phishing and online scam in china - def con · characteristics of chinese phishing websites lottery...
TRANSCRIPT
![Page 1: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/1.jpg)
Phishing and Online Scams
in China
Joey Zhu
Trend Micro Inc.
![Page 2: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/2.jpg)
Who I am:
• Worked for Trend Micro Inc. (2005 – Present)
• Rich experience with virus sandbox (2005 – 2008)
• Rich experience as a JavaScript analyzer (2008 – Present)
• Web threat expert, focusing on HTML/Javascript
exploits
• Now interested in phishing in China
![Page 3: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/3.jpg)
Only 3% of phishing occurs in China
Do you believe this number?
![Page 4: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/4.jpg)
All vendors
don’t focus on China
100+ phishing QQ sites found among 4M traffic
(reported by Trend Micro)
![Page 5: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/5.jpg)
Phisher’s bonus:
Large population
QQ.com: 640 Million
Taobao.com: 300 Million
Passengers at Spring Festival: 280 Million
Global WoW: 10 Million
![Page 6: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/6.jpg)
Hot Phishing Eventtarget www.boc.com
• Over 500 phishing site in Feb
• Spread via SMS message
• Also includes other banks
– CEB/SDB
![Page 7: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/7.jpg)
Vulnerable Validation Procedures
E-Token from www.boc.com
• Password invalid
after 60 seconds
• www.bocxx.com
![Page 8: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/8.jpg)
Phishing in China
• More prevalent than drive-by websites
• Three categories:
– lottery scams (most common), fake websites, fraudulent websites
fake websites/仿冒著名网站仿冒著名网站仿冒著名网站仿冒著名网站 fraudulent websites /欺诈网站欺诈网站欺诈网站欺诈网站 lottery scam/中奖骗局中奖骗局中奖骗局中奖骗局
![Page 9: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/9.jpg)
Lottery Scambeyond traditional private information leakage
• Over 70% of scams, making it the No. 1 category
• Fake webpages such as QQ, games & CCTV
![Page 10: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/10.jpg)
A typical lottery scam
Step 1. IM/Email message: “Lucky you, go won a prize…”
Step 2. A phishing webpage pretends to be the
official site like QQ.com or CCTV.com, …
Step 3. After clicking, the phishing site will ask
users to pay income tax or notary fees first.
![Page 11: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/11.jpg)
Where does the Phishing URL come from?
Chinese Instant Messenger
• A special phenomenon in China
• Notably from QQ & Aliwangwang/阿里旺旺阿里旺旺阿里旺旺阿里旺旺
![Page 12: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/12.jpg)
Where does the Phishing URL come from?
Comprised of a website & injected with Iframe
in order to deliver phishing message
Money Driven
![Page 13: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/13.jpg)
Fraudulent Websites
New Phishing without Target BrandDelivered by AdWords
![Page 14: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/14.jpg)
Scams with Stocks & Securitiesfor membership fees
![Page 15: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/15.jpg)
Taobao Phishing == Money
• Over 80 billion dollars in 2010
• AliPay = Paypal
• Supported by most Chinese eBanks
![Page 16: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/16.jpg)
Taobao Phishing Demo
![Page 17: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/17.jpg)
Phishing Web Site Source Code
• Active market
• Sell at a price < ¥¥¥¥1000
• Copied from a template
![Page 18: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/18.jpg)
Source Code and Framework
![Page 19: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/19.jpg)
Summary
Characteristics of Chinese Phishing Websites
� Lottery scam is targeted to a few branded websites which are
then faked: QQ, Taobao, CCTV
� Scams/fraudulent websites are so popular and go beyond the
traditional phishing scope
� Short uptime of phishing websites because they are easy to create
� Visual/content similarity among fake websites
� URLs are propagated by IMs, BlackSeo or Comprised Servers
![Page 20: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/20.jpg)
![Page 21: Phishing and Online Scam in China - DEF CON · Characteristics of Chinese Phishing Websites Lottery scam is targeted to a few branded websites which are then faked: QQ, Taobao, CCTV](https://reader034.vdocument.in/reader034/viewer/2022042912/5f45a2f8740d5d0f980a5028/html5/thumbnails/21.jpg)
Thanks