先叙述下缘由,我今天收到了一封勒索邮件,说是我密码在访问不安全网站时被泄露,黑客掌握了我的所有信息,还给我电脑上植入的木马,即使修改邮件密码也没用,如果不在48h之内支付九百多美金的比特币就会把我的信息公示到网上!
看到第一眼我差点信了,后来一想我的邮箱是自己设置的,只用来接收邮件,从未在其他地方登陆过,仔细分析了下我觉得是属于欺骗,其实并没有我的相关信息,后来谷歌了下确实也证实了,属于乱撞,有不谨慎的可能真的会给他打钱!
后来我就想知道这份邮件里面真的有么有藏着木马啥的,发现没有附件,于是打开这封邮件的源码,发现里面有这么一段js,我格式化了一下贴出来
< script >
var w = 3Dwindow;
if (w.performance || w.mozPerformance || w.msPerformance || w.webki = tPerformance) {
var d = 3Ddocument;
AKSB = 3Dw.AKSB || {}, AKSB.q = 3DAKSB.q || [], AKSB.m = ark = 3DAKSB.mark ||
function(e, _) {
AKSB.q.push(["mark", e, _ || (new Date).getTime( = )])
}, AKSB.measure = 3DAKSB.measure ||
function(e, _, t) {
AKSB.q.push(["measure", e, = _, t || (new Date).getTime()])
}, AKSB.done = 3DAKSB.done ||
function(e) {
AKSB.q.push = (["done", e])
}, AKSB.mark("firstbyte", (new = 20
Date).getTime()), AKSB.prof = 3D {
custid: "641075",
ustr: "",
originlat: "0",
clientr = tt: "19",
ghostip: "217.212.224.166",
ipv6: false,
pct: "10",
clientip: "46.183.219.=
233",
requestid: "2120224a",
region: "27660",
protocol: "h2",
blver: 14,
akM: "x",
akN = : "ae",
akTT: "O",
akTX: "1",
akTI: "2120224a",
ai: "441803",
ra: "false",
pmgn: "",
pmgi = : "",
pmp: "",
qc: ""
}, function(e) {
var _ = 3Dd.createElement("script");
_.async = 3D "=
async", _.src = 3De;
var = 20
t = 3Dd.getElementsByTagName("script"),
t = 3Dt[t.length - 1];
t.parentNode.insertB = efore(_, t)
}(("https:" = 3D = 3D = 3Dd.location.protocol ? "https:" : "http:") + "//ds-a=
ksb-a.akamaihd.net/aksb.min.js")
} < /script>
看了半天看不明白到的有什么用,会不会发送东西出去,谷歌发现akamaihd.net这个域名应该是一个代理服务器,很多网站都会挂在它上面!路过的高手可以帮忙分析下,先谢过诸位路过的兄弟!
补充:当我第一次打开邮件时立马收到了一份已读的提示邮件,如下图,这个是怎么做到的?
666,大致能看的懂一点点就是通过创建一个script标签,将aksb.min.js添加进去。