Exploiting the post-attendee URL feature in Zoom webinar to distribute malware

The post-attendee Uniform Resource Locator (URL) feature within the video conferencing application known as Zoom is often overlooked by digital forensic experts as a potential risk for malware transmission. However, with the ability to redirect webinar participants to any URL set by the host for the webinar, the post-attendee URL can be abused by bad actors to expose webinar participants to malicious websites or, in the worst-case scenario, force participants to download a file through the use of a direct download link URL. This study aims to showcase how this exploit can be replicated by creating an experimental environment involving four Windows 10 desktops running Zoom version 5.7.5 and creating a webinar with four user accounts acting as webinar participants and setting the post-attendee URL value to the URL of a website that contained a keylogger. In another trial, the same experimental environment was utilized, with the only difference being the post-attendee URL that was set to redirect webinar participants to a download link for a .jpg file. In both instances, every user account that joined the webinar via clicking on the invitation link that was emailed to each user account after registering for the webinar was redirected to the post-attendee URL regardless of their user account role. These results not only prove that the post-attendee URL can be exploited, but also provide insight as to how this type of attack can be prevented.     

基于浏览器的钓鱼网站防范策略

随着钓鱼网站的活动日渐猖獗,钓鱼网站的数量逐渐激增,严重地影响我国电子商务、网上银行的发展,影响人们对互联网应用的信心,危害广大网络用户利益。钓鱼网站的影响和危害程度已经远远超过木马和病毒,成为我国互联网最大的安全威胁。因此,弄清钓鱼网站本质特征和主要类型、了解钓鱼网站的传播途径和危害方法,掌握钓鱼网站的鉴别方法和防范策略,以及遭遇钓鱼网站后的补救措施,显得非常必要。     

对钓鱼欺诈中第三方支付机构作为或不作为法律问题的思考

钓鱼欺诈是与第三方支付相伴而生的、利用技术不法套利的现象。在对被欺诈者进行法律救济时,第三方支付机构究竟应该扮演什么样的角色,是一个比较尴尬的问题。基于买方市场、第三方支付行业自身的特点、技术与法律的关联等从实体与程序上标明第三方支付机构应对该类突发事件的作为义务及对相关法律进行适时创新事关该新兴行业的发展与壮大。