针对钓鱼攻击的防范技术研究

论文从网络攻击的角度,提炼出了三种钓鱼攻击的模型,并对其实现机理、关键技术进行了比较详细的剖析。然后,针对钓鱼攻击本身的特点,提出了一种同时具备双因素认证和双向认证优点的认证模型来防御钓鱼攻击。     

视频分享网站使用过滤技术后避风港原则之适用——基于技术与制度双赢视角的分析

随着网络技术的不断进步,对视频分享网站侵权作品进行过滤的新技术出现。从网络存储服务商的性质和运营模式等角度看,视频分享网站不应拒绝使用这种新技术。从避风港原则设置的立法初衷和价值取向出发,围绕新的网络技术会引发的法律问题,探讨避风港原则在未来新的技术环境下的适用、改进以及未来网络技术发展与法律规则调整良性互动的发展趋势。     

Anatomy of a Data Breach

ABSTRACT

In the wake of undiscovered data breaches and subsequent public exposure, regulatory compliance and security audit standards are becoming more important to protecting critical assets. Despite the increase in the number of data breaches via illicit means, internal controls seem to fail when it comes to the assurance that critical assets remain uncompromised. According to the Identity Theft Resource Center, 336 breaches have been reported in 2008 alone, 69%?greater than this time last year ¹ 1. Identity Theft Resource Center. (2008, July 15). IRTC 2008 Breach List. . This is a concern for security teams, especially since a lack of dedicated resources exists to combat and revert this trend.

This is significantly important to take into consideration when going through the formal audit process to certify adherence to Sarbanes-Oxley (SOX), Graham Leach Bliley (GLBA), Payment Card Industry (PCI), or the Health Insurance and Portability and Accountability Act (HIPAA). With the significant increase in data exposure corporations cannot afford to take shortcuts when it comes to information assurance. Otherwise it is almost certain that one will become a victim of a serious exposure of sensitive information. This paper will explore the several disconnects between established and accepted security audit framework and the variable of hidden infections.     

A Survey on Fast-flux Attacks

ABSTRACT

“Fast-flux” refers to rapidly assigning different IP addresses to the same domain name. Although there are some legitimate uses for this technique, recently it has become a favorite tool for cyber criminals to launch collaborative attacks. After it was first observed by Honeynet, it was reported that fast-flux has been used in phishing, malware spreading, spam, and other malicious activities linked to criminal organizations. Combining with peer-to-peer networking, distributed command and control, web-based load balancing, and proxy redirection, fast-flux makes Internet attacks more resistant to discovery and counter-measure. This article aims at giving a comprehensive survey on fast-flux attacks. Some important issues including technical background, classification, characterization, measurement and detection, and mitigation are discussed. Challenges of detecting and mitigating fast-flux attack are also pointed out.     

区块链资产窃取攻击与防御技术综述

自中本聪提出比特币以来,区块链技术得到了跨越式发展,特别是在数字资产转移及电子货币支付方面。以太坊引入智能合约代码,使其具备了同步及保存智能合约程序执行状态,自动执行交易条件并消除对中介机构需求,Web3.0 开发者可利用以太坊提供的通用可编程区块链平台构建更加强大的去中心化应用。公链系统具备的特点,如无须中央节点控制、通过智能合约保障交互数据公开透明、用户数据由用户个人控制等,使得它在区块链技术发展的过程中吸引了更多的用户关注。然而,随着区块链技术的普及和应用,越来越多的用户将自己的数字资产存储在区块链上。由于缺少权威机构的监管及治理,以太坊等公链系统正逐步成为黑客窃取数字资产的媒介。黑客利用区块链实施诈骗及钓鱼攻击,盗取用户所持有的数字资产来获取利益。帮助读者建立区块链资产安全的概念,从源头防范利用区块链实施的资产窃取攻击。通过整理总结黑客利用区块链环境实施的资产窃取攻击方案,抽象并归纳威胁模型的研究方法,有效研究了各类攻击的特征及实施场景。通过深入分析典型攻击方法,比较不同攻击的优缺点,回答了攻击能够成功实施的根本原因。在防御技术方面,针对性结合攻击案例及攻击实施场景介绍了钓鱼检测、代币授权检测、代币锁定、去中心化代币所属权仲裁、智能合约漏洞检测、资产隔离、供应链攻击检测、签名数据合法性检测等防御方案。对于每一类防御方案,给出其实施的基本流程及方案,明确了各防护方案能够在哪类攻击场景下为用户资产安全提供防护。     

2011年6月网络安全监测数据分析

2011年6月,中国境内僵尸网络受控主机数量和木马受控主机数量较5月稍有下降,网页篡改数量下降。恶意代码活动情况方面,中国大陆地区约有38万个IP地址对应的主机被木马或僵尸程序控制,较5月下降6%;网站安全方面,6月中国大陆地区被篡改网站数量为3164个,较5月下降6%,其中被篡改政府网站数量为333个,较5月增长57%。     

一种防范钓鱼网站的方法

网络钓鱼是在线身份窃取的一种。近年来,网络钓鱼成为了在线身份窃取的主流。要防止网络钓鱼,最重要的是让用户能够识别网站的真伪。本文提出了一种让用户能够有效地识别网站真伪的技术:当用户需要辨别网站真伪时,先输入一个私数,上传到服务器;然后,服务器返回一组与此私数相关的特有的防钓码,用户看到这组防钓码,便知网站真假。由于防钓码因由户给出的私数而异,钓鱼者很难伪造,运用此法可有效的防范钓鱼网站。     

Accessibility levels of Portuguese enterprise websites: equal opportunities for all?

Web accessibility is growing in importance. We may also find an increasing need for access to web resources by those with some sort of disability. The Web is very important for spreading information and for promoting interaction between the various elements in society. Given this, it is essential that the Web presents itself as a totally accessible resource, so that it can help citizens with disabilities and their integration in society. This obligation should be even greater for enterprises as primarily the Web is used as a marketing and business platform. With this document, we present indicators regarding the [lack of] accessibility levels of Portuguese enterprise websites. This article contains theoretical and background considerations as well as the results of two different studies that the research team undertook. First of all, the research team made a comparison between the 1000 largest Portuguese enterprises (annual sales volume) and the 1000 best Portuguese small and medium enterprises (sales growth and profit) using a specialised software tool and according to Web Content Accessibility Guidelines (WCAG) 1.0; the research team then also considered WCAG 2.0 and its impact on enterprise Web accessibility. In the second study (qualitative in nature), focus group interactions led to a set of recommendations towards greater accessibility.     

钓鱼网站的鉴别方法与防范策略研究

文章从钓鱼网站的种类和传播途径入手,重点分析了钓鱼网站的鉴别方法和防范措施,最后指出了打击钓鱼网站的难度.     

网络钓鱼的现状、方式及防范初探

网络钓鱼已经成为因特网历史上传播速度最快、最为普及的网络诈骗方式,并对电子商务活动的正常进行构成了巨大威胁。本文首先介绍网络钓鱼的发展历史及其现状,并对常见的网络钓鱼实施方式进行了分析,最后给出了防范网络钓鱼的一些建议。