SonicWall 2024幎çãµã€ããŒè åšã¬ããŒãäžéã¢ããããŒãïŒIoTã®çéšãPowerShellã®åé¡ãªã©
2024幎ã®äžåæãéãå»ããŸãããSonicWallã®2024幎çãµã€ããŒè åšã¬ããŒãäžéã¢ããããŒãã§ã¯ããã®æéäžã«åœç€ŸãåéããããŒã¿ã䜿çšããŠãææ°ã®è åšã®æ å¢ãšæ¥çã®ãã¬ã³ãã«ã€ããŠããæ確ã«èª¬æããŠããŸããããžãã¹ã¡ãŒã«è©æ¬ºïŒBECïŒæ»æãå¢å åŸåã§ããµãã©ã€ãã§ãŒã³æ»æãšé¢é£ãããªã¹ã¯ãå¢ããŠãããIoTãã«ãŠã§ã¢ã¯ãŸããŸã倧ããªåé¡ã«ãªã£ãŠããŸããããã«ãåœç€Ÿã¯ä»å¹Žã®è åšãšãããŸã§ã®ãã¬ã³ãã«é¢ããSOCã®èŠç¹ãæäŸããŸãããã®ãã¹ãŠã枬å®ããããã«ãåœç€Ÿã¯ããã粟床ã®é«ãã·ã¹ãã ãå°å ¥ããŠããŸãã ããããªããHITSããããã«ã¡ã¯ãTICKSã è åšã¯ããå±éºãªãã®ã«é²åããåœç€Ÿã®ä¿è·æ©èœãããããšäžŠè¡ããŠé²åããŠããŸãããåœç€Ÿãè åšã枬å®ããæ¹æ³ã®éèŠæ§ã¯èŠèœãšãããã¡ã§ãã2024幎çãµã€ããŒè åšã¬ããŒãäžéã¢ããããŒãã§ãåœç€Ÿã¯å€é©ã®ææã§ãããšæ±ºæããŸããã ãããŸã§åœç€Ÿã¯ãã¡ã€ã¢ãŠã©ãŒã«ã«å¯Ÿãããã¹ãŠã®è¢«å®³ä»¶æ°ïŒHITSïŒãã«ãŠã³ãããŠããŸãããããã¯æŽé¢šéšã®ãšãã«ãã¹ãŠã®éšç²ãæ°ãããããªãã®ã§ãããå®éã«èµ·ããŠããããšãèªåŒµããŠç€ºãããšã«ã€ãªãããããããããŸãããTICKSãææšã¯ãäžã€äžã€ã®è¢«å®³ã§ã¯ãªãããã¡ã€ã¢ãŠã©ãŒã«ãæ»æãåããŠããæéæ°ãã«ãŠã³ãããä»çµã¿ã§ããããã»ã©ã®éšã®äŸã§ã¯ããä»æ¥ã®ååŸã¯300äžç²ã®éšãéããŸããããšèª¬æããããšãšãä»æ¥ã®ååŸã¯1æééšãéããŸããããšèª¬æããããšã¯èããç°ãªããŸããTICKSã¯äžè²«æ§ãé«ããæ¯èŒãããŒã¿ã®è§£éãç°¡åã«ãªããŸãããŸãããã¬ã¡ããªããŒã¿ã®åæãšã¬ããŒãã®æ¹æ³ãå šäœçã«å€§å¹ ã«æ¹åãããŸãããŸããã©ãã ãã®åçãå±éºã«ãããããSonicWallã«ãã£ãŠä¿è·ãããããæ£ç¢ºã«åæããããšãã§ããŸãïŒè©³çŽ°ã«ã€ããŠã¯ã¬ããŒãã®å šæã確èªããå¿ èŠããããŸãïŒã è åšã«é¢ããç·æ¬ ããžãã¹ã¡ãŒã«è©æ¬ºïŒBECïŒïŒ ããžãã¹ã¡ãŒã«è©æ¬ºïŒBECïŒæ»æã¯å¢å åŸåã§ããå®éã«ãã©ã³ãµã ãŠã§ã¢ã®ã€ãã³ã1件ã«å¯ŸããŠ10件ã®BECã€ãã³ããå ±åãããŠãããBECã€ãã³ãã®70%ã«ããŸããŸãªãœãŒã·ã£ã«ãšã³ãžãã¢ãªã³ã°ã®ææ³ãé¢ä¿ããŠããŸãã IoTãã«ãŠã§ã¢ïŒ IoTïŒã¢ãã®ã€ã³ã¿ãŒãããïŒãã«ãŠã§ã¢ã¯2024幎äžåæã«107%ã®æ¥å¢ãšãªããŸãããæ»æ察象ã§ãã£ãããã€ã¹ã¯å¹³åã§52.8æéæ»æãåããŠããŸããã ã¯ã©ãŠãæ»æïŒ: åœç€Ÿã®ãããŒãžããµãŒãã¹ããŒã ã®é¡§å®¢ããã®ã¢ã©ãŒãã®83%ã¯ã¯ã©ãŠãã¢ããªã䟵害ãåããèªèšŒæ å ±ã«é¢é£ãããã®ã§ãããã®ããšã¯ãæ»æ察象é åãšããŠã®ã¯ã©ãŠãã®æ¡å€§ã2024幎以éãç¶ãããšãæå³ããŸãã ãµãã©ã€ãã§ãŒã³æ»æãåŒãç¶ãå¢å 2024幎ã®ãµãã©ã€ãã§ãŒã³æ»æã«ã€ããŠçŸåšãŸã§ã«ããã£ãããšããããšããã°ãããã¯ããµãã©ã€ãã§ãŒã³æ»æã¯ããæ¥åžžçã§ãããããã€ã³ãã¯ããããã察åŠããããšãããå°é£ãªãã®ã«ãªã£ãŠãããšããããšã§ããä»å¹Žã¯JetBrains TeamCityã®èªèšŒãã€ãã¹ã®è匱æ§ãªã©ãè€æ°ã®ãµãã©ã€ãã§ãŒã³ã®è匱æ§ã泚ç®ãéããŠããŸããæ»æè ã¯ãã®è匱æ§ãæªçšããŠã圱é¿ãåããã·ã¹ãã ãå¶åŸ¡ã§ããŸãããå®å šã«å¶åŸ¡ã§ããã±ãŒã¹ããããŸãããå®éã«ãSonicWallã®é¡§å®¢ã®16%ããã®è匱æ§ãæªçšããããšããæ»æã®æšçã«ãªããŸããããããã®æ»æã®å€§åïŒ83%ïŒã¯3æã«çºçãããã®åŸæ°ãæã§æ¥æ¿ã«æžå°ããŸããã ãµãã©ã€ãã§ãŒã³æ»æã«ã€ãªãã£ãã®ã¯æ°ããè匱æ§ã ãã§ã¯ãããŸããã§ãããä»å¹Žã®äžåæã¯ãæ§æ¥ã®ææ³ãæå¹ã§ããããšã瀺ãããŠããŸãããªãœãŒã¹ãéãããŠããäžå°äŒæ¥ïŒSMBïŒã«ãšã£ãŠãLog4jãšHeartbleedã¯äŸç¶ãšããŠå€§ããªè åšã§ããããšãããããŸããã PowerShellïŒè¯ãããšã«ãæªãããšã«åœ¹ç«ã€ïŒ PowerShellã¯åªããããŒã«ã§ããéåžžã«åŒ·åãªã¹ã¯ãªããã£ã³ã°æ©èœãåããŠãããWindowsãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ãšã®ç·å¯ãªçµ±åãå¯èœã§ããèªååããŒã«ãšããŠæé«ã¬ãã«ãšèšãããããããŸããããããæ®å¿µãªããšã«ãéçºè ã«ãšã£ãŠPowerShellãçŽ æŽãããããŒã«ãããããŠããæ©èœã¯ããµã€ããŒç¯çœªè ã«ãšã£ãŠãPowerShellãçŽ æŽãããããŒã«ã«å€ããŠããŸããŸããå®éã«ãäž»èŠãªãã«ãŠã§ã¢ãã¡ããªãŒã®90%以äžãPowerShellãäžæ£ãªç®çã§å©çšããŠããŸããAgentTeslaãGuLoaderãAsyncRatãDBatLoaderãLokiBotã¯ãã¹ãŠPowerShellãæªçšããŠããŸãã çŸåšã¯ããæ¥åžžçã«ãªã£ãŠããŸããããã®ãããªæªçšã¯ãã°ããã®éçºçãç¶ããŠããã2020幎ã«ããã®ãŒã£ãŠPowerShellããŒã¹ã®æ»æã®å€§èŠæš¡ãªæ¥å¢ã瀺ããŠããå ±åããããŸããPowerShellã¯ãããã®ãµã€ããŒç¯çœªè ãé»æ¢ããããã«åãçµãã§ããŸããããåé¿ããæ¹æ³ãçºèŠããŠåªåãç¶ããã ãã§ããã IoTïŒã¢ãã®ã€ã³ã¿ãŒãããïŒæ»æã®æ¥å¢ IoTããã€ã¹ãžã®æ»æã¯2024幎äžåæã«å幎æ¯107%ãšããããããŠå€§å¹ ãªå¢å ãèšé²ããŠããŸããæ»æãå¢å ããŠããçç±ã¯äººã ãèããŠãã以äžã«åçŽã§ããIoTããã€ã¹ã®ã»ãã¥ãªãã£ãè¯ããªãåŸåã«ããããã§ããå€ãã®æ»æè ã¯ããçããããæšçã奜ã¿ãŸããIoTããã€ã¹ã¯æãçããããæšçã®1ã€ã§ãããã®ç¹ãšWindowsãªã©ã®äž»èŠãªãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ã®ã»ãã¥ãªãã£ãåäžããŠããäºå®ãåãããŠèãããšããããã®ãµã€ããŒç¯çœªè ã«ãšã£ãŠãã容æãªéžæè¢ã«ãªããŸãããã®æ¥å¢ã®æ倧ã®èŠå ã®1ã€ã¯ãTP-Linkã®ã³ãã³ãã€ã³ãžã§ã¯ã·ã§ã³ã®è匱æ§ã§ããCVE-2023-1389ã§ãããã®è匱æ§ã¯ãããã ãã§ãäžå°äŒæ¥ã®21.25%ã«åœ±é¿ãåãŒããŠããŸãããã®è匱æ§ãšä»ã®IoTæ»æãåããããšãæ¥æ¿ãªå¢å ã®çç±ãç解ã§ããŸãããŸãããããã®ããã€ã¹ã¯å€ãã®å ŽåéèŠãªã€ã³ãã©ã¹ãã©ã¯ãã£ã«çŽæ¥ã€ãªãã£ãŠãããããã¡ãŒã«ãŒããã€ã»ãã¥ãªãã£ã«ã€ããŠããçå£ã«èãå§ããã®ãå€æã«è¿·ããŸãã ããããŒïŒSonicWallã®2024幎çãµã€ããŒè åšã¬ããŒãäžéã¢ããããŒããããŠã³ããŒã æ¬æïŒ2024幎çãµã€ããŒè åšã¬ããŒãäžéã¢ããããŒãã¯ã2024幎äžåæã®ææ°ã®ã€ã³ããªãžã§ã³ã¹ããã¬ã³ããå®çšçãªã€ã³ãµã€ãã«ã€ããŠè©³ãã説æããŠããŸããSonicWallã«ããç¬èªã®è åšã€ã³ããªãžã§ã³ã¹ã®è©³çŽ°ã¯ãç¡æã®ã¬ããŒãå šæãä»ããå ¥æããŠã芧ãã ããã 詳现ã¯ãã¡ã