Android¤Î¶ä¹Ô¥¢¥×¥ê¥æ¡¼¥¶¡¼¤òÁÀ¤¦¥×¥í¥°¥ì¥Ã¥·¥ÖWeb¥¢¥×¥ê¤ËÃí°Õ
ESET¤Ï8·î20Æü(¸½ÃÏ»þ´Ö)¡¢¡ÖBe careful what you pwish for - Phishing in PWA applications¡×¤Ë¤ª¤¤¤Æ¡¢¥â¥Ð¥¤¥ë¥æ¡¼¥¶¡¼¤òɸŪ¤È¤¹¤ë¥Õ¥£¥Ã¥·¥ó¥°¥¥ã¥ó¥Ú¡¼¥ó¤òȯ¸«¤·¤¿¤ÈÊ󤸤¿¡£¤³¤Î¥¥ã¥ó¥Ú¡¼¥ó¤Ç¤Ï¥×¥í¥°¥ì¥Ã¥·¥ÖWeb¥¢¥×¥ê(PWA: Progressive Web Apps)¤ò»ÈÍѤ¹¤ë¤³¤È¤Ç°°Õ¤Î¤¢¤ë¥¢¥×¥ê¤ò±£Ê乤ë¤È¤µ¤ì¤ë¡£
PWA¤È¤ÏHTML¡¢CSS¡¢JavaScript¤È¤¤¤Ã¤¿Webµ»½Ñ¤ò»ÈÍѤ·¤Æ¹½ÃÛ¤µ¤ì¤Æ¤¤¤ë¥¢¥×¥ê¥±¡¼¥·¥ç¥ó¤Ç¡¢1¤Ä¤Î¥³¡¼¥É¥Ù¡¼¥¹¤«¤é¤¹¤Ù¤Æ¤Î¥Ç¥Ð¥¤¥¹¤Ë¥¤¥ó¥¹¥È¡¼¥ë¤·¤Æ¼Â¹Ô¤Ç¤¤ë¡£
![](https://image.news.livedoor.com/newsimage/stf/4/4/44d3f_1223_b428f97d24f5e7e538166b7797612796.jpg)
Be careful what you pwish for - Phishing in PWA applications
¡ûAndroid¥æ¡¼¥¶¡¼¤òɸŪ¤È¤·¤¿¥Õ¥£¥Ã¥·¥ó¥°
ESET¤Ë¤è¤êȯ¸«¤µ¤ì¤¿¿·¤¿¤Ê¥Õ¥£¥Ã¥·¥ó¥°¥¥ã¥ó¥Ú¡¼¥ó¤Ç¤Ï¡¢½é´ü¥¢¥¯¥»¥¹¤Ë¼«Æ°²»À¼ÄÌÏᢥ·¥ç¡¼¥È¥á¥Ã¥»¡¼¥¸¥µ¡¼¥Ó¥¹(SMS: Short Message Service)¡¢¥½¡¼¥·¥ã¥ë¥á¥Ç¥£¥¢¤Î¥Þ¥ë¥Ð¥¿¥¤¥¸¥ó¥°(µ¶¹¹ð)¤Ê¤É¤ò°ÍѤ¹¤ë¤È¤¤¤¦¡£²»À¼ÄÌÏäǤÏɸŪ¤Ë¸Å¤¤¶ä¹Ô¥¢¥×¥ê¤Î¥¢¥Ã¥×¥Ç¡¼¥È¤òÂ¥¤·¡¢SMS¤Ç¤Ï¥½¡¼¥·¥ã¥ë¥¨¥ó¥¸¥Ë¥¢¥ê¥ó¥°¤Ë¤è¤ë¥Õ¥£¥Ã¥·¥ó¥°¥µ¥¤¥È¤Ø¤ÎͶƳ¤¬¹Ô¤ï¤ì¤ë¡£¥Þ¥ë¥Ð¥¿¥¤¥¸¥ó¥°¤Ç¤ÏInstagram¤äFacebook¤Î¹¹ð¤¬°ÍѤµ¤ì¡¢ÆÃÄê¤Î¥¿¡¼¥²¥Ã¥ÈÁؤò¶ä¹Ô¥¢¥×¥ê¤Ëµ¶Áõ¤·¤¿¥Õ¥£¥Ã¥·¥ó¥°¥µ¥¤¥È¤ËͶƳ¤¹¤ë¡£
¤¤¤º¤ì¤Î¾ì¹ç¤â¡¢¶ä¹Ô¥¢¥×¥ê¤Î¥¢¥Ã¥×¥Ç¡¼¥È¤òµá¤á¤ë¤³¤È¤Ç°°Õ¤Î¤¢¤ë¥¢¥×¥ê¤ò¥¤¥ó¥¹¥È¡¼¥ë¤µ¤»¤ë¡£Android¥æ¡¼¥¶¡¼¤Ë¤ÏWebAPK·Á¼°(Ãæ¿È¤ÏPWA)¤Î¥¢¥×¥ê¤òÇÛ¿®¤·¡¢¤½¤ì°Ê³°¤Î¥æ¡¼¥¶¡¼¤Ë¤ÏPWA·Á¼°¤Î¥¢¥×¥ê¤òÇÛ¿®¤¹¤ë¡£
![](https://image.news.livedoor.com/newsimage/stf/9/e/9e57e_1223_d0496bcb48c1e66198b91a1c03c193ab.jpg)
°°Õ¤Î¤¢¤ë¥¢¥×¥ê¤ÎÇÛ¿®·ÐÏ©¡¡°úÍÑ¡§ESET
¡û¥×¥í¥°¥ì¥Ã¥·¥ÖWeb¥¢¥×¥ê¤Î»ÈÍÑÌÜŪ
º£²ó¤Î¥¥ã¥ó¥Ú¡¼¥ó¤Ë¤ª¤¤¤Æ¡¢¹¶·â¼Ô¤¬PWA¤òºÎÍѤ·¤¿Íýͳ¤Î1¤Ä¤Ï·Ù¹ð¤Î²óÈò¤È¤µ¤ì¤ë¡£ESET¤Ë¤è¤ë¤È¡¢Chrome¤Ï¥Ç¥Õ¥©¥ë¥ÈÀßÄê¤ÇWebAPK·Á¼°¤Î¥¢¥×¥ê¤Î¥¤¥ó¥¹¥È¡¼¥ë¤ò·Ù¹ð¤»¤º¡¢iOS¤Î¾ì¹ç¤â¥¤¥ó¥¹¥È¡¼¥ëÊýË¡¤ò¥Ý¥Ã¥×¥¢¥Ã¥×ɽ¼¨¤¹¤ë¤À¤±¤Ç·Ù¹ð¤µ¤ì¤Ê¤¤¤È¤¤¤¦¡£
![](https://image.news.livedoor.com/newsimage/stf/7/d/7ddcc_1223_ee7e46fc080e1200fdd32a7d44676cf1.jpg)
iOS¤Î¥Ý¥Ã¥×¥¢¥Ã¥×ɽ¼¨¡¡°úÍÑ¡§ESET
¾¤Ë¤âÄ̾ï¤Î¥â¥Ð¥¤¥ë¥¢¥×¥ê¤Î¤è¤¦¤ËÆ°ºî¤µ¤»¤ë¤³¤È¤¬²Äǽ¤ÊÅÀ¤âÍýͳ¤Î1¤Ä¤È¤µ¤ì¤ë¡£¤Þ¤¿¡¢Android¤Î¾ì¹ç¤Ï¥¢¥×¥ê¥¢¥¤¥³¥ó¤«¤éWeb¥Ö¥é¥¦¥¶¡¼¥í¥´¤ò¾Ã¤»¤ë¤¿¤á¡¢Ä̾ï¤Î¥¢¥×¥ê¤È¶èÊ̤¬¤Ä¤«¤º¡¢¥æ¡¼¥¶¡¼¤ÏÉÔÀµ¤Ê¥¢¥×¥ê¤Èǧ¼±¤¹¤ë¤³¤È¤¬Æñ¤·¤¤¤È¤µ¤ì¤ë¡£
![](https://image.news.livedoor.com/newsimage/stf/1/7/17f12_1223_fe297455d2d83d4bab179ae56a4cb18d.jpg)
°°Õ¤Î¤¢¤ë¥¢¥×¥ê(º¸)¤ÈÀµµ¬¤Î¶ä¹Ô¥¢¥×¥ê(±¦) - °úÍÑ¡§ESET
¡û±Æ¶Á¤ÈÂкö
ESET¤ÎÄ´ºº¤Ë¤è¤ë¤È¡¢Ëܷ便ã¥ó¥Ú¡¼¥ó¤Î¼ç¤ÊɸŪ¤Ï¥Á¥§¥³¤Î¥â¥Ð¥¤¥ë¥æ¡¼¥¶¡¼¤È¤µ¤ì¤ë¡£¹¶·â¼Ô¤Ï2¤Ä¤Î°Û¤Ê¤ë¥³¥Þ¥ó¥É¡õ¥³¥ó¥È¥í¡¼¥ë(C2: Command and Control)¥µ¡¼¥Ð¤ò»ÈÍѤ·¤Æ¤ª¤ê¡¢ESET¤Ï2¤Ä¤Î¶¼°Ò¥°¥ë¡¼¥×¤Ë¤è¤ë³èÆ°¤Ç¤Ï¤Ê¤¤¤«¤È¿ä¬¤·¤Æ¤¤¤ë¡£
¤³¤Î¥¥ã¥ó¥Ú¡¼¥ó¤Ç¤Ï½é´ü¥¢¥¯¥»¥¹¤ËÊ£¿ô¤Î¥Õ¥£¥Ã¥·¥ó¥°¼êË¡¤¬ÍѤ¤¤é¤ì¤ë¡£¤½¤Î¤¿¤á¡¢¶ä¹Ô¥¢¥×¥ê¤ò»ÈÍѤ¹¤ë¥â¥Ð¥¤¥ë¥æ¡¼¥¶¡¼¤Ï¡¢¥Õ¥£¥Ã¥·¥ó¥°Âкö¤Î¥Ù¥¹¥È¥×¥é¥¯¥Æ¥£¥¹¤ò¼ÂÁ©¤¹¤ë¤³¤È¤¬¿ä¾©¤µ¤ì¤Æ¤¤¤ë¡£¤Þ¤¿¡¢ESET¤ÏÄ´ºº²áÄø¤¨È½ÌÀ¤·¤¿¥»¥¥å¥ê¥Æ¥£¿¯³²¥¤¥ó¥¸¥±¡¼¥¿¡¼(IoC: Indicator of Compromise)¤ò¸ø³«¤·¤Æ¤ª¤ê¡¢É¬Íפ˱þ¤¸¤Æ³èÍѤ¹¤ë¤³¤È¤¬Ë¾¤Þ¤ì¤Æ¤¤¤ë¡£
![](https://image.news.livedoor.com/newsimage/stf/4/4/44d3f_1223_b428f97d24f5e7e538166b7797612796.jpg)
¡ûAndroid¥æ¡¼¥¶¡¼¤òɸŪ¤È¤·¤¿¥Õ¥£¥Ã¥·¥ó¥°
ESET¤Ë¤è¤êȯ¸«¤µ¤ì¤¿¿·¤¿¤Ê¥Õ¥£¥Ã¥·¥ó¥°¥¥ã¥ó¥Ú¡¼¥ó¤Ç¤Ï¡¢½é´ü¥¢¥¯¥»¥¹¤Ë¼«Æ°²»À¼ÄÌÏᢥ·¥ç¡¼¥È¥á¥Ã¥»¡¼¥¸¥µ¡¼¥Ó¥¹(SMS: Short Message Service)¡¢¥½¡¼¥·¥ã¥ë¥á¥Ç¥£¥¢¤Î¥Þ¥ë¥Ð¥¿¥¤¥¸¥ó¥°(µ¶¹¹ð)¤Ê¤É¤ò°ÍѤ¹¤ë¤È¤¤¤¦¡£²»À¼ÄÌÏäǤÏɸŪ¤Ë¸Å¤¤¶ä¹Ô¥¢¥×¥ê¤Î¥¢¥Ã¥×¥Ç¡¼¥È¤òÂ¥¤·¡¢SMS¤Ç¤Ï¥½¡¼¥·¥ã¥ë¥¨¥ó¥¸¥Ë¥¢¥ê¥ó¥°¤Ë¤è¤ë¥Õ¥£¥Ã¥·¥ó¥°¥µ¥¤¥È¤Ø¤ÎͶƳ¤¬¹Ô¤ï¤ì¤ë¡£¥Þ¥ë¥Ð¥¿¥¤¥¸¥ó¥°¤Ç¤ÏInstagram¤äFacebook¤Î¹¹ð¤¬°ÍѤµ¤ì¡¢ÆÃÄê¤Î¥¿¡¼¥²¥Ã¥ÈÁؤò¶ä¹Ô¥¢¥×¥ê¤Ëµ¶Áõ¤·¤¿¥Õ¥£¥Ã¥·¥ó¥°¥µ¥¤¥È¤ËͶƳ¤¹¤ë¡£
¤¤¤º¤ì¤Î¾ì¹ç¤â¡¢¶ä¹Ô¥¢¥×¥ê¤Î¥¢¥Ã¥×¥Ç¡¼¥È¤òµá¤á¤ë¤³¤È¤Ç°°Õ¤Î¤¢¤ë¥¢¥×¥ê¤ò¥¤¥ó¥¹¥È¡¼¥ë¤µ¤»¤ë¡£Android¥æ¡¼¥¶¡¼¤Ë¤ÏWebAPK·Á¼°(Ãæ¿È¤ÏPWA)¤Î¥¢¥×¥ê¤òÇÛ¿®¤·¡¢¤½¤ì°Ê³°¤Î¥æ¡¼¥¶¡¼¤Ë¤ÏPWA·Á¼°¤Î¥¢¥×¥ê¤òÇÛ¿®¤¹¤ë¡£
![](https://image.news.livedoor.com/newsimage/stf/9/e/9e57e_1223_d0496bcb48c1e66198b91a1c03c193ab.jpg)
¡û¥×¥í¥°¥ì¥Ã¥·¥ÖWeb¥¢¥×¥ê¤Î»ÈÍÑÌÜŪ
º£²ó¤Î¥¥ã¥ó¥Ú¡¼¥ó¤Ë¤ª¤¤¤Æ¡¢¹¶·â¼Ô¤¬PWA¤òºÎÍѤ·¤¿Íýͳ¤Î1¤Ä¤Ï·Ù¹ð¤Î²óÈò¤È¤µ¤ì¤ë¡£ESET¤Ë¤è¤ë¤È¡¢Chrome¤Ï¥Ç¥Õ¥©¥ë¥ÈÀßÄê¤ÇWebAPK·Á¼°¤Î¥¢¥×¥ê¤Î¥¤¥ó¥¹¥È¡¼¥ë¤ò·Ù¹ð¤»¤º¡¢iOS¤Î¾ì¹ç¤â¥¤¥ó¥¹¥È¡¼¥ëÊýË¡¤ò¥Ý¥Ã¥×¥¢¥Ã¥×ɽ¼¨¤¹¤ë¤À¤±¤Ç·Ù¹ð¤µ¤ì¤Ê¤¤¤È¤¤¤¦¡£
![](https://image.news.livedoor.com/newsimage/stf/7/d/7ddcc_1223_ee7e46fc080e1200fdd32a7d44676cf1.jpg)
¾¤Ë¤âÄ̾ï¤Î¥â¥Ð¥¤¥ë¥¢¥×¥ê¤Î¤è¤¦¤ËÆ°ºî¤µ¤»¤ë¤³¤È¤¬²Äǽ¤ÊÅÀ¤âÍýͳ¤Î1¤Ä¤È¤µ¤ì¤ë¡£¤Þ¤¿¡¢Android¤Î¾ì¹ç¤Ï¥¢¥×¥ê¥¢¥¤¥³¥ó¤«¤éWeb¥Ö¥é¥¦¥¶¡¼¥í¥´¤ò¾Ã¤»¤ë¤¿¤á¡¢Ä̾ï¤Î¥¢¥×¥ê¤È¶èÊ̤¬¤Ä¤«¤º¡¢¥æ¡¼¥¶¡¼¤ÏÉÔÀµ¤Ê¥¢¥×¥ê¤Èǧ¼±¤¹¤ë¤³¤È¤¬Æñ¤·¤¤¤È¤µ¤ì¤ë¡£
![](https://image.news.livedoor.com/newsimage/stf/1/7/17f12_1223_fe297455d2d83d4bab179ae56a4cb18d.jpg)
¡û±Æ¶Á¤ÈÂкö
ESET¤ÎÄ´ºº¤Ë¤è¤ë¤È¡¢Ëܷ便ã¥ó¥Ú¡¼¥ó¤Î¼ç¤ÊɸŪ¤Ï¥Á¥§¥³¤Î¥â¥Ð¥¤¥ë¥æ¡¼¥¶¡¼¤È¤µ¤ì¤ë¡£¹¶·â¼Ô¤Ï2¤Ä¤Î°Û¤Ê¤ë¥³¥Þ¥ó¥É¡õ¥³¥ó¥È¥í¡¼¥ë(C2: Command and Control)¥µ¡¼¥Ð¤ò»ÈÍѤ·¤Æ¤ª¤ê¡¢ESET¤Ï2¤Ä¤Î¶¼°Ò¥°¥ë¡¼¥×¤Ë¤è¤ë³èÆ°¤Ç¤Ï¤Ê¤¤¤«¤È¿ä¬¤·¤Æ¤¤¤ë¡£
¤³¤Î¥¥ã¥ó¥Ú¡¼¥ó¤Ç¤Ï½é´ü¥¢¥¯¥»¥¹¤ËÊ£¿ô¤Î¥Õ¥£¥Ã¥·¥ó¥°¼êË¡¤¬ÍѤ¤¤é¤ì¤ë¡£¤½¤Î¤¿¤á¡¢¶ä¹Ô¥¢¥×¥ê¤ò»ÈÍѤ¹¤ë¥â¥Ð¥¤¥ë¥æ¡¼¥¶¡¼¤Ï¡¢¥Õ¥£¥Ã¥·¥ó¥°Âкö¤Î¥Ù¥¹¥È¥×¥é¥¯¥Æ¥£¥¹¤ò¼ÂÁ©¤¹¤ë¤³¤È¤¬¿ä¾©¤µ¤ì¤Æ¤¤¤ë¡£¤Þ¤¿¡¢ESET¤ÏÄ´ºº²áÄø¤¨È½ÌÀ¤·¤¿¥»¥¥å¥ê¥Æ¥£¿¯³²¥¤¥ó¥¸¥±¡¼¥¿¡¼(IoC: Indicator of Compromise)¤ò¸ø³«¤·¤Æ¤ª¤ê¡¢É¬Íפ˱þ¤¸¤Æ³èÍѤ¹¤ë¤³¤È¤¬Ë¾¤Þ¤ì¤Æ¤¤¤ë¡£