6. Traceability of Transmission Channels

根据中国互联网络信息中心（CNNIC）第45次发布《中国互联网络发展状况统计报告》显示，截止今年3月，我国网民规模达9.04亿，不法分子利用网络直播平台传播淫秽色情信息非法牟利现象屡见不鲜，国家六部门联合下发《关于加强网络直播服务管理工作的通知》，恒安嘉新暗影安全实验室针对此类问题，成立了移动互联网“黄赌骗”专题研究小组，持续针对“黄赌骗”黑色产业链进行研究，在国家互联网应急中心发布的《中国移动互联网安全报告（2019）》中，发表了移动互联网“黄赌骗”黑色产业专题研究报告。    

近日，恒安嘉新暗影安全实验室接到用户投诉，一款名为“玖色直播”的应用程序涉及“黄赌骗”行为，安全研究人员第一时间进行了研究分析，发现该应用是一款直播软件，内容以色情为主，还包含网络赌博，网络私彩、在线小说（色情）等，同时，利用该软件进行招聘网络主播。本文主要是针对“玖色直播”的传播方式、盈利模式，溯源分析，情报挖掘等方面进行披露，以免更多网民上当受骗。    

图1应用安装图标

一、样本基本信息

二、应用的传播方式、盈利模式

在测试样本内容时，我们发现应用本身包含“发展下级代理”的功能，即除了软件本身利用网络传播外，软件使用者作为另一传播源向下传播，一传十，十传百，如下图所示：    

Figure 2 Application spread method    

According to the test, the profit model of this live streaming software is very clear, including sharing with anchors, agency sharing, online betting, online private lottery, and gifts props given by users to anchors, all of which require recharge purchase.   

Figure 3 Application profit model    

3. Traceability relationship logic diagram

Figure 4 Application traceability relationship logic diagram

4. Based on the system expansion of intelligence clues mining

4.1 Server interaction information

4.1.1 Master address

Through packet capture analysis of the application, it was found that some suspicious URLs are as follows:

http://bj******as.com/Client/UserOperation.

Figure 5 Master 1

After investigating the filing information and whois information of this domain name, it was found that this domain name is not filed, and there is no valid registrant information in whois. The IP address has been queried, and this domain name corresponds to a total of 7 IP addresses, with physical addresses in Hong Kong, Taiwan, and South Korea.    

Figure 6 Master 1 corresponding IP

IP address list:

http://imapp.******.com:8888/:

Through the abovehttp://bjFrom the information returned by ******as.com/Client/UserOperation, it jumps tohttp://imapp.******.com:8888/.

Figure 7 Master 2

Query the filing information of this domain name, automatically filtered to the second-level domain: ******.com, obtaining the website filing person '*** Lin', and no relevant information was found after network search.    

Figure 8 Master 2 filing information

IP query: Through inquiry, this domain name has only one corresponding IP    

IP address: 183.******.145    

Physical address: Zhejiang Jiaxing City, China Telecom    

Figure 9 Master 2 corresponding IP

4.1.2 Software function interaction address

Through packet capture analysis of software functions, it can be traced back to some address information as follows:     

Happy **:             

https://dfqdvip2.******.com/manifest.json?v=0.19072484366816922    

Figure 10 'Happy **' corresponds to the link

Through domain name filing inquiries, the owner is 'Changsha ** E-commerce Co., Ltd.'

Figure 11 'Happy **' corresponds to the domain name filing

The company has also registered other 3 domain nameswww.ky****.comwww.ky****.comwww.ky****.com.    

Figure 12 Related Domains of the Enterprise

Query the information of the enterprise, the legal person of the company is *Tao.    

Figure 13 Record Enterprise Information

Through Tianyancha, the following information was obtained:    

Figure 14 'Tianyancha' Information of Record Enterprise

After querying the reserved phone number of the enterprise, it shows that the phone number is from Liaoning Tieling, is kept by the enterprise, and needs to upload business license, legal person *** information, etc. for modification, and no WeChat and Alipay accounts with the same phone number were found.    

Figure 15 Reserved Phone Number

Free porn novel:             

http://m2.*****.ltd/?access-token=cfa6ETs-ZncwfywIDyRYXClrMFJpNl5CKAs8bhRoAG5FOxJ7Rh1cb3YFSko。    

Figure 16 'Porn Novel' Corresponding Link

Domain record information query, automatically filtered to the 2nd level domain ****.ltd, domain owner *Xixiang, latest registrant chenlin.    

Figure 17 Domain Record Information    

Figure 18 Domain Registration Information

Through searching the website owner 'Xixiang', it was found that two other domains registered, www.******.ltd and www.******.ltd, and the website names are all 'The Journey of Aojing's Heart'.    

Figure 19 Other Domain Information of Website Owner

Figure 20 Other Domain Information of Website Owner

Initiate Alipay payment:             

http://pay.*******.org/Home/Pay?id=3&charge_money=101.0&order_number=2005261958024fF0F&user_id=47466&charge_type=2。    

Figure 21 Initiate 'Alipay' Payment Link

Record query, not recorded, IP address 182.******.110, physical address: Hong Kong simcentric network company.    

Figure 22 Domain Corresponding IP

The above link will be redirected to the following link after connection:    

https://cwww.https://cwww.******.cn/pay/receivables?order=3a9c8e4049f34083bf3d942c54d3a03e。    

Figure 23 Payment Redirect Link

IP address 124.******.1, physical address: IDc room of China Telecom in Changsha City, Hunan Province.

Figure 24 Redirect Link Corresponding IP

The record information of cwww.******.cn is as follows:    

Figure 25 Domain Name Record Information

The enterprise has also registered the following 3 domain names: www.******.cn, www.*******.cn, www.*******.cn.

Figure 26 Other Domain Name Information of the Enterprise

Through Tianyancha, query the information of the enterprise.    

Figure 27 Record Information of the Registered Enterprise “Tianyancha”    

Figure 28 Record Information of the Registered Enterprise “Tianyancha”

157****5100 This phone number can be searched for the same number WeChat and Alipay accounts. Through the Alipay account, it can be known that this phone number belongs to “*Chao”.Figure 29 Phone Number Corresponding to WeChat and Alipay Information

4.1.3 Customer Service Interaction Address

Through packet capture analysis of customer service functions, it is confirmed that it uses **Cloud Customer Service System:

https://pubcon.******.com/config_22874.json

https://22874.******.ink/chat.html

Figure 30 Customer Service Domain Name Record Information    

Figure 31 Customer Service Domain Name Record Information

Introduction of the Customer Service Company:    

****Network Technology Co., Ltd. was established in 2017 and independently developed a cloud customer service system based on the SaaS model. Registration is required to activate and use it, which is used for online dialogue and communication between enterprises and customers. It can help customer service teams of enterprises better collaborate and manage, and at the same time provide more convenient dialogue channels and elegant dialogue experiences for the customers of enterprises, enabling enterprises to better serve customers.    

Figure 32 Customer Service Official Website Introduction

V. Payment Traceability    

The recharge and payment system of this live streaming software is roughly divided into three types: bank transfer, Alipay, and WeChat payment.    

Figure 33 Recharge and Payment Methods

(I)***Payment:

Bank transfer can only be transferred to Agricultural Bank, and there is only one payee named '*Chun Hua'.    

Figure 34: Bank Transfer

(2) WeChat Payment:    

There are two options for WeChat-initiated payments: one is WeChat transfer to ***, and the other is WeChat QR code payment, and the current WeChat QR code payment function shows 'No QR code payment available in the current region'.    

Figure 35: WeChat Payment Method One

Select WeChat transfer to ***, a QR code page pops up, this QR code does not require scanning, and the prompt is 'Click'.    

Figure 36: WeChat Payment Method Two

Test initiating WeChat transfer to *** click the QR code payment operation, multiple occurrences of the following several *** numbers.    

Figure 37: WeChat Payment Payee and Card Number One

Figure 38: WeChat Payment Payee and Card Number Two

Among them, the *** named as '*Liang' involves multiple banks, with 4 different bank *** numbers.

Note: The payee and random-generated *** numbers cannot be guaranteed to be obtained in the test

(3) Alipay Payment:

Alipay-initiated payments can be directly redirected to Alipay payment, or payments can be made based on the appearing payee and account number.    

Redirected to Alipay payment, only showing the payee's name, not the card number.    

Figure 39: Alipay In-app Payment    

The payee's name and account number that appear when initiating an Alipay payment.    

Figure 40: Alipay Payee and Card Number One    

Figure 41: Alipay Payee and Card Number Two    

Figure 42: Alipay Payee and Card Number Three    

Figure 43: Alipay Payee and Card Number Four    

Figure 44: Alipay Payee and Card Number Five

Among them, “*Yongjun” appeared twice, containing two *** numbers    

Note: The payee and random-generated *** numbers cannot be guaranteed to be obtained in the test    

6. Traceability of Transmission Channels    

This software was obtained through user complaints from Hang'an Jiaxin Dark Shadow Security Lab, and during the testing process, multiple software download entries were found, as follows:    

Figure 45 Customer Service System Default Message

Domain/IP location query, the physical addresses are all in Hong Kong.    

After visiting the above address, the returned page content is the same as shown in the figure below:

Figure 46 “Jiu Se Live” download entrance

Click the quick download button:    

Figure 47 “Jiu Se Live” software download button

A link appears as follows:    

http://jius********p.oss-cn-hangzhou.aliyuncs.com/20200516/jiuse_live_g4_v1.2.2_g4Release.apk.    

This link is verified to be an Aliyun server:    

Figure 48 Download link record information

7. Expanded Clues

By performing correlation analysis on the application in the APP panoramic situation platform of Hang'an Jiaxin, a total of 3 applications in the same series were found.    

Figure 49 “Jiu Se Live” series applications

The application package name and MD5 are as follows:    

Author: Shadow Security Lab, please indicate the source as FreeBuf.COM when reproduced