×
Array
(
[fid] => 6980
[description] =>
[password] =>
[icon] =>
[redirect] =>
[attachextensions] =>
[creditspolicy] => Array
(
[post] => Array
(
[usecustom] => 1
[cycletype] => 1
[cycletime] => 0
[rewardnum] => 75
[extcredits1] => 0
[extcredits2] => 0
[extcredits3] => 0
[extcredits4] => 0
[extcredits5] => 0
[extcredits6] => 0
[extcredits7] => 0
[extcredits8] => 0
[rid] => 1
[fid] => 6980
[rulename] => 发表主题
[action] => post
[fids] => 32,52,67,447,1120,1151,1156,6750,6762,6763,6766,6769,6772,6773,6787,6796,6808,6809,6810,6813,6814,6820,6829,6830,6846,6856,6864,6865,6827,6930,6931,6776,6858,6880,6764,6932,6871,6758,6905,1116,6788,6812,6798,6736,6759,6842,6966,6767,6828,6924,6935,6936,6938,6940,6941,6826,6909,6803,6919,6911,6908,6881,6920,6912,6913,6921,6925,6922,6789,6818,6819,6872,6928,6969,6889,6888,6917,6939,6947,6961,6937,6943,6970,6869,6900,6902,6783,6817,1111,6870,6821,6951,6876,6952,6954,6960,6942,6910,6949,6962,6963,6964,6927,6926,6973,6728,6929,6874,6894,6896,6885,6857,6868,1113,6778,56,6844,6878,6802,6933,6811,6923,6877,6875,6918,6892,6757,6832,6833,6795,6793,6848,6837,6849,6850,6851,6852,6853,6854,6863,6882,6836,6790,6838,6794,6791,6873,555,6895,6934,6958,6944,6945,6907,6779,6886,6950,6904,6956,6862,6957,6855,6955,6959,6914,6965,6971,6972,6953,6975,6976,6799,6974,6824,6815,6891,6866,6979,6977,6765,6903,6948,6845,6879,1121,6980
)
[reply] => Array
(
[usecustom] => 1
[cycletype] => 4
[cycletime] => 0
[rewardnum] => 0
[extcredits1] => 0
[extcredits2] => 0
[extcredits3] => 0
[extcredits4] => 0
[extcredits5] => 0
[extcredits6] => 0
[extcredits7] => 0
[extcredits8] => 0
[rid] => 2
[fid] => 6980
[rulename] => 发表回复
[action] => reply
)
[digest] => Array
(
[usecustom] => 1
[cycletype] => 4
[cycletime] => 0
[rewardnum] => 0
[extcredits1] => 0
[extcredits2] => 0
[extcredits3] => 0
[extcredits4] => 0
[extcredits5] => 0
[extcredits6] => 0
[extcredits7] => 0
[extcredits8] => 0
[rid] => 3
[fid] => 6980
[rulename] => 加精华
[action] => digest
)
)
[formulaperm] => a:5:{i:0;s:0:"";i:1;s:0:"";s:7:"message";s:0:"";s:5:"medal";N;s:5:"users";s:0:"";}
[moderators] =>
[rules] =>
[threadtypes] => Array
(
[status] => 1
[required] => 0
[listable] => 0
[types] => Array
(
)
)
[threadsorts] => Array
(
)
[viewperm] =>
[postperm] =>
[replyperm] =>
[getattachperm] =>
[postattachperm] =>
[postimageperm] =>
[spviewperm] =>
[seotitle] =>
[keywords] =>
[seodescription] =>
[supe_pushsetting] =>
[modrecommend] => Array
(
[open] => 0
[num] => 10
[imagenum] => 0
[imagewidth] => 300
[imageheight] => 250
[maxlength] => 0
[cachelife] => 0
[dateline] => 0
)
[threadplugin] => Array
(
)
[replybg] =>
[extra] => a:2:{s:9:"namecolor";s:0:"";s:9:"iconwidth";s:0:"";}
[jointype] => 0
[gviewperm] => 0
[membernum] => 0
[dateline] => 0
[lastupdate] => 0
[activity] => 0
[founderuid] => 0
[foundername] =>
[banner] =>
[groupnum] => 0
[commentitem] =>
[relatedgroup] =>
[picstyle] => 0
[widthauto] => 0
[noantitheft] => 0
[noforumhidewater] => 0
[noforumrecommend] => 0
[livetid] => 0
[price] => 0
[fup] => 6974
[type] => sub
[name] => 币圈资讯
[status] => 1
[displayorder] => 0
[styleid] => 0
[threads] => 50922
[posts] => 50990
[todayposts] => 0
[yesterdayposts] => 0
[rank] => 60
[oldrank] => 61
[lastpost] => 2688723 美国2024年大选已花费147亿美元，或为史上最贵 1730688420 比推快讯
[domain] =>
[allowsmilies] => 1
[allowhtml] => 1
[allowbbcode] => 1
[allowimgcode] => 1
[allowmediacode] => 0
[allowanonymous] => 0
[allowpostspecial] => 1
[allowspecialonly] => 0
[allowappend] => 0
[alloweditrules] => 0
[allowfeed] => 0
[allowside] => 0
[recyclebin] => 1
[modnewposts] => 0
[jammer] => 0
[disablewatermark] => 0
[inheritedmod] => 0
[autoclose] => 0
[forumcolumns] => 0
[catforumcolumns] => 0
[threadcaches] => 0
[alloweditpost] => 1
[simple] => 16
[modworks] => 0
[allowglobalstick] => 1
[level] => 0
[commoncredits] => 0
[archive] => 0
[recommend] => 0
[favtimes] => 0
[sharetimes] => 0
[disablethumb] => 0
[disablecollect] => 0
[ismoderator] => 0
[threadtableid] => 0
[allowreply] =>
[allowpost] =>
[allowpostattach] =>
)
|
SAFEIS：深度剖析Uniswap黑客攻击事件!
[复制链接]
|
当前离线
经验:
天策币:
活跃币:
策小分:
总在线: 分钟
本月在线: 分钟
|
|
|
近日，发生了一起针对UNISWAP的黑客攻击事件，黑客通过钓鱼攻击的方式盗取了众多用户钱包里的巨额资产。
黑客在此次钓鱼攻击中盗取了价值约为830万美元的虚拟货币资金，攻击后不久，黑客即将几乎所有盗取的虚拟货币转移到 Tornado Cash中进行混币。
SAFEIS通过综合研判，梳理出整个攻击事件的发展脉络。
钓鱼网站
通过查看钓鱼网站，可以看出该虚假网站和UNI官网高度相似，就是为了钓鱼攻击而仿照UNI官网而做的仿冒虚假网站。
然而，该虚假网站还是有很多明显不正常的特征，比如，无法进行网络切换。此外，该网站注册时间很短，只是在发动攻击前四天进行注册的，注册人保持匿名。
攻击过程技术分析
黑客创建了一个虚假的“UniswapLP[.]com”代币，合约地址为0xcf39...00c，然后把这些虚假代币空投到大约7.4万个钱包中，每个钱包收到400 个代币。
当一些用户经受不住诱惑，被诱骗至虚假代币名称相同的钓鱼网站时，他们会收到一条消息，说明他们能够索取与他们收到的“UniswapLP[.]com”代币数量相等的 UNI 代币。
一旦用户点击“点击此处领取”（Click here to claim）的按钮并在钱包中批准授权和交易，就会触发一个名为 SetApprovalForAll() 函数的调用。这可使黑客访问用户钱包，并能够窃取用户钱包中的NFT，紧接着，黑客可以定位NFT合约并利用Uniswap V3将盗取的NFT交换为WBTC和ETH。
此后黑客通过四笔交易，将总计240枚WBTC和3278枚ETH进行转移归集。这是黑客收集被盗资金的交易截图之一。
黑客收集被盗资金的交易截图之一
随后，黑客将240枚WBTC换成4295枚ETH。
资产追溯
通过SAFEIS资金追溯平台，可以更好地了解本次黑客攻击事件的资金的流向。在这次网络钓鱼攻击中，总共有 7,500 ETH 被转移到 Tornado Cash，转移时约为 830 万美元，换算为人民币约为5600万元。
经验总结
加密行业钓鱼攻击事件频繁发生，钓鱼网站制作成本和技术要求都很低，目前，已经形成相当完善、模块化、流程化的黑色产业链，攻击者甚至都不用自己搭建虚假网站，可以通过某些软件直接生成。SAFEIS提醒广大加密用户，在看到任何公告、消息和链接时，保持警惕至关重要，必须首先验证其真实性。
来源：金色财经 |
|
|
|
|
|
|
|
|
|
