http://www.apcert.org/events/calendar/2006/0328-31.html [43] National Computer network Emergency Response technical Team/Coordination Center of China (CNCERT/CC) http://www.cert.org.cn/ [44] Forum of Incident Response and Security Teams (FIRST) https://www.first.org/ [45] FIRST Steering Committee https://www.first.org/about/organization/sc.html [46] $B>pJs%;%-%e%j%F%#8)L1%;%_%J!<(b http://www.cmuj.jp/05pref/index2.html [47] $BoAm2q(B)$B5D;vO?(B http://www.nic.ad.jp/ja/materials/general-meeting/20060303/minutes.html __________ <JPCERT/CC $B$+$i$N$*CN$i$;$H$*4j$$(B> $BK\J8=q$G2r@b$7$?%3%s%T%e!<%?%;%-%e%j%f%#%$%s%7%g%s%h$b4^$a!"%$%s%?!<(b $B%M%C%H>e$G0z$-5/$3$5$l$k$5$^$6$^$J%3%s%T%e!<%?%;%-%e%j%f%#%$%s%7%g%s%h(b $B$K4X$9$k>pJs$,$"$j$^$7$?$i!"(Binfo@jpcert.or.jp $B$^$G$4Ds6!$/$@$5$$$^$9$h(B $B$&$*4j$$$7$^$9!#Js9pMM<0$k4x$7$f$o0j2<$n(b URL $B$r$4Mw$/$@$5$$(B http://www.jpcert.or.jp/form/ $BJs9pMM<0$k$45-:\$n$&$(!"(b info@jpcert.or.jp $B$^$G$*Aw$j$/$@$5$$!#(B JPCERT/CC $B$KD:$$$?Js9p$O!"Js9pAH?%Ey$K3+<((b $B$9$k$3$H$O$"$j$^$;$s!#(BJPCERT/CC $B$NAH?%35MW$K$D$-$^$7$F$O!"(B http://www.jpcert.or.jp/ $B$r$4;2>H$/$@$5$$!#(B JPCERT/CC $B$G$O!"%3%s%T%e!<%?%;%-%e%j%f%#%$%s%7%g%s%h$k4x$9$k>pJs$r?W(B $BB.$K$4Ds6!$9$k$?$a$K!"%a!<%j%s%0%j%9%h$r3+@_$7$f$$$^$9!#epo?$nj}k!ey!"(b $B>\$7$/$O!"(B http://www.jpcert.or.jp/announce.html $B$r$4;2>H$/$@$5$$!#(B __________ $BCm(B: JPCERT/CC $B$N3hF0$O!"FCDj$N8D?M$dAH?%$NMx1W$rJ]>c$9$k$3$H$rL\E*$H$7(B $B$?$b$N$G$O$"$j$^$;$s!#8DJL$NLdBj$K4X$9$k$*Ld$$9g$o$;Ey$KBP$7$FI,$:$*Ez(B $B$($G$-$k$H$O8B$i$J$$$3$H$r$"$i$+$8$a$4N;>5$/$@$5$$!#$^$?!"K\7o$K4X$9$k(B $B$b$N$b4^$a!"(BJPCERT/CC $B$X$N$*Ld$$9g$o$;Ey$,A}2C$9$k$3$H$,M=A[$5$l$k$?$a!"(B $B$*Ez$($G$-$k>l9g$G$b$42sEz$,CY$l$k2DG=@-$,$"$k$3$H$r2?B4$4>5CN$*$-$/$@(B $B$5$$!#(B $BCm(B: $B$3$NJ8=q$O!"%3%s%T%e!<%?%;%-%e%j%f%#%$%s%7%g%s%h$k4x$9$k0lhle*$j>p(B $BJsDs6!$rL\E*$H$9$k$b$N$G$"$j!"FCDj$N8D?M$dAH?%$KBP$9$k!"8DJL$N%3%s%5%k(B $B%F%#%s%0$rL\E*$H$7$?$b$N$G$O$"$j$^$;$s!#$^$?(B JPCERT/CC $B$O!"$3$NJ8=q$K(B $B5-:\$5$l$?>pJs$NFbMF$,@53N$G$"$k$3$H$KEX$a$F$*$j$^$9$,!"@53N@-$r4^$a0l(B $B@Z$NIJZ$9$k$b$N$G$O$"$j$^$;$s!#$3$NJ8=q$K5-:\$5$l$?(B $B>pJs$K4p$E$$$F!"5.J}$"$k$$$O5.AH?%$,$H$i$l$k9TF0(B / $B$"$k$$$O$H$i$l$J$+$C(B $B$?9TF0$K$h$C$F0z$-5/$3$5$l$k7k2L$KBP$7$F!"(BJPCERT/CC $B$O2?$iJ]>c$rM?$($k(B $B$b$N$G$O$"$j$^$;$s!#(B __________ 2006 (C) JPCERT/CC $B$3$NJ8=q$rE>:\$9$k:]$K$O!"A4J8$rE>:\$7$F$/$@$5$$!#$^$?!":G?7>pJs$K$D(B $B$$$F$O(B JPCERT/CC $B$N(B Web $B%5%$%H(B http://www.jpcert.or.jp/ $B$r;2>H$7$F$/$@$5$$!#(B JPCERT/CC $B$N(B PGP $B8x3+80$O0J2<$n(b URL $B$+$iF~

AltStyle $B$K$h$C$FJQ49$5$l$?%Z!<%8(b (->$B%*%j%8%J%k(B) /