英语学习流氓软件的工作原理

The working principle of the rogue softwareWhy "browser hijacking can be so rampant? Looking at many other forums help post, from time to time we can see, such as "my IE is homepage has been changed the, I use anti-virus tool swept again has not discovered the virus, I put the home page back to its own address, but a restart it back! "," my system a boot on the jump out of an ad, I clearly used the latest version of the anti-virus software ah! "And so on this kind of IE abnormal question for help, 80% of the questions are said to wonder, they have installed anti-virus software, but IE still be" black ", this is why?In fact, these are typical of the browser hijacking phenomenon, but the victim is not already installed antivirus software? Why still hiding the browser in black? Many users of this area there is a kind of psychological misunderstanding: browser hijacking? I have the latest anti-virus software, I am not afraid!So, when they encounter the browser hijacking, surprised.You know, antivirus software itself only an auxiliary tool, it is not possible to completely protect system security, not to mention, anti-virus software, users must know the fact that the browser hijacking attacks by recognized by the system "legal means"! Antivirus software can only through the "signature" in the form of procedures to determine whether legitimate, but this is built on artificially defined, and the implementation of "browser hijackers" program can have a lot of, impossible.Why say "browser hijacking" can be said to be legal? Because most of the browser hijacking the initiator, by which are called the BHO (browser helper object, browser helper object) technology into the system.BHO is Microsoft back in 1999 launched as the browser on third-party programmers open interface standard in the industry, it is a can allow programmers to use simple code into the browser "interface" (INTERACTIVED interface) Through the interface of the BHO, third party programmers can own code browser access to some behavior (action) and event notification (event), such as "back", "forward", "the current page", and even can get information on the various component of the browser, like a bar, coordinates and other menu, industry and trade. Due to the interactive character of the BHO, programmers can also use code to control the browser behavior, such as common modification replacement browser toolbar, in the browser interface to add their own program button operation, and these operations are regarded as "legitimate", which is the root of all evil.BHO appeared to help programmers to better create personalized browser or for their own program to realize the interactive function of the simple and convenient, it can be said, if there is no birth of BHO interface, today we can not be used some of the tools to realize the function of personalized ie. From the point of view of a particular aspect, the BHO is indeed a variety of colorful network interactive function of the behind the scenes hero, but all things are two sides,the constant ancient invariable truth also the BHO effective, so there will be a today let security headache "browser hijackers" attack means birth.Look at the BHO interface features I mentioned earlier, what do you think of? BHO can learn and implement most of the events and functions of the browser, that is, it can use a small amount of code control browser behavior. Programmers can design a BHO button in order to achieve the user click notify the viewer to jump to a page to complete the interactive function, of course, may be further write control the viewer to jump to he wants to let the user to the page, this is the first browser hijacking "of the causes of: BHO hijacked.In the description of the BHO hijacked before, we must first start the BHO interface to do a simple introduction: meet the BHO interface standard code was written as a dynamic link library (DLL) form in the registry registered as a COM object, also in the BHO interface at the entrance to the registry to register the component, after each time ie start will through described here registration information call to load the DLL file, and the DLL file would thus be ie a module (BHO component), and IE share a cycle of operation, until the IE is closed.Start ie, will load any BHO component, these components directly into the fields of IE, and ie become their parent process and carrier, from every event ie will the IUnknown interface transfer to BHO used to provide interactive iobjectwithsite interface, which is BHO achieve with IE cross entry function.The BHO parameter to the IE interface to transfer the received after the start of judgment of what IE is doing most of the events, BHO can theoretically obtain IE, then according to the programmer to write code, BHO holds the right to decide to respond to specific events, such as the realization of a "Chinese." BHO, is to get to the site URL IE current open by GetSite method (or through the IURLSearchHook interface to learn, if found, BHO) condition access to URL and built-in, the BHO will enable SetSite forced IE to jump to the page to set by the programmer, this process is the use of the about:blank home page "browser hijacking" tampering with one way, it's actually the realization principle very simple, write a malicious BHO component, when it gets to the IE window of the current site "about:blank" was forced to jump to that IE The advertising page, then made shortly before the "blank page IE raise a Babel of criticism of hijacking".Understanding of this kind of trick of the crime means, to solve it is easy, as long as you find and remove the hidden in the system BHO program can be.In addition to this kind of "adware" nature of the BHO and a using the iurlsearchhook interface of the other more subtle BHO, the BHO in some ways probably not BHO, because it does not response IUnknown, but wait for IE to create the iurlsearchhook to start. The iurlsearchhook browser used to translate the address of an unknown URL protocol, when the browser in an attempt to open an unknown protocol URL, the browser first try to get the agreement from the address, if this is not successful, the browser will find system all registered for the URL search hook hook (resource search, ush) object and put the IE doesn't understand the address to send in the past, if a ush object "know" this address, it returns the a specific identification told ie it knowshow to open this address and IE according to the appointment of a method call it, and eventually opened this address. In fact ush object is not strange, some of our lazy users often in order to save without input http: / /, but ie will eventually be able to recognize and open an address, is the achievement of ush, but this was malicious programmers brought sharpening the, by creating their own ush objects, malicious programmers can command ie in can't find some websites automatically jump to the site that is set in advance, if the site with poison or horse, users would be finished.This kind of BHO solution and in front of the same, but it is more subtle, unless users often lazy, or may not until the system collapse will not know that they have been infected with this kind of thing. Perhaps you will say, as long as the user input will never let IE can not be identified, this kind of infiltration is not in vain? But the fact is not optimistic, we can not learn that the BHO will not be through other methods to intercept IE, perhaps every time you let IE pop up an ad?DLL API just BHO IE "caused by the above said so much BHO and IE engage in cooperation failure examples may give the reader a BHO must transfer data to action" misunderstanding, but the fact is not so, the browser itself is a standard executable program, and use the program started the process DLL, it was not the kind to let you come to busy, busy finished kicked open the slave state, in front of said, the BHO is a species in the browser to load together with the start of routines, it is equivalent to a self operating logic is not too clear sub process (which is on the IE event response and operation?The difference between and Sun Yue Fei Liu GUI on HO DLL and API DLL flash love nature, BHO does not require all events must rely on the big guy, it can have the right to self-determination, as long as the appropriate modifications can use BHO DLL to achieve a similar function of the Trojan, of course, this is not to say that we will be able to in the IE under the eyelids open cynically doing bad things because BHO itself, as IE process is started, it must have some limitations, such as inside their programmers can not create a network connection, it will cause the IE collapse error and write your DLL BHO, afraid to become another backdoor user can relax, to achieve Winsock probably can only when the rest of the IE in BHO, but there will be an open space which users open IE what things are not done?But this is not to say that the BHO can sound, although it can't do a remote control, but don't forget, the BHO can see ie all things, can be arbitrary access user files and registry, under the premise of this condition is established, an intruder can write code to find the user privacy, then at the appropriate time through setsite submitted out - who is now webmail so popular? BHO which is why many manufacturers released such as "Chinese Web site", "web search", "ie custom, ie surveillance" of these functions are guaranteed to do not collect user privacy, as long as you want, the BHO can get everything.Some people may think, since BHO is the right of the Microsoft browser, then I do not have IE, I use Firefox, Opera not? For this is understandable, but you do not use Windows? Use without sharing software? If you are using windows, then you may still be exposed to the BHO world in, because Windows itself is combined closely with the IE, which the "ie" of the process of scope to expand, careful users will probably find, ie can directly visit the "my computer", "my computer window also can quickly turn into ie, because the essence of them are dependent on the IEkernel, and it is for this reason, the BHO can you open a folder in the follow secretly started. At the same time, the network now is in a kind of "sharing software Bundling Strategy" vigorously implement the era, you no longer care cannot avoid some shareware tied up and fixed the BHO behavior. After installation you will find folder and what "assistant", "search". In order to completely escape the siege of BHO, probably only to abandon the use of Windows.Hook, you hook a browserAs "Jurassic" in this sentence, the intruders also constantly looking for new ways to their, although I said above so many BHO negative examples, but real crisis is not only BHO, in some occasions of BHO is impossible, the invaders began to throw their hooks.What is a hook? Let's take a look at its official definition:Hook is a platform of windows message handling mechanism, the application can be in the above set way to monitor a specified window of a message, and monitor window can be created by other processes. When the message arrives, it is processed before the target window processing function. Hook mechanism allows applications to intercept processing window messages or specific events.Hook is actually a process of processing the message segment, through the system call, put it into the system. Whenever a particular message is issued, the hook procedure first catches the message before it reaches the destination window. At this time the hook function that can be processed (change) the message, can not be processed and continue to pass the message, you can also force the end of the message passing.The official definition of the above understanding of the part of the reader is difficult, in fact, just as a hook is all the procedures of "prophet", a the hook procedure itself although it is ordinary procedure, but it always in some other program data before you already know everything. This is why? On Windows systems must understand the readers should know, windows is a through the "information processing" of the operating mechanism of the system, the data transmission in this system is by message (message) sent in the form of, each message followed the official agreement, otherwise will not be able to make the system respond. And the transfer step is reversed, for example, we closed a program, we may think is their own procedures after the closure of the notification system, actually otherwise, when users click on the close button, windows will put a WM close message to this program is called, the program received message on the implementation of the unloading its routine operations. Understand this point, can know hook principle, the so-called hook procedure, is the use of the system provides the API hook, let oneself than each of them a program in advance to receive the message system, and make a deal. If a hook to intercept the system WM close message to a program, then the program will because of not receiving the shutdown message to shut down their. In addition to the message, the hook can also intercept API, as we are familiar with the screen translation software is Hook a number of text output functions such as TextOutA to achieve the purpose.Technology so that programmers can easily get useful data on other programs or data transmission, like the now common in some of the game plug-in. They use hook to hook the game form, and recognition in the game behaviors and to simulate the send button in the standard news, finally realizes the function of your computer to play the game. The application of this technology to the browser, it has become another way to control the behavior of the browser.Hook is of two kinds, local hook (local hook) and global hook (global hook), local hook only in the process of work, so not belonging to the scope; global hook code must be written in the form of DLL, so that at the time of entry into force of the hook is other the process of loading call. Because of this we see most of the hook procedure DLL form.Actually mentioned before the BHO can also be regarded as a hook for IE and hooked it is ie events, and this is the starting point and IE BHO interaction, but for more complex point, such as determining the download ie is GIF or JPEG images, the BHO powerless, because it only know IE events and DownloadComplete DownloadBegin. For specific content, ie itself is won't tell it, otherwise ie isn't to busy to death? At least, I don't see what the leadership also need to the Secretary's report at noon to eat chicken or duck. The bar, the BHO can not IE's wife, or ie no tracheitis.So, in order to get more data IE, the programmer began to hook IE. And BHO is different, the hook does not need to wait for the passive IE event, it directly and IE to form a supervisor to subordinate relationship, this is the turn of IE to do what all have to go through it approved. Hook control does not require DLL file must develop components of relationships with IE registry entries, which can be a separate DLL, activated by rundll32.exe or comes with the loader exe and because it belongs to the hook, hook and effective will be automatically inserted into other programs in the process of, is not a bit like a DLL Trojan horse?Ie hook procedure in the loading process will be informed of all message types, API and content, once found a messages that meet the requirements, such as IE execution of an event, or the user input the specific content, hook code began to work, it first interception system to send message to ie, then analyzes the contents of the message, according to different message content to make the modified send ie, a hook forgery. With famous 3721's real name search, for example, some people may think that it is by the BHO or the iurlsearchhook completed jump recognition of Chinese domain names, in fact, it is used to first get the hook technology of windows message. In this way we can avoid being other stolen a march on its rivals by analytical domain name: 3721 main program is a hook DLL, it monitors the IE address bar?No Cong Yun neon invasion pattern 'Hun flatter Lu Ze ho South III bad mesitylol plugins work intercepted the message, and call their own code to complete work for the conversion of Chinese domain name to English URL, then return (may also cooperate with their BHO DLL) a let ie jump to the URL of the message, the completion of a domain name for the translation task.Ie hooks can help the programmer with a small amount of code to complete the work of IE interaction more, but once the hook is used to commit the crime, and the consequences areserious, malicious programmers can write a interception IE input keyboard hook to steal passwords, so whether you are a plaintext HTTP protocol or SecurityHTTP of cryptographic protocols cannot evade password was stolen and the fate of the, because it catches you in IE input, behind the data transmission is not important.LSP WinsockFull name is "windows socket layered service provider" (layered service provider. This is Winsock 2.0 to some function, it need Winsock service provider interface (service provider interface support, SPI) can be achieved, the SPI is a cannot work independently, it is dependent on the system from already existing basic provider protocol, such as TCP / IP protocol, etc., in these protocols send separate sub protocol is layered protocols, such as SSL, they must through certain interface function call, LSP is the protocol interface.By LSP, we can analysis basic agreement easier get we want the content of the data, such as direct access to the system running on a browser is currently address and content delivery, regardless of the browser is Internet Explorer or opera or Firefox, because to obtain information directly from the Winsock LSP, even without Microsoft production car, at least you this car has been built at Microsoft on the road running.LSP convenient programmers write monitor communication of the network system of the sniffer can be on the right path, but now common LSP are used to hijacks the browser, users have a nightmare.。