A method and system for generating APP bait files

Abstract

The present invention relates to an APP bait file generation method and system in the field of red-blue confrontation technology in network security, comprising the following steps: obtaining an application from a compressed image file and storing the application in a system folder of a launcher; obtaining a configuration information key-value pair of the application and copying the configuration information key-value pair to a configuration information folder of the launcher; constructing a binary capture file and storing the binary capture file in a system folder of the launcher; modifying the execution order of the execution script of the launcher and modifying the name information of the launcher according to the application to obtain a bait file, which has the advantage of high simulation and breaks through the bottleneck of the existing Mac OS system being unable to obtain attacker information when attacked by an attacker.

Description

Technical Field

[0001] The present invention relates to the field of red-blue confrontation technology in network security, and in particular to a method and system for generating APP bait files. Background Art

[0002] DMG is a compressed image file on Mac, equivalent to the common iso file on Windows. DMG can be directly loaded on Mac and converted into an ISO file on Windows PC using the command line software dmg2iso.exe. Bait files refer to data used to confuse attackers, including files, databases, codes and other information, to trick attackers into clicking or viewing the bait files.

[0003] Existing bait files are all made based on the Windows system. However, bait files based on the Windows system cannot be used on the Mac OS system. When facing network attackers, Mac OS users cannot obtain and track the attacker's information, making it impossible for Mac OS users to take further defensive measures when facing network information security risks. Summary of the Invention

[0004] In response to the shortcomings of the prior art, the present invention provides an APP bait file generation method and system, which has the advantage of high simulation and breaks through the bottleneck of the existing MacOS system being unable to obtain attacker information when attacked by an attacker.

[0005] In order to solve the above technical problems, the present invention is solved by the following technical solutions:

[0006] A method for generating an APP bait file comprises the following steps:

[0007] Obtain an application from a compressed image file, and store the application in a system folder of a launcher;

[0008] Obtain the application's configuration information key-value pair and copy the configuration information key-value pair to the launcher's configuration information folder;

[0009] Constructing a binary capture file and storing the binary capture file in a system folder of the launcher;

[0010] The execution order of the execution script of the launcher is modified, and the name information of the launcher is modified according to the application program to obtain a bait file.

[0011] Optionally, build a binary capture file, including the following steps:

[0012] Generate a request code, obtain and collect code, transmit code and execute code in sequence, wherein the request code, obtain and collect code, transmit code and execute code are all binary codes;

[0013] A binary capture file is obtained according to the request code, acquisition and collection code, transmission code and execution code.

[0014] Optionally, the following steps are also included:

[0015] According to the application, a web version link of the application is obtained, and the web version link is stored in a system folder of the launcher.

[0016] Optionally, modifying the name information of the launcher according to the application includes the following steps:

[0017] The name script information of the launcher is obtained, and the application name of the application is obtained, and the application name is written into the name script information.

[0018] Optionally, the following steps are also included:

[0019] The bait file is compressed to generate a DMG bait file.

[0020] An APP bait file generation system, comprising:

[0021] An acquisition module is used to obtain an application from a compressed image file and store the application in a system folder of the launcher;

[0022] A copy module is used to obtain the configuration information key-value pairs of the application and copy the configuration information key-value pairs to the configuration information folder of the launcher;

[0023] A construction module is used to construct a binary capture file and store the binary capture file in a system folder of the launcher;

[0024] The modification module is used to modify the execution order of the execution script of the launcher and modify the name information of the launcher according to the application program to obtain a bait file.

[0025] Optionally, the construction module includes:

[0026] A code generation module, configured to sequentially generate a request code, an acquisition and collection code, a transmission code, and an execution code, wherein the request code, the acquisition and collection code, the transmission code, and the execution code are all binary codes;

[0027] The first compression module is used to obtain a binary capture file according to the request code, the acquisition and collection code, the transmission code and the execution code.

[0028] Optionally, a link acquisition module is further included, which is used to acquire a web version link of the application according to the application, and store the web version link in a system folder of the launcher.

[0029] Optionally, the modification module is further configured to obtain the name script information of the launcher, obtain the application name of the application, and write the application name into the name script information.

[0030] Optionally, a second compression module is also included, which is used to compress the bait file to generate a DMG bait file.

[0031] Compared with the prior art, the technical solution provided by the present invention has the following beneficial effects:

[0032] By setting a binary capture file in the launcher, the attacker's information is captured through the binary capture file when the attacker clicks the launcher. At the same time, the key-value pairs of the obtained application are copied to the launcher, so that the launcher's version, icon and other information remain the same as the application. At the same time, by modifying the launcher's name information, the launcher's name remains the same as the application, which is used to confuse the attacker into thinking that the launcher is the real application, and then confuse the attacker into clicking the launcher. At the same time, by modifying the execution order of the launcher, it is ensured that after the attacker clicks the launcher, he is first intercepted by the binary capture file and obtains information, and then enters the real application. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0034] Figure 1 This is a flow chart of a method for generating an APP bait file proposed in the first embodiment;

[0035] Figure 2 This is a comparison diagram of the bait file startup process proposed in the first embodiment and the real application startup process. DETAILED DESCRIPTION

[0036] The present invention will be further described in detail below with reference to the examples. The following examples are intended to explain the present invention but the present invention is not limited to the following examples.

[0037] Example 1

[0038] like Figure 1 As shown, a method for generating an APP bait file includes the following steps: obtaining a compressed image file, and decompressing the compressed image file to obtain an application; when making the bait file, it is first necessary to make the launcher have the same appearance as the real application, so as to confuse the attacker, click on the launcher, and then obtain the information of the attacker who clicked. It should be noted that the launcher mentioned in this embodiment is an empty shell of the application, and the launcher contains the resource folder, configuration information folder and system folder carried by the launcher itself.

[0039] Among them, the resource folder is a folder for storing basic launcher information such as icons, the configuration information folder is a folder for storing applications, application versions and application permissions, and the system folder is a folder for storing application binaries. Since the launcher is an empty shell of the application, there is no data in the configuration information folder. It should be noted that the bait file generated in this embodiment is applied to the Mac OS system.

[0040] Furthermore, in order to improve the similarity between the launcher and the real application, it is first necessary to obtain the compressed image file used in the Mac OS system, and then decompress it to obtain a real application. The real application can be any application that can be used in the Mac OS system. Then, obtain the configuration information key-value pair of the application, and copy the configuration information key-value pair to the configuration information folder of the launcher, so that the configuration information of the launcher is consistent with that of the real application, that is, to achieve the purpose of making the launcher version and icon and other information consistent with the real application.

[0041] When the configuration information in the launcher is consistent with the real application, the name information of the launcher needs to be modified according to the application, and the application is stored in the system folder of the launcher. The application is stored in the system file of the launcher so that after the launcher is clicked by the attacker, an application can be opened normally, thereby completing high simulation. Modifying the name information of the launcher according to the application specifically includes the following steps: obtaining the name script information of the launcher, and obtaining the application name of the application, writing the application name into the name script information, thereby realizing the name modification of the launcher by rewriting the script, and then obtaining a launcher with the same name as the application.

[0042] After achieving a high degree of simulation of the launcher, it is necessary to enable the launcher to obtain the attacker's information after being clicked by the attacker. Therefore, a binary capture file needs to be constructed and stored in the system folder of the launcher; the execution order of the launcher's execution script is modified to obtain a bait file, wherein the construction of the binary capture file specifically includes the following steps: generating a request code, obtaining a collection code, a transmission code and an execution code in sequence, and the request code, obtaining a collection code, a transmission code and an execution code are all binary codes; the request code, obtaining a collection code, a transmission code and an execution code are compressed to obtain a binary capture file.

[0043] The binary capture file includes request command data, acquisition and collection command data, transmission command data and execution command data, and the request command data is the request code, the acquisition and collection command data is the acquisition and collection code, the transmission command data is the transmission code, and the execution command data is the execution code. In actual applications, when the attacker clicks the launcher, it will trigger the request code in the binary capture file to send a request to the server to obtain the attacker's information. After receiving the request, the server sends feedback information. After receiving the feedback information from the server, the execution code executes the command in the feedback information. Taking the command to agree to obtain the attacker's information as an example, the binary capture file will start to obtain the attacker's information, including the attacker's attack path, attacker account information, etc., and then upload the obtained attacker information to the server for the staff to further understand the attacker's situation. The feedback information sent by the server can be to obtain the attacker's information or a command to prevent the attacker from continuing to access. The feedback information includes but is not limited to the above two situations.

[0044] It should be noted that, since the underlying executable files in the Mac OS system need to exist in binary form, the capture file format needs to be set to binary before it can be executed in the Mac OS system, that is, the generated codes are all binary codes.

[0045] like Figure 2As shown, on the other hand, since it is necessary to ensure that after the attacker clicks the launcher, the launcher first obtains information about the attacker through the binary capture file, it is also necessary to modify the execution script of the launcher to modify the execution order of the launcher. Specifically, the execution order of the execution script of the launcher needs to be modified as follows: when the attacker clicks the launcher, the launcher first executes the script program in the system folder, and the script program then grants executable permission to the binary capture file. Then the script executes the binary capture file in the background, starts the program that sends a request to the server, and executes the command issued by the server. Finally, it determines whether the script starts the copied application. By rewriting the execution process, before the attacker opens the real application, the constructed binary capture file can be used to obtain information about the attacker, and the server can be reported to remind the staff of matters such as the attacker's intrusion and facilitate the staff's further follow-up processing of the attacker, such as whether to organize the attacker to continue access.

[0046] Since a normal application directly executes the binary file that starts the application when it is accessed by an attacker, the decoy file containing the application finally obtained in this embodiment can realize online monitoring of the attacker's access based on security.

[0047] Furthermore, generating the bait file also includes the following steps: compressing the bait file to generate a DMG bait file, so that all staff members can download and install it without regenerating the bait file.

[0048] On the other hand, in the red-blue confrontation, the attacked party can use the bait file to lure the attacker. If the attacker needs to use the bait file to counter-entrap the attacked party, the attacker can send the compressed package of the bait file to the attacked party via email or social software, thereby achieving the attacker's counter-entrapment purpose.

[0049] Example 2

[0050] A method for generating an APP bait file also includes the following steps: obtaining a web version link of the application according to the application, and storing the web version link in a system folder of a launcher.

[0051] Compared with the first embodiment, the difference of this embodiment is that the application stored in the system folder can be replaced with a web link of the application. That is, when the attacker clicks the launcher and the binary capture file obtains the attacker's information, the attacker is directly redirected to the official webpage of the application through the web link. For example, if the application is WeChat, after the attacker's information is obtained, the attacker is directly redirected to the browser and opens the official login website of WeChat through the browser, thereby also confusing the attacker and achieving the purpose of obtaining the attacker's information.

[0052] Example 3

[0053] A system for generating APP bait files includes: an acquisition module for obtaining a compressed image file, decompressing the compressed image file to obtain an application, and storing the application in a system folder of a launcher; first, the launcher needs to have the same appearance as the real application, so as to confuse the attacker, click the launcher, and then obtain the information of the attacker who clicks. It should be noted that the launcher mentioned in this embodiment is an empty shell of the application, and the launcher contains the resource folder, configuration information folder and system folder carried by the launcher itself.

[0054] Among them, the resource folder is a folder for storing basic launcher information such as icons, the configuration information folder is a folder for storing applications, application versions and application permissions, and the system folder is a folder for storing application binaries. Since the launcher is an empty shell of the application, there is no data in the configuration information folder. It should be noted that the bait file generated in this embodiment is applied to the Mac OS system.

[0055] Furthermore, in order to improve the similarity between the launcher and the real application, it is first necessary to obtain the compressed image file used in the Mac OS system, and then decompress it to obtain a real application. The real application can be any application that can be used in the Mac OS system. Then, the configuration information key-value pair of the application is obtained through the copy module, and the configuration information key-value pair is copied to the configuration information folder of the launcher, so that the configuration information of the launcher is consistent with that of the real application, that is, the purpose of achieving consistency between the version and icon of the launcher and the real application is achieved.

[0056] When the configuration information in the launcher is consistent with the real application, the modification module needs to modify the name information of the launcher according to the application and store the application in the system folder of the launcher. The application is stored in the system file of the launcher so that after the launcher is clicked by the attacker, an application can be opened normally, thereby completing high simulation. Furthermore, the modification module is also used to obtain the name script information of the launcher and the application name of the application, and write the application name into the name script information, so as to realize the name modification of the launcher by rewriting the script, and then obtain a launcher with the same name as the application.

[0057] After achieving a high degree of simulation of the launcher, it is necessary to enable the launcher to have the ability to obtain the attacker's information after being clicked by the attacker. Therefore, the construction module needs to construct a binary capture file and store the binary capture file in the system folder of the launcher. The modification module modifies the execution order of the launcher's execution script to obtain a bait file. Among them, the construction module includes: a code generation module, which is used to generate a request code, an acquisition and collection code, a transmission code and an execution code in sequence, and the request code, the acquisition and collection code, the transmission code and the execution code are all binary codes; a first compression module, which is used to compress the request code, the acquisition and collection code, the transmission code and the execution code to obtain a binary capture file.

[0058] The binary capture file includes request command data, acquisition and collection command data, transmission command data and execution command data, and the request command data is the request code, the acquisition and collection command data is the acquisition and collection code, the transmission command data is the transmission code, and the execution command data is the execution code. In actual applications, when the attacker clicks the launcher, it will trigger the request code in the binary capture file to send a request to the server to obtain the attacker's information. After receiving the request, the server sends feedback information. After receiving the feedback information from the server, the execution code executes the command in the feedback information. Taking the command to agree to obtain the attacker's information as an example, the binary capture file will start to obtain the attacker's information, including the attacker's attack path, attacker account information, etc., and then upload the obtained attacker information to the server for the staff to further understand the attacker's situation. The feedback information sent by the server can be to obtain the attacker's information or a command to prevent the attacker from continuing to access. The feedback information includes but is not limited to the above two situations.

[0059] It should be noted that, since the underlying executable files in the Mac OS system need to exist in binary form, the capture file format needs to be set to binary before it can be executed in the Mac OS system, that is, the generated codes are all binary codes.

[0060] On the other hand, since it is necessary to ensure that after the attacker clicks the launcher, the launcher first obtains information about the attacker through the binary capture file, the execution script of the launcher also needs to be modified to modify the execution order of the launcher. Specifically, the execution order of the execution script of the launcher needs to be modified so that when the attacker clicks the launcher, the launcher first executes the script program in the system folder, and the script program grants executable permissions to the binary capture file. Then the script executes the binary capture file in the background, starts the program that sends a request to the server, and executes the command issued by the server. Finally, it determines whether the script starts the copied application. By rewriting the execution process, before the attacker opens the real application, the attacker's information can be obtained through the constructed binary capture file, and operations such as reporting to the server can be performed to remind the staff of matters such as the attacker's intrusion and facilitate the staff's further follow-up processing of the attacker, such as whether to prevent the attacker from continuing to access.

[0061] Since a normal application directly executes the binary file that starts the application when it is accessed by an attacker, the decoy file containing the application finally obtained in this embodiment can realize online monitoring of the attacker's access based on security.

[0062] Furthermore, it also includes a second compression module for compressing the bait file to generate a DMG bait file, so that all staff can download and install it without regenerating the bait file.

[0063] On the other hand, the bait file generation system also includes a link acquisition module, which is used to obtain the web version link of the application according to the application, and store the web version link in the system folder of the launcher. The application stored in the system folder can also be replaced with the web version link of the application. That is, when the attacker clicks the launcher and the binary capture file obtains the attacker's information, it will directly jump to the official webpage of the application through the web link. For example, if the application is WeChat, the attacker will directly jump to the browser after the information is obtained, and open the official login website of WeChat through the browser, thereby also confusing the attacker and achieving the purpose of obtaining the attacker's information.

[0064] On the other hand, in the red-blue confrontation, the attacked party can use the bait file to lure the attacker. If the attacker needs to use the bait file to counter-entrap the attacked party, the attacker can send the compressed package of the bait file to the attacked party via email or social software, thereby achieving the attacker's counter-entrapment purpose.

[0065] Furthermore, it should be noted that the specific embodiments described in this specification may vary in the shapes and names of their components. Any equivalent or simple variations based on the structure, features, and principles described in the patented concept of this invention are included within the scope of protection of this patent. Persons skilled in the art may make various modifications, additions, or substitutions to the described specific embodiments, and these modifications, as long as they do not deviate from the structure of the invention or exceed the scope defined by the claims, shall fall within the scope of protection of this invention.

Claims

1. A method for generating an APP bait file, characterized in that: The following steps are involved: Obtain an application from a compressed image file, and store the application in a system folder of a launcher; Obtain the application's configuration information key-value pair and copy the configuration information key-value pair to the launcher's configuration information folder; Constructing a binary capture file and storing the binary capture file in a system folder of the launcher; Modify the execution order of the launcher's execution script and modify the launcher's name information according to the application to obtain a bait file. Among them, modifying the execution order of the launcher's execution script includes the following steps: when the attacker clicks the launcher, the launcher first executes the script program in the system folder, the script program then grants executable permissions to the binary capture file, and then the script background executes the binary capture file, starts the program that sends a request to the server, and executes the command issued by the server, and finally determines whether the script starts the copied application.

2. The method for generating an APP bait file according to claim 1, characterized in that: Building a binary capture file involves the following steps: Generate a request code, obtain and collect code, transmit code and execute code in sequence, wherein the request code, obtain and collect code, transmit code and execute code are all binary codes; A binary capture file is obtained according to the request code, acquisition and collection code, transmission code and execution code.

3. The method for generating an APP bait file according to claim 1, characterized in that: The following steps are also included: According to the application, a web version link of the application is obtained, and the web version link is stored in a system folder of the launcher.

4. The method for generating an APP bait file according to claim 1, characterized in that: Modifying the name information of the launcher according to the application includes the following steps: The name script information of the launcher is obtained, and the application name of the application is obtained, and the application name is written into the name script information.

5. The method for generating an APP bait file according to claim 1, characterized in that: The following steps are also included: The bait file is compressed to generate a DMG bait file.

6. A system for generating APP bait files, characterized in that: include: An acquisition module is used to obtain an application from a compressed image file and store the application in a system folder of a launcher; A copy module is used to obtain the configuration information key-value pairs of the application and copy the configuration information key-value pairs to the configuration information folder of the launcher; A construction module is used to construct a binary capture file and store the binary capture file in a system folder of the launcher; The modification module is used to modify the execution order of the launcher's execution script and modify the launcher's name information according to the application to obtain a bait file. The modification of the execution order of the launcher's execution script includes the following steps: when the attacker clicks the launcher, the launcher first executes the script program in the system folder, and the script program then grants executable permissions to the binary capture file. The script then executes the binary capture file in the background, starts the program that sends a request to the server, and executes the command issued by the server. Finally, it determines whether the script starts the copied application.

7. The system for generating APP bait files according to claim 6, characterized in that: The building blocks include: A code generation module, configured to sequentially generate a request code, an acquisition and collection code, a transmission code, and an execution code, wherein the request code, the acquisition and collection code, the transmission code, and the execution code are all binary codes; The first compression module is used to compress according to the request code, acquisition and collection code, transmission code and execution code to obtain a binary capture file.

8. The system for generating APP bait files according to claim 6, characterized in that: It also includes a link acquisition module, which is used to acquire the web version link of the application according to the application, and store the web version link in the system folder of the launcher.

9. The system for generating APP bait files according to claim 6, characterized in that: The modification module is further configured to obtain the name script information of the launcher, obtain the application name of the application, and write the application name into the name script information.

10. The system for generating APP bait files according to claim 6, characterized in that: It also includes a second compression module, which is used to compress the bait file to generate a DMG bait file.

Images