Chinese Internet Security Report 2017 (a) // 中華人民共和國2017年上半年互聯網安全報告

Chinese Internet Security Report 2017 (a) //


1 Internet security situation is grim, to develop network security is imperative

At the same time, the Internet security has become more and more important. In 2014, the central network security and information leading group was formally established, Xi Jinping personally as head of the country and the government’s attention to the degree of network security is evident. In the central network security and information leading group at the first meeting, Xi Jinping first proposed “network power” strategy, “no network security is no national security”, network security is a relationship between national security and sovereignty, social stability, national culture The important issue of inheritance and development. Its importance, with the pace of global information to accelerate and become more and more significant. “Home is the door”, security issues without delay.

In China, the network has entered the tens of thousands of households, the number of Internet users in the world, China has become a network power. The Internet has been deeply involved in all aspects of people’s lives. According to a survey on the information of the public, students and white-collar groups of Internet usage has been close to 100%, more than Jiucheng college students and white-collar groups the most important information access channel for the Internet. Internet users on the Internet to conduct the main news, learning, real-time communication, social networking and all kinds of leisure and entertainment. In the era of universal networking, Internet users how to ensure network security? How does an enterprise network effectively defend against cyber attacks? These have become important issues that countries, governments and the security industry are facing and need to address as soon as possible.

From the domestic “dark cloud Ⅲ” virus, to sweeping the global “WannaCry” extortion virus, and then to “Petya” malignant devastating virus, all that the current network security situation is grim, corporate security vulnerable, vigorously develop the network Security is imperative.

2 to strengthen the network security construction, lack of talent need to improve the current situation

Although China has become a big country network, but there is distance from the network power. Trojans and botnets, mobile Internet malicious programs, denial of service attacks, security vulnerabilities, phishing, web tampering and other network security incidents have occurred, the basic network equipment, domain name systems, industrial Internet and other basic infrastructure and critical infrastructure is still facing Greater security risks, strengthen the network security construction is imminent.

At the same time, the shortage of network security personnel in China is in urgent need of improvement. As a network power, China in addition to research and development of computer equipment to enhance the speed of network transmission, but also should step up the cultivation of computer information security personnel, so that China from the network power into a network power, which is to enhance China’s information security important basis.

Network security has risen to the national strategy, the state is also vigorously invested to promote the construction of network security. But do a good job of network security is not an organization, a department of things, but the need for the participation of the whole society. From the city of Wuhan issued “on the support of national network security personnel and innovation base development policy measures” invested 4.5 billion construction funds, to June 1, 2017 formally implemented the “People’s Republic of China Network Security Law”, are for network security Healthy, steady development and make efforts. We also call for the social responsibility as a safe enterprise, institutions, individuals actively into the network security building, for the country, the national network security protection contribute a force.

3 Tencent to promote the establishment of China’s first strongest Internet security matrix

Tencent security has 17 years of capacity accumulation and 800 million users of large data operating experience, is China’s leading Internet security products, security services provider. In the spirit of “open, joint, shared” concept, will accumulate years of ability and data sharing to partners, is committed to the Internet security and open platform construction, enhance the security of the Internet security industry chain, enhance user safety awareness, and jointly promote China’s Internet security Environmental construction.

At present, Tencent has promoted the establishment of China’s first Internet security matrix, covering the basic security of the laboratory matrix, security product matrix, security, large data platform matrix, and Internet security open platform matrix, committed to China’s Internet security new ecological construction, open core competencies And data for China’s Internet security and ecological construction unremitting efforts.

First, the overall status of network security scan

1.1 affect the world’s six major network security incidents, the cumulative impact of the world

1.1.1 WikiLeaks CIA top secret file leak event

March 7, 2017, WiKiLeaks announced thousands of documents and revealed the CIA on the hacker hacking technology, Mobile phones and smart TVs, but also can invade attacks on Windows, Mac and Linux operating systems, and even control smart cars to launch assassination activities. Outside the name of the leak event named Vault 7, Vault 7 published confidential documents recorded by the United States Central Intelligence Agency (CIA) conducted by the global hacker attacks.

Vault7 contains 8761 confidential documents and documents, which documents the CIA for Android and Apple smart phones developed by the intrusion crack technology details, some of which can also get the complete control of the target device. WikiLeaks founder A Sangqi said the document shows the “CIA network attack the overall ability”, and WikiLeaks in the release of these documents claimed that “CIA network armory has been out of control.”

1.1.2 Shadow Broker Public NSA (US National Security Agency) Hacker Arsenal

On April 14, 2017, Shadow Brokers published a large number of very destructive hacking tools used by the Equation Group in the NSA (National Security Agency) on, including You can remotely break the global about 70% of the Windows machine vulnerability exploit tools. Anyone can use NSA’s hacker weapons to attack someone else’s computer. Among them, there are ten tools most likely to affect Windows personal users, including eternal blue, eternal king, eternal romance, eternal collaboration, emerald fiber, eccentric hamster, Eskimo volume, elegant scholar, eclipse wings and respect review. Hackers do not need any operation, as long as the network can invade the computer, like shock waves, Sasser and other famous worms can instantly blood wash the Internet.

1.1.3 “WannaCry” extortion virus broke out in the world on May 12th

May 12, 2017, “WannaCry” (want to cry) bitbell blackmail virus in the global outbreak, the event affected more than 150 countries and regions, more than 10 million organizations and institutions and more than 30 million Internet users, the total loss Up to more than 500 billion yuan. Including hospitals, educational institutions and government departments, without exception, suffered an attack. Blackmail virus worms in conjunction with the way the spread of the attack is a large-scale outbreak of the important reasons.

User’s most obvious symptoms after poisoning is the computer desktop background is modified, many files are encrypted lock, the virus pops up prompted the user to the relevant bit coin address transfer $ 300 in order to unlock the file. At present, security companies have found ways to restore encrypted files.

1.1.4 FireBall Fireball virus infected more than 250 million computers

June 1, 2017, foreign security agency Check Point reported that the outbreak of a “FireBall” virus abroad, and claimed that more than 250 million computers worldwide are infected, the most affected countries are India (10.1%) and Brazil (9.6%). The United States has 5.5 million computers in the move, accounting for 2.2%. In the infected business network, India and Brazil accounted for 43% and 38% respectively, compared with 10.7% in the US.

This malware will force the browser home page to its own website and search engine, and redirect the search results to Google or Yahoo. These forged search engines track user data and secretly collect user information. The author of this virus for the production of China’s Rafotech company, the company’s Web site has been unable to visit.

1.1.5 “dark cloud” series virus upgrade to “dark cloud III” again struck

June 9, 2017, Tencent computer housekeeper detected, as early as 2015 was first discovered and intercepted killing the “dark cloud” virus resurgence, upgrade to “dark cloud Ⅲ”, through the download station large-scale transmission, at the same time through Infected disk MBR boot boot, the number of infected users has reached millions.

After the upgrade of the “dark cloud Ⅲ” will be the main code stored in the cloud, real-time dynamic updates, and its function is currently downloaded to promote malicious Trojans, lock the browser home page, tampering to promote navigation page id. Once the user in the move, the computer will become a “broiler” to form a “botnet”, and the use of DDoS attacks built on a cloud service provider platform chess class site, resulting in the site access becomes abnormal card slow.

1.1.6 new round of extortion virus “Petya” struck, more destructive

June 27, 2017, a new round of extortion virus “Petya” attacked a number of countries in Europe, including Ukraine, Russia, India, Spain, France, Britain, Denmark and other countries have been attacked, the governments of these countries, Banks, enterprises, power systems, communications systems and airports are affected by different procedures.

This virus is more destructive than “WannaCry”, the virus on the computer’s hard disk MFT encryption, and modify the MBR, so that the operating system can not enter. According to the relevant analysis, said the information on the boot interface even if the information provided to the hackers is no way to decrypt, therefore, had to doubt the “Petya” the real purpose of the virus. “Petya” is more like a purposeful attack, the target can not repair the devastating attack, rather than extortion for the purpose.

1.2 “People’s Republic of China Network Security Law” formally implemented

June 1, China’s first comprehensive standard of cyberspace security management of the basic law – “People’s Republic of China Network Security Law,” the formal implementation of a total of seven chapters seventy-nine, the content is very rich, with six outstanding highlights. One is clear the principle of cyberspace sovereignty; the second is clear the network products and service providers of security obligations; third is clear the network operator’s security obligations; four is to further improve the personal information protection rules; five is the establishment of the key Information infrastructure security protection system; six is ​​to establish a key information infrastructure important data cross-border transmission rules.

At the same time the new law also pointed out that should take a variety of ways to train network security personnel, and promote network security personnel exchanges. The implementation of the new law marks the network security of China from the law, cyber space management, network information dissemination order norms, cybercrime punishment and so forth will open a new page, to protect China’s network security, safeguarding the overall security of the country has far-reaching and significant The meaning of.

1.3 The size of Internet users in China is equivalent to the total population of Europe, the safety gap of up to 95%

1.3.1 Chinese Internet users reached 731 million, equivalent to the total population of Europe

As of December 2016, the scale of Internet users in China reached 731 million, the penetration rate reached 53.2%, more than the global average of 3.1 percentage points, more than the Asian average of 7.6 percentage points. A total of 42.99 million new Internet users, the growth rate of 6.2%. The size of Chinese Internet users has been equivalent to the total population of Europe.

1.3.2 mobile users continue to grow, the proportion of mobile phone users accounted for 95.1%

As of December 2016, China’s mobile phone users reached 695 million scale, the growth rate of more than 10% for three consecutive years. Desktop computers, notebook computers are using the decline in the number of mobile phones continue to squeeze the use of other personal Internet devices.

1.3.3 security talent gap is huge, up to 95%

Although the number of Internet users in China has been ranked first in the world, but China’s information security industry in the very few people, security personnel and its lack. According to relevant information, in recent years, China’s education and training of information security professionals only 3 million people, and the total demand for network security personnel is more than 700,000 people, the gap up to 95%. 710 million Internet users in China network security issues, has become the industry and the country to solve the problem.

Beijing Institute of Electronic Science and Technology, vice president of the Ministry of Education of Higher Education Information Teaching Committee of the Secretary-General Fenghua pointed out that the current important information systems and information infrastructure in China need all kinds of network information security personnel will be 15,000 per year The rate of increase, by 2020 the relevant talent needs will grow to 1.4 million. But at present, only 126 colleges and universities in China have set up 143 network security related professionals, accounting for only 10% of the 1200 science and engineering institutions.

Analysis on the situation of network virus threat in the first half of 2017

2.1 Tencent security anti-virus laboratory PC-side virus interception over 1 billion, the chain by 30%

2.1.1 Trojan horse intercepts an average of nearly 170 million times per month

In the first half of 2017, Tencent security anti-virus laboratory statistics show that PC-side total has blocked the virus 1 billion times, the overall number of viruses compared to the second half of 2016 Tencent security anti-virus laboratory to intercept the number of viruses increased by 30% Interception Trojan virus nearly 170 million times. April, June to intercept the peak of the virus, interceptions are 180 million times.

2017 Q2 quarter compared to 2016 Q2 quarter, Tencent security anti-virus laboratory virus blocking an increase of 23.7%. From 2014 to 2017 Q2 season, the amount of virus blocking the number of malicious programs increased year by year.

2.1.2 PC users in Guangdong, the highest number of poisoning, poisoning peak for the morning 9-11 points found a total of 230 million times in the first half of the user machine Trojan virus 

The first half of 2017 Tencent security anti-virus laboratory found a total of 230 million times the user machine Trojan virus, compared to the second half of 2016 down 0.5%, an average of 38.8 million poisoning machines per month for virus killing. 2017 Q2 quarter compared to Q1 quarter, a slight increase in the number of poisoning machines.

In the second quarter of 2017, the number of users in the second quarter of 2016 increased by 3% compared with the same period in the second quarter of 2016. From 2015 to 2017 Q2 season, the number of poisoning machine growth trend is obvious, was increasing year by year state. PC end user poisoning peak for the morning 9:00 to 11:00

According to statistics, the peak time of daily poisoning for the morning 10 am – 11 am, in line with business and ordinary users 9 am – 11 am to open the computer processing work of the law. This time the user poisoning virus type is more use of e-mail, sharing, etc. spread Office document macro virus, indicating that the office security situation is still grim. PC end poisoning user provinces up to Guangdong, which ranks first in Shenzhen

According to Tencent security anti-virus laboratory to monitor the number of poisoning PC statistics, from the urban distribution point of view, the Internet is more developed city users poisoning situation is heavy, the country ranked the first city to intercept the virus in Shenzhen City, accounting for 3.76% , The second for the Chengdu City, accounting for 3.57% of all interceptions, the third for the Guangzhou City, accounting for 3.39% of all interceptions.

From the provincial geographical distribution, the largest number of PC poisoning in Guangdong Province, accounting for 13.29% of the total intercept, the second in Jiangsu Province, accounting for 7.75% of all interceptions, the third in Shandong Province, accounting for all Intercept the amount of 7.12%.

2.1.3 The largest virus category accounted for 53.8% of the Trojan virus, blackmail virus added 13.39% PC-side of the first major virus is still Trojans, PE-infected virus type, but the spread of large

According to Tencent security anti-virus laboratory 2017 Q2 season to obtain the virus sample analysis, from the virus type, Trojans accounted for 53.80% of the total number, is still the first major virus. Adware class (adware, forced installation, user privacy, spam, etc.) for the second largest virus category, accounting for 39.02% of the total number. Backdoor category for the third largest virus category, accounting for 5.13% of the total number. Compared to the 2017 Q1 quarter, the virus type did not change much.

The number of virus samples from the top of the division, ranked first and second is still the Trojans and Adware class, but ranked third in the PE infection, accounting for 25.07% of the total number.

There are not many types of infectious samples, which is difficult to produce infectious virus, hackers and other programmers need to master the technology, high cost, long development time and other factors. At the same time, the transmission of infectious virus is very large, the survival time is relatively long, therefore, less species of PE infection type in the sample transmission level accounted for a certain proportion, which is due to infection with a wide range of viruses, Fast propagation characteristics. extortion virus sample number Q2 added 13.39%, the first is not WannaCry

The extortion of the virus is the purpose of extortion money for the purpose of making the Trojan horse infected computer user system specified data files are malicious encryption, resulting in user data loss. At present, most of the domestic extortion of the virus by the need to pay the rupiah to be able to decrypt. As the bit currency completely anonymous circulation, the current technical means can not track behind the extortion behind the virus operator, which also makes the extortion virus from 2013 after the explosive growth.

The amount of extortion

According to Tencent security anti-virus laboratory to detect the extortion virus, 2017 in the first half of the total has been found in the number of extortion virus samples in about 300 million, the average monthly detection of the number of extortion virus nearly 500,000, Q2 quarterly extortion virus samples The number increased by 13.39% over Q1 quarter. May, June to intercept the peak of the virus, respectively, 57 million, 530,000.

Extortion virus type

According to the relevant data analysis shows that the May 12 outbreak of the WannaCry extortion virus is the most active in this quarter, the greatest impact on the virus. The virus and other viruses in the way of transmission is significantly different, due to the use of the windows system vulnerabilities, making the virus can spread around the world, as the quarter of the hot safety events. On June 27, a new type of extortion virus called Petya began spreading around the world, and its extortion was similar to WannaCry, but more destructive, directly encrypting the MFT of the user’s hard drive and modifying the MBR, causing the user to fail to windows system.

Although the impact of the virus is large, but from the sample size point of view, the largest or with the spread of infection PolyRansom virus. This virus will be infected, encrypted users of the file to extortion, but because there is no use like WannaCry virus key encryption, but the use of a simple encryption algorithm, and the algorithm is reversible, anti-virus software can help users to restore files, So although the number of samples in the first, but the impact is not great. This type of extortion virus accounted for 78.84% of all extortion virus, we can see the spread of infectious virus strong.

From the sample size point of view, in addition to infectious extortion virus, the first is Blocker, accounting for 36.82% of all extortion virus, the second category is Zerber, accounting for 23.63% of all extortion virus, the third category Is the most affected this quarter, WannaCry extortion virus, accounting for all extortion virus 12.06%. WannaCry virus volume quickly rose to the third position, because the means of communication using the spread of vulnerability.

The current extortion virus mainly uses the following kinds of transmission:

Document infection spread

File infection is the use of infectious virus transmission characteristics, such as PolyRansom virus is the use of infectious virus characteristics, encrypted users all the documents and then pop-up information. Because the PE class file is infected with the ability to infect other files, so if the file is carried by the user (U disk, network upload, etc.) to run on other computers, it will make the computer’s files are all infected with encryption.

Site hanging horse spread

Web site is through the site or the site server to obtain some or all of the authority, in the web page file to insert a malicious code, these malicious code, including IE and other browser vulnerabilities use code. When a user accesses a linked page, a malicious code is executed if the system does not update the exploit patch used in the malicious code.

The virus can also use known software vulnerabilities to attack, such as the use of Flash, PDF software vulnerabilities, to the site with malicious code to add the file, the user with a loopholes in the software to open the file will be executed after the malicious code, download virus.

Using system vulnerabilities

May outbreak of WannaCry is the use of Windows system vulnerabilities to spread, the use of system vulnerabilities is characterized by passive poisoning, that is, users do not have to visit a malicious site, not open the unknown file will be poisoned. This virus will scan with the network vulnerabilities in other PC host, as long as the host is not marked with a patch, it will be attacked.

Tencent anti-virus laboratory to remind you, timely updates third-party software patches, timely update the operating system patches to prevent known vulnerabilities attack.

Mail attachment spread

The extortion virus that spreads through e-mail attachments usually disguises documents that users need to view, such as credit card spending lists, product orders, and so on. The attachment will hide the malicious code, when the user opens the malicious code will begin to perform, release the virus. This type of camouflage virus is usually sent to enterprises, universities, hospitals and other units, these units in the computer usually save the more important documents, once malicious encryption, the possibility of payment of ransom far more than ordinary individual users.

Network share file spread

Some small-scale spread of extortion virus will be spread through the way the file spread, the virus will upload the virus to the network sharing space, cloud disk, QQ group, BBS forums and other places to share the way to send a specific crowd to trick the download and install The

Tencent anti-virus laboratory to remind users to download the software go to the official formal channel download and install, do not download the unknown program, such as the need to use the unknown source of the program can be installed in advance Tencent computer housekeeper for security scanning.

2.2 mobile side killing a total of 693 million Android virus, mobile phone users over 100 million

2.2.1 mobile side of the virus package growth trend slowed down, but the total is still 899 million

In the first half of 2017, Tencent mobile phone housekeeper intercepted Android new virus package totaled 8990000, compared with 2016 in the first half of a small decline, but the total is still very large.

2.2.2 Guangdong mobile users poisoning the most, the number of mobile phone users decreased by 45.67% Tencent mobile phone housekeeper in the first half were killing Android virus 693 million times

In the case of a large number of virus infection users in the case, the first half of 2017 Tencent mobile phone housekeeper killing the virus has reached 693 million times, an increase of 124.24%, the total number of more than double the first half of 2016 more than doubled. Malicious programs and Trojans to reduce the cost of production, virus transmission channel diversification is an important factor in this phenomenon.

In addition to June, the first half of 2017 killing more than 100 million times a month, of which the number of mosquitoes in January up to 136 million times, almost the first half of 2014, 140 million in the killing of the same level. 2017 in the first half of the number of mobile phone users over 100 million 

In the first half of 2017, the number of virus infected users was 109 million, down 45.67% year on year, compared with 2015, the first half of 2016 compared to all declined.

January 2017 single month infected users reached 21.66 million, the highest for the first half, then the number of infected users began to slow down. the number of mobile users poisoning Guangdong ranks first

In the infected mobile phone users geographical distribution, Guangdong ranked first, accounting for up to 11.41%.

2.2.3 hooliganism and resources accounted for more than 80%, two-dimensional code is most easy to poison mobile-side virus in the hooliganism and tariff consumption accounted for more than 80%

In the first half of 2017, the proportion of mobile phone viruses, rogue behavior and tariff consumption accounted for the highest, to 44.59% and 44.44% ratio of one or two. Ranked third of the same access to privacy accounted for 5.85%, lodging fraud, malicious deductions, remote control, system damage and malicious spread accounted for 1.94%, 1.55%, 0.80%, 0.74% and 0.08%.

Hooliganism refers to the malicious behavior of a virus that has a rogue attribute. Such as the recent WannaCry virus and once again concerned about the mobile phone lock screen Serbia virus with rogue behavior. This type of virus through the forum paste it and other means to spread, the drug will usually use plug-in, free, brush drill, red envelopes and other words on the Trojan virus packaging, induction users download and install. After the installation of the virus will be forced to lock the phone screen, forcing the victim had to contact the drug maker in order to make the equipment back to normal.

Whether the computer or mobile phone, with rogue behavior of the extortion virus to the user losses are difficult to estimate, if accidentally poisoning, not only will cause property damage, will also lead to loss of important information, so users should be careful to guard.

Tariff is also a common type of mobile phone virus, such a virus usually in the user without the knowledge or unauthorized circumstances, by sending text messages, frequent connections to the network, etc., resulting in user tariff losses. Part of the malicious promotion of the virus to help third-party advertisers to increase traffic for the purpose of the user to download and install the virus, access to mobile portal privileges, the implementation of the download malicious advertising software. These software will continue to push a variety of pop advertising, affecting the user’s mobile phone experience, and even those who will disclose user privacy information, stolen online banking accounts, resulting in serious personal and property safety.

Infected with the world’s ultra-36 million Andrews device malicious ad click software “Judy” is a tariff consumption of mobile phone viruses. The malware is hidden in a Korean tour. After completing the download and install, the infected device will send the information to the target page and automatically download the malicious code in the background and access the advertising link, theft of user traffic, to the user Consumption. two-dimensional code, software bundles are the main source of mobile virus source

Mobile virus channel sources are mainly seven categories, namely, two-dimensional code, software bundles, electronic market, network disk communication, mobile phone resource station, ROM built-in and mobile forum. The diversification and diversification of the entrance of the virus channel also further increases the risk and risk of the user’s exposure.

In the first half of 2017, two-dimensional code became the source of mainstream virus channels, accounting for up to 20.80%. Two-dimensional code in the various areas of the popularity of more and more users to develop a habit of sweeping the random, the drug maker also increased for the two-dimensional code channel virus package delivery ratio. Part of the virus is embedded in the two-dimensional code, as long as swept away will automatically download the malicious virus, ranging from mobile phone poisoning, while the personal privacy information is caused by leakage, resulting in property losses.

Third, anti-harassment fraud effect is remarkable, but the user loss situation is grim

3.1 the first half of the number of spam messages over 566 million, illegal loans over 50%

3.1.1 In the first half of 2017, the total number of spam messages continued to grow close to 600 million

Low spread costs and the existence of a huge chain of interests, resulting in spam messages have been difficult to be effectively remediation, the number of users is also increasing the number of reports. In the first half of 2017, Tencent mobile phone housekeeper received a total of 586 million copies of spam messages reported by users, an increase of 40.69%, more than 2 times in the first half of 2014.

3.1.2 users to report spam messages up to the provinces of Guangdong, the largest city for Shenzhen

In the geographical distribution of spam messages, the top three provinces that reported spam messages were Guangdong, Jiangsu and Shandong, accounting for 12.91%, 6.98% and 5.70% respectively. In addition, Henan, Zhejiang, Sichuan, Hebei, Beijing, Hunan and Shanghai also ranked the top ten. These provinces or municipalities are generally distributed in the eastern coastal and central regions, and densely populated and economically developed are their greatest common ground, which creates favorable conditions for fraudulent bulk spam messages and profiteering.

City, the first half of 2017 users in Shenzhen reported a total of 23.34 million spam messages (accounting for 3.98%), Chengdu, Guangzhou and Suzhou, two to four, the number of spam messages are 10 million level.

3.1.3 2017 first half of the common types of fraud SMS

Although the overall amount of fraud SMS reported a downward trend, but its means of diversification and secrecy makes the dangers of fraud has always been high. According to Tencent mobile phone housekeeper to monitor the 28.57 million fraud messages show that illegal loans, online shopping, viral Web site, malicious Web site and pseudo-base station is the highest proportion of several fraudulent SMS type.

One of the illegal loan fraud messages a dominant, accounting for more than 50%. In the modern “room full of things” and rely on home buyers to seek a sense of security in the context of the community, the loan to buy a house has become a major social needs. Liar also keep up with this social pain points, a large number of illegal loans to send text messages, to profit.

3.2 harassing telephone users labeled up to 235 million times, down 27.12%

3.2.1 2017 users in the first half of the total number of harassment calls 235 million times down 27.12%

After the first half of 2015, after the explosive growth in the first half of 2015, the number of harassing telephone marks began to decline year by year in the first half of 2016, and the total number of harassing telephone marks in the first half of 2017 was 235 million, down from the first half of 2016 %.

3.2.2 In the first half of 2017, more than 50% of harassing calls were sounded

User-tagged harassing phone types are divided into five categories. Among them, the sound ranked first, accounting for more than 50%. This kind of harassing phone will not cause serious harm to the user, but will still affect the use of mobile phones, interference users. Phishing calls accounted for 15.14%, ranked second, in addition to advertising sales, real estate intermediary and insurance management also occupy a certain percentage.

3.2.3 harassing telephone calls for the highest proportion of verification code

According to Tencent mobile phone housekeeper users take the initiative to report the harassment of telephone malicious clues show that asking for verification code, fake leadership, transfer, online shopping and offense is the most common keywords. Which requires the highest proportion of verification code, nearly 24.74% of the harassing phone, the liar will be through various means to ask for verification code, and verification code as an important private information, once leaked, it is easy to cause property damage.

3.2.4 fraud telephone mark down 59.68% year on year, Beijing up

In the user has been marked 235 million harassing phone, scams like telephone ratio is far less than loud, but its substantial harm caused by the largest. Based on Tencent mobile phone housekeeper user fraud phone tag data show that in the first half of 2017 defraud telephone mark down 59.68%, a total of 35.59 million.

These frauds are targeted at the target area is more clear to the eastern coastal economically developed areas and inland central provinces. On the urban side, Beijing is the largest number of cities with the largest number of fraudulent calls, up to 1.826 million. Shenzhen and Guangzhou, respectively, to 141.8 million and 1.257 million mark the number followed. Shanghai, Xi’an, Changsha, Chengdu, Hangzhou, Chongqing and Wuhan are ranked fourth to ten.

3.3 malicious Web site to intercept up to 47.8 billion, pornographic fraud head of the site

3.3.1 The number of malicious web sites detected in the first half of 2017 exceeded 1.83 billion

In the first half of 2017, Tencent security in the PC and mobile side detected a total of more than 183 million malicious web site, the overall trend of rising volatility. Which in June detected 35.75 million malicious Web site, the highest for the first half, the lowest in April, the number of 25.53 million detection.

3.3.2 Pornography The website is still the main means of committing malicious web sites

In the effective detection of malicious Web site at the same time, the first half of 2017 Tencent security in the PC and mobile side to intercept malicious sites up to 47.8 billion times, equivalent to 265 million times a day intercept. This huge data also further illustrates the grim situation of Internet security.

In Tencent’s securely intercepted malicious Web site, pornographic websites, gambling sites, information scams, malicious files, fake ads and phishing scams are the most widely distributed six categories of malicious Web sites. Which accounted for half of the site of pornography, accounting for 51.98%, pornographic fraud sites will be embedded fraudulent advertising or trick users to pay online. Malicious Web site will also be embedded in the fraud message to spread, to increase the confusion, so users see the text in the URL, should consciously raise vigilance, remember not to click.

3.4 iOS harassment and fraud phone calls fell by about 35%, calendar ads into new harassment

3.4.1 iOS harassment calls and phishing calls appear more substantial decline

In September 2016, Tencent mobile phone housekeeper and Apple introduced a new version of iOS10, the first increase in interception harassment and fraud phone features, effectively alleviate the troubled iPhone users troubled phone problems. Data show that the first half of 2017 iOS users were marked a total of 14.492 million harassing telephone, fraud, telephone 2.196 million times.

From the overall trend point of view, the first half of the iOS harassment phone signs showed a downward trend in the number of signs in January the highest number of 3.195 million times, only 2.0 million in April, the first half of the lowest peak. In contrast, the overall trend of fraudulent phone is more stable. From the above data can be seen, the first half of 2017 harassing telephone and phishing calls have emerged a more substantial decline, which is inseparable from the relevant departments, mobile operators and mobile phone users to work together.

3-4 calendar ads into the third largest harassment of Apple phones

Spam, harassing the phone, calendar advertising has become the main source of iPhone users harassment. Among them, the calendar advertising harassment problem is increasingly serious. 61.1% of users have experienced calendar ads, including gambling ads, real estate advertising, taxi software advertising top three.

3.5 Tencent Kirin system to combat pseudo-base station protection 150 million people

3.5.1 Tencent Kirin system to intercept 230 million fraud messages to protect 150 million people

In the first half of 2017, Tencent Kirin pseudo-base station real-time positioning system for the national users to intercept 230 million pseudo-base station fraud messages, the total impact of the number of 150 million people.

3.5.2 pseudo-base station regional characteristics: Sichuan, Shaanxi, Hubei, Hubei and Hubei provinces up

From the geographical point of view, Tencent Kirin for Sichuan, Shaanxi, Beijing, Hubei, Hunan users to intercept the largest number of fraudulent SMS, the five provincial administrative departments to intercept the number of fraud messages more than 50% of the total.

From the city point of view, the number of intercepting the number of fraud messages Top 10 cities such as Beijing, Chengdu, Xi’an, etc. are almost capital cities or economically developed cities, due to densely populated, urban residents income is higher, by pseudo-base station fraud gang included in the key attack Object.

3.5.3 pseudo-base station crime time characteristics: the most frequent working hours

From the time of committing the crime point of view, pseudo-base station fraud messages sent between 9 am to 19 pm, which in 10 am to 12 pm, 15 pm to 18 pm for the two peaks. It is easy to see that the peak of fraudulent SMS coincides with the daily working hours.

3.5.4 Content characteristics: Industrial and Commercial Bank of China, China Mobile most “lying gun”

Pseudo-base station SMS type, the points exchange, account abnormalities and bank credit card mention category accounted for close to 90%. These three categories often associated with operators, banks, often points to clear, credit card to mention the amount, account real name, abnormal and other reasons to fraud.

Tencent Kirin intercepted pseudo-base station counterfeit port, counterfeit industrial and commercial bank fraud SMS up to (up to 52%), Top 5 counterfeit port in addition to middle peasants construction of four major banks, as well as operators China Mobile. It is not difficult to see that these “lying gun” business because the user community is huge, business mode, short message is particularly important, so become a pseudo-base station fraud group to simulate the main object to send.

Fake base station SMS reach the user’s operator distribution, China Mobile accounted for 74%, followed by China Telecom (16%), China Unicom (10%).

Fourth, the first half of 2017 safety personnel development progress and results

4.1 “Network Security Law” to promote the comprehensive training of talent

June 1, 2017 from the implementation of the “Internet Security Law” for the first time in the form of legal provisions of the network space security field of personnel requirements, not only reflects the country’s attention to the network of talent, but also for the State Council and the local network The rules of safety personnel training provide the highest level of legal basis.

“Network Security Law” provides that: state support enterprises and institutions of higher learning, vocational schools and other education and training institutions to carry out network security-related education and training, to take a variety of ways to train network security personnel, and promote network security personnel exchanges. Network security personnel not only include technical talent, but also management talent. The current network security is not only the technical contest, it is the idea, the rules of the contest, familiar with international rules, power relations network security personnel in the future of cyberspace competition can play a greater role. Therefore, the training of network security personnel not only to cultivate traditional talents, but also based on the domestic, look at the world, cultivate a comprehensive understanding of network diplomacy talent.

At the same time, the provisions of the provisions of the “network of security personnel exchanges”, reflects the training mechanism for China’s open innovation and innovative ideas. Talent training is inseparable from the advanced countries of academic research and technical exchanges, the business organizations should attract foreign high-end technical personnel, while speeding up the training of our top talent.

4.2 security personnel training “Tencent mode”: to create talent closed-loop

As an advocate of Internet security open platform, Tencent has been “network security” as an important part of the enterprise design and strategic project. In the process of continuous attention and support of safe personnel selection and training, Tencent has gradually recruited a set of safety personnel selection system in the aspects of campus recruitment, social recruitment, promotion of internal talents, salary and welfare, etc .; at the same time, Security events and promote personnel training program, Tencent has gradually formed a mature, perfect, and for social reference to the safety of personnel training system.

Tencent in 2017, the parties launched the Tencent Information Security Competition (TCTF), through the internationalization of the system to explore talent, through high-quality counseling mechanism and professional mentor team training personnel and through the construction of enterprises and universities bridge transport personnel. At the same time, Tencent through the creation of “Hundred Talents Program” to build the Internet security personnel training closed-loop, through the TCTF contest layers of competition examinations, selected the most potential of 100 security personnel, and through continuous follow-up training to build the Internet security complex, Leading talent.

Tencent hopes to TCTF as a professional security personnel training platform between enterprises and universities to build a bridge between the formation of selection, training, transportation in one of the closed-loop talent for the Chinese new forces to provide a multi-dimensional growth environment, and further promote the development of China’s network security The

4.3 Tencent security joint laboratory set up the first anniversary: ​​escort six key areas of the Internet

July 2016, Tencent security integration of its laboratory resources, the establishment of the first domestic Internet laboratory matrix – Tencent security joint laboratory, which covers Cohen Laboratory, basaltic laboratory, Zhan Lu laboratory, cloud tripod laboratory, Anti-virus laboratory, anti-fraud laboratory, mobile security laboratory, including seven laboratories. Laboratory focus on security technology research and security attack and defense system structures, security and security coverage covers the connection, systems, applications, information, equipment and cloud, touch the six key areas of the Internet.

2016, Tencent security joint laboratory for Google, Microsoft, Apple, adobe and other international manufacturers to dig a total of 269 loopholes, ranking first in the country. In addition, by virtue of “the world’s first long-range non-physical contact with the invasion of Tesla car” research results, Tencent security joint laboratory Cohen laboratory selected “Tesla security researcher Hall of Fame”, and Tesla CEO Maske’s personal thanks The

In the field of anti-fraud in the country concerned, the anti-fraud laboratory in Tencent Security Joint Laboratory has formed a set of new standards for anti-fraud evaluation based on AI innovation + ability and openness in the field of anti-fraud research. Stop mode. In the AI ​​innovation and the ability to open the two-wheel drive, the laboratory has launched Hawkeye anti-telephone fraud system, Kirin pseudo-base station real-time positioning system, God anti-phishing system, God investigation funds flow control system, God sheep intelligence analysis platform Five systems, and through the Tencent cloud SaaS services open to the need for government units, enterprises, etc., to help users prevent Internet fraud.

Five, safe hot event inventory

5.1 outbreak of Serbian virus and virus outbreak

5.1.1 WannaCry extortion virus broke out globally on 12 May

Event Background:

On May 12th, WannaCry (wanna cry) bitbell blackmail virus broke out on a global scale. According to Tencent security anti-virus laboratory security researchers found that the extortion event compared with the past, the biggest difference is that the extortion virus combined with the way worms to spread. Due to the leak in the NSA file, WannaCry spread vulnerability code is called “EternalBlue”, so some reports that the attack is “eternal blue”.

Virus Detailed Explanation:

The outbreak of blackmail virus in the past two years is largely related to the increasing perfection of encryption algorithms. The continuous updating of cryptography and algorithms ensures the security of data transmission and preservation in our daily network. Unfortunately, the author of the extortion virus also used this feature, so that although we know the Trojan algorithm, but do not know the author to use the key, there is no way to restore the file is maliciously encrypted.

Encryption algorithms are usually divided into symmetric encryption algorithm and asymmetric encryption algorithm two categories. These two types of algorithms are used in the blackmail virus.

The encryption and decryption of the symmetric encryption algorithm uses exactly the same key, which is characterized by a faster operation, but when using such an algorithm alone, the key must be exchanged with the server using a method that is recorded in the process And the risk of leakage. The symmetric encryption algorithms commonly used for blackmail viruses include AES and RC4.

Asymmetric encryption algorithm is also known as public key encryption algorithm, which can use the public key to encrypt the information, and only the owner of the private key can be decrypted, so as long as the public key and save the private key, you can guarantee The encrypted data is not cracked. The asymmetric encryption algorithm is usually slower than symmetric encryption. The asymmetric encryption algorithms commonly used by blackmail viruses include RSA algorithms and ECC algorithms.

Usually, the blackmail virus will combine these two categories of encryption algorithms, both can quickly complete the entire computer a large number of documents encryption, but also to ensure that the author’s private key is not leaked.

5.1.2 new round of extortion virus “Petya” struck, more destructive

Event Background: 

June 27 A new round of extortion virus Petya attacked several European countries. This virus is more damaging than WannaCry. The virus encrypts the computer’s hard disk MFT and modifies the MBR so that the operating system can not enter. Compared to the previous, Petya more like a purpose of the attack, rather than a simple extortion. Tencent Hubble analysis system has been able to identify the virus and determine the high risk, the use of Tencent computer housekeeper can kill the virus.

Virus Detailed Explanation:

Petya Serbia virus virus poisoning will scan the network after the machine, through the eternal blue loopholes since the spread, to achieve the purpose of rapid propagation. Foreign security researchers believe that Petya extortion virus variants will be spread through the mailbox attachment, using the vulnerability to carry the DOC document to attack. After poisoning, the virus will modify the system MBR boot sector, when the computer restart, the virus code in the Windows operating system before taking over the computer, the implementation of encryption and other malicious operations. After the computer restarts, it will display a disguised interface, this interface is actually a virus display, the interface is suspected of being a disk scan, in fact, the disk data encryption operation.

5.1.3 Laurent virus Tencent security response program

For the outbreak of extortion virus, Tencent security emergency response program, for the advance prevention, in the virus cleanup and after the file recovery three cases, to the majority of users to deal with recommendations:


1. Use the computer housekeeper’s extortion virus immune tools, automated installation system patches and port shielding, or manually download and install.

2. Back up the data, install the security software, turn on the protection.

a) the relevant important documents using offline backup (that is, the use of U disk, etc.), such as backup;

b) the use of some computers with the system restore function, without attack before setting the system restore point, after the attack can restore the system, defense file encryption;

c) install Tencent computer housekeeper, open real-time protection, to avoid attack;

d) the use of computer housekeeper’s document guardian of the file backup, protection.

3. To establish an inactivated domain name for immunization.

According to the existing sample analysis, there is a trigger mechanism for extortion software, if you can successfully access the specified link, the computer will be in the extortion of the virus directly after the exit, it will not file encryption.

a) Ordinary users can be connected to the site, to ensure access to the site, you can avoid the attack to avoid being encrypted (only known to extortion virus);

b) enterprise users can build Web Server through the intranet, and then through the way DNS DNS domain name resolution to Web Server IP way to achieve immunity; through the domain name of the visit can also monitor the situation of intranet virus infection.

Things in the virus clean up

1. Unplug the cable and other ways to isolate the computer has been attacked to avoid infection with other machines.

2. Use the computer steward’s antivirus function to directly check out the blackmail software, scan clean up directly (isolated machines can be downloaded through the U disk, etc. to install the offline package).

3. Back up the relevant data directly after the system reload.

After the file is restored

1. Blackmail software with the ability to restore part of the encrypted file, you can directly through the extrapolated software to restore part of the file; or directly click on the blackmail interface, “Decrypt” pop-up recovery window to restore the list of files.

2. You can use third-party data recovery tool to try data recovery, cloud users can contact Tencent security cloud tripod laboratory to help deal with.

5.2 DDOS attacks continue, dark clouds variants frequently struck

Event Background:

June 9, a 2017 years since the largest DDoS network attack activities swept the country, Tencent security cloud tripod laboratory released traceability analysis report, through the attack source machine analysis, engineers found in the machine dark cloud Ⅲ variants. Through the flow, memory DUMP data and other content analysis, Tencent cloud tripod laboratory to determine the large-scale DDoS attacks by the “dark cloud” hacker gang initiated. After the upgrade, “Dark Cloud III” will be the main code stored in the cloud, real-time dynamic updates.

Virus Detailed Explanation:

“Dark cloud” series Trojan from the beginning of 2015 by Tencent anti-virus laboratory for the first time to capture and killing, has been more than two years. In the past two years, the Trojan constantly updated iteration, continue to fight against the upgrade.

From the beginning of April this year, the Trojans comeback again, the outbreak of the outbreak of the dark horse than the previous version of the more obvious promotion features, so we named it dark clouds Ⅲ. Dark clouds Ⅲ compared with the previous version has the following characteristics and differences:

First, more subtle, dark cloud Ⅲ is still no file without a registry, compared with the dark cloud II, cancel the number of kernel hooks, cancel the object hijacking, become more hidden, even professionals, it is difficult to find traces The

Second, the compatibility, because the Trojan mainly through the hook disk drive StartIO to achieve the protection and protection of the virus MBR, such a hook is located in the bottom of the kernel, different types of brand hard drive need hook point is not the same, this version of the Trojan increased More judgment code, able to infect the vast majority of the market and hard disk.

Third, targeted against security software, security vendors, “first aid kit” type of tool to do a special confrontation, through the device name of the way to try to prevent the pit of some tools to load the run.

5.3 in the first half of the focus of fraud cases inventory

5.3.1 Xu Yuyu telegraphic case

August 2016, just by the Nanjing University of Posts and Telecommunications Xu Yuyu, received a fraudulent phone, the other scholarship in the name of cheating Xu Yuyu University of the cost of 9900 yuan. After the report of Xu Yuyu emotional abnormalities, leading to sudden cardiac death, unfortunately died, triggering social concern about the unprecedented fraud. The case was publicly declared on July 19, 2017, the principal Chen Wenhui was sentenced to life imprisonment, confiscation of all personal property. The other six defendants were sentenced to 15 to 3 years imprisonment and fined. This verdict, to the community to pass the court in accordance with the law severely punished the telecommunications network fraud crime clear attitude.

Proposed: Xu Yuyu tragedy enough to cause public vigilance. Internet era, each person’s information flow are online through different channels of circulation, to the lawless elements can take advantage of the machine. Faced with such an environment, we should be on the strange phone and SMS alert. Even if the other can speak personal accurate information, can not be trusted, any event needs to be verified by reliable channels to protect their own security.

5.3.2 Henan large telecommunications fraud: lied to sell college entrance examination answers cheat nearly 100 million students

June 2017, Henan HebiCity police cracked the big telecommunications fraud, arrested two suspects, seized more than 70 copies of bank cards. These suspects under the guise of selling college entrance examination questions answer the way, through the network of college entrance examination candidates to implement fraud. According to the police preliminary investigation, fraud victims accumulated more than 3,500 people, involving more than 3 million yuan.

Prevention recommendations: the annual admission of college entrance examination, college entrance examination fraud is a high period of time. Candidates and parents need to beware of all the so-called “internal indicators”, false check the site, false search results such as college entrance examination in the name of all kinds of fraud means, do not have luck, deceived.

5.3.3 Wuhan female teachers suffered a series of telecommunications fraud 7 months to cheat 2.53 million

Wuhan, a secondary school teacher Chen, master’s degree, 2017 May to the police alarm fraud. It is understood that in November 2016, Chen received a strange call, said its social security card was stolen brush, and directly to the phone to the “Hunan Provincial Public Security Department.” Answer the phone “police” said Ms. Chen involved a fraudulent money laundering case, as “washing charges”, Ms. Chen half a year to the other side of the transfer of 2.53 million, the debt owed more than 300 million. The case is still in the investigation.

Precautionary advice: people need to be alert to unfamiliar calls and text messages. When receiving a suspected fraud or SMS, pay attention to verify the identity of the other party, especially the other party to the designated account remittance, do not easily remittance, should be the first time to inform the family to discuss or consult the public security organs; The public security department can not provide a security account, but will not guide you transfer, set a password.

Six, security experts advice

In the computer use, set the security factor high password. Using a password that is not easily guessed by violent attacks is an effective way to improve your security. Violent attack is an attacker using an automated system to guess the password. Avoid using words that can be found in the dictionary, do not use pure digital passwords; use special characters and spaces, and use uppercase and lowercase letters. This password is harder to crack than use your mother’s name or birthday as a password. In addition, the password length for each additional one, the combination of the composition of the password characters will increase in multiple, so the long password will be more secure.

Regularly upgrade the software, update the security patch. In many cases, it is important to patch the system before installing and deploying the production application software. The final security patch must be installed on the PC’s system. If not for a long time without a security upgrade, may lead to the computer is very easy to become an unethical hacker attack target. Therefore, do not install the software on a computer that does not have a security patch update for a long time.

Protect your data by backing up important documents. Back up your data, which is one of the important ways you can protect yourself from minimizing the loss in the face of a disaster. If the amount of data is huge, the data can be saved to the hard disk. But more convenient way, you can use Tencent computer steward class of security software, at any time to automatically restore the data to the local, you can also store to the cloud, maximize the data to ensure security.

Do not easily trust the external network, open network risk is huge. In an open wireless network, such as in a wireless network with a coffee shop, the network risk will multiply, this concept is very important. This does not mean that in some untrusted external network can not use the wireless network, but to always keep the security and caution of security. The key is that the user must be through their own systems to ensure safety, do not believe that the external network and its own private network as safe.

Improve the unfamiliar telephone, SMS alertness, do not believe in which the content. Fraudulent forms of SMS diversification, a variety of new SMS Trojans flooding through the temptation of the SMS comes with the virus link to pay the class, privacy stealth virus rapid growth. For the “college entrance examination”, “school notice”, “test report card”, “household registration management”, “mobile phone real name system”, “video video” and “traffic violation” and other text messages embedded in the URL link should be vigilant, Do not click anywhere. For unfamiliar calls, SMS should be vigilant and wary, do not believe what the other side of the content, if necessary, to verify their identity information.

Protect personal privacy information, do not easily disclose personal information to others. Personal account, password, ID card information and other key personal privacy information, it is absolutely free to any unfamiliar SMS, the phone revealed. Receive a strange message, the phone asked personal privacy, be sure to be vigilant. When publishing a message on a social platform, beware of important privacy information in the form of photos, screenshots, etc. Do not arbitrarily discard tickets, tickets or courier documents containing personal information to prevent personal information from being stolen.

Mobile phone users should develop good habits to use security software to protect the safety of mobile phones. Mobile phone users can download and install such as Tencent mobile phone housekeeper a class of mobile phone security software, regular mobile phone physical examination and virus killing, and timely update the virus database. For the latest popular and difficult to remove the virus or vulnerability, you can download the killing tool in time to kill or repair. At the same time open Tencent mobile phone housekeeper harassment intercept function, which can effectively intercept fraud phone, SMS, enhance mobile phone security.

Original Mandarin Chinese:

1 互联网安全形势严峻,大力发展网络安全防护势在必行












1.1 影响全球的六大网络安全事件,累计影响遍及全球


2017年3月7日,维基解密(WiKiLeaks)公布了数千份文档并揭秘了美国中央情报局关于黑客入侵技术的最高机密,根据泄密文档中记录的内容,该组织不仅能够入侵iPhone手机、Android手机和智能电视,而且还可以入侵攻击Windows、Mac和Linux操作系统,甚至可以控制智能汽车发起暗杀活动。外界将此次泄漏事件取名为Vault 7,Vault 7公布的机密文件记录的是美国中央情报局(CIA)所进行的全球性黑客攻击活动。



2017年4月14日,影子经纪人(Shadow Brokers)在steemit.com上公开了一大批NSA(美国国家安全局)“方程式组织” (Equation Group)使用的极具破坏力的黑客工具,其中包括可以远程攻破全球约70%Windows机器的漏洞利用工具。任何人都可以使用NSA的黑客武器攻击别人电脑。其中,有十款工具最容易影响Windows个人用户,包括永恒之蓝、永恒王者、永恒浪漫、永恒协作、翡翠纤维、古怪地鼠、爱斯基摩卷、文雅学者、日食之翼和尊重审查。黑客无需任何操作,只要联网就可以入侵电脑,就像冲击波、震荡波等著名蠕虫一样可以瞬间血洗互联网。

1.1.3 “WannaCry”敲诈勒索病毒5月12日在全球爆发



1.1.4 FireBall火球病毒感染超过2.5亿电脑

2017年6月1日,国外安全机构Check Point发报告称在国外爆发了“FireBall”病毒,并声称全球有超过2.5亿台电脑受到感染,其中受影响最大的国家分别是印度(10.1%)和巴西(9.6%)。美国有550万台电脑中招,占2.2%。受感染的企业网络中,印度和巴西分别占到43%和38%,美国则为10.7%。





















2.1.1 木马病毒拦截量平均每月近1.7亿次



2.1.2 PC端广东用户中毒最多,中毒高峰期为上午9-11点 上半年共发现2.3亿次用户机器中木马病毒 


2017年Q2季度相较于2016年Q2季度报毒用户量同比增长3%。从2015年到2017年Q2季度中毒机器数增长趋势明显,呈逐年递增状态。 PC端用户中毒高峰期为上午9点到11点

根据统计,每天中毒高峰时间为上午10点-上午11点,符合企业及普通用户上午9点-上午11点开启电脑处理工作的规律。这段时间用户中毒的病毒类型较多为利用邮件、共享等方式传播的Office文档类宏病毒,说明企业办公安全防护形势依旧严峻。 PC端中毒用户省份最多为广东,其中深圳市居首



2.1.3第一大病毒种类为占比53.8%的木马病毒,勒索病毒新增13.39% PC端第一大种类病毒依然是木马,PE感染型病毒种类少但传播性大

























2.2 移动端共查杀Android病毒6.93亿次,手机染毒用户数超1亿



2.2.2 移动端广东用户中毒最多,染毒手机用户数同比减少45.67%上半年腾讯手机管家共查杀Android病毒6.93亿次


除6月以外,2017年上半年每月查杀病毒次数均超过1亿次,其中1月份查杀次数更高达1.36亿次,几乎与2014年上半年1.4亿的查杀次数持平。 2017年上半年染毒手机用户数超1亿 


2017年1月单月感染用户数达到2166万,为上半年最高纪录,此后感染用户数开始缓慢下降。 移动端中毒用户数量广东居首







感染了全球超3600万安卓设备的恶意广告点击软件“Judy”就属于资费消耗类手机病毒。该恶意软件暗藏于一款韩国手游中,在完成下载安装后,会将感染设备的信息发送到目标页面,并在后台自动下载恶意代码并访问广告链接,盗刷用户流量,给用户造成资费消耗。 二维码、软件捆绑是移动病毒主要渠道来源





3.1.1 2017年上半年垃圾短信持续增长 总数接近6亿





3.1.3 2017年上半年常见的诈骗短信类型




3.2.1 2017年上半年用户共标记骚扰电话2.35亿次 同比下降27.12%


3.2.2 2017年上半年骚扰电话超过50%为响一声


3.2.3 骚扰电话中索要验证码占比最高


3.2.4 诈骗电话标记数同比下降59.68%,北京最多



3.3 恶意网址拦截次数高达478亿,色情欺诈网站居首

3.3.1 2017年上半年检出恶意网址数量超1.83亿





3.4 iOS骚扰及诈骗电话降幅约35%,日历广告成新的骚扰

3.4.1 iOS骚扰电话和诈骗电话出现较大幅度下降





3.5 腾讯麒麟系统打击伪基站保护1.5亿人次





从城市来看,拦截诈骗短信数量Top 10的城市如北京、成都、西安等几乎均为省会城市或经济较发达城市,由于人口密集、城市居民收入较高,被伪基站诈骗团伙列入重点攻击对象。

3.5.3 伪基站作案时间特征:工作时间最频繁




腾讯麒麟拦截的伪基站仿冒端口中,仿冒工商银行的诈骗短信最多(高达52%),Top 5仿冒端口除中农工建四大银行,还有运营商中国移动。不难看出,这些“躺枪”的企业是因为用户群体巨大,业务模式中短信息又尤为重要,所以成为伪基站诈骗团伙主要模拟的发送对象。







4.2 安全人才培养“腾讯模式”:打造人才闭环









5.1 勒索病毒集中爆发及病毒详解

5.1.1 WannaCry敲诈勒索病毒5月12日在全球爆发









5.1.2 新一轮勒索病毒“Petya”来袭,更具破坏性

















b)企业用户可以通过在内网搭建Web Server,然后通过内网DNS的方式将域名解析到Web Server IP的方式来实现免疫;通过该域名的访问情况也可以监控内网病毒感染的情况。








5.2 DDOS攻击不断,暗云变种频繁来袭







第二、兼容性,由于该木马主要通过挂钩磁盘驱动器的StartIO来实现隐藏和保护病毒MBR,此类钩子位于内核很底层,不同类型、品牌的硬盘所需要的 hook点不一样,此版本木马增加了更多判断代码,能够感染市面上的绝大多数系统和硬盘。



5.3.1 8.19徐玉玉电信诈骗案宣判






5.3.3武汉女教师遭遇连环电信诈骗 7个月被骗253万











Referring URL:

Leave a Reply

Your email address will not be published. Required fields are marked *