2016年8月29日 星期一

恐嚇廣告

昨天我在用手機看影集時, 突然跳出一個新分頁
看完內文之後,第一時間反應是…關掉!我急著看影片

後來覺得有幾點還蠻有趣的
所以,我再度把它打開來研究





先觀察

  1. 網址(URL)是偽網址,讓人誤以為是Google給你的訊息。結尾的".xyz"域名也太不認真了。(也許是想kuso吧)
  2. 使用Google的圖片,和 1. 相同的原因
  3. 時間倒數,故意使人緊張。
  4. 手機開始會每一秒震動一次,讓你不注意也不行。(這蠻有趣的)
  5. 內文簡單來說,就是發現手機中有病毒,要你快點去下載APP。(簡中/繁中夾雜,看了就不高興)

這是恐嚇網頁,主要目的是要讓你去下載某個惡意程式,下載並執行之後理所當然地就中毒了
我故意下載看看,是一個APP(*.apk)
檔名我沒去記,因為名字是可以隨便取的

所以這個惡意程式還是得要安裝,並且要使用者給予權限
不過通常也沒人會去注意APP要求什麼權限拉

上網 GOOGLE,在今年5月就有新聞了
當時是會連到 Google play,下載某防毒軟體(我沒有說是像"CM Security"之類的)

我試著照著它流程走,會連到Google play的 SuperB Cleaner(Boost&Clean) 頁面)
Google play基本上算安全,所以這個恐嚇網頁本質上仍是騙你下載,衝流量的

試著玩一下


先在桌機試看看,貼上URL看看
[http://s.system-online-service.xyz/imo/ansapp580061/2/index.htm?models=%2AUNKNOWN&isp=Android+6.0.1&a001=trk.googleplay&b001=trk.yahoo.xyz&c001=trk.loadingcontent.xyz&d001=trk.amazon.xyz]


OK,看來需要在手機上跑才看得到原始碼
在手機Chrome,使用view-source可以得到網頁原始碼
view-source:<url>
# 可以得到網頁原始碼

原始碼為
  1. <html><head>
  2. <script>
  3. var suffixurl = (location.search.length > 0 ? location.search.substring(1) : "");
  4. function getURLParameter(name) {
  5. return decodeURI(
  6. (RegExp(name + '=' + '(.+?)(&|$)').exec(location.search)||[,null])[1] || ''
  7. );
  8. }
  9. if(getURLParameter('isp') == "" || typeof getURLParameter('isp') == 'undefined')
  10. {
  11. document.location.replace("index.htm?" + suffixurl);
  12. }
  13.  
  14.  
  15. if(typeof window.orientation == 'undefined')
  16. {
  17. document.location.replace("index.htm?" + suffixurl);
  18. }
  19. </script>
  20. <script>
  21.  
  22. function getURLExtParameter(name, replaceisp='isp'){
  23. var models = getURLParameter(name);
  24. if(!models || models.toLowerCase().indexOf("unknow") >= 0){
  25. models = getURLParameter(replaceisp);
  26. }
  27. if(models)
  28. models = decodeURIComponent(models).replace(/\+/g, ' ');
  29. return models;
  30. }
  31.  
  32. </script>
  33.  
  34. <meta charset="utf-8">
  35. <meta name="viewport" content="width=device-width, initial-scale=1.0,maximum-scale=1.0, user-scalable=no">
  36.  
  37. <title>Google</title>
  38. <link rel="icon" href="logo11.png">
  39.  
  40. <style type="text/css">
  41. a {
  42. color: #585858;
  43. }
  44.  
  45. body {
  46. background-color: #fff;
  47. color: #646464;
  48. margin: 0;
  49. line-height:150%;
  50. }
  51.  
  52. h1 {
  53. color: #000;
  54. font-size: 1.4em;
  55. }
  56.  
  57. .hidden {
  58. display: none;
  59. }
  60.  
  61. html {
  62. -webkit-text-size-adjust: 100%;
  63. font-size: 125%;
  64. }
  65.  
  66. .interstitial-wrapper {
  67. padding-top: 20px;
  68. box-sizing: border-box;
  69. font-size: 1em;
  70.  
  71. margin: auto;
  72. max-width: 600px;
  73. width: 90%;
  74. }
  75.  
  76. h1 {
  77. margin-top: 10px;
  78. }
  79.  
  80. a {
  81. color: rgb(17,85,204);
  82. text-decoration: none;
  83. }
  84.  
  85. #blink {
  86. color: #ff0000;
  87. padding-bottom: 2px;
  88. padding-top: 10px;
  89. -webkit-animation: blink 1s infinite;
  90. -moz-animation: blink 1s infinite;
  91. -ms-animation: blink 1s infinite;
  92. -o-animation: blink 1s infinite;
  93. animation: blink 1s infinite;
  94. }
  95.  
  96. @-webkit-keyframes blink {
  97. 0% {
  98. opacity: 1.0;
  99. }
  100.  
  101. 50% {
  102. opacity: 0.0;
  103. }
  104.  
  105. 100% {
  106. opacity: 1.0;
  107. }
  108. }
  109.  
  110. @-moz-keyframes blink {
  111. 0% {
  112. opacity: 1.0;
  113. }
  114.  
  115. 50% {
  116. opacity: 0.0;
  117. }
  118.  
  119. 100% {
  120. opacity: 1.0;
  121. }
  122. }
  123.  
  124. @-ms-keyframes blink {
  125. 0% {
  126. opacity: 1.0;
  127. }
  128.  
  129. 50% {
  130. opacity: 0.0;
  131. }
  132.  
  133. 100% {
  134. opacity: 1.0;
  135. }
  136. }
  137. }
  138.  
  139. @-o-keyframes blink {
  140. 0% {
  141. opacity: 1.0;
  142. }
  143.  
  144. 50% {
  145. opacity: 0.0;
  146. }
  147.  
  148. 100% {
  149. opacity: 1.0;
  150. }
  151. }
  152.  
  153. @keyframes blink {
  154. 0% {
  155. opacity: 1.0;
  156. }
  157.  
  158. 50% {
  159. opacity: 0.0;
  160. }
  161.  
  162. 100% {
  163. opacity: 1.0;
  164. }
  165. }
  166. </style>
  167. </head>
  168. <body onload="translate()" class="offline" style="font-family: Helvetica, sans-serif; font-size: 75%;">
  169. <div id="main-frame-error" class="interstitial-wrapper">
  170. <div id="main-content">
  171. <image overflow="visible" width="150" height="53" src="logo.png"></image>
  172.  
  173. <div id="today"></div>
  174. <div id="main-message" style="clear: both;">
  175. <h1 id="headTxt2" style="">
  176. <span id="headingtext"><script>document.write(getURLExtParameter('models', 'isp'))</script> <div id='blink'><div id="NO1"></div></div></span></h1>
  177. <div id="subhead" style="margin-bottom: 1px; color: black; font-weight: bold;"><div id="NO2"></div></div>
  178. <div id="bodytxt" style="">
  179.  
  180. <image overflow="visible" width="100" height="104" src="404.png" style="float:right;"></image>
  181.  
  182. <span style="font-size:18px;font-weight:bold;color:red;font-family:sans-serif;" id="timer"></span>
  183. <div id="successScan" style="margin-bottom:8px"></div>
  184. <div id="NO3"></div> <br> </div>
  185. </div>
  186. </div>
  187. <div id="details" class="" jstcache="0">
  188. <div jsselect="summary" jstcache="5">
  189. <span style="text-align:center;display:block;">
  190. <a id="NO4" href="" style="box-sizing: border-box;padding:10px 15px;color:#fff;border-radius:3px;width: 100%;display: block;background: #0370ea;
  191. background: -moz-linear-gradient(top,#008dfd 0,#0370ea 100%);
  192. background: -webkit-gradient(linear,left top,left bottom,color-stop(0,#008dfd),color-stop(100%,#0370ea));
  193. background: -webkit-linear-gradient(top,#008dfd 0,#0370ea 100%);
  194. background: -o-linear-gradient(top,#008dfd 0,#0370ea 100%);
  195. background: -ms-linear-gradient(top,#008dfd 0,#0370ea 100%);
  196. background: linear-gradient(top,#008dfd 0,#0370ea 100%);" rel="noreferrer"></a>
  197. </span>
  198. </div>
  199. <div style="text-align:center;margin:0 auto;margin-top:20px;"><a id="NO404" href="" rel="noreferrer"><img src="googleplaylogo.png" border="0"></a></div>
  200. </div>
  201. </div>
  202.  
  203. <br>
  204.  
  205. <div id="musicplace"><audio id="music" autoplay="autoplay" loop="loop">
  206. <source src="alert.mp3" type="audio/mpeg">
  207. <source src="alert.oga" type="audio/mpeg">
  208. </audio>
  209. </div>
  210.  
  211. <script type="text/javascript">document.getElementById("NO4").href="http://"+getURLParameter('c001')+"/go.php";</script>
  212. <script type="text/javascript">document.getElementById("NO404").href="http://"+getURLParameter('c001')+"/go.php";</script>
  213. <script type="text/javascript" src="language.js"></script>
  214.  
  215. <script type="text/javascript">
  216. ! function () {
  217. var t;
  218. try {
  219. for (t = 0; 10 > t; ++t) history.pushState({}, "", "#");
  220. onpopstate = function (t) {
  221. t.state && location.replace("http://"+getURLParameter('c001')+"/go.php");
  222. }
  223. } catch (o) {}
  224. }();
  225. </script>
  226.  
  227.  
  228. </body></html>

可以看一下language.js
[http://s.system-online-service.xyz/imo/ansapp580061/2/language.js]
  1. setTimeout ('changeLanguage()',1);
  2. setTimeout ('pausemusic()',1400);
  3. setTimeout ('showAlert()',825);
  4. setTimeout ('pausetime()',90000);
  5.  
  6. function pausemusic(){
  7. document.getElementById('musicplace').innerHTML = '';
  8. }
  9.  
  10. function pausetime(){
  11. document.getElementById('timer').style.display = 'none';
  12. }
  13.  
  14. function changeLanguage()
  15. {
  16.  
  17. var type=navigator.appName
  18. if (type=="Netscape"){
  19. var lang = navigator.language
  20. }
  21. else{
  22. var lang = navigator.userLanguage
  23. }
  24.  
  25. var lang = lang.substr(0,2)
  26.  
  27. if (lang == "zh"){
  28.  
  29. document.getElementById('NO1').innerHTML = '您的手機發現 (22) 個病毒!';
  30. document.getElementById('NO2').innerHTML = '這些手機病毒即將損壞您的電池.為了您的設備安全,系統將永久關機.<br><br>';
  31. document.getElementById('NO3').innerHTML = '<strong>請立即按下列步驟清除病毒:</strong><br><strong>第一步:</strong> 點擊"刪除病毒",到Google Play下載官方免費殺毒APP.<br><strong>第二步:</strong> 打開APP,清除電池病毒並恢復系統運行速度.';
  32. document.getElementById('NO4').innerHTML = '刪除病毒';
  33.  
  34. }
  35.  
  36. else if (lang == "ms"){
  37.  
  38. document.getElementById('NO1').innerHTML = 'Amaran!';
  39. document.getElementById('NO2').innerHTML = 'Telefon anda mempunyai (2) Virus dan baterinya telah rosak!<br><br>';
  40. document.getElementById('NO3').innerHTML = '<strong>Bagaimana membaiki bateri anda:</strong><br><strong>Langkah 1:</strong>Ketik butang di bawah dan pergi ke Google Play Store untuk memasang aplikasi alih keluar virus dengan percuma.<br><strong>Langkah 2:</strong>Mengalih keluar semua virus dan membaiki bateri anda.';
  41. document.getElementById('NO4').innerHTML = 'Alih Keluar Virus Sekarang';
  42.  
  43. }
  44.  
  45. else if (lang == "de"){
  46.  
  47. document.getElementById('NO1').innerHTML = 'Ihre Batterie ist stark beschädigt!';
  48. document.getElementById('NO2').innerHTML = 'Wir haben einen Virus auf Ihrem Telefon gefunden! <br>Um einen Komplettverlust zu vermeiden, Muss die Batterie jetzt repariert werden.<br><br>';
  49. document.getElementById('NO3').innerHTML = '<strong>Wie Sie Ihren Akku reparieren:</strong><br><strong>Schritt 1:</strong>Die untenstehende Schaltfläche antippen & auf Google Play Store gehen, um die kostenlose App zu installieren, die zur Virenentfernung empfohlen wird.<br><strong>Schritt 2:</strong>Wöchentlich auf Viren prüfen, Um sicherzustellen, Dass Ihr Telefon virenfrei ist.';
  50. document.getElementById('NO4').innerHTML = 'Den Akkuvirus jetzt entfernen';
  51.  
  52.  
  53. }
  54.  
  55. else if (lang == "it"){
  56.  
  57. document.getElementById('NO1').innerHTML = 'Avviso di sistema!';
  58. document.getElementById('NO2').innerHTML = 'Sono stati rilevati (2) virus e la batteria è stata infettata e danneggiata.<br><br>';
  59. document.getElementById('NO3').innerHTML = "<strong>Come riparare la batteria:</strong><br><strong>Fase 1:</strong>tocca il pulsante sottostante per accedere al Google Play Store e installare gratuitamente l'applicazione consigliata per la rimozione dei virus.<br><strong>Fase 2:</strong>esegui l'applicazione per rimuovere tutti i virus e riparare la batteria.<br><strong>Fase 3:</strong>Mantieni l'app per almeno 3 giorni per eliminare completamente i virus e prevenire ulteriori attacchi.";
  60. document.getElementById('NO4').innerHTML = 'Rimuovi i virus della batteria ora';
  61.  
  62. }
  63.  
  64. else if (lang == "es"){
  65.  
  66. document.getElementById('NO1').innerHTML = 'El teléfono dispone de (3) Virus!';
  67. document.getElementById('NO2').innerHTML = 'Amenaza de: Backdoor.Battery.OS.Obad.a/.b/.f. Si no eliminas los virus ahora, ocasionará más daños graves a tu móvil.<br><br>';
  68. document.getElementById('NO3').innerHTML = '<strong>Cómo arreglar tu teléfono:</strong><br><strong>Paso 1:</strong>Pulse el botón de abajo y vaya a Google Play para instalar de forma gratuita la aplicación recomendada de eliminación de virus.<br><strong>Paso 2:</strong>Abra la aplicacion para arreglar tu teléfono.<br><strong>Paso 3:</strong>mantén la app mínimo 3 días para borrar completamente todos los virus y prevenir ataques posteriores.';
  69. document.getElementById('NO4').innerHTML = 'Eliminar Virus';
  70.  
  71. }
  72.  
  73. else if (lang == "tr"){
  74.  
  75. document.getElementById('NO1').innerHTML = 'Sistem Uyarısı!';
  76. document.getElementById('NO2').innerHTML = 'cihazınızda (2) virüs bulundu ve pile de bulaşmış ve hasar görmüş!<br><br>';
  77. document.getElementById('NO3').innerHTML = "<strong>Pilinizi nasıl onaracaksınız:</strong><br><strong>Adım 1:</strong>Aşağıdaki düğmeye dokunun ve önerilen virüs silme uygulamasını Google Play Store'dan ücretsiz olarak kurun.<br><strong>Adım 2:</strong>Tüm virüsleri silmek ve pilinizi onarmak için uygulamayı çalıştırın.";
  78. document.getElementById('NO4').innerHTML = 'ŞİMDİ HIZLI REPAIR';
  79.  
  80. }
  81.  
  82. else if (lang == "ar"){
  83.  
  84. document.getElementById('NO1').innerHTML = 'تحذير ';
  85. document.getElementById('NO2').innerHTML = 'جهاز لديك مصاب بفيروس والبطارية تالفة<br><br>';
  86. document.getElementById('NO3').innerHTML = "اضغط على الزر أدناه وانتقل إلى Google Play لتثبيت التطبيق الموصى به لإزالة الفيروسات مجانا<br><br>";
  87. document.getElementById('NO4').innerHTML = 'إزالة فيروس البطارية الآن';
  88.  
  89. }
  90.  
  91. else if (lang == "ja"){
  92.  
  93. document.getElementById('NO1').innerHTML = 'システム警告!';
  94. document.getElementById('NO2').innerHTML = '(22)個のウイルスが検出され、バッテリーが感染して破損していることが分かりました。<br><br>';
  95. document.getElementById('NO3').innerHTML = '<strong>バッテリーの修複方法:</strong><br><strong>ステップ1:</strong> 下のボタンをタップしてGoogle Playストアに移動します。おすすめのウイルス削除アプリを無料でインストールします。<br><strong>ステップ2:</strong> アプリを起動させ、全てのウイルスを削除してバッテリーを修復します。';
  96.  
  97. document.getElementById('NO4').innerHTML = 'ウイルスを除去';
  98.  
  99. }
  100.  
  101. else if (lang == "ko"){
  102.  
  103. document.getElementById('NO1').innerHTML = '시스템 경고!';
  104. document.getElementById('NO2').innerHTML = '귀하의 휴대 전화는 (2) 바이러스가있다! 에서 검출되었으며 배터리가 감염되었고 손상되었습니다.<br><br>';
  105. document.getElementById('NO3').innerHTML = '<strong>배터리를 복구하는 방법:</strong> <br><strong>1 단계: </strong> 아래 버튼을 누르고 Google Play Store로 이동하여 무료로 권장하는 바이러스 제거 앱을 설치합니다.<br><strong>2 단계: </strong>앱을 실행하여 모든 바이러스를 제거하고 배터리를 복구합니다.<br><strong>3 단계: </strong>모든 바이러스를 완전히 정리하고 추가 공격을 방지하기 위해 최소 3일 동안 앱을 유지하십시오.';
  106.  
  107. document.getElementById('NO4').innerHTML = '바이러스를 제거';
  108.  
  109. }
  110.  
  111. else{
  112.  
  113. document.getElementById('NO1').innerHTML = 'Warning! (22) Virus Detected!';
  114. document.getElementById('NO2').innerHTML = 'If you do not remove the virus from your device immediately, your battery will be infected and your device will be shut down permanently!<br><br>';
  115. document.getElementById('NO3').innerHTML = '<strong>Here is what you should do immediately:</strong><br><br><strong>Step 1:</strong> Tap the "Remove Battery Virus" button below to install official virus removal App from Google play for Free.<br><strong>Step 2:</strong> Run the app to remove all virus & repair your battery.';
  116.  
  117. document.getElementById('NO4').innerHTML = 'Remove Battery Virus';
  118. }
  119.  
  120. }
  121.  
  122.  
  123. function showAlert(){
  124. var type=navigator.appName
  125. if (type=="Netscape"){
  126. var lang = navigator.language
  127. }
  128. else{
  129. var lang = navigator.userLanguage
  130. }
  131. var lang = lang.substr(0,2)
  132.  
  133. if (lang == "zh"){
  134. alert("警告!您的手機發現病毒!\n\n病毒即將損壞您的電池。\n\n請按照說明刪除該病毒");
  135. _showMessage(window, "****************\n\n 警告! \n\n 離開此頁面後果自負! \n\n ****************");
  136. _performEvent(navigator);
  137. }
  138. else if (lang == "ja"){
  139. alert("システム警告!");
  140. _showMessage(window, "****************\n\n手順に従い攜帯を修復してください。\n\n ウィンドウを閉じないでください。\n\n 閉じる場合は自己責任となります! \n\n ****************");
  141. _performEvent(navigator);
  142.  
  143. }
  144. else if (lang == "ko"){
  145. alert("시스템 경고!");
  146. _showMessage(window, "****************\n\n 휴대폰을 수정하기 위해 지침을 계속합니다. 이 창을 닫지 마십시오.\n\n 자체 위험에서 종료.****************");
  147. _performEvent(navigator);
  148. }
  149. else if (lang == "ms"){
  150. alert("Amaran!");
  151. _showMessage(window, "****************\n\n Amaran! \n\n Jika anda keluar daripada aplikasi,\n\n anda perlu menanggung semua risiko. \n\n ****************");
  152. _performEvent(navigator);
  153. }
  154. else if (lang == "de"){
  155. alert("System warnung!");
  156. _showMessage(window, "****************\n\n Systemwarnung! \n\n Fahren Sie mit den Anweisungen fort, um das Telefon zu reparieren. Schließen Sie dieses Fenster nicht.\n\n Beenden auf eigene Gefahr.\n\n****************");
  157. _performEvent(navigator);
  158. }
  159. else if (lang == "it"){
  160. alert("Avviso di sistema!");
  161. _showMessage(window, "****************Avviso di sistema! \n\n Segui le istruzioni per riparare il telefono. Non chiudere questa finestra.\n\n Esci a tuo rischio e pericolo!****************");
  162. _performEvent(navigator);
  163. }
  164. else if (lang == "es"){
  165. alert("Advertencia!");
  166. _showMessage(window, "****************\n\n Advertencia! \n\n Continua con las instrucciones para arregular tu telefono. \n\n No cierres la ventana.\n\n****************");
  167. _performEvent(navigator);
  168. }
  169. else if (lang == "tr"){
  170. alert("Sistem Uyarısı!");
  171. _showMessage(window, "****************\n\n Sistem Uyarısı!\n\n Telefonu düzeltmek için talimatları izleyin.\n\n Bu pencereyi kapatmayın.\n\n Çıkmanın riski size aittir! \n\n ****************");
  172. _performEvent(navigator);
  173. }
  174. else if (lang == "ar"){
  175. alert("تحذير! ");
  176. _showMessage(window, "****************\n\n تحذير! \n\n يرجى مواصلة التعليمات لإصلاح الهاتف. لا تغلق هذه النافذة \n\n ****************");
  177. _performEvent(navigator);
  178. }
  179. else {
  180. alert("WARNING! Virus detected! \n\n Please follow the instructions to remove the Virus.");
  181. _showMessage(window, "****************\n\nWARNING! Virus detected!\n\n Please follow the instructions to remove the Virus! \n\n Exit at your own risk!\n\n ****************");
  182. _performEvent(navigator);
  183. }
  184.  
  185.  
  186. }
  187.  
  188. //timer script
  189. var sec = 29; // set the seconds
  190. var min = 01; // set the minutes
  191. function countDown() {
  192. sec--;
  193. if (sec == -01) {
  194. sec = 59;
  195. min = min - 1;
  196. } else {
  197. min = min;
  198. }
  199. if (sec<=9) { sec = "0" + sec; }
  200. time = (min<=9 ? "0" + min : min) + " : " + sec;
  201. if (document.getElementById) { document.getElementById('timer').innerHTML = time; }
  202. SD=window.setTimeout("countDown();", 1000);
  203. if (min == '00' && sec == '00') { sec = "00"; window.clearTimeout(SD); }
  204. }
  205. window.onload = countDown;
  206.  
  207.  
  208. function _showMessage(e, t){
  209. function n(){for(var e=document.getElementsByTagName("meta"),t=0;t<e.length;++t)if(-1!==e[t].httpEquiv.search(/refresh/i)){var n=e[t].content.match(/\d+/);if(n)return 1e3*parseInt(n[0])}return!1}var a,r=(new Date).valueOf();document.onclick=function(e){try{var t=e?e.target:event.srcElement;"a"===t.tagName.toLowerCase()&&(a=!0)}catch(n){a=!0}},e.onbeforeunload=function(c){var o=n();if(o!==!1){var i=(new Date).valueOf()-r;if(Math.abs(i-o)<500)return}return a||e._clicked?void 0:t}
  210. }
  211.  
  212. function _performEvent(e){
  213. try{var a=e.vibrate||e.webkitVibrate||e.mozVibrate||e.msVibrate;a&&a.call(e,[666,333,666,333,666,333,666,333,666,333,666,333,666,333])}catch(t){}
  214. }

OK,其實我花這麼久時間,只要想找手機震動的方法是什麼而已XD
有興趣的人可以去查查 navigator.vibrate

對了,如果點button之後
會導向URL [http://trk.loadingcontent.xyz/go.php]
內容應該是再導頁到其它URL

@update 2016/12/16
昨天跳出一個新頁面出來時,本能反應要拉下來、關掉時,看見
呵呵,google開始擋了

然後,沒過多久就又看見全新風格的頁面
只是這次沒有掛 google名字XD
忘了截圖,SAD

沒有留言:

張貼留言