那个赌博网站？它背后有中国有组织犯罪集团撑腰.pdf

1、#BHUSA BlackHatEventsThatThat Gambling Site?Gambling Site?Its Fueled by Its Fueled by Chinese Organized CrimeChinese Organized CrimeMal Le Touz&Rene Burton#BHUSA BlackHatEventsWho Are We?Rene heads up Infoblox Threat Intel.Loves DNS hunting.Also knits.knitcodeinfosec.exchangeJust somebody with a com

2、puter.Loves finding bad BlackHatEventsVigorish Viper Self-Image#BHUSA BlackHatEventsThe Real Vig#BHUSA BlackHatEvents#BHUSA BlackHatEventsIllegal Gambling estimated USD$1.7 Trillion EconomyNearly 3x Illegal Drug EconomyMotivation#BHUSA BlackHatEventsSports Sponsorship Scheme#BHUSA BlackHatEvents14 D

3、omains Seized in 2023#BHUSA BlackHatEventsIt is always the DNS.DNS and Vigorish Viper#BHUSA BlackHatEventsAccess Denied#BHUSA BlackHatEventsAll Sites are the Same#BHUSA BlackHatEvents Gambling on soccer,basketball,esports,cricket,flash games,lottery.Softcore adult content Streaming of games Payment

4、handling 24/7 Customer service Self-signed mobile apps One Stop Vice City#BHUSA BlackHatEventsMobile Apps#BHUSA BlackHatEventsCaptchas and Fingerprinting#BHUSA BlackHatEventsLayered Defenses(i32.const 21008)040000/scytale/)(i32.const 21524)/api/site/gameassist)(i32.const 22044)140001/scytale/)(i32.c

5、onst 23080)180001/scytale/)(i32.const 23616)application/json)(i32.const 23696)tb-client-type)(i32.const 23760)tb-client-origtype)(i32.const 23832)tb-site-id)(i32.const 23904)tb-token)(i32.const 23976)tb-agent-token)(i32.const 24048)tb-uuid)(i32.const 24120)tb-version)(i32.const 24192)x-kk-appkey)(i3

6、2.const 24264)x-kk-nonce)(i32.const 24336)x-kk-sign)(i32.const 24408)x-kk-svn)(i32.const 24480)x-kk-timestamp)(i32.const 24552)x-kk-sv)Constant background queries Encrypted API calls 300MB of WASM#BHUSA BlackHatEventsLayered Defenses#BHUSA BlackHatEventsDomain