{"id":6159,"date":"2017-10-24T02:17:06","date_gmt":"2017-10-24T02:17:06","guid":{"rendered":"http:\/\/tapchicntt.com\/?p=6159"},"modified":"2017-10-24T02:17:06","modified_gmt":"2017-10-24T02:17:06","slug":"phat-hien-phan-mem-doc-hai-sockbot-tren-google-play-store","status":"publish","type":"post","link":"https:\/\/tapchicntt.com\/phat-hien-phan-mem-doc-hai-sockbot-tren-google-play-store\/","title":{"rendered":"Ph\u00e1t hi\u1ec7n ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i Sockbot tr\u00ean Google Play Store"},"content":{"rendered":"

8 \u1ee9ng d\u1ee5ng tr\u00ean Google Play v\u1eeba \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n ch\u1ee9a ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i Sockbot, kh\u00f4ng ch\u1ec9 t\u1ea1o doanh thu b\u1ea5t h\u1ee3p ph\u00e1p cho nh\u00e0 ph\u00e1t tri\u1ec3n n\u00f3 m\u00e0 c\u00f2n c\u00f3 th\u1ec3 khi\u1ebfn thi\u1ebft b\u1ecb tr\u1edf th\u00e0nh m\u1ed9t ph\u1ea7n c\u1ee7a botnet.<\/p>\n

\"\"<\/p>\n

Theo h\u00e3ng b\u1ea3o m\u1eadt Trend Micro, c\u00e1c \u1ee9ng d\u1ee5ng n\u00e0y \u0111\u00e3 \u0111\u01b0\u1ee3c t\u1ea3i xu\u1ed1ng t\u1eeb 600.000 \u0111\u1ebfn 2,6 tri\u1ec7u l\u01b0\u1ee3t, ch\u1ee7 y\u1ebfu l\u00e0 ng\u01b0\u1eddi d\u00f9ng \u1edf M\u1ef9, ti\u1ebfp theo l\u00e0 Nga, Ukraine, Brazil v\u00e0 \u0110\u1ee9c.
\nSockbot c\u00f2n \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn v\u1edbi t\u00ean g\u1ecdi ANDROIDOS_TAPJOY.OPD (do Trend Micro \u0111\u1eb7t) xu\u1ea5t hi\u1ec7n b\u00ean trong c\u00e1c \u1ee9ng d\u1ee5ng t\u00f9y ch\u1ec9nh tr\u00f2 ch\u01a1i ph\u1ed5 bi\u1ebfn Minecraft: Pocket Edition, cho ph\u00e9p ng\u01b0\u1eddi d\u00f9ng t\u00f9y ch\u1ec9nh s\u1ef1 xu\u1ea5t hi\u1ec7n nh\u00e2n v\u1eadt c\u1ee7a h\u1ecd. Tuy nhi\u00ean, c\u00e1c \u1ee9ng d\u1ee5ng \u0111\u01b0\u1ee3c t\u00ecm th\u1ea5y \u0111\u00e3 l\u00e9n l\u00fat t\u1ea1o ra doanh thu qu\u1ea3ng c\u00e1o cho c\u00e1c nh\u00e0 ph\u00e1t tri\u1ec3n, v\u00e0 t\u1eeb \u0111\u00f3 \u0111\u00e3 b\u1ecb g\u1ee1 b\u1ecf kh\u1ecfi Google Play.<\/p>\n

B\u00e1o c\u00e1o cho bi\u1ebft, c\u00e1c \u1ee9ng d\u1ee5ng s\u1ebd k\u1ebft n\u1ed1i b\u00ed m\u1eadt \u0111\u1ebfn m\u1ed9t m\u00e1y ch\u1ee7 v\u00e0 ki\u1ec3m so\u00e1t (C&C) tr\u00ean c\u1ed5ng 9001, y\u00eau c\u1ea7u \u1ee9ng d\u1ee5ng m\u1edf m\u1ed9t c\u1ed5ng th\u00f4ng qua giao th\u1ee9c Socket Secure (SOCKS). Sau \u0111\u00f3 n\u00f3 s\u1ebd k\u1ebft n\u1ed1i v\u1edbi \u0111\u1ecba ch\u1ec9 IP v\u00e0 c\u1ed5ng \u0111\u01b0\u1ee3c x\u00e1c \u0111\u1ecbnh b\u1edfi m\u00e1y ch\u1ee7 C&C. Sau khi k\u1ebft n\u1ed1i \u0111\u01b0\u1ee3c thi\u1ebft l\u1eadp, \u1ee9ng d\u1ee5ng k\u1ebft n\u1ed1i v\u1edbi m\u1ed9t m\u00e1y ch\u1ee7 \u0111\u01b0\u1ee3c nh\u00e0 ph\u00e1t tri\u1ec3n ch\u1ec9 \u0111\u1ecbnh s\u1ebd ph\u00e1t m\u1ed9t danh s\u00e1ch c\u00e1c qu\u1ea3ng c\u00e1o v\u00e0 si\u00eau d\u1eef li\u1ec7u c\u00f3 li\u00ean quan. S\u1eed d\u1ee5ng SOCKS proxy, \u1ee9ng d\u1ee5ng s\u1ebd k\u1ebft n\u1ed1i v\u1edbi m\u00e1y ch\u1ee7 qu\u1ea3ng c\u00e1o v\u00e0 y\u00eau c\u1ea7u qu\u1ea3ng c\u00e1o kh\u1edfi ch\u1ea1y.<\/p>\n

C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u l\u01b0u \u00fd r\u1eb1ng c\u01a1 ch\u1ebf c\u1ee7a Sockbot c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c m\u1edf r\u1ed9ng \u0111\u1ec3 khai th\u00e1c c\u00e1c l\u1ed7 h\u1ed5ng tr\u00ean m\u1ea1ng. V\u00e0 v\u1edbi kh\u1ea3 n\u0103ng t\u1ea5n c\u00f4ng c\u1ee7a Sockbot, thi\u1ebft b\u1ecb b\u1ecb nhi\u1ec5m c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 kh\u1edfi \u0111\u1ed9ng cu\u1ed9c t\u1ea5n c\u00f4ng t\u1eeb ch\u1ed1i d\u1ecbch v\u1ee5 (DDoS). M\u00e3 v\u00e0 chu\u1ed7i c\u1ee7a Sockbot b\u1ecb l\u00e0m nh\u00f2e v\u00e0 m\u00e3 h\u00f3a khi\u1ebfn vi\u1ec7c ph\u00e1t hi\u1ec7n ra kh\u00f3 kh\u0103n h\u01a1n.
\nSocksbot kh\u00f4ng ph\u1ea3i l\u00e0 ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i \u0111\u1ea7u ti\u00ean l\u1ea1m d\u1ee5ng giao th\u1ee9c SOCKS ho\u1eb7c s\u1eed d\u1ee5ng c\u00e1c \u1ee9ng d\u1ee5ng Android \u0111\u1ec3 t\u1ea1o ra doanh thu b\u1ea5t h\u1ee3p ph\u00e1p, bao g\u1ed3m DressCode xu\u1ea5t hi\u1ec7n th\u00e1ng 9.2016, hay MilkyDoor xu\u1ea5t hi\u1ec7n th\u00e1ng 4.2017. B\u00e1o c\u00e1o cho th\u1ea5y \u00edt nh\u1ea5t 3.000 \u1ee9ng d\u1ee5ng xu\u1ea5t hi\u1ec7n tr\u00ean DressCode, 400 trong s\u1ed1 \u0111\u00f3 c\u00f3 m\u1eb7t tr\u00ean Google Play. C\u00f2n MilkyDoor, c\u00f3 \u0111\u1ebfn 200 \u1ee9ng d\u1ee5ng Android b\u1ecb nhi\u1ec5m, v\u1edbi m\u1ed9t trong s\u1ed1 \u0111\u00f3 c\u00f3 t\u1eeb 500.000 \u0111\u1ebfn 1 tri\u1ec7u l\u01b0\u1ee3t t\u1ea3i xu\u1ed1ng tr\u00ean Google Play.<\/p>\n

V\u00ec v\u1eady, c\u00e1ch t\u1ed1t nh\u1ea5t l\u00e0 ng\u01b0\u1eddi d\u00f9ng c\u1ea7n \u0111\u1ea3m b\u1ea3o an to\u00e0n cho \u0111i\u1ec7n tho\u1ea1i di \u0111\u1ed9ng tr\u01b0\u1edbc c\u00e1c ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i n\u00e0y. M\u1ed9t s\u1ed1 ph\u01b0\u01a1ng ph\u00e1p \u0111\u01b0\u1ee3c \u0111\u00e1nh gi\u00e1 l\u00e0 kh\u00e1 t\u1ed1t \u0111\u1ec3 \u0111\u1ec1 ph\u00f2ng tr\u01b0\u1edbc c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng n\u00e0y, bao g\u1ed3m k\u00edch ho\u1ea1t v\u00e0 tri\u1ec3n khai t\u01b0\u1eddng l\u1eeda \u0111\u1ec3 gi\u00fap h\u1ea1n ch\u1ebf c\u00e1c h\u1ec7 th\u1ed1ng n\u1ed9i b\u1ed9 truy c\u1eadp v\u00e0o c\u1ed5ng \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng kh\u00f4ng ph\u1ed5 bi\u1ebfn, m\u1ed9t k\u1ef9 thu\u1eadt quan tr\u1ecdng \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng b\u1edfi giao th\u1ee9c SOCKS; th\u1ef1c thi nguy\u00ean t\u1eafc \u00edt quy\u1ec1n \u01b0u ti\u00ean nh\u1ea5t \u0111\u1ec3 ng\u0103n tin t\u1eb7c truy c\u1eadp m\u1ea1ng n\u1ed9i b\u1ed9; t\u1ea1o ch\u00ednh s\u00e1ch qu\u1ea3n l\u00fd v\u00e1 l\u1ed7i m\u1ea1nh m\u1ebd h\u01a1n; c\u1eadp nh\u1eadt b\u1ea3n v\u00e1 l\u1ed7i h\u1ec7 \u0111i\u1ec1u h\u00e0nh v\u00e0 \u1ee9ng d\u1ee5ng Android m\u1edbi nh\u1ea5t; tr\u00e1nh s\u1eed d\u1ee5ng k\u1ebft n\u1ed1i kh\u00f4ng an to\u00e0n hay s\u1eed d\u1ee5ng m\u1ea1ng ri\u00eang \u1ea3o (VPN) khi truy c\u1eadp t\u1eeb xa v\u00e0 c\u00e1c m\u1ea1ng v\u00e0 t\u00e0i s\u1ea3n c\u1ee7a c\u00f4ng ty.<\/p>\n","protected":false},"excerpt":{"rendered":"

8 \u1ee9ng d\u1ee5ng tr\u00ean Google Play v\u1eeba \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n ch\u1ee9a ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i Sockbot, kh\u00f4ng ch\u1ec9 t\u1ea1o doanh […]<\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-6159","post","type-post","status-publish","format-standard","hentry","category-bao-mat"],"views":428,"_links":{"self":[{"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/posts\/6159","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/comments?post=6159"}],"version-history":[{"count":0,"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/posts\/6159\/revisions"}],"wp:attachment":[{"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/media?parent=6159"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/categories?post=6159"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tapchicntt.com\/rest-api\/wp\/v2\/tags?post=6159"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}