連結Oh my God這個案例是這樣的途徑來詐騙的

作者: andy199113 (中川翔子最高!!) 看板: Gossiping
標題: Re: [問卦] 有沒有FB病毒的八卦?
時間: Mon Mar  4 01:33:09 2013

稍微研究了一下，

tk這個網路域名，由於是完全免費註冊申請，

導致有大量不肖人士利用此缺點來藉此犯罪，

什麼色情商、竊取資料、詐騙個資等壞人都有用過.tk


連結 [Oh my God] 這個案例是這樣的途徑來詐騙的

1. 藉由facebook發布http://www.xn--○○.tk的連結，讓人誤信是朋友發的新消息
   (○○為某語言文字，類似中文網址一樣，需經轉碼)

2. 該網址自動轉至http://www.fb○○met.com/ 這網站

3. 中間有個假的播放器，實際上是javescript惡意連結，
   會自動跳出chrome應用程式FlashPlayer Extension V11.2叫你安裝，
   一般人可能會傻傻的就按下去，悲劇就發生了
   (據其他網友分析，除了這應用程式外還有其他應用程式)

   當然如果你不是用Chrome，而用Firefox或IE就幸運逃過這災難

4. 依照Chrome商店所寫的，這個擴充功能擁有的存取權：
   ．您存放於所有網站的資料
   ．您複製並貼上的資料
   ．可指定網站是否要用 Cookie、JavaScript 和外掛程式等功能的設定。
   ．您的瀏覽記錄
   ．您已安裝的應用程式、擴充功能和主題清單
   ．您的分頁和瀏覽活動

   也就是說同意安裝下去就中標了！
   不清楚儲存在chrome密碼會不會因此外洩，不過目前情況看來是會的，
   當然你也自動會被駭客登入你的facebook帳號、各種電子信箱亂偷個資

5. 想要移除方法不用很難，只要到當初被騙安裝程式的這程式網頁，
   在相關項目旁邊，按下「垃圾桶」的標誌，就能移除了
https://chrome.google.com/webstore/detail/dceiojpfddghojpmfheadkiilbnlimib

   當然如果不是這個程式，可能就要從以下路徑來找到程式並刪除
WinXP：%HOMEPATH%\Local Settings\Application Data\Google\Chrome\
       User Data\Default\Extensions
Win7 ：%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions


6. 移除後記得修改所有已儲存密碼，並且取消不明的按讚與追蹤
   (文末有附註部份粉絲專頁與追蹤的網址)



這程式Google Chrome線上應用程式商店是審核認可通過上架的
(當然Oh my God詐騙不只這一個程式)

如果你有空，有Google帳號，

請幫忙檢舉這「FlashPlayer Extension V11.2」程式
https://chrome.google.com/webstore/report/dceiojpfddghojpmfheadkiilbnlimib

1. 請選「這個商品含有惡意軟體或是會對使用者的電腦造成損害。」

2. 按「提交」

當檢舉數量一多，這惡意程式自然就會下架



程式經分析，寫這程式的壞人，疑似是這位「Ur Gayretli」
http://www.facebook.com/profile.php?id=798169840

目前已經有189672個人上當被安裝程式
詳見 facebook - Timeline list
http://www.facebook.com/lists/10151482688859841

會被加入以下這些粉絲專頁
（這只是局部，可能有更多專頁會被自動加入）
http://www.facebook.com/profile.php?id=107373955985378
http://www.facebook.com/profile.php?id=354262328019741
http://www.facebook.com/profile.php?id=429076900444967
http://www.facebook.com/profile.php?id=147163295400711
http://www.facebook.com/profile.php?id=542140999130443
http://www.facebook.com/profile.php?id=372182226222722
http://www.facebook.com/profile.php?id=313598148756243
http://www.facebook.com/profile.php?id=421688067926251
http://www.facebook.com/profile.php?id=259161060808728
http://www.facebook.com/profile.php?id=439275272816511
http://www.facebook.com/profile.php?id=199906373488032
http://www.facebook.com/profile.php?id=149381605220629
http://www.facebook.com/profile.php?id=137542559619897
http://www.facebook.com/profile.php?id=255357917899117
http://www.facebook.com/profile.php?id=112268252278140
http://www.facebook.com/profile.php?id=431069030314114
http://www.facebook.com/profile.php?id=316028655185975
http://www.facebook.com/profile.php?id=433242606756813
http://www.facebook.com/profile.php?id=201939106579833
http://www.facebook.com/profile.php?id=155509137937615
http://www.facebook.com/profile.php?id=499010033474146
http://www.facebook.com/profile.php?id=110390459144083
http://www.facebook.com/profile.php?id=192940940800112
http://www.facebook.com/profile.php?id=429027960504972
http://www.facebook.com/profile.php?id=478286462207790
http://www.facebook.com/profile.php?id=179530228736198
http://www.facebook.com/profile.php?id=150933648400192
http://www.facebook.com/profile.php?id=616992708314258
http://www.facebook.com/profile.php?id=506345219411822
http://www.facebook.com/profile.php?id=304263279650475
http://www.facebook.com/profile.php?id=163222597107707
http://www.facebook.com/profile.php?id=115060793084
http://www.facebook.com/profile.php?id=539491689415953
http://www.facebook.com/profile.php?id=361024447344720
http://www.facebook.com/profile.php?id=305960829507716
http://www.facebook.com/profile.php?id=303370773122400
http://www.facebook.com/profile.php?id=590761520952702
http://www.facebook.com/profile.php?id=145431815617735
http://www.facebook.com/profile.php?id=433694126705632
http://www.facebook.com/profile.php?id=478079458924923
http://www.facebook.com/profile.php?id=461180343936924
http://www.facebook.com/profile.php?id=391696434257010
http://www.facebook.com/profile.php?id=294884233964733
http://www.facebook.com/profile.php?id=95227081844
http://www.facebook.com/profile.php?id=243603302372166
http://www.facebook.com/profile.php?id=133588296813108
http://www.facebook.com/profile.php?id=236602149740013
http://www.facebook.com/profile.php?id=182888791835026
http://www.facebook.com/profile.php?id=235721399782425
http://www.facebook.com/profile.php?id=400902623311446
http://www.facebook.com/profile.php?id=119967478161145
http://www.facebook.com/profile.php?id=131428787031869
http://www.facebook.com/profile.php?id=156663854352810
http://www.facebook.com/profile.php?id=157498287703875
http://www.facebook.com/profile.php?id=108475415989391
http://www.facebook.com/profile.php?id=483774405001964
http://www.facebook.com/profile.php?id=120046071417424
http://www.facebook.com/profile.php?id=271179569680273
http://www.facebook.com/profile.php?id=419165598168812
http://www.facebook.com/profile.php?id=311186269004461
http://www.facebook.com/profile.php?id=565842136760384
http://www.facebook.com/profile.php?id=171140842976135
http://www.facebook.com/profile.php?id=484219208281601
http://www.facebook.com/profile.php?id=254859381218406
http://www.facebook.com/profile.php?id=407054856048407
http://www.facebook.com/profile.php?id=424964444223400
http://www.facebook.com/profile.php?id=522644344432672
http://www.facebook.com/profile.php?id=253073614802191
http://www.facebook.com/profile.php?id=417121668357456
http://www.facebook.com/profile.php?id=409562465788081
http://www.facebook.com/profile.php?id=410378515661467
http://www.facebook.com/profile.php?id=498720656857624
http://www.facebook.com/profile.php?id=297426573692153
http://www.facebook.com/profile.php?id=173943602658799
http://www.facebook.com/profile.php?id=313961751958203
http://www.facebook.com/profile.php?id=474015989325002
http://www.facebook.com/profile.php?id=376500302396772
http://www.facebook.com/profile.php?id=123335714486
http://www.facebook.com/profile.php?id=516816295035446
http://www.facebook.com/profile.php?id=153274061494521
http://www.facebook.com/profile.php?id=340533549311041
http://www.facebook.com/profile.php?id=438844746204212
http://www.facebook.com/profile.php?id=504108792961127
http://www.facebook.com/profile.php?id=505974622782299
http://www.facebook.com/profile.php?id=548845485127982
http://www.facebook.com/profile.php?id=494285880635024
http://www.facebook.com/profile.php?id=344496762326480
http://www.facebook.com/profile.php?id=569212953105983
http://www.facebook.com/profile.php?id=195675533910483
http://www.facebook.com/profile.php?id=134347253398740
http://www.facebook.com/profile.php?id=438463122845015
http://www.facebook.com/profile.php?id=347106975300379
http://www.facebook.com/profile.php?id=179850328756751
http://www.facebook.com/profile.php?id=152353318256609
http://www.facebook.com/profile.php?id=105748569490019
http://www.facebook.com/profile.php?id=240832442676024
http://www.facebook.com/profile.php?id=508941525815596
http://www.facebook.com/profile.php?id=541601682537919
http://www.facebook.com/profile.php?id=182091298490032
http://www.facebook.com/profile.php?id=258409404213557
http://www.facebook.com/profile.php?id=338734539561275
http://www.facebook.com/profile.php?id=112653042246023
http://www.facebook.com/profile.php?id=377408112341598
http://www.facebook.com/profile.php?id=119724048068604
http://www.facebook.com/profile.php?id=214722938592706
http://www.facebook.com/profile.php?id=128414214003077
http://www.facebook.com/profile.php?id=337790539672663
http://www.facebook.com/profile.php?id=111005928957982
http://www.facebook.com/profile.php?id=148011482012269
http://www.facebook.com/profile.php?id=137394086356679
http://www.facebook.com/profile.php?id=492702947432061
http://www.facebook.com/profile.php?id=125117532466
http://www.facebook.com/profile.php?id=341545273299
http://www.facebook.com/profile.php?id=329228007110678
http://www.facebook.com/profile.php?id=133940850078252
http://www.facebook.com/profile.php?id=206296172822493
http://www.facebook.com/profile.php?id=130940087078300
http://www.facebook.com/profile.php?id=312815948821290
http://www.facebook.com/profile.php?id=300724693296802
http://www.facebook.com/profile.php?id=146449672182692
http://www.facebook.com/profile.php?id=114448045347744
http://www.facebook.com/profile.php?id=162212810598956
http://www.facebook.com/profile.php?id=146456735421701
http://www.facebook.com/profile.php?id=125117532466
http://www.facebook.com/profile.php?id=161866810629855
http://www.facebook.com/profile.php?id=207439972735988
http://www.facebook.com/profile.php?id=129631360541725
http://www.facebook.com/profile.php?id=561693297188533
http://www.facebook.com/profile.php?id=398914903527149
http://www.facebook.com/profile.php?id=477375888990613
http://www.facebook.com/profile.php?id=427086787368710
http://www.facebook.com/profile.php?id=119724048068604
http://www.facebook.com/profile.php?id=416440158440945
http://www.facebook.com/profile.php?id=188887541160481
http://www.facebook.com/profile.php?id=435547266520841
http://www.facebook.com/profile.php?id=143432342386826
http://www.facebook.com/profile.php?id=128787670633905
http://www.facebook.com/profile.php?id=372577909521582
http://www.facebook.com/profile.php?id=488388491222888
http://www.facebook.com/profile.php?id=287806967995218
http://www.facebook.com/profile.php?id=134102113417911
http://www.facebook.com/profile.php?id=440649122641611
http://www.facebook.com/profile.php?id=427464370671001
http://www.facebook.com/profile.php?id=511916405516571
http://www.facebook.com/profile.php?id=338981232878359
http://www.facebook.com/profile.php?id=152896554868936
http://www.facebook.com/profile.php?id=329103113844887
http://www.facebook.com/profile.php?id=162831710445020
http://www.facebook.com/profile.php?id=100003022214364
http://www.facebook.com/profile.php?id=1680131486
http://www.facebook.com/profile.php?id=100003103567539
http://www.facebook.com/profile.php?id=100004447634567
http://www.facebook.com/profile.php?id=1093128310
http://www.facebook.com/profile.php?id=100005349303853
http://www.facebook.com/profile.php?id=1801381535
http://www.facebook.com/profile.php?id=100005281511055
http://www.facebook.com/profile.php?id=100004700704055
http://www.facebook.com/profile.php?id=100003280382534
http://www.facebook.com/profile.php?id=100001101410792
http://www.facebook.com/profile.php?id=100005187668390
http://www.facebook.com/profile.php?id=1591336546
http://www.facebook.com/profile.php?id=100000778801829
http://www.facebook.com/profile.php?id=1846519160
http://www.facebook.com/profile.php?id=100003612024277
http://www.facebook.com/profile.php?id=1194403301
http://www.facebook.com/profile.php?id=100003699093590
http://www.facebook.com/profile.php?id=100000563813055
http://www.facebook.com/profile.php?id=100005302542899
http://www.facebook.com/profile.php?id=100004060270347
http://www.facebook.com/profile.php?id=100001001233659
http://www.facebook.com/profile.php?id=100005312263743
http://www.facebook.com/profile.php?id=100000632321801
http://www.facebook.com/profile.php?id=100000287106763
http://www.facebook.com/profile.php?id=100001647817391
http://www.facebook.com/profile.php?id=1066266801
http://www.facebook.com/profile.php?id=100005121491356
http://www.facebook.com/profile.php?id=100005270103269
http://www.facebook.com/profile.php?id=852809801
http://www.facebook.com/profile.php?id=100000575020895
http://www.facebook.com/profile.php?id=1563484725
http://www.facebook.com/profile.php?id=100004897690621
http://www.facebook.com/profile.php?id=100001734816824
http://www.facebook.com/profile.php?id=100005313014422
http://www.facebook.com/profile.php?id=100000426977960
http://www.facebook.com/profile.php?id=100002532327215
http://www.facebook.com/profile.php?id=100004424261912
http://www.facebook.com/profile.php?id=100001981579448
http://www.facebook.com/profile.php?id=1147471978
http://www.facebook.com/profile.php?id=100002152537999
http://www.facebook.com/profile.php?id=1101618222
http://www.facebook.com/profile.php?id=100005207921342
http://www.facebook.com/profile.php?id=100005330375385



徵求另一支end of the world is coming的連結，

我想順便分析一下...

--
※ 發信站: 批踢踢實業坊(ptt.cc)
◆ From: 220.133.45.155
推 XXXXGAY:有專業友推！                                            03/04 01:35
推 ziolin:推!                                                      03/04 01:36
推 dryden:詳細推，該外掛已檢舉                                     03/04 01:36
推 ntust661:推!                                                    03/04 01:37
※ andy199113:轉錄至看板 Facebook                                  03/04 01:38
推 littlenee:                                                      03/04 01:45
推 gygg543:專業的安迪                                              03/04 01:46
推 choco7:專業推~~已檢舉                                           03/04 02:01
推 acer758219:專業推 已檢舉                                        03/04 02:09
推 cywang0307:推主播專家～                                         03/04 02:19
推 xinyuxiao:                                                      03/04 02:26
推 isoda226:專業推~~                                               03/04 02:39
推 shintz:專業推                                                   03/04 02:41
推 a1b2a3g4h:Andy出品 保證專業                                     03/04 02:49
推 hiphopboy7:厲害                                                 03/04 02:49
※ 編輯: andy199113      來自: 220.133.45.155       (03/04 02:57)
推 donkilu:推，沒想到是利用插件...                                 03/04 03:13
推 goldstein:推                                                    03/04 03:46
→ theskyofblue:強者                                               03/04 06:07
推 andy810515:專業推                                               03/04 07:19
推 ru04ul4:跟我想的差不多                                          03/04 08:17
→ w6422613:專業文推                                               03/04 08:36
推 accin:強暴了 FB顆比                                             03/04 08:55
推 echoempty:讚                                                    03/04 09:13