Smishing Strategy Dynamics and Evolving Botnet Activities in Japan

XLoader and FakeSpy, the two major smishing botnets targeting Japan, change their attack strategies over various timescales. Based on recent observations of the botnets and Twitter data, we present empirical facts about their strategies and activity patterns and applied some of these strategic and activity patterns to malware detection and malicious domain detection. All the proposed methods yielded small false positive and negative rates, and are expected to run on user devices owing to their small computational cost. Recent malware detection methods based on traffic analysis extract TCP/IP traffic features if the upper layers of TCP are encrypted. In this study, Frida’s hooking capability was employed to decode the upper layers (WebSocket and JSON-RPC) to create a list of all commands flowing over the botnet channel. The command-level traffic analysis presents decisive attack features because commands are transmitted according to strategies developed by the attackers. The proposed malicious domain detection method, on the other hand, exploited the tendency of the attackers to create domains in batches. Previous researchers focused on how benign and malicious domains were registered and used on the name servers. The proposed method, on the other hand, focuses on the arrival rate of SMS messages with URL links. The error rates become significantly small when users do not receive such messages very often.

View this article on IEEE Xplore

 

IEEE Access 10 Year Anniversary Twitter Giveaway

In celebration of the 10 Year Publishing Anniversary of IEEE Access, the journal will be hosting a Twitter Giveaway to thank our authors for choosing IEEE Access to publish their important research over the last decade.  For the entire month of May, share a link on Twitter to your published IEEE Access article on IEEE Xplore for a chance to win an IEEE Access swag bag!  

Be sure to use the hashtag #10YearsofIEEEAccess and tag us @IEEEAccess to qualify. Ten (10) winners will be randomly selected on June 1st, and will receive  a “swag bag” containing IEEE Access branded items such as a padfolio, a metal tumbler, a spiral notebook, pens, cloth tote bag, and keychain flashlights (valued at approximately $100).

For more information please see the Rules below.

To view the Top 10 Published IEEE Access articles since inception, please click here.

 

 

Official Rules

NO PURCHASE OR PAYMENT IS NECESSARY TO ENTER OR WIN. A PURCHASE WILL NOT IMPROVE YOUR ODDS OF WINNING. 

Contest: IEEE Access 10 Year Anniversary Twitter Giveaway (the “Contest”) 

Sponsor: The Institute of Electrical and Electronics Engineers, Incorporated, 445 Hoes Lane, Piscataway, New Jersey, USA, 08854 (“Sponsor”) 

Eligibility: Contest is open to residents of the United States of America and other countries, where permitted by local law, who are the age of eighteen (18) and older. Employees of Sponsor, its agents, affiliates and their immediate families are not eligible to enter Contest. Entrants may be subject to rules imposed by their institution or employer relative to their participation in contests and should check with their institution or employer for any relevant policies. Void where prohibited by law. 

Agreement to Official Rules: By participating in this contest, entrants agree to abide by the terms and conditions thereof as established by Sponsor. Sponsor reserves the right to alter any of these Official Rules at any time and for any reason. All decisions made by Sponsor concerning the Contest including, but not limited to the cancellation of the Contest, shall be final and at its sole discretion. 

Entry Period: This Contest commences from Monday, 01 May 2023 12:00AM EDT to Wednesday, 31 May 2023 12:00AM EDT (“Entry Period”). Sponsor’s server is the official clock for the Contest. Entries received before or after the Entry Period are void. 

How To Enter: 

  • Share your own published IEEE Access article on Twitter using the hashtag #10YearsofIEEEAccess and tagging @IEEEAccess

○ The Twitter post should include a link to your published IEEE Access article on IEEE Xplore. Links to other sites such as preprint servers or institutional websites do not qualify.

○ The Twitter post must include the hashtag #10YearsofIEEEAccess.

○ The Twitter post must tag the IEEE Access Twitter account @IEEEAccess. 

○ You must read and agree to these Official Rules

○ You only qualify for sharing an article that you are an author on.

○ All authors listed on a published IEEE Access article are permitted to share the same article on their respective Twitter accounts.  However, a published article can only win once and only 1 author can win.  The author of the selected Tweet was selected will be the winner.

○ For an example of a qualifying Twitter post, please visit our Contest website at https://ieeeaccess.ieee.org/about-ieee-access/announcements/10years_twittergiveaway/.

 

LIMIT THREE (3) ENTRIES PER PERSON. 

The participant is permitted to share three (3) of their published IEEE Access articles to participate.  The participant can only share a published article once but may share three (3) different published IEEE Access articles total.  An author can only win once.

Only entries submitted in accordance with these Official Rules will be eligible for consideration. No alternate means of entry permitted. All entries become the exclusive property of Sponsor and will not be acknowledged or returned. 

Selection of Winner: 

In celebration of ten (10) years of publishing, ten (10) winners will be selected randomly by random.org.  Only contestants that follow the criteria for inclusion will be able to win. 

Prize: The prize(s) for the Contest are being sponsored by IEEE. The winner(s) (the “Prize Winner(s)”) shall receive an IEEE Access “swag bag” containing 2 stylus pens, a cloth tote bag, a spiral notebook, a padfolio, 2 keychain flashlights, and a water tumbler, valued at approximately $100 (the “Prize”).  Only the contestant that shared the winning Twitter post will receive the Prize (as long as the person is an author on the shared IEEE Access article).

In the event that a winner is residing in a country that presents difficulty for shipping the Prize (i.e., the cost of shipping outweighs the cost of the Prize, embargo issues, etc.), the winner will receive an Amazon e-gift card of approximate equal value to the Prize (in USD).  The Amazon e-gift card cannot be requested, as this is at the discretion of the IEEE.

No cash in lieu of prize or substitution of prize permitted, except that Sponsor reserves the right to substitute a prize or prize component of equal or greater value in its sole discretion for any reason at time of award. Sponsor shall not be responsible for service obligations or warranty (if any) in relation to the prize(s). Prize may not be transferred prior to award. All other expenses associated with use of the prize, including, but not limited to local, state, or federal taxes on the Prize, are the sole responsibility of the winner. Winner(s) understand that delivery of a prize may be void where prohibited by law and agrees that Sponsor shall have no obligation to substitute an alternate prize when so prohibited. Amazon is not a sponsor or affiliated with this Contest.

The winner must provide proof of authorship.

 

Notification of Potential Prize Winners: The Prize Winners will be notified by e-mail within 14 days of the selection date. If a Prize Winner does not acknowledge acceptance of the Prize within 14 business days after being notified that he or she is a Prize Winner, or if a potential Prize Winner does not return the signed claim forms within the required time, or is otherwise found to be ineligible or not in full compliance with these Official Rules, another Prize Winner will be chosen using the same procedure specified above. Potential Prize Winner may be asked to execute and return to Sponsor a declaration of eligibility and liability/publicity release, where lawful, within fourteen (14) days of attempted notification. Winner may waive the right to receive the prize. The decisions of Sponsor are final and binding in all respects. 

Release, Publicity, and Privacy: By receipt of the Prize and/or, if requested, by signing an affidavit of eligibility and liability/publicity release, the Prize Winner consents to the use of his or her name, likeness, business name and address by Sponsor for advertising and promotional purposes, including but not limited to on Sponsor’s social media pages, without any additional compensation, except where prohibited. No entries will be returned. All entries become the property of Sponsor. The Prize Winner agrees to release and hold harmless Sponsor and its officers, directors, employees, affiliated companies, agents, successors and assigns from and against any claim or cause of action arising out of participation in the Contest. 

Sponsor assumes no responsibility for computer system, hardware, software or program malfunctions or other errors, failures, delayed computer transactions or network connections that are human or technical in nature, or for damaged, lost, late, illegible or misdirected entries; technical, hardware, software, electronic or telephone failures of any kind; lost or unavailable network connections; fraudulent, incomplete, garbled or delayed computer transmissions whether caused by Sponsor, the users, or by any of the equipment or programming associated with or utilized in this Contest; or by any technical or human error that may occur in the processing of submissions or downloading, that may limit, delay or prevent an entrant’s ability to participate in the Contest. 

Sponsor reserves the right, in its sole discretion, to cancel or suspend this contest and award a prize from entries received up to the time of termination or suspension should virus, bugs or other causes beyond Sponsor’s control, unauthorized human intervention, malfunction, computer problems, phone line or network hardware or software malfunction, which, in the sole opinion of Sponsor, corrupt, compromise or materially affect the administration, fairness, security or proper play of the contest or proper submission of entries. Sponsor is not liable for any loss, injury or damage caused, whether directly or indirectly, in whole or in part, from downloading data or otherwise participating in this Contest. 

Entrant acknowledges and agrees that Sponsor may collect, store, share, and otherwise use personally identifiable information provided during the registration and application process and the Contest, including, but not limited to, name, mailing address, phone number, and email address. Sponsor will use this information with accordance with its Privacy Policy (https://www.ieee.org/security_privacy.html), including for administering the Contest and verifying Entrant’s identity, postal address, and telephone number in the event an entry qualifies for a prize. Entrant’s information may also be transferred to countries outside the country of Entrant’s residence, including the United States. Such other countries may not have privacy laws

and regulations similar to those of the country of Entrant’s residence. If an Entrant does not provide the mandatory data required at registration, Sponsor reserves the right to disqualify the entry. 

Right to Use Entries: By entering the Contest, entrants grant Sponsor a non-exclusive, irrevocable, royalty-free, perpetual, worldwide right and license to reproduce, publish, display, edit and otherwise use the submitted Entries, and entrant’s full name and city and state/province/country of residence, photograph, likeness, voice and institutional affiliation, in print or any offline or online and other media for purposes of editorials, exhibition, advertising, publicity and promotion without additional compensation or permission, unless prohibited by law. 

Representations and Warranties Regarding Entries: By submitting an Entry, you represent and warrant that your Entry does not and shall not comprise, contain, or describe, as determined in Sponsor’s sole discretion: (A) false statements or any misrepresentations of your affiliation with a person or entity; (B) personally identifying information about you or any other person; (C) statements or other content that is false, deceptive, misleading, scandalous, indecent, obscene, unlawful, defamatory, libelous, fraudulent, tortious, threatening, harassing, hateful, degrading, intimidating, or racially or ethnically offensive; (D) conduct that could be considered a criminal offense, could give rise to criminal or civil liability, or could violate any law; (E) any advertising, promotion or other solicitation, or any third party brand name or trademark; or (F) any virus, worm, Trojan horse, or other harmful code or component. By submitting an Entry, you represent and warrant that you own the full rights to the Entry and have obtained any and all necessary consents, permissions, approvals and licenses to submit the Entry and comply with all of these Official Rules, and that the submitted Entry is your sole original work, has not been previously published, released or distributed, and does not infringe any third-party rights or violate any laws or regulations. 

Limitations of Liability/Reserved Rights: Neither Sponsor, its parent, subsidiary or affiliated companies, nor its advertising or promotional agencies shall have any obligation, liability or responsibility with regard to (i) entries that contain incorrect or inaccurate information or do not comply with these Official Rules, (ii) entries, prize claims or notifications that are lost, late, incomplete, illegible, unintelligible, damaged or otherwise not received by the intended recipient, in whole or in part, due to computer, technical or other error of any kind, (iii) telephone, electronic, hardware, software, network, Internet or computer malfunctions, failures or difficulties of any kind, (iv) any condition caused by events beyond the control of Sponsor that may cause the Contest to be disrupted or delayed, (v) any printing or typographical errors in these Official Rules or any other materials associated with the Contest, or (vi) any damages or losses of any kind caused by any prize or resulting from participation in the Contest, accessing, uploading or downloading data in connection with the Contest, or acceptance, possession or use of any prize. Sponsor, in its sole discretion, reserves the right to disqualify any entrant tampering with or abusing the entry process or the operation of the Contest or otherwise violating these Official Rules. Sponsor, in its sole discretion, further reserves the right to cancel, terminate, suspend or modify the Contest if the Contest cannot be completed as planned because of infection by computer virus, bugs, tampering, unauthorized intervention or technical failures of any sort and to select a winner from among eligible entries unaffected by such event, if any.

Disputes: EACH ENTRANT AGREES THAT: (1) ANY AND ALL DISPUTES, CLAIMS, AND CAUSES OF ACTION ARISING OUT OF OR IN CONNECTION WITH THIS CONTEST, OR ANY PRIZES AWARDED, SHALL BE RESOLVED INDIVIDUALLY, WITHOUT RESORTING TO ANY FORM OF CLASS ACTION, PURSUANT TO ARBITRATION CONDUCTED UNDER THE COMMERCIAL ARBITRATION RULES OF THE AMERICAN ARBITRATION ASSOCIATION THEN IN EFFECT, (2) ANY AND ALL CLAIMS, JUDGMENTS AND AWARDS SHALL BE LIMITED TO ACTUAL OUT-OF-POCKET COSTS INCURRED, INCLUDING COSTS ASSOCIATED WITH ENTERING THIS CONTEST, BUT IN NO EVENT ATTORNEYS’ FEES; AND (3) UNDER NO CIRCUMSTANCES WILL ANY ENTRANT BE PERMITTED TO OBTAIN AWARDS FOR, AND ENTRANT HEREBY WAIVES ALL RIGHTS TO CLAIM, PUNITIVE, INCIDENTAL, AND CONSEQUENTIAL DAMAGES, AND ANY OTHER DAMAGES, OTHER THAN FOR ACTUAL OUT-OF-POCKET EXPENSES, AND ANY AND ALL RIGHTS TO HAVE DAMAGES MULTIPLIED OR OTHERWISE INCREASED. ALL ISSUES AND QUESTIONS CONCERNING THE CONSTRUCTION, VALIDITY, INTERPRETATION AND ENFORCEABILITY OF THESE OFFICIAL RULES, OR THE RIGHTS AND OBLIGATIONS OF ENTRANT AND SPONSOR IN CONNECTION WITH THE CONTEST, SHALL BE GOVERNED BY, AND CONSTRUED IN ACCORDANCE WITH, THE LAWS OF THE STATE OF NEW JERSEY, WITHOUT GIVING EFFECT TO ANY CHOICE OF LAW OR CONFLICT OF LAW, RULES OR PROVISIONS (WHETHER OF THE STATE OF NEW JERSEY OR ANY OTHER JURISDICTION) THAT WOULD CAUSE THE APPLICATION OF THE LAWS OF ANY JURISDICTION OTHER THAN THE STATE OF NEW JERSEY. SPONSOR IS NOT RESPONSIBLE FOR ANY TYPOGRAPHICAL OR OTHER ERROR IN THE PRINTING OF THE OFFER OR ADMINISTRATION OF THE CONTEST OR IN THE ANNOUNCEMENT OF THE PRIZES. 

Contest Results and Official Rules: To obtain the identity of the prize winner and/or a copy of these Official Rules, send a self-addressed stamped envelope to Kimberly Rybczynski, IEEE, 445 Hoes Lane, Piscataway, NJ 08854-4141 USA.