不择手段：揭露技术支持诈骗者的各种滥用策略
By Hook or by Crook: Exposing the Diverse Abuse Tactics of Technical Support Scammers
摘要：
尽管采取了几次执法行动，但技术支持诈骗（TSS）仍然存在，它将在线滥用与电话渠道上的社会工程相结合。这些骗子使用的策略随着时间的推移而演变，他们针对越来越多的技术品牌。虽然最近的研究提供了对TSS的见解，但这些骗局现在已经发展到利用普遍使用的在线服务，例如搜索和响应搜索查询的赞助广告。我们使用数据驱动的方法来了解TSS的搜索和广告滥用，以了解促进其的在线基础设施。通过使用多个搜索引擎仔细制定技术支持查询，我们收集有关支持基础设施和TSS受害者在线搜索技术支持资源时指向的网站的数据。我们通过基于DNS的放大技术来增强这一点，以进一步提高对这种滥用基础设施的可见性。通过分析收集的数据，我们证明了技术支持诈骗者（1）成功地让主要和自定义搜索引擎返回链接到他们控制的网站，（2）他们能够让广告网络提供恶意广告，导致诈骗页面。我们为期8个月的研究发现了超过9，000个TSS域，包括被动和主动类型，通过自然搜索结果和赞助广告到达的集合之间的重叠最小。此外，我们还发现了超过2,400个支持域，这些支持域帮助TSS域操纵有机搜索结果。此外，我们发现通过滥用域名停车和URL缩短服务达到的域几乎没有重叠。因此，对搜索和广告滥用的调查为TSS策略提供了新的见解，并有助于检测以前未知的滥用基础设施，从而促进这些骗局。
英文摘要：
Technical Support Scams (TSS), which combine online abuse with social engineering over the phone channel, have persisted despite several law enforcement actions. The tactics used by these scammers have evolved over time and they have targeted an ever increasing number of technology brands. Although recent research has provided insights into TSS, these scams have now evolved to exploit ubiquitously used online services such as search and sponsored advertisements served in response to search queries. We use a data-driven approach to understand search-and-ad abuse by TSS to gain visibility into the online infrastructure that facilitates it. By carefully formulating tech support queries with multiple search engines, we collect data about both the support infrastructure and the websites to which TSS victims are directed when they search online for tech support resources. We augment this with a DNS-based amplification technique to further enhance visibility into this abuse infrastructure. By analyzing the collected data, we demonstrate that tech support scammers are (1) successful in getting major as well as custom search engines to return links to websites controlled by them, and (2) they are able to get ad networks to serve malicious advertisements that lead to scam pages. Our study period of 8 months uncovered over 9,000 TSS domains, of both passive and aggressive types, with minimal overlap between sets that are reached via organic search results and sponsored ads. Also, we found over 2,400 support domains which aid the TSS domains in manipulating organic search results. Moreover, we found little overlap with domains that are reached via abuse of domain parking and URL-shortening services which was investigated previously. Thus, investigation of search-and-ad abuse provides new insights into TSS tactics and helps detect previously unknown abuse infrastructure that facilitates these scams.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
