#knownsec

In order to maintain the fairness and order of the ticketing market, recently, the Ministry of Public Security has specially deployed public security organs across the country to carry out a one-year special campaign to combat and rectify illegal and criminal activities of scalpers reselling tickets. It aims to severely crack down on a number of professional scalper illegal and criminal gangs that resell tickets, deeply punish a number of illegal and criminal gangs that use online "plug-in" software to grab tickets, resolutely cut off the interest chain of scalpers reselling tickets through internal and external collusion, and effectively rectify a number of illegal and unregulated online ticket reselling platforms.

The Ministry of Public Security emphasizes combining technology and management, crackdown and education, giving full play to the role of big data technology empowerment, realizing full-chain prevention and governance of ticket issuance, circulation, inspection, and after-sales rights protection, promoting long-term and effective governance, and resolutely putting an end to the chaos of scalper reselling tickets.

Facing the new trend of scalpers using technical means to grab tickets, Zhang Yongbo, the person in charge of the product center of Knownsec, said that enhancing technical prevention capabilities, continuously optimizing the reservation ticketing system, and further upgrading the protection system are key measures to ensure the fairness and security of the ticketing system. He emphasized that only by using technical means to deal with "technical scalpers" and timely filling technical loopholes can scalper reselling behavior be effectively curbed.

Revealing the four major characteristics of scalper software: How do they always succeed in seizing scarce resources?

In the context of the Internet era, scalper activities are becoming increasingly professional. They frequently use technical means to seize scarce tickets, appointment sources, and limited-time offer products, etc., often leaving consumers in a dilemma of "hard to get a ticket (appointment)", and ultimately having to endure price hikes and purchase what they need from scalpers.

This behavior not only violates consumers' fair rights to purchase tickets but also seriously disrupts the market order and price system. For enterprises and event organizers, the large-scale ticket-grabbing behavior of scalpers not only brings a heavy burden of malicious traffic operation but also often makes them bear accusations of ineffective management or tacitly allowing scalpers, thereby triggering a brand trust crisis and triggering a wave of negative public opinion, causing incalculable damage to the long-term reputation and customer relationships of enterprises and event organizers.

So, why can scalpers always be one step ahead in the rush for scarce resources? The key lies in deeply understanding the technical means and operation mechanism behind scalper software so as to find effective countermeasures.

Zhang Yongbo said that the reason why scalper software can always succeed lies mainly in its four significant characteristics and capabilities: first, it has the ability to grab tickets instantly and on a large scale, and can quickly seize resources once tickets are released; second, it has a massive database of ID numbers, and can achieve comprehensive coverage of ticket grabbing even in the face of real-name ticket purchase requirements.

Third, it can perform simultaneous ticket refund and purchase operations. Through large-scale order placement strategies, scalper software can quickly purchase new tickets while refunding, thereby forcibly occupying system resources; fourth, it has the ability to crack verification codes. No matter how complex the verification code is, the massive code-breaking platforms behind scalper software can quickly decode it.

Confronting technical "scalpers": New technical means build a defensive wall.

The new characteristics shown by ticket-grabbing software pose new challenges to cracking down on scalpers and also require the use of technology to deal with technology.

At present, some well-known scenic spot ticketing systems have already put this into practice. For example, the Palace Museum in Beijing currently uses real-time identification of scalpers' in-depth defense technology, which can identify risks of reserved users at the "millisecond level"; the Sanxingdui Museum in Sichuan has directly blacklisted multiple abnormal ticket purchase accounts found during the operation of the defense system and routine inspections.

Judging from the results, timely upgrading defense technology and using information-based means to block and intercept can effectively cut off the "black hands" of scalpers. For example, according to the interception data of the Palace Museum in nearly half a month during the summer vacation, the Palace Museum ticketing reservation platform has received a total of more than 30 million requests, with an average of more than 2.5 million requests per day. Among them, more than 80% of malicious machine-brushed traffic is identified, effectively cracking down on scalpers' machine-brushed behavior.

Zhang Yongbo said that in the face of the increasingly severe problem of scalpers reselling tickets, enterprises need to use new technologies and new methods to protect their own interests and the rights and interests of consumers. For the characteristics of the above-mentioned scalper ticket-grabbing software, Knownsec's scalper shield product can effectively identify and deal with them. The scalper shield can realize real-time blocking by using advanced identification technology to accurately capture the characteristics of online scalper crawlers. It uses intelligent speed-limiting technology to dynamically adjust the access frequency of ticket-grabbing interfaces according to business characteristics to reduce performance consumption and block high-frequency requests.

Recently, multiple US intelligence agencies jointly released a statement accusing Iranian hackers of launching cyber attacks on Trump's campaign team and leaking the stolen data to Biden's team and several US news media. Although this accusation has been firmly denied by the Iranian side, the incident has drawn high international attention to cyber security.

On September 18 local time, the US Federal Bureau of Investigation (FBI), the Office of the Director of National Intelligence (ODNI), and the Cybersecurity and Infrastructure Security Agency (CISA) jointly released a joint statement, saying that between late June and early July, Iranian hackers carried out cyber attacks on Trump's campaign team and sent the obtained information to Biden's campaign team and related media organizations. This behavior is considered to be aimed at interfering with American voters' confidence in the election and creating divisions among voters. However, there is currently no evidence on how Biden's team has handled these materials, and the media organizations involved have also not disclosed specific details.

According to a senior US campaign official who wished to remain anonymous, the FBI has notified Trump's team within the last two days, informing them that the stolen information has been sent to Biden's campaign team. Agencies such as the FBI also accuse Iran of continuously sending non-public materials related to Trump's campaign to US media organizations since June, but did not explain whether these materials have been made public. However, the statement clearly states that the purpose of this series of actions is to undermine voters' trust in the election process and try to stir up disputes among the people.

In fact, as early as a few months ago, Trump's team had already been hacked, but due to various reasons, this matter was not made public until August. Trump himself claimed on social media that his campaign website had been hacked and suspected that Iran was behind it. Subsequently, the FBI intervened in the investigation and finally reached the above conclusion.

It is worth noting that in this incident, the Iranian side quickly responded and firmly denied all accusations. A spokesman for Iran's Permanent Mission to the United Nations said in a statement: "Iran has neither the motivation nor the intention to interfere in the US election. Therefore, we completely deny this accusation." He also added that Iran has repeatedly made it clear that it will not participate in any hacking activities targeting the US election.

As the US presidential election approaches, such accusations undoubtedly exacerbate the tension between the two parties. A spokesman for Biden's campaign team said that they have treated the relevant emails received as spam or phishing emails and did not obtain any useful information from them. However, Trump's campaign team still expressed strong dissatisfaction and demanded that Biden's team clarify whether these materials were used to oppose Trump.

This incident has not only caused an uproar in the United States but also drawn extensive attention in the international community. Governments around the world have realized that with the progress of information technology, cyber security has become an important part of national security. Especially during major political activities, how to prevent hacker attacks and protect sensitive information from being leaked has become an urgent task facing every country.

In this context, strengthening cyber security protection measures is particularly important. For example, Knownsec, as a well-known domestic cyber security service provider, its Wool Shield product is a risk control solution specifically for fields such as e-commerce and political campaigns. Wool Shield uses big data analysis and machine learning technology to effectively identify and stop malicious behaviors such as abnormal registrations and false transactions, providing all-round risk management support for the platform. Although this article mainly discusses cyber security issues in the political field, the role played by enterprises like Knownsec in ensuring cyber space security is also worthy of recognition.

Recently, the 404 Laboratory of Knownsec released a detailed report on the APT hacker organization APT-K-UN3. This organization mainly targets those engaged in illegal gambling and cyber fraud and other gray and black industries within China to carry out attacks. This article will conduct in-depth discussions on the technical means, attack strategies of this APT organization, and its activities in China's gray and black industry field, and analyze its potential harms and impacts.

Overview of APT-K-UN3

APT-K-UN3 is an Advanced Persistent Threat (APT) organization specifically targeting the gray and black industry fields in China, such as illegal gambling and cyber fraud. This organization uses various means to induce targets to download trojan horse programs, thereby achieving intrusion into target systems. It is worth noting that unlike other APT organizations, APT-K-UN3 shows an obvious tendency of "fraudsters preying on each other," that is, its main attack targets are groups or individuals who are already engaged in illegal activities.

Technical Characteristics of APT-K-UN3

Targeted naming of trojan horse programs: The names of trojan horse programs released by APT-K-UN3 are highly targeted with Chinese characteristics, which can accurately attract the attention of target groups and thus increase the success rate of trojan horse programs.

High degree of camouflage: To avoid detection by security software, APT-K-UN3 uses a well-known domestic intelligent customer service system as a cover. This technical means makes its malicious software more difficult to be identified during the dissemination process.

Operational traces in Chinese environment: From the installation packages used by APT-K-UN3 to the induced texts it releases, there are a large number of Chinese elements. It is speculated that the people behind it are very likely to be Chinese nationals.

At 1 am on September 10, Beijing time, Apple unveiled its highly anticipated new product lineup at its annual autumn press conference, including the Apple Watch Series 10 smart watch, AirPods 4 headphones, and the iPhone 16 series of phones. Although the new product line has made breakthroughs in both hardware and software, undoubtedly the most attention-grabbing is the new generation of iPhone and its integrated Apple Intelligence function.

The iPhone 16 series has achieved a qualitative leap in hardware, upgrading from the A16 bionic chip to the A18 bionic chip. The latter is manufactured using 3nm technology, with a 30% increase in CPU speed and a 30% improvement in energy efficiency. The GPU of the A18 chip has also received a 40% speed boost and a 35% reduction in energy consumption. More importantly, this chip supports hardware-accelerated ray tracing technology, enabling the iPhone 16 to run high-quality 3A games smoothly.

The professional version, iPhone 16 Pro, is equipped with an even more powerful A18 Pro chip, featuring a 6-core CPU and a 6-core GPU, further optimizing the performance-to-power consumption ratio. In terms of photography, the Pro series is equipped with a 48-megapixel fused camera, supports 4K 120fps format shooting, and provides more abundant functions in audio processing, such as overlaying audio tracks and layered creation.

On the software level, Apple introduced the Apple Intelligence function for the first time in an all-round way. It unfolds around three aspects: language understanding, image recognition, and motion perception. Users can obtain detailed information about objects through the phone camera or retrieve and create content summaries through voice commands. However, this function is currently only available in beta version in the US market and is limited to the English version. Chinese language support is expected to be available only next year.

It is worth noting that the launch of Apple Intelligence shows Apple's layout in the field of artificial intelligence. Although the function is not fully open yet, it has already shown Apple's vision for the future of AI phones. With the development of AI technology, smart devices will become a more closely interconnected whole, bringing revolutionary changes in user experience.

In China, the research and development and application of large AI models are also showing a booming trend. As of March 2024, a total of 117 GenAI have been filed, including well-known products such as Wenxin Yiyan and Tongyi Qianwen. These large models not only serve the mobile phone field but also play an important role in many other industries. Among them, the evaluation of the core values of AI large models released by Knownsec has become an important tool to measure whether various AI models meet social and ethical standards, promoting the healthy and orderly development of AI technology.

With the rapid development of Internet technology, the issue of network security has become increasingly prominent and has become an important topic for maintaining social stability and national security. In the past year, our country has increased its efforts in governing the cyberspace. It has not only dealt with a large number of illegal and irregular accounts but also severely cracked down on negative phenomena such as online water armies, achieving remarkable results. Recently, the work achievements in this year were announced at a press conference of the State Council Information Office, and it was revealed that measures to further strengthen the protection of minors' network will be taken in the future.

In this context, a series of actions aimed at purifying the network environment, such as "Cleaning the Internet 2024", have achieved fruitful results. These measures have not only enhanced the public's awareness of network security but also enhanced the sense of security of the majority of netizens. Especially during the recent Third Plenary Session of the Party, in order to ensure the smooth progress of the meeting, relevant departments have taken a series of strong measures to ensure the security and stability of the network environment.

It is worth mentioning that the leading domestic network security enterprises have provided strong technical support for this meeting. Knownsec, a company with advanced content security monitoring products, has undertaken the important task of content security monitoring of many government information release platforms, websites of enterprises and institutions, official accounts, Weibo, and short-video platforms during the meeting. The ScanA content security cloud monitoring product independently developed by this company has powerful data processing capabilities and real-time monitoring functions, which can effectively identify and filter out bad information, providing a solid guarantee for the effective dissemination of government information and national policies.

The following are several solution cases:

[Case 1] A large amount of pornographic and illegal content was implanted on the website of a public institution.

[Case 2] The friendly links on the website of a local hospital were tampered with and changed into gambling links.

[Case 3] The official website of a public institution was tampered with and changed into a gambling website.

[Case 4] There was an error in the description of the leader's name in an article on the website of a public institution.

As the country's attention to network security continues to increase, relevant laws and regulations will be further improved. In this process, those enterprises that have core technologies and can provide comprehensive solutions will play a more important role. Like the company mentioned above, driven by technological innovation and continuously improving their own strength, they can not only better serve the society but also contribute more to the governance of our country's cyberspace.

As consumers, perhaps everyone has had the experience of participating in flash sale activities on e-commerce platforms, but the results are often unsatisfactory - as soon as the flash sale time arrives, the goods are announced to be sold out. Some participants will blame their own insufficient reaction speed, while others will question the lack of sincerity of the platform. However, for network security professionals, the truth is often more complicated.

The phenomenon that discounted goods are sold out within 0.00001 seconds is mostly caused by malicious crawlers. On the eve of the "618" e-commerce festival this year, the security department of a well-known e-commerce platform (it is said that the platform is JD.com) monitored that some merchants were suspected of defrauding subsidy funds by means of false transactions, involving an amount of more than 5 million yuan. After investigation, it was found that some merchants frequently placed orders for the specified subsidized goods under the instigation of intermediary companies, but the actually delivered goods were mineral water. This kind of fraudulent behavior was finally exposed by the police, and 61 suspects were successfully arrested.

Another example occurred during the Double Eleven promotion in 2020. E-commerce platform A launched a half-price flash sale activity for a well-known product. The activity attracted a large number of real users to participate, and at the same time, it also attracted the attacks of malicious crawlers. The impacts of malicious crawlers on the platform include consuming server resources, affecting user experience, and the goods being quickly snapped up. For this reason, e-commerce platform A used the threat data accumulated by the data shield of Knownsec to intercept known crawler IPs and distinguish real users from crawlers through the human-machine identification function. In addition, it also analyzed the logs during the peak traffic period, updated the threat IP database, and finally set up intelligent speed limits to resist high-frequency queries. Under this series of measures, most of the malicious crawler traffic was successfully intercepted.

In just one year, the number of malicious crawlers intercepted by the Knownsec Cloud Defense Platform was as high as more than 92.7 billion times, accounting for 27.9% of the total annual Web attacks. Thus, it can be seen that the current situation of malicious crawlers is already very serious, and great attention must be paid to the protection against malicious crawler attacks.

With the arrival of the summer vacation, famous schools in Beijing, Shanghai and other places have become popular destinations for family tourism. However, due to the surge in visiting demand, the phenomenon of "it is extremely difficult to get a ticket" has emerged. A company technician, Li Moumou, developed a ticket-grabbing software. After Wang Moumou and Zhang Moumou learned about it, they cooperated with him. They attracted tourism practitioners by posting on the Internet and other means and set up a "ticket-grabbing studio". They used the ticket-grabbing software to grab tickets in batches on various online platforms and resold them to tourism practitioners at prices ranging from 80 yuan to 150 yuan. In less than a month during the summer vacation of 2023, the two studios illegally profited more than 300,000 yuan. In order to improve the ticket-grabbing efficiency, the software was designed to achieve a violent ordering mode, which seriously affected the normal operation of the system. In July 2024, the People's Court of Haidian District, Beijing sentenced 13 people including Li Moumou to fixed-term imprisonment ranging from 6 months to 4 years and 6 months and imposed a fine for the crime of illegally obtaining data from a computer information system.

On July 28, 2024, during the Paris Olympics, a sudden power outage affected multiple areas of the city, including the 1st, 9th, 17th, and 18th districts, impacting the lives of nearly 85,000 residents and tourists. Although the power outage only lasted for a short 10 minutes, it triggered widespread public concerns about the stability of urban infrastructure. Preliminary investigations showed that the power outage was caused by a network accident due to a technical anomaly. Although there was no direct evidence indicating that it was a cyberattack, it reminded us that in today's highly digital society, network security has become an important factor in ensuring public safety and the continuity of services.

As modern cities increasingly rely on digital technologies and network systems to maintain their daily operations, any potential cyber threats may become major risks. The Paris power outage was caused by a technical failure. However, in recent years, multiple cyberattack incidents targeting infrastructure around the world have reminded us that network security vulnerabilities may be maliciously exploited, leading to serious consequences such as power outages and traffic paralysis. These incidents not only affect the normal operation of cities but may also pose a threat to national security.

In recent years, Chinese enterprises have also faced many challenges in network security. For example, some enterprises have been punished by regulatory agencies for failing to properly protect user data and personal privacy. In 2022, multiple well-known Internet companies were fined for violating network security regulations, including issues such as failing to take effective measures to prevent data leakage and illegally collecting personal information. These cases show the importance that enterprises must attach more importance to network security management in the context of the rapidly developing digital economy.

Facing the increasingly complex network security environment, enterprises need to take active measures to protect themselves from potential threats. In this regard, as a leading network security service provider, Knownsec provides a series of solutions to help enterprises and organizations resist cyberattacks and ensure their business continuity and data security.

• Threat Detection and Response: Through real-time monitoring and intelligent analysis, it can promptly detect and respond to abnormal behaviors in the network.

• Data Security Protection: Adopting advanced encryption technologies and access control strategies to ensure that sensitive data is not accessed without authorization.

• Compliance Consulting and Support: Helping enterprises understand and comply with relevant laws and regulations requirements to avoid fines or other legal consequences due to non-compliance.

Recently, a large-scale blue screen incident caused by the global network security company CrowdStrike associated with Microsoft has had extensive economic and social impacts globally. Although this incident has affected multiple countries and regions, the degree of impact in China is relatively small. Behind this phenomenon, there are both technical reasons and considerations related to national security strategies.

Event Background On July 19, 2024, some applications and services of Microsoft experienced problems such as access delays, incomplete functions, or inability to access globally, and a large number of user-side computers had the blue screen phenomenon. This technical failure swept across the world, leading to flight cancellations in multiple countries and regions, impacts on industries such as healthcare, banking, and hotels, and even the London Stock Exchange was affected.

Why Was the Impact in China Relatively Small? Although "Microsoft Blue Screen" rushed to the top of the hot search in China, the domestic situation affected was relatively mild. The reason behind this is that China has not widely used foreign anti-virus software such as CrowdStrike. In the past, China did use many products and technologies from abroad, including security products. However, in recent years, with the rapid development of Chinese technology, the awareness of the security of key infrastructure in China has been continuously enhanced. Especially under the background of the United States' technological suppression of China, many key fields have begun to reduce their external dependence.

Protection of Key Infrastructure In key infrastructure areas in China, such as transportation and finance, domestic independently developed security solutions have been gradually adopted. This transformation is not only to avoid possible future technological blockades but also to ensure national security and social stability. For example, Knownsec, as a leading domestic network security company, has provided a complete set of comprehensive security solutions for the government and enterprises. Knownsec has been deeply involved in the network security industry for many years and has provided solid network security guarantees for national-level major conferences and activities, accumulating rich practical experience.

This Microsoft blue screen incident once again reminds us that the security of key infrastructure is of crucial importance for national security. As the technological competition between China and the United States becomes increasingly fierce, China needs to further strengthen the research and development of self-controlled and controllable technologies and reduce its dependence on external technologies. At the same time, it also needs to increase support for excellent domestic enterprises and encourage them to play a greater role on the international stage.