Upgrade to Pro — share decks privately, control downloads, hide ads and more …

佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishing site

佐川急便のフィッシングサイトを調べてみた / Analysis of sagawa fishing site

LT会でやった内容のスライドを公開し忘れてたので載せておきます

Tomoyuki KOYAMA

August 14, 2018
Tweet

More Decks by Tomoyuki KOYAMA

Other Decks in Technology

Transcript

  1. ࠤ઒ٸศϑΟογϯά
    αΠτΛௐ΂ͯΈͨ
    2018/08/14
    ηΩϡϦςΟΩϟϯϓ શࠃେձ 2018
    Tomoyuki KOYAMA

    View Slide

  2. ࣗݾ঺հ
    • ͜΍· ͱ΋Ώ͖
    • ౦ژ޻Պେ 2೥
    • શࠃେձ 2017मྃ
    • NOCνϡʔλʔ
    • PyCon JP ελοϑ
    Twitter:
    @tmyk_kym
    Blog:
    blog.koyama.me

    View Slide

  3. ͖͔͚ͬ
    TBHBXBNNDPN

    View Slide

  4. sagawa-mm.com

    View Slide

  5. औಘ/ൺֱ
    $ curl -s http://www.sagawa-exp.co.jp/

    > white # ਖ਼نαΠτ

    $ curl -s http://sagawa-mm.com/ 

    > black # ِαΠτ
    $ vim -d white black # ൺֱ

    View Slide

  6. $ vim -d black white

    View Slide

  7. ൺֱ:ِαΠτʹͷΈଘࡏ

    css="display:none;" download="sagawa.apk">
    ʙলུʙ



    Πϯετʔϧ




    View Slide

  8. υϝΠϯͷௐࠪ

    View Slide

  9. υϝΠϯॴ༗ऀΛௐࠪ(ൈਮ)
    $ whois sagawa-mm.com
    ߋ৽೔࣌: 2018-07-18T11:24:40.0Z
    ొ࿥೔: 2018-07-18T11:24:40.0Z
    ొ࿥ۀऀ: Chengdu west dimension digital technology Co., LTD
    ొ࿥ऀ໊: mengmeng li // தࠃͷঁ༏: Meng Li
    ొ࿥૊৫: li meng meng
    ొ࿥ॅॴ1: Tan Cheng Zhen Deng Qiao She Q
    ొ࿥ॅॴ2: Meng Cheng Xian
    ొ࿥༣ศ൪߸: 010000
    ొ࿥ࠃ: cn
    ొ࿥ి࿩൪߸: +86.13614466925 // தࠃ ٢ྛল ന৓ࢢ
    ొ࿥Fax: +86.13614466925
    ొ࿥ϝʔϧ: [email protected]

    View Slide

  10. ॴ༗ऀΛௐࠪ
    • RISKIQ, DomainBigData, DomainWatchͰௐࠪ

    View Slide

  11. 102 Domains
    whois৘ใʹ [email protected]
    ؚ͕·ΕΔsagawaܥυϝΠϯ

    View Slide

  12. υϝΠϯͷҰ෦
    • sagawa-anu\.com // sagawa-???
    • sagawa-expr\.com // expressͷදه
    • saggawa-exp\.com // ΞϧϑΝϕοτॏͶ
    • sagawa-co-jp\.com // .Λ-Ͱදݱ
    • sagawajp\.com // ҧ࿨ײ͕ͳ͍

    View Slide

  13. APKϑΝΠϧͷௐࠪ
    ಈతղੳ

    View Slide

  14. ݕূ؀ڥ/ݕମ
    • Nexus 7 2013 Wi-Fi
    • Android 6.0.1
    • sagawa.apk
    • sagawa-mm\.comΑΓऔಘ
    • SHA-256:
    580a027109ac70b32e4423623dfff5b4c6d52220a
    905125332c0af0e231e0387
    ˞஫҆શͳ؀ڥͰ

    ݕূ͍ͯͩ͘͠͞ɻ
    ݕূ࣌ʹ͸ωοτϫʔΫ
    ͷִ཭ͳͲे෼ʹ஫ҙ͠
    ͍ͯͩ͘͞ɻ

    View Slide

  15. APKϑΝΠϧ - ಈతղੳ(1)

    View Slide

  16. APKϑΝΠϧ - ಈతղੳ(2)
    όοΫάϥ΢ϯυ

    Ͱ઀ଓΛzҡ࣋z
    Ṗͷന͍ΞϓϦ͕
    ৗற
    ࠤ઒ٸศ͕ফ͑ͨ

    View Slide

  17. APKϑΝΠϧ - ಈతղੳ(3)
    Կ΋දࣔ͞Εͣ
    αʔϏεEH.BJO4FSWJDFΛ

    ΋ͭྨࣅ"1,ϑΝΠϧΛൃݟ
    4)"
    BDGBEG
    CDCEGDEBEEGF
    GCECGF

    View Slide

  18. APKϑΝΠϧ - ಈతղੳ(4)
    • tPacketCaptureͰύέοτΩϟϓνϟ
    ΍ΓऔΓ͕ແ͍

    View Slide

  19. APKϑΝΠϧͷௐࠪ
    ੩తղੳ

    View Slide

  20. APKΛղੳ(1)
    1. apktoolΛΠϯετʔϧ
    2. apk͔ΒresσΟϨΫτϦΛऔΓग़͢

    $ apktool d sagawa.apk

    View Slide

  21. APKΛղੳ(2)
    1. ϑΝΠϧ classes.dex ΛऔΓग़͢

    $ unzip sagawa.apk
    2. dex2jar ΛΠϯετʔϧ
    3. dexϑΝΠϧ͔ΒjarϑΝΠϧΛੜ੒

    $ bash d2j-dex2jar.sh ../unziped/classes.dex

    View Slide

  22. APKΛղੳ(3)
    1. jarϑΝΠϧΛల։

    $ unzip classes-dex2jar.jar
    2. JavaDecompiler ΛΠϯετʔϧ
    3. JavaDecompiler Ͱ1ͷιʔεΛ։͘

    View Slide

  23. σίϯύΠϥͰιʔεΛಡΉ

    View Slide

  24. ϑΝΠϧҰཡ
    • gfer/DhsActivity$1.java
    • gfer/DhsActivity.java // ΤϯτϦϙΠϯτ
    • tog/essMyApplication$1.java
    • tog/essMyApplication$a.java
    • tog/vtdMyWebActivity.java
    • tog/essMyApplication.java
    • gig/dgMainService.java
    • a.java
    • goda/eeftMyReceiver.java

    View Slide

  25. View Slide

  26. ௥Ճ

    View Slide

  27. ଞͷυϝΠϯ
    • ϝʔϧΞυϨε: [email protected]

    View Slide