{"id":540,"date":"2014-06-13T17:51:32","date_gmt":"2014-06-13T09:51:32","guid":{"rendered":"http:\/\/wx.wosign.com\/?p=540"},"modified":"2014-06-13T17:51:32","modified_gmt":"2014-06-13T09:51:32","slug":"%e7%a7%bb%e5%8a%a8%e6%81%b6%e6%84%8f%e7%a8%8b%e5%ba%8f%e6%95%b0%e9%87%8f%e7%a0%b4200%e4%b8%87%e5%8d%8a%e5%b9%b4%e5%86%85%e6%95%b0%e5%ad%97%e7%bf%bb%e5%80%8d","status":"publish","type":"post","link":"https:\/\/wx.wosign.com\/?p=540","title":{"rendered":"\u79fb\u52a8\u6076\u610f\u7a0b\u5e8f\u6570\u91cf\u7834200\u4e07!\u534a\u5e74\u5185\u6570\u5b57\u7ffb\u500d"},"content":{"rendered":"

\u3000\u968f\u7740\u667a\u80fd\u79fb\u52a8\u8bbe\u5907\u7684\u5feb\u901f\u666e\u53ca\uff0c\u76f8\u5173\u7684\u6076\u610fAPP\u4e5f\u4ee5\u60ca\u4eba\u7684\u901f\u5ea6\u4e0d\u65ad\u6210\u957f\u3002\u8fd1\u65e5\uff0c\u5168\u7403\u670d\u52a1\u5668\u5b89\u5168\u3001\u865a\u62df\u5316\u5b89\u5168\u53ca\u4e91\u5b89\u5168\u5382\u5546\u8d8b\u52bf\u79d1\u6280\u516c\u5e03\uff0c\u5728\u6076\u610f\u53ca\u9ad8\u98ce\u9669\u7684\u79fb\u52a8APP\u7a81\u7834100\u4e07\u5173\u5361\u540e\u7684\u534a\u5e74\u5185\uff0c\u8be5\u6570\u5b57\u53c8\u7ffb\u4e86\u4e00\u500d\uff0c\u5df2\u7ecf\u7a81\u7834200\u4e07\u5927\u5173!\u6709\u9274\u4e8e\u6b64\uff0c\u8d8b\u52bf\u79d1\u6280\u518d\u5ea6\u547c\u5401\u79fb\u52a8\u8bbe\u5907\u7528\u6237\uff0c\u52a1\u5fc5\u4ed4\u7ec6\u7b5b\u9009\u79fb\u52a8APP\u3001\u907f\u514d\u5f00\u542f\u4e0d\u660e\u7684\u7f51\u5740\u3001\u5220\u9664\u53ef\u7591\u7684\u4fe1\u606f\uff0c\u4ee5\u53ca\u5b89\u88c5\u6709\u4fe1\u8a89\u7684\u79fb\u52a8\u9632\u62a4\u7a0b\u5e8f\u7b49\uff0c\u4ee5\u4fdd\u969c\u81ea\u5df1\u79fb\u52a8\u8bbe\u5907\u7684\u5b89\u5168\u3002
\n\u3000\u3000\u8d8b\u52bf\u79d1\u6280(\u4e2d\u56fd\u533a)\u9ad8\u7ea7\u4ea7\u54c1\u7ecf\u7406\u5218\u653f\u5e73\u8868\u793a\uff1a\u201c\u4ec5\u57282013\u5e74\uff0c\u6211\u4eec\u5c31\u53d1\u73b0\u4e86100\u4e07\u4e2a\u65b0\u7684Android \u5a01\u80c1\uff0c\u53ef\u4ee5\u9884\u89c1\u672a\u6765\u7f51\u7edc\u72af\u7f6a\u8005\u52bf\u5fc5\u7ee7\u7eed\u89ca\u89ce\u79fb\u52a8\u8bbe\u5907\u3002\u800c\u5728\u79fb\u52a8\u8bbe\u5907\u6076\u610f\u7a0b\u5e8f\u521a\u6ee1\u5341\u5468\u5e74\u7684\u73b0\u5728\uff0c\u5c31\u5df2\u7ecf\u7a81\u7834200\u4e07\u7684\u5927\u5173\uff0c\u53ef\u4ee5\u9884\u89c1\u672a\u6765\u79fb\u52a8\u8bbe\u5907\u7684\u9632\u62a4\u91cd\u8981\u6027\u8d8a\u6765\u8d8a\u9ad8\uff0c\u7528\u6237\u52a1\u5fc5\u5f00\u59cb\u63d0\u9ad8\u8b66\u60d5\u6027\uff0c\u5e76\u5b89\u88c5\u79fb\u52a8\u5b89\u5168\u9632\u62a4\u7a0b\u5e8f\u4ee5\u4fdd\u969c\u4e2a\u4eba\u4fe1\u606f\u3002\u201d
\n\u79fb\u52a8\u6076\u610f\u7a0b\u5e8f\u6570\u91cf\u6b63\u5f0f\u7a81\u7834200\u4e07!\u534a\u5e74\u5185\u6570\u5b57\u7ffb\u500d
\n\"wKioL1M-hsKCJhcwAAAwBCxiwic279\"<\/a>\u3000
\n\u3000\u3000\u3010\u6076\u610f\u53ca\u9ad8\u98ce\u9669\u7684\u79fb\u52a8APP\u5df2\u7a81\u7834200\u4e07\u3011
\n\u3000\u3000\u5218\u653f\u5e73\u8868\u793a\uff1a\u201c\u4e16\u754c\u4e0a\u7b2c\u4e00\u4e2a\u79fb\u52a8\u8bbe\u5907\u6076\u610f\u7a0b\u5e8f\u57282004\u5e74\u73b0\u8eab\uff0c\u662f\u4e00\u4e2a\u540d\u4e3a SYMBOS_CABIR \u7684\u6982\u5ff5\u9a8c\u8bc1 (PoC) \u6076\u610f\u7a0b\u5e8f\uff0c\u4e13\u95e8\u611f\u67d3\u8bfa\u57fa\u4e9a\u624b\u673a\u3002\u4f46\u76f4\u5230\u667a\u80fd\u624b\u673a\u51fa\u73b0\uff0c\u79fb\u52a8\u8bbe\u5907\u6076\u610f\u7a0b\u5e8f\u624d\u771f\u6b63\u4e00\u4e3e\u8dc3\u4e0a\u4fe1\u606f\u5b89\u5168\u5a01\u80c1\u821e\u53f0\u3002\u4ece\u4e00\u5f00\u59cb\u76f8\u5bf9\u65e0\u5bb3\u7684\u5f39\u51fa\u4fe1\u606f\uff0c\u79fb\u52a8\u8bbe\u5907\u6076\u610f\u7a0b\u5e8f\u4e00\u8def\u6f14\u5316\u5230\u73b0\u5728\u7684\u9ad8\u8d39\u7387\u670d\u52a1\u76d7\u7528\u7a0b\u5e8f\u3001\u4fe1\u606f\u7a83\u53d6\u7a0b\u5e8f\u3001\u540e\u95e8\u7a0b\u5e8f\uff0c\u751a\u81f3\u662fRootkit\u9ed1\u5ba2\u5de5\u5177\u3002\u201d
\n\u3000\u3000\u7136\u800c\uff0c\u5a01\u80c1\u4ecd\u5728\u6301\u7eed\u53d1\u5c55\u3002\u5728\u7a81\u7834\u4e86\u4e00\u767e\u4e07\u5173\u5361\u4e4b\u540e\uff0c\u79fb\u52a8\u8bbe\u5907\u6076\u610f\u7a0b\u5e8f\u5df2\u7ecf\u5f00\u59cb\u626e\u6f14\u5148\u9a71\u8005\u7684\u89d2\u8272\u3002\u8fd9\u4e9b\u6076\u610f\u7a0b\u5e8f\u5f88\u53ef\u80fd\u9884\u544a\u4e86\u672a\u6765\u6570\u4e2a\u6708\u5185\u5373\u5c06\u51fa\u73b0\u7684\u6076\u610f\u7a0b\u5e8f\u7c7b\u578b\u4e0e\u7279\u6027\uff0c\u4f8b\u5982\u5229\u7528TOR(Onion Router\u6d0b\u8471\u8def\u7531\u5668\uff0c\u4e00\u822c\u79f0\u4e3aTOR)\u9690\u533f\u884c\u8e2a\u3002TOR\u662f\u4e00\u79cd\u53ef\u4ee5\u8ba9\u7528\u6237\u5728\u7f51\u7edc\u4e0a\u201c\u533f\u540d\u201d\u7684\u5de5\u5177\uff0c\u5b83\u4e5f\u56e0\u4e0e\u7f51\u7edc\u5730\u4e0b\u5e02\u573a\u76f8\u5173\u800c\u95fb\u540d\u3002ANDROIDOS_TORBOT.A \u662f\u7b2c\u4e00\u4e2a\u4f7f\u7528 TOR \u6765\u8fde\u63a5\u8fdc\u7a0b\u670d\u52a1\u5668\u7684\u79fb\u52a8\u8bbe\u5907\u6076\u610f\u7a0b\u5e8f\u3002\u4e00\u65e6\u8fde\u4e0a\u4e4b\u540e\uff0c\u5b83\u5c31\u4f1a\u6267\u884c\u4e00\u4e9b\u6076\u610f\u884c\u4e3a\uff0c\u5982\u62e8\u6253\u7535\u8bdd\u3001\u62e6\u622a\u5e76\u8bfb\u53d6\u77ed\u4fe1\u3001\u5c06\u77ed\u4fe1\u53d1\u9001\u81f3\u7279\u5b9a\u53f7\u7801\u3002\u4f7f\u7528 TOR \u7f51\u7edc\u8ba9\u5b83\u7684\u884c\u8e2a\u66f4\u96be\u88ab\u8ffd\u67e5\uff0c\u4e5f\u66f4\u96be\u8ffd\u8e2a\u5176\u63a7\u5236\u670d\u52a1\u5668(C&C server)\u3002
\n\u3000\u3000DENDROID \u5927\u91cf\u7e41\u6b96
\n\u3000\u3000\u6211\u4eec\u5df2\u63d0\u5230\u79fb\u52a8\u8bbe\u5907\u6076\u610f\u7a0b\u5e8f\u7684\u6570\u91cf\u6b63\u4ee5\u60ca\u4eba\u901f\u5ea6\u4e0d\u65ad\u6210\u957f\u3002\u4f46\u968f\u7740\u79fb\u52a8\u8bbe\u5907\u8fdc\u7aef\u5b58\u53d6\u6728\u9a6c\u7a0b\u5e8f (RAT) \u7684\u51fa\u73b0\uff0c\u6709\u53ef\u80fd\u5f88\u5feb\u5c31\u4f1a\u6210\u4e3a\u5176\u6570\u91cf\u589e\u957f\u7684\u91cd\u5927\u5173\u952e\u3002
\n\u3000\u3000ANDROIDOS_DENDROID.HBT \u6076\u610f\u7a0b\u5e8f\u53ef\u6293\u53d6\u5c4f\u5e55\u622a\u56fe\u3001\u62cd\u7167\u3001\u5f55\u5f71\u53ca\u5f55\u97f3\uff0c\u6b64\u5916\uff0c\u5b83\u8fd8\u80fd\u7a83\u542c\u901a\u8bdd\u5185\u5bb9\u3002\u4f46\u662f\u771f\u6b63\u503c\u5f97\u5173\u6ce8\u7684\u662f\uff0cDENDROID\u540c\u65f6\u4e5f\u662f\u4e00\u79cd\u5728\u5e02\u573a\u4e0a\u9500\u552e\u7684\u72af\u7f6a\u5de5\u5177\u3002\u8be5\u6076\u610f\u7a0b\u5e8f\u4ee5300\u7f8e\u5143\u7684\u4ef7\u683c\u5728\u5730\u4e0b\u5e02\u573a\u8d29\u552e\uff0c\u5ba3\u79f0\u53ef\u4ee5\u8f7b\u6613\u5c06\u5408\u6cd5\u7684APP\u201c\u53d8\u6210\u6728\u9a6c\u7a0b\u5e8f\u201d(\u4e5f\u5c31\u662f\u6728\u9a6c\u5316)\u3002DENDROID \u63d0\u4f9b\u4e86APK\u6253\u5305\u5de5\u5177(Binder)\u3001APK\u5ba2\u6237\u7aef\u548c\u5e55\u540e\u63a7\u5236\u53f0\uff0c\u8ba9\u4e70\u5bb6\u80fd\u591f\u91cd\u65b0\u5305\u88c5\u5236\u4f5c\u597d\u7684APP\u7a0b\u5e8f\u3002\u66f4\u8ba9\u4eba\u62c5\u5fc3\u7684\u662f\uff0cDENDROID\u7adf\u7136\u53ef\u4ee5\u8eb2\u8fc7Google Bouncer\u7684\u5ba1\u6838\u673a\u5236\uff0c\u51fa\u73b0\u5728Google Play\u5546\u5e97\u4e2d\u3002
\n\u3000\u3000\u79fb\u52a8\u8bbe\u5907\u6210\u91c7\u77ff\u5de5\u5177
\n\u3000\u3000\u4e0d\u4ec5\u5982\u6b64\uff0c\u7f51\u7edc\u72af\u7f6a\u4e5f\u51fa\u73b0\u53e6\u4e00\u9879\u53d1\u5c55\uff0c\u90a3\u5c31\u662f\u5c06\u79fb\u52a8\u8bbe\u5907\u53d8\u6210\u91c7\u77ff\u5de5\u5177\u3002
\n\u3000\u3000ANDROIDOS_KAGECOIN.HBT \u5df2\u7ecf\u5177\u5907\u5f00\u91c7Bitcoin(\u6bd4\u7279\u5e01)\u3001Dogecoin \u3001Litecoin\u7b49\u865a\u62df\u8d27\u5e01\u7684\u80fd\u529b\uff0c\u800c\u4e14\u91c7\u77ff\u5de5\u4f5c\u53ea\u4f1a\u5728\u79fb\u52a8\u8bbe\u5907\u5145\u7535\u65f6\u8fdb\u884c\uff0c\u4ee5\u907f\u514d\u56e0\u4e3a\u8017\u7535\u91cf\u4e0d\u6b63\u5e38\u800c\u88ab\u53d1\u73b0\u3002\u4e0d\u7ba1\u8fd9\u9879\u5de5\u4f5c\u591a\u4e48\u9690\u853d\uff0c\u4ecd\u65e7\u4f1a\u5bf9\u79fb\u52a8\u8bbe\u5907\u9020\u6210\u5f71\u54cd\u3002\u865a\u62df\u8d27\u5e01\u7684\u5f00\u91c7\u9700\u8017\u8d39\u8d85\u8d8a\u624b\u673a\u6240\u80fd\u8d1f\u8377\u7684\u5927\u91cf\u8fd0\u7b97\uff0c\u56e0\u6b64\u7528\u6237\u53ef\u80fd\u4f1a\u53d1\u73b0\u624b\u673a\u53d8\u5f97\u5f88\u6162\u3002
\n\u3000\u3000\u79fb\u52a8\u8bbe\u5907\u5a01\u80c1\u65b0\u9886\u57df
\n\u3000\u3000\u503c\u5f97\u4e00\u63d0\u7684\u662f\uff0c\u79fb\u52a8\u8bbe\u5907\u6076\u610f\u7a0b\u5e8f\u4e5f\u7275\u6d89\u5230\u4e00\u4e9b\u6280\u672f\u9886\u57df\u7684\u70ed\u95e8\u8bdd\u9898\u3002TOR \u56e0\u4e3a\u7ebf\u4e0a\u9690\u79c1\u6743\u7684\u5173\u7cfb\u800c\u8d8a\u6765\u8d8a\u53d7\u5230\u5173\u6ce8\u548c\u6b22\u8fce\u3002\u800c\u968f\u8457\u5e01\u503c\u4e0d\u65ad\u6ce2\u52a8\uff0cBitcoin\u53caDogecoin\u4e4b\u7c7b\u7684\u865a\u62df\u8d27\u5e01\u6b63\u5feb\u901f\u83b7\u5f97\u7528\u6237\u9752\u775e\uff0c\u8fd9\u6b63\u9a8c\u8bc1\u4e86\u7f51\u7edc\u72af\u7f6a\u8005\u4f1a\u6293\u4f4f\u4efb\u4f55\u6709\u52a9\u5176\u62d3\u5c55\u7684\u5fae\u5c0f\u673a\u4f1a\u3002
\n\u3000\u3000\u5218\u653f\u5e73\u547c\u5401\uff0c\u968f\u8457\u79fb\u52a8\u8bbe\u5907\u6076\u610f\u7a0b\u5e8f\u7a81\u7834200\u4e07\u5173\u5361\uff0c\u7528\u6237\u52a1\u5fc5\u591a\u82b1\u4e00\u70b9\u65f6\u95f4\u6765\u4fdd\u62a4\u81ea\u5df1\u7684\u8bbe\u5907\u3002\u4ed4\u7ec6\u7b5b\u9009\u79fb\u52a8APP\u3001\u907f\u514d\u5f00\u542f\u4e0d\u660e\u7684\u7f51\u5740\u3001\u5220\u9664\u53ef\u7591\u7684\u4fe1\u606f\u548c\u7535\u5b50\u90ae\u4ef6\uff0c\u90fd\u80fd\u5bf9\u79fb\u52a8\u8bbe\u5907\u5b89\u5168\u6709\u6240\u5e2e\u52a9\u3002\u540c\u65f6\uff0c\u7528\u6237\u8fd8\u9700\u8981\u5bc6\u5207\u6ce8\u610f\u8f6f\u4ef6\u95ee\u9898\u53ca\u6f0f\u6d1e\u7684\u901a\u62a5(\u4f8b\u5982\u6709\u5173\u81ea\u52a8\u83b7\u53d6\u6743\u9650\u7684\u95ee\u9898\u4ee5\u53ca\u5bfc\u81f4\u7cfb\u7edf\u5d29\u6e83\u7684\u6f0f\u6d1e)\uff0c\u8fdb\u800c\u91c7\u53d6\u5fc5\u8981\u7684\u9632\u8303\u63aa\u65bd\uff0c\u56e0\u4e3a\u6b79\u5f92\u5f88\u53ef\u80fd\u5c31\u4f1a\u5229\u7528\u8fd9\u4e9b\u6f0f\u6d1e\u3002
\n\u3000\u3000\u9700\u8981\u79fb\u52a8\u8bbe\u5907\u9632\u62a4\u7a0b\u5e8f\u7684\u7528\u6237\uff0c\u53ef\u4e0b\u8f7d\u514d\u8d39\u8d8b\u52bf\u79d1\u6280\u79fb\u52a8\u5b89\u5168\u4e2a\u4eba\u7248\uff0c\u9664\u4e86\u53ef\u9632\u62a4\u79fb\u52a8\u8bbe\u5907\u7684\u9690\u79c1\u4e0e\u4e2a\u4eba\u4fe1\u606f\u3001\u9632\u6b62\u9493\u9c7c\u3001\u5bfb\u627e\u9057\u5931\u624b\u673a\u4e4b\u5916\uff0c\u8fd8\u53ef\u627e\u5230\u7ecf\u8fc7\u4fe1\u606f\u5b89\u5168\u8ba4\u8bc1\u7684\u591a\u5143\u5316\u6e38\u620f\uff0c\u4e00\u4e3e\u6570\u5f97\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

\u3000\u968f\u7740\u667a\u80fd\u79fb\u52a8\u8bbe\u5907\u7684\u5feb\u901f\u666e\u53ca\uff0c\u76f8\u5173\u7684\u6076\u610fAPP\u4e5f\u4ee5\u60ca\u4eba\u7684\u901f\u5ea6\u4e0d\u65ad\u6210\u957f\u3002\u8fd1\u65e5\uff0c\u5168\u7403\u670d\u52a1\u5668\u5b89\u5168\u3001\u865a\u62df\u5316\u5b89\u5168\u53ca\u4e91\u5b89\u5168 … Read more<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[],"tags":[],"_links":{"self":[{"href":"https:\/\/wx.wosign.com\/index.php?rest_route=\/wp\/v2\/posts\/540"}],"collection":[{"href":"https:\/\/wx.wosign.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wx.wosign.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wx.wosign.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/wx.wosign.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=540"}],"version-history":[{"count":1,"href":"https:\/\/wx.wosign.com\/index.php?rest_route=\/wp\/v2\/posts\/540\/revisions"}],"predecessor-version":[{"id":542,"href":"https:\/\/wx.wosign.com\/index.php?rest_route=\/wp\/v2\/posts\/540\/revisions\/542"}],"wp:attachment":[{"href":"https:\/\/wx.wosign.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=540"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wx.wosign.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=540"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wx.wosign.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=540"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}