https://blog.ast.moe/en/tags/security/Recent posts: GorimuchuHugohttps://blog.ast.moe/en/blog/2026-10-09/Fri, 09 Oct 2026 10:03:32 +0900https://blog.ast.moe/en/blog/2026-10-09/<p>In the previous article (<a href="https://blog.ast.moe/en/blog/2026-10-08-3/">source</a>), we introduced Izanagi, which isolates and runs development commands while recording file accesses and network communications. This time, we discuss the addition of behavior analysis using Jev.</p> <p>Existing detection rules issue warnings based on a single action—such as an attempt to open a secret file, a connection to an address outside the allowed list, or the execution of an unexpected command. In addition, we have made it possible to link multiple actions together in chronological order.</p>https://blog.ast.moe/en/blog/2026-10-08-3/Thu, 08 Oct 2026 22:24:12 +0900https://blog.ast.moe/en/blog/2026-10-08-3/<p>When you run <code>npm install</code>, it not only downloads the package but may also execute scripts that the package provides. If you run that code in your regular development environment, you can access files readable by the executing user and the environment variables passed to the process.</p> <p>To isolate such development commands and track what they access, we have built Izanagi in Rust (<a href="https://github.com/ieee0824/izanagi">source</a>). It records file accesses, network communications, and child‑process launches so you can examine the behavior of the executed code.</p>https://blog.ast.moe/en/blog/2026-10-07/Thu, 08 Oct 2026 06:58:01 +0900https://blog.ast.moe/en/blog/2026-10-07/<p>I was just wondering how a YubiKey actually performs authentication.</p> <p>I started using the YubiKey 5C NFC in 2023, and later I also bought a USB‑A model. At the time I introduced it to protect my 1Password account, planning to register one key for everyday carry and another as a spare kept at home. (<a href="https://blog.ast.moe/blog/2023-01-27/">source</a>) (<a href="https://blog.ast.moe/blog/2023-03-07/">source</a>)</p> <p>You plug it into a USB port and touch it when needed. With a smartphone you use NFC. The user interaction is minimal, but I’ve never taken the time to understand exactly what’s happening behind the scenes.</p>https://blog.ast.moe/en/blog/2026-09-26/Sat, 26 Sep 2026 07:06:58 +0900https://blog.ast.moe/en/blog/2026-09-26/<p>During the development of Omoikane, I happened to notice that the internal <code>__omoikane_*</code> function was visible from the page’s JavaScript. By examining the code, I confirmed through static analysis that passing a different Document or Node ID could create a path that reaches the DOM, cookies, or storage of a cross‑origin document without going through the same‑origin policy. I did not create a proof‑of‑concept that actually reproduced the read/write behavior before the fix. After the fix, I verified in regression tests that cross‑origin access is properly blocked.</p>