佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishing site

LT会でやった内容のスライドを公開し忘れてたので載せておきます

Transcript

1. ࠤ઒ٸศϑΟογϯά
   αΠτΛௐ΂ͯΈͨ
   2018/08/14
   ηΩϡϦςΟΩϟϯϓ શࠃେձ 2018
   Tomoyuki KOYAMA
   

   View Slide

2. ࣗݾ঺հ
   • ͜΍· ͱ΋Ώ͖
   • ౦ژ޻Պେ 2೥
   • શࠃେձ 2017मྃ
   • NOCνϡʔλʔ
   • PyCon JP ελοϑ
   Twitter:
   @tmyk_kym
   Blog:
   blog.koyama.me
   

   View Slide

3. ͖͔͚ͬ
   TBHBXBNNDPN
   

   View Slide

4. sagawa-mm.com
   
   

   View Slide

5. औಘ/ൺֱ
   $ curl -s http://www.sagawa-exp.co.jp/

   > white # ਖ਼نαΠτ

   $ curl -s http://sagawa-mm.com/ 

   > black # ِαΠτ
   $ vim -d white black # ൺֱ
   

   View Slide

6. $ vim -d black white
   

   View Slide

7. ൺֱ:ِαΠτʹͷΈଘࡏ
   

   css="display:none;" download="sagawa.apk">
   ʙলུʙ
   
   

   

   Πϯετʔϧ
   
   
   
   
   

   View Slide

8. υϝΠϯͷௐࠪ
   

   View Slide

9. υϝΠϯॴ༗ऀΛௐࠪ(ൈਮ)
   $ whois sagawa-mm.com
   ߋ৽೔࣌: 2018-07-18T11:24:40.0Z
   ొ࿥೔: 2018-07-18T11:24:40.0Z
   ొ࿥ۀऀ: Chengdu west dimension digital technology Co., LTD
   ొ࿥ऀ໊: mengmeng li // தࠃͷঁ༏: Meng Li
   ొ࿥૊৫: li meng meng
   ొ࿥ॅॴ1: Tan Cheng Zhen Deng Qiao She Q
   ొ࿥ॅॴ2: Meng Cheng Xian
   ొ࿥༣ศ൪߸: 010000
   ొ࿥ࠃ: cn
   ొ࿥ి࿩൪߸: +86.13614466925 // தࠃ ٢ྛল ന৓ࢢ
   ొ࿥Fax: +86.13614466925
   ొ࿥ϝʔϧ: mantianxing0111@yahoo.co.jp
   

   View Slide

10. ॴ༗ऀΛௐࠪ
    • RISKIQ, DomainBigData, DomainWatchͰௐࠪ
    

    View Slide

11. 102 Domains
    whois৘ใʹ mantianxing0111@yahoo.co.jp 

    ؚ͕·ΕΔsagawaܥυϝΠϯ
    

    View Slide

12. υϝΠϯͷҰ෦
    • sagawa-anu\.com // sagawa-???
    • sagawa-expr\.com // expressͷදه
    • saggawa-exp\.com // ΞϧϑΝϕοτॏͶ
    • sagawa-co-jp\.com // .Λ-Ͱදݱ
    • sagawajp\.com // ҧ࿨ײ͕ͳ͍
    

    View Slide

13. APKϑΝΠϧͷௐࠪ
    ಈతղੳ
    

    View Slide

14. ݕূ؀ڥ/ݕମ
    • Nexus 7 2013 Wi-Fi
    • Android 6.0.1
    • sagawa.apk
    • sagawa-mm\.comΑΓऔಘ
    • SHA-256:
    580a027109ac70b32e4423623dfff5b4c6d52220a
    905125332c0af0e231e0387
    ˞஫҆શͳ؀ڥͰ

    ݕূ͍ͯͩ͘͠͞ɻ
    ݕূ࣌ʹ͸ωοτϫʔΫ
    ͷִ཭ͳͲे෼ʹ஫ҙ͠
    ͍ͯͩ͘͞ɻ
    

    View Slide

15. APKϑΝΠϧ - ಈతղੳ(1)
    

    View Slide

16. APKϑΝΠϧ - ಈతղੳ(2)
    όοΫάϥ΢ϯυ

    Ͱ઀ଓΛzҡ࣋z
    Ṗͷന͍ΞϓϦ͕
    ৗற
    ࠤ઒ٸศ͕ফ͑ͨ
    

    View Slide

17. APKϑΝΠϧ - ಈతղੳ(3)
    Կ΋දࣔ͞Εͣ
    αʔϏεEH.BJO4FSWJDFΛ

    ΋ͭྨࣅ"1,ϑΝΠϧΛൃݟ
    4)"
    BDGBEG
    CDCEGDEBEEGF
    GCECGF
    

    View Slide

18. APKϑΝΠϧ - ಈతղੳ(4)
    • tPacketCaptureͰύέοτΩϟϓνϟ
    ΍ΓऔΓ͕ແ͍
    

    View Slide

19. APKϑΝΠϧͷௐࠪ
    ੩తղੳ
    

    View Slide

20. APKΛղੳ(1)
    1. apktoolΛΠϯετʔϧ
    2. apk͔ΒresσΟϨΫτϦΛऔΓग़͢

    $ apktool d sagawa.apk
    

    View Slide

21. APKΛղੳ(2)
    1. ϑΝΠϧ classes.dex ΛऔΓग़͢

    $ unzip sagawa.apk
    2. dex2jar ΛΠϯετʔϧ
    3. dexϑΝΠϧ͔ΒjarϑΝΠϧΛੜ੒

    $ bash d2j-dex2jar.sh ../unziped/classes.dex
    

    View Slide

22. APKΛղੳ(3)
    1. jarϑΝΠϧΛల։

    $ unzip classes-dex2jar.jar
    2. JavaDecompiler ΛΠϯετʔϧ
    3. JavaDecompiler Ͱ1ͷιʔεΛ։͘
    

    View Slide

23. σίϯύΠϥͰιʔεΛಡΉ
    

    View Slide

24. ϑΝΠϧҰཡ
    • gfer/DhsActivity$1.java
    • gfer/DhsActivity.java // ΤϯτϦϙΠϯτ
    • tog/essMyApplication$1.java
    • tog/essMyApplication$a.java
    • tog/vtdMyWebActivity.java
    • tog/essMyApplication.java
    • gig/dgMainService.java
    • a.java
    • goda/eeftMyReceiver.java
    

    View Slide

25. View Slide

26. ௥Ճ
    

    View Slide

27. ଞͷυϝΠϯ
    • ϝʔϧΞυϨε: 21449497@qq.com
    

    View Slide