揭示支持性基础设施在标题党 PDF 活动中的作用
Uncovering the Role of Support Infrastructure in Clickbait PDF Campaigns
AI总结：
针对标题党 PDF 传播所依赖的主机基础设施，论文开展 17 个月大规模实测，划分托管类型、识别上传组件并评估漏洞通知效果。
摘要：
标题党 PDF 是多种 Web 攻击的入口，它们通过 SEO 毒化进行传播，并因被大量上传到遭滥用或被攻陷的网站而在搜索结果中排名靠前。这些主机在标题党 PDF 传播中的核心作用仍未得到充分研究，目前尚不清楚攻击者是否会区分用于上传 PDF 的托管类型、他们依赖主机多长时间，以及受影响方如何回应滥用行为。为解决这些问题，我们对主机开展了实时分析，在 17 个月内收集了由 177,835 台主机提供的 4,648,939 份标题党 PDF 的数据。结果揭示了一个多样化的基础设施，其中主机可分为三种主要托管类型。我们还大规模识别出 8 个有助于文件上传且很可能被利用来传播标题党 PDF 的软件组件。我们通过大规模漏洞通知联系受影响方，报告其资源遭到滥用。尽管我们观察到通知后被清理 PDF 的数量体现出一定效果，但该基础设施的长期改善仍不显著。这一发现引发了关于托管服务提供商在打击滥用中的作用以及漏洞通知实际影响的疑问。
英文摘要：
Clickbait PDFs, an entry point for multiple Web attacks, are distributed via SEO poisoning and rank high in search results due to being massively uploaded on abused or compromised websites. The central role of these hosts in the distribution of clickbait PDFs remains understudied, and it is unclear whether attackers differentiate the types of hosting for PDF uploads, how long they rely on hosts, and how affected parties respond to abuse. To address this, we conducted real-time analyses on hosts, collecting data on 4,648,939 clickbait PDFs served by 177,835 hosts over 17 months. Our results revealed a diverse infrastructure, with hosts falling into three main hosting types. We also identified at scale the presence of eight software components which facilitate file uploads and which are likely exploited for clickbait PDF distribution. We contact affected parties to report the misuse of their resources via a large-scale vulnerability notification. While we observed some effectiveness in terms of number of cleaned-up PDFs following the notification, long-term improvement in this infrastructure remained insignificant. This finding raises questions about the hosting providers' role in combating abuse and the actual impact of vulnerability notifications.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
