Despite the significant investment of manpower, time, and resources by insurance companies to address and solve fraud issues, fraud detection remains a major bottleneck for insurance companies. 

Insurance fraud refers to the intentional fabrication or concealment of information by individuals or organizations in an attempt to obtain insurance benefits or payments they are not entitled to. This is a serious illegal activity that not only harms the interests of insurance companies but also affects the legitimate rights and interests of policyholders. Insurance fraud appears in various unexpected forms. Claimants may fabricate false injury experiences, falsify the extent of damage to vehicles or property, submit false documents, forged medical records, receipts, etc., or even make blatantly false statements.
![2024042602.jpg](https://cdn.aisecurius.com/images/80e/80e30e83-1fd5-45ef-a4e6-85ddf6926979.jpg)

This intentional fraudulent behavior may involve multiple parties, including policyholders, insurance agents, brokers, financial planners, medical personnel, legal advisors, and organized criminal organizations, among others. Although insurance fraud takes various forms, they all have one common characteristic: dishonesty and deception.


# Insurance Fraud: Why is it Complex


Despite the significant investment of manpower, time, and resources by insurance companies to address and solve fraud issues, fraud detection remains a major bottleneck for insurance companies. The methods used by fraudulent claimants are becoming increasingly sophisticated and covert, making it exceptionally difficult to differentiate between fraudulent and non-fraudulent claims.

1. Historically fraudulent behavior has not been accurately identified, making it significantly more difficult to predict future fraudulent events.

2. Insurance companies frequently change their fraud detection methods, making it extremely challenging to identify fraud based on historical data.

3. The inability to accurately assess the relationships and connections between suspicious entities and scenarios.

4. Lack of sufficient resources to quickly and effectively investigate each suspicious claim.

Due to the manual processing of large volumes of documentation by claims handlers, it is common for key information to be overlooked. Moreover, in many cases, the assessment of claims often relies on the professionalism and experience of claims handlers, resulting in claim evaluations being based more on subjective judgment rather than objective facts.



# Insurance Fraud: Common Anomalous Signals


While insurance fraud often involves complex networks of deception and falsification, some danger signals and warning signs can help us identify potential fraudulent activities.

1. Inconsistencies in information on application forms or medical records may indicate dishonest behavior by the claimant.

2. Unusual behavioral patterns, such as frequent claims for the same type of injury, may suggest the presence of fraudulent activity.

3. Fraudsters are more likely to fabricate false claims when there are no witnesses to accidents or injuries.

4. Suspicious healthcare providers who charge for services not provided, overcharge, or prescribe unnecessary treatments are likely involved in fraud.

5. Using unusual payment methods may also indicate someone attempting to conceal their identity.

As one of the most heavily regulated industries globally, the insurance industry faces significant challenges in adopting new technologies and innovations. Nevertheless, in the face of the stubborn problem of insurance fraud, insurance companies must continue to explore and innovate to identify and prevent fraudulent activities more effectively, safeguarding the healthy and stable development of the insurance industry.


Insurance fraud is difficult to identify, but there are several anomalous features that serve as signals.

Olga claims that her likeness may be used for fraudulent promotional activities, becoming a means for profiteers to make money.


Earlier this year, 20-year-old Ukrainian internet sensation Olga Loiek encountered a group of AI-generated clones of herself online. "I was really scared. I saw my face being used to promote products in Chinese," she told the media. These presenters selling products on social media platforms have their faces and voices generated using AI face-swapping technology, portraying themselves as foreigners in China selling foreign specialties. Accounts using Olga's likeness and voice number close to a hundred, spanning across mainstream social media platforms in China, with followers ranging from thousands to hundreds of thousands. One fake account even amassed 300,000 followers.
![2024040807.png](https://cdn.aisecurius.com/images/4df/4df3e33c-51dc-4bf2-b41e-43fecb3e45c5.png)

Olga claims that her likeness may be used for fraudulent promotional activities, becoming a means for profiteers to make money.

# Stolen Faces: Becoming Profitable Anchors for Others

Livestream e-commerce typically involves hosts showcasing a range of products to their followers, who can then purchase them through integrated buy buttons. Despite sounding somewhat mundane, these shows attract a large audience: last year, over 1 trillion yuan worth of goods were sold through live commerce, and there are now over 1 million people acting as livestream hosts in China.
![2024041602.png](https://cdn.aisecurius.com/images/4ce/4ceee8b2-4394-4b2f-92d7-8fcc4368ef34.png)
The integration of AI clones and face-swapping-generated virtual influencers into Chinese e-commerce and livestreaming represents a significant evolution in brand engagement strategies. These AI digital humans can be tailored to clients' needs, capable of livestreaming 24 hours a day, achieving a "non-stop" work ethic to mimic the effect of human hosts even during "non-peak hours." Moreover, these virtual hosts enable brands to precisely control their messaging, ensuring consistent brand representation and operational efficiency. Compared to traditional influencer partnerships, they offer potentially lower costs, less unpredictability, and very low operating costs. If there are no bizarre interaction issues, digital personas might never reveal themselves.

Creating virtual hosts is extremely simple, requiring only a single photo for cloning, with the fastest turnaround being just 60 seconds.

However, this innovative sales approach brings about numerous complex implications. Worse, it has sparked the misuse of technology, cloning faces without the consent of the individuals involved for commercial purposes or fraud. Olga Loiek's experience is a notable example. Attackers only need to download photos, videos, audio, and activities shared by the victim on social media, requiring only 30 seconds to 1 minute of sample material to create highly realistic voices and images, thus recreating a presenter for video livestreaming.

[Dingxiang Defense Cloud Business Security Intelligence Center's Intelligence Digest on "DEEPFAKE" Threat Research and Security ](https://www.aisecurius.com/blog/article/55)Strategies points out that another major factor contributing to the proliferation of AI fraud is the accessibility of AI tools, making the creation of false videos and images even easier. Especially with the emergence of Cybercrime as-a-Service, ordinary people can easily purchase AI fraud services or technologies. Attackers use a range of media, including social media, email, remote meetings, online recruitment, and news information, to carry out various AI fraud attacks against businesses and individuals.


# User: How to prevent face theft?


The security threats brought by AI are increasingly attracting attention and quickly becoming a new means of threat, posing unprecedented risks to both businesses and individual users.

[The Intelligence Digest on "DEEPFAKE" Threat Research and Security Strategies suggests that](https://www.aisecurius.com/blog/article/55) to prevent and combat AI fraud, it is necessary to effectively identify and detect AI-generated content on one hand, and prevent the exploitation and spread of AI fraud on the other. This requires not only technical countermeasures but also complex psychological warfare and an increase in public security awareness. Therefore, enterprises need to strengthen digital identity recognition, review account access permissions, and minimize data collection. Additionally, enhancing employees' awareness of how to detect AI threats is crucial.


## 1. Establish an AI-driven security tool system. 
Implement anti-fraud systems that combine manual review with AI technology to enhance automation and efficiency in detecting and responding to AI-based cyber attacks.


## 2. Strengthen identity verification and protection.
 This includes enabling multi-factor authentication, encrypting data at rest and in transit, and implementing firewalls. Strengthen frequent verification for account activities such as remote logins, device changes, phone number changes, and sudden account activity spikes to ensure consistent user identity during usage. Compare and identify device information, geographic locations, and behavioral operations to detect and prevent abnormal activities.


## 3. Enhance account authorization control. 
Restrict access to sensitive systems and accounts based on the principle of least privilege, ensuring access only to the resources necessary for their role, thereby minimizing the potential impact of account hijacking and preventing unauthorized access to your systems and data.


## 4. Stay informed about the latest technology and threats.
 Stay updated on the latest developments in AI technology to adjust security measures accordingly. Continuous research, development, and updates of AI models are crucial to maintaining a leading position in the increasingly complex security landscape.


## 5. Reduce the sharing of sensitive information on social media.
 Minimize or eliminate sharing sensitive information such as account services, family members, transportation, job positions, etc., on social media to prevent fraudsters from downloading and forging images and voices for identity fraud.

Traditional security tools and measures are no longer effective in defending against fraud threats based on AI. [Comprehensive risk prevention and control measures are required before, during, and after identifying fraud risks. Dingxiang's latest upgraded anti-fraud ](https://www.aisecurius.com/blog/article/60)technology and security products can help enterprises build a multi-channel, all-scenario, multi-stage security system, effectively combating new threats brought by AI. This includes App reinforcement for App security, atbCAPTCHA to prevent malicious AI registration and login, device fingerprinting to identify AI-forged devices, Dinsight to discover potential fraud threats and prevent complex AI attacks, and a comprehensive facial security threat perception solution to intercept "DEEPFAKE" attacks along the entire chain.

Through a multi-channel, all-scenario, multi-stage security system based on threat perception, security protection, data precipitation, model construction, and strategy sharing, various security services can meet different business scenarios, possess industry-specific strategies, and achieve precipitation and iteration based on their own business characteristics, achieving precise platform control to rapidly and effectively 

New Threat: Someone is Using Your Face for Online Livestreaming

In the state of New Jersey, insurance fraud ranks as the second largest white-collar non-violent crime, trailing only behind tax evasion. 

In the state of New Jersey, insurance fraud ranks as the second largest white-collar non-violent crime, trailing only behind tax evasion. A report from insurancefraud.org indicates that insurance fraud amounts to a staggering $308.6 billion annually. This not only results in a significant increase in insurance costs but also places a higher premium burden on policyholders.

![2024041003.jpg](https://cdn.aisecurius.com/images/34d/34d30220-cf1a-4e91-b8e0-2fc64e337a52.jpg)

Prosecutors responsible for handling insurance fraud cases emphasize in their report that the scale of perpetrators involved in insurance fraud is increasingly vast, severely impacting the normal operation of the insurance industry.

An investigation into insurance fraud reveals that nearly 9% of respondents do not view insurance fraud as a wrongdoing or criminal activity. They perceive it either as insurance companies extorting people or as rightful compensation for having paid sufficient premiums. Meanwhile, a significant proportion of respondents (28.6%) hold the viewpoint that insurance fraud is either not truly a crime (8.5%) or constitutes a business practice without genuine victims (20.1%). Additionally, defenders of insurance fraud may argue on behalf of deceiving insurance companies, viewing it as a victimless crime.

For the insurance industry, agents and companies must be prepared for the increasing frequency of claims. The emergence of AI tools brings about a series of complex issues. It not only creates more sophisticated fraudulent content for phishing but also has the capability to steal sensitive data such as insurance policy accounts, thereby affecting the accuracy of insurance assessments and impacting claims payout rates.

Of particular note is the fact that AI has become a powerful tool for insurance fraud. For instance, some insurance companies no longer accept photo claims as they could be doctored. Falsified photos depicting damages to specific makes and models of cars, which are not genuine, can be used to extract claim payments. AI fraud also extends to life insurance scams. Attackers leverage AI to easily mimic a person's photo and voice, fabricating a wealth of data to bypass insurance companies' voice recognition technologies and initiate policies for non-insured individuals or non-beneficiaries.

In the face of numerous threats posed by AI, the insurance industry needs to strengthen preventive measures and enhance fraud detection capabilities. Additionally, cooperation with technology companies is crucial to jointly address this challenge.

AI: Making Insurance Fraud More Complex, Now the Second Largest White-Collar Non-Violent Crime in the US

In mainstream scenarios, AI poses a significant threat to digital trust and integrity and has the potential to disrupt the relationship between customers and financial institutions.

According to McKinsey & Company's data, AI-based identity fraud has become the fastest-growing type of financial crime in the United States and is on the rise globally. Research from the UK's GDG indicates that over 8.6 million people in the UK use false or others' identities to obtain goods, services, or credit.

![2024041001.png](https://cdn.aisecurius.com/images/400/400b5b8f-6ad4-4105-9d72-fa87c4ff4ecf.png)

[The US Department of the Treasury recently emphasized in a report titled](https://www.aisecurius.com/blog/article/63) "Specific AI-Enabled Custodial Cybersecurity Risks in the Financial Services Industry" that AI's development makes it easier for cybercriminals to use deepfakes to impersonate financial institution clients and access accounts. The report states, "Generative AI can help existing threat actors develop and test more sophisticated malicious software, providing them with complex attack capabilities previously available only to the most resourceful actors. It can also help lower-skilled threat actors develop simple but effective attacks." According to Deloitte's data, 91% of cyberattacks start with phishing emails.

Undoubtedly, in today's digital environment, AI has altered the nature of identity fraud. In mainstream scenarios, AI poses a significant threat to digital trust and integrity and has the potential to disrupt the relationship between customers and financial institutions.


# Attackers: Five Common AI Attack Methods


AI provides new tools for all threat actors, and attackers are using AI to target employees, create phishing emails, impersonate supply chain partners, and even create deepfake chief financial officers for video conferences. Analysis from the Dingxiang Defense Cloud Business Security Center has identified the following five types of AI-based attacks used by attackers for forging digital identities, credit card theft, forging documents, and other financial fraud.

![2024041601.png](https://cdn.aisecurius.com/images/e3e/e3eeb951-aeac-45bc-93ec-4411d5c0790b.png)
## 1. AI Cloned Voice for Phone Scams: 
Attackers mimic the voices of company executives or colleagues, requesting victims to transfer funds or provide account passwords, potentially resulting in theft of enterprise funds or leakage of sensitive information, causing financial losses and reputational damage to the company.


## 2. AI Face Swapping for Online Meetings and Video Calls:
 Attackers engage in remote business meetings or video calls using forged identities, requesting victims to transfer funds or provide account passwords, potentially resulting in theft of personal or enterprise funds, leakage of information related to significant contracts or transactions, and subsequently affecting business interests and reputation.


## 3. AI-Generated Fake Financial Websites and Clone Financial Apps
: Victims may provide personal bank account information or credit card information under the mistaken belief that they are accessing legitimate financial institution websites or apps, resulting in theft of funds or identity theft, causing significant financial losses and credit crises.


## 4. AI-Enhanced Phishing Emails:
 Attackers use AI to generate more realistic email content, making it easier to deceive victims' trust, such as spoofing emails from legitimate institutions, requesting victims to click on malicious links or download attachments, thereby disclosing sensitive information or controlling victims' computers, leading to financial losses.


## 5. AI-Generated Fake Images, Text, and Videos: 
False financial information may spread widely on social media, news websites, and other platforms, misleading consumers into purchasing fraudulent financial products or insurance, resulting in investment losses or purchasing unsecured fake insurance, leading to significant financial losses.

These fraudulent methods pose extremely serious financial risks, exploiting people's trust in identity recognition and information authenticity, resulting in issues such as financial losses and personal information leaks.


# Banks: Defense Strategies Needed


[The Intelligence Special Issue "AI Face-Swapping"](https://www.aisecurius.com/blog/article/55) Threat Research and Security Strategies believe that to prevent and combat AI fraud, it is necessary to effectively identify and detect AI-generated content while also preventing the exploitation and spread of AI fraud. This requires not only technical countermeasures but also complex psychological warfare and an increase in public awareness of security. Therefore, enterprises need to strengthen digital identity recognition, review account access permissions, and minimize data collection. At the same time, enhance employee awareness of how to detect AI threats.


## 1. Preventing Business-Focused Fraud Activities Based on AI:
 AI can monitor and analyze various aspects of the process from supplier interaction to payment, providing real-time risk assessments and trust scores, issuing alerts to warn of potential fraudulent activities, and seamlessly integrating into current processes. AI can also automatically monitor and analyze large amounts of transaction data, allowing human investigators to focus more on actual fraud events. This automation can reduce manual workload, decrease the likelihood of errors and fraud, and ensure faster response times. By analyzing received invoices, new supplier requests, emails, documents, and bank statements in real-time, AI can help prevent fraud and detect abnormal communication patterns, payment details, and document structures.


## 2. Building a Multi-Channel, Comprehensive, and Multi-Stage Security System:
 [Dingxiang's latest upgraded anti-fraud technology and security products can help enterprises establish a multi-channel, ](https://www.aisecurius.com/blog/article/60)comprehensive, and multi-stage security system to combat new threats posed by AI. This includes securing apps with app reinforcement, preventing malicious registration and login with atbCAPTCHA, identifying AI-forged devices with device fingerprinting, uncovering potential fraud threats, preventing complex AI attacks with Dinsight, and intercepting "AI face-swapping" attacks with a comprehensive facial security threat perception solution. Through a multi-channel, comprehensive, and multi-stage security system based on threat perception, security protection, data accumulation, model construction, and strategy sharing, various security services can meet different business scenarios, possess industry-specific strategies, and achieve accumulation and iteration based on their own business characteristics, enabling precise control and protection of the platform to effectively respond to AI attacks and provide personalized protection.


## 3. Strengthening Identity Verification and Protection:
 This includes enabling multi-factor authentication, encrypting data at rest and in transit, and implementing firewalls. Strengthen frequent verification for activities such as account logins from different locations, device changes, phone number changes, and sudden activity on dormant accounts to ensure consistency in user identity during usage. Comparing device information, geographic location, and behavioral operations can identify and prevent abnormal operations.

## 
4. Strengthening Account Authorization Control:
 Limit access to sensitive systems and accounts based on the principle of least privilege, ensuring access to only the resources required by their roles, thereby reducing the potential impact of account theft and preventing unauthorized access to your systems and data.


## 5. Continuously Understanding Latest Technologies and Threats
: Stay updated on the latest developments in AI technology as much as possible to adjust safeguard measures accordingly. Continuous research, development, and updates to AI models are crucial for maintaining a leading position in an increasingly complex security situation.


## 6. Continuously Educating and Training Employees on Security
: Continuously provide training on AI technology and related risks, help employees identify and avoid AI attacks and other social engineering risks through simulated attacks, vulnerability discovery, security training, etc., remain vigilant, report anomalies quickly, and significantly improve the organization's ability to detect and respond to deepfake threats.

Banks: The Five Most Common AI Attack Methods

like a coin with two sides, AI is both a boon and a threat to companies and their clientele in security. AI can analyze data patterns and identify anomalies

With the rapid evolution of cyber threats, experts project that by 2024, cybercrime will cost US companies up to $452 billion, a figure expected to escalate rapidly in the coming years. Beyond just cybersecurity measures, critical to secure operations is business security. Today, AI has become an indispensable tool in security, ranging from phishing detection tools to AI chatbots capable of responding to cybersecurity queries.
![2024040207.png](https://cdn.aisecurius.com/images/1a9/1a987802-f054-4655-85bc-3fbea4e7821e.png)

However, like a coin with two sides, AI is both a boon and a threat to companies and their clientele in security. AI can analyze data patterns and identify anomalies, alerting to potential risks that might otherwise be overlooked, aiding in proactive measures and propelling the adoption of cutting-edge defensive network technologies. Yet, simultaneously, AI has become a tool for attackers to craft genuine scams and penetrate corporate networks.

# 
Discovering Potential Threats -> Becoming an Internal Threat


One of AI's notable advantages in cybersecurity is its ability to predict and preempt potential threats. By analyzing data patterns and recognizing anomalies, it can provide alerts on risks, preventing crucial information from slipping through the cracks. However, this predictive capability also makes it a useful tool for attackers.

It's precisely this predictive capability that makes AI a useful tool for attackers. They can exploit AI to craft more sophisticated scams, circumventing traditional security measures like email anti-spam filters. Additionally, attackers can leverage AI-driven social engineering strategies to create seemingly personalized and convincing false messages or requests, enticing users to divulge sensitive information or access secure systems.


# Precise Threat Detection -> Disrupting Normal Operations


AI in threat detection is a double-edged sword. It excels at providing real-time responses to security incidents, automating processes, saving time, and minimizing damage.

However, this rapid response system can sometimes backfire. The automated, swift response system can sometimes be counterproductive because AI's determination of what constitutes a threat isn't always accurate, potentially leading to false positives and disrupting business operations. Moreover, if threat actors understand its response patterns, they could manipulate the system to trigger desired reactions, rendering AI's speed counterproductive.

# 
Deep Learning -> Data Poisoning


Furthermore, AI systems continuously learn and evolve, making them more effective at handling increasing volumes of data, better identifying and addressing the ever-changing landscape of network risks.

Yet, paradoxically, this power can be exploited. If threat actors feed manipulated data to AI systems (i.e., "data poisoning"), it could distort their learning process, leading to inaccurate models unable to detect actual threats, even considering malicious activities as safe.

In conclusion, while AI brings numerous benefits to cybersecurity, each advantage comes with a set of challenges. We need to judiciously employ AI technologies and continually strengthen cybersecurity defense measures to ensure these powerful tools enhance security rather than become vulnerabilities.

AI: A Double-Edged Sword in Enterprise Security

The report shows that among various AI threats facing financial institutions, the most significant threats are social engineering attacks and forged identity fraud.

In November 2023, fraudsters disguised themselves as a close friend of Mr. Guo from a certain tech company, swindling 4.3 million RMB. In December 2023, parents of a student studying abroad received a ransom video claiming their child was kidnapped, demanding a ransom of 5 million RMB. In January 2024, 19 multinational corporation employees in Hong Kong fell victim to phishing scams, resulting in a loss of 200 million HKD. In February 2024, the AI virus "GoldPickaxe" emerged, capable of stealing facial information and transferring users' bank balances...

![2024041001.png](https://cdn.aisecurius.com/images/400/400b5b8f-6ad4-4105-9d72-fa87c4ff4ecf.png)


According to McKinsey & Company, AI-based identity fraud has become the fastest-growing type of financial crime in the United States and is on the rise globally. Research by the UK's GDG indicates that over 8.6 million people in the UK are using false or others' identities to obtain goods, services, or credit.

A recent report from the US Department of the Treasury titled "Specific AI-Related Custodial Cybersecurity Risks in the Financial Services Industry" emphasizes that the development of AI makes it easier for cybercriminals to use deepfakes to impersonate financial institution customers and access accounts. The report states, "AI can help existing threat actors develop and test more sophisticated malicious software, providing them with complex attack capabilities previously only available to the most resourceful actors. It can also assist less skilled threat actors in developing simple but effective attacks."

The report shows that among various AI threats facing financial institutions, the most significant threats are social engineering attacks and forged identity fraud. On one hand, attackers use generative AI to create more convincing phishing emails, write phishing website content, and deceive financial institution staff. On the other hand, attackers leverage AI to mimic customers' photos, voices, and videos to bypass identity verification processes.

Related statistics indicate that in 2023, fraud incidents based on "AI face swapping" grew by 3000%, and the number of AI-based phishing emails increased by 1000%.

# Attacker: Process Record of Utilizing AI Threats

Attackers employ a series of media including social media, emails, remote meetings, online recruitment, news updates, etc., to conduct AI attacks on financial institutions. In a recent intelligence digest titled ["AI Face-Swapping Threat Research and Security Strategies" ](https://www.aisecurius.com/blog/article/55)released by the Dingxiang Defense Cloud Business Security Intelligence Center, a detailed analysis of a financial fraud case involving "AI face-swapping" was conducted, outlining the entire process of fraud by the scammers.
![2024031205.jpg](https://cdn.aisecurius.com/images/a7d/a7df2f97-bcaf-4a48-aba2-9a4e9a4342fb.jpg)


## Phase One:
 Gaining the victim's trust. The fraudsters contact the victim through methods such as text messages, social tools, social media, phone calls, etc. (for example, being able to directly mention the victim's name, family, phone number, workplace, address, ID number, colleagues or partners, and even some experiences), and gain trust.


## Phase Two:
 Recording the victim's facial information. The fraudsters engage with the victim via social tools, video conferences, video calls, etc., to capture the victim's facial information during the video call (facial expressions, nodding, tilting, opening mouth, blinking, etc.) for the creation of fake videos and portraits using "AI face-swapping" technology. During this process, the victim may also be induced to set up call forwarding or download malicious app software, which can forward or intercept calls from the bank's customer service or calls.


## Phase Three
: Logging into the victim's bank account. The fraudsters use the bank's app to log into the victim's bank account, submit the fake video and portrait created through "AI face-swapping" for facial recognition authentication by the bank, and intercept the SMS verification code and risk alerts sent by the bank to the victim's phone.


## Phase Four:
 Draining the victim's bank balance. The calls from the bank are redirected to a virtual number pre-set by the fraudster, impersonating the victim. After successfully passing the manual verification by the bank's customer service personnel, the balance in the victim's bank card is smoothly transferred out.

Overall, utilizing AI for fraud is divided into the above four steps, each intricately linked. Victims who cannot discern or judge effectively, and platforms that cannot provide efficient warnings and interceptions, are susceptible to falling into the trap set by fraudsters.


# Banks: How to Guard Against AI Attacks


This is a new challenge facing the entire industry. Faced with attackers who have industrialized and mature attack patterns, the intelligence digest "AI Face-Swapping Threat Research and Security Strategies" suggests that to prevent and combat AI fraud, it is necessary to effectively identify and detect AI-generated content on one hand, and prevent the exploitation and spread of AI fraud on the other. This requires not only technical countermeasures but also complex psychological warfare and an increase in public safety awareness. Therefore, enterprises need to strengthen digital identity recognition, review account access permissions, and minimize data collection. Additionally, enhancing employee awareness on detecting AI threats is crucial![2024041002.jpg](https://cdn.aisecurius.com/images/9aa/9aa8d1b6-7509-474b-9f40-3b11f89bb7ea.jpg).
## 1. Build a comprehensive security system with multi-channel
annel, full-scenario, and multi-stage protection. Covering various channel platforms and business scenarios, providing security services such as threat perception, security protection, data deposition, model construction, and strategy sharing, capable of meeting different business scenarios, possessing industry-specific strategies, and achieving sedimentation and iteration evolution based on its own business characteristics, realizing precise platform prevention and control. This involves deploying multiple security solutions at different points in the network to protect oneself from various threats, devising comprehensive incident response plans to quickly and effectively respond to AI attacks, and implementing personalized protection
## 2. Construct an AI-driven security tool system
ystem. A fraud prevention system combining manual review with AI technology to enhance automation and efficiency, detecting and responding to AI-based cyber attacks
## 3. Strengthen identity verification and protection.
tion. This includes enabling multi-factor authentication, encrypting data at rest and in transit, and implementing firewalls. Strengthen frequent verification for account remote logins, device changes, phone number changes, and sudden activity in dormant accounts to ensure consistency of user identity during usage. Compare and identify device information, geographic location, and behavioral actions to detect and prevent abnormal operations
## 4. Strengthen account authorization control. 
rol. Restrict access to sensitive systems and accounts based on the principle of least privilege to ensure access to resources required by their role, thereby minimizing the potential impact of account hijacking and preventing unauthorized access to your systems and data
## 5. Continuously stay informed about the latest technologies and threats
reats. Keep abreast of the latest developments in AI technology as much as possible to adjust security measures accordingly. Continuous research, development, and updating of AI models are crucial to maintaining a leading position in an increasingly complex security landscape
## 6. Continuously educate and train employees on security.
rity. Provide ongoing training on AI technology and its related risks, helping employees identify and avoid AI attacks and other social engineering risks through simulated attacks, vulnerability discovery, security training, etc. Encourage vigilance and prompt reporting of abnormal situations, significantly improving the organization's ability to detect and respond to deepfake threats.

To guard against AI-based threats, effective identification and detection of AI threats are necessary on one hand, while preventing the exploitation and spread of AI fraud on the other. This requires not only technical countermeasures but also complex psychological warfare and an increase in public safety awareness.


# Security: Defense Products Against AI Fraud


Traditional security tools and measures are no longer effective in defending against fraud threats brought by AI. [To timely identify fraud risks, comprehensive risk prevention and control need to be carried out before, during, and after events. Dingxiang's latest upgraded anti-fraud technology and security products can build a multi-channel, full-scenario, and multi-stage security system for enterprises, effectively combating new threats brought by AI](https://www.aisecurius.com/blog/article/60).


## Securing App Security to Prevent AI Automation Crackdown
. Dingxiang's adaptive iOS reinforcement, based on graph neural network technology, automatically selects appropriate methods for obfuscation based on the characteristics of different code blocks, significantly increasing the difficulty of reverse analysis and reducing computational overhead by 50%. Through encryption and obfuscation engines, App code can be encrypted, obfuscated, and compressed, greatly increasing the security of App code, effectively preventing products from being cracked, copied, or repackaged by attackers.


## Securing Account Security to Prevent AI Malicious Registration and Login
. Dingxiang atbCAPTCHA, based on AIGC technology, prevents AI brute force cracking, automated attacks, and phishing attacks, effectively preventing unauthorized access, account hijacking, and malicious operations, thereby protecting system stability. It integrates 13 verification methods and multiple control strategies, aggregating 4380 risk policies, 112 risk intelligence categories, covering 24 industries and 118 risk types. Its precision control accuracy reaches 99.9%, and it can quickly realize the transformation from risk to intelligence. It also supports seamless verification for secure users and reduces real-time countermeasures to within 60 seconds, further improving the convenience and efficiency of digital login services.


## Identifying AI-Forged Devices to Prevent AI Malicious Fraud
. Dingxiang device fingerprinting generates a unified and unique device fingerprint for each device by internally linking multiple device information. It builds a multi-dimensional identification strategy model based on devices, environments, and behaviors to identify risk devices such as virtual machines, proxy servers, and manipulated emulators. It analyzes whether devices have multiple account logins, frequent IP address changes, or frequent device attribute changes, detecting abnormal behaviors or behaviors inconsistent with user habits, tracking and identifying fraudster activities, helping enterprises achieve operational consistency across all channels under the same ID, and assisting in cross-channel risk identification and control.


## Unearthing Potential Fraud Threats to Prevent Complex AI Attacks.
 Dingxiang Dinsight helps enterprises conduct risk assessment, anti-fraud analysis, and real-time monitoring to improve the efficiency and accuracy of risk control. The average processing speed of Dinsight's daily risk control strategies is within 100 milliseconds, supporting configuration-based access and sedimentation of multi-party data. It can achieve self-performance monitoring and self-iteration of risk control mechanisms based on mature indicators, strategies, models, and deep learning technologies. Paired with the Xintell intelligent model platform, it can automatically optimize security policies for known risks and configure support for risk control strategies for different scenarios based on risk control logs and data mining of potential risks. Its standardized approach to complex data processing, mining, and machine learning processes provides one-stop modeling services from data processing, feature derivation, model construction to final model deployment.


## Intercepting "AI Face-Swapping" Attacks to Ensure Facial Application Securit
y. Dingxiang's full-chain, panoramic facial security threat perception solution intelligently verifies multiple dimensions of information such as device environment, facial information, image authenticity, user behavior, and interaction status. It quickly identifies over 30 types of malicious attacks, such as injection attacks, live spoofing, image forgery, camera hijacking, debugging risks, memory tampering, Root/Jailbreak, malicious Rom, and simulator operations, and automatically blocks operations after discovering forged videos, fake face images, or abnormal interactive behavior. It can also flexibly configure the intensity and friendliness of video verification, achieve seamless verification for normal users, and dynamically strengthen verification for abnormal users.


Two Major AI Threats Facing Banks: Identity Forgery and Social Engineering Attacks

This new type of AI-based threat not only poses a threat to users' personal information and data security but may also seriously affect users' safety and privacy rights. 


In recent years, with the widespread application of artificial intelligence technology, the security threats it brings have increasingly attracted people's attention. In February 2024, [a malicious software named "GoldPickaxe" appeared, which, in its iOS version](https://www.aisecurius.com/blog/article/51), deceives users into performing facial recognition and submitting identity documents, using deepfake technology to create false facial videos, thus defrauding users' bank account information, posing significant security risks to users.
![2024040802.jpeg](https://cdn.aisecurius.com/images/ca4/ca454210-b1c3-48d4-9361-ccef4ca47758.jpeg)
This new type of AI-based threat not only poses a threat to users' personal information and data security but may also seriously affect users' safety and privacy rights. The development of AI makes it easier for false information and fraudulent activities to spread. Attackers may use this technology to create false videos or images, damaging the reputation of individuals or organizations, and even causing social chaos. Additionally, social engineering attacks are becoming increasingly rampant, with attackers using AI-generated fake accounts or information for phishing and online scams, leading to privacy breaches and financial losses for users.

To address the new security challenges brought by AI, the ShikaoBang App has decided to adopt [Dingxiang iOS Reinforcement. Dingxiang iOS Reinforcement is an adaptive reinforcement solution based on graph neural network technology](https://www.aisecurius.com/blog/article/60). It analyzes and extracts features from the App code, automatically selecting appropriate methods for encryption, obfuscation, and compression, increasing the difficulty of reverse engineering the code, effectively preventing the App from being cracked, duplicated, or repackaged by attackers. Additionally, the use of encryption and obfuscation engines further enhances the security of the App.
![2024040806.jpg](https://cdn.aisecurius.com/images/427/42701886-d567-4eb5-8a7e-aa5294dc1abe.jpg)

As a specialized learning client for professional exams and surrounding public recruitment exams, the ShikaoBang App is developed and operated by Jinbiaoshai Education, providing rich learning resources for exam candidates. It integrates specialized question banks, past exam papers, series of books, and high-quality courses, and also provides personalized learning services based on users' learning situations and needs. Users can comprehensively prepare for exams through functions such as video explanations, question bank exercises, exam information, and participate in learning discussions, exchange experiences, and interact with other candidates, enhancing the fun and motivation of learning.

Dingxiang iOS Reinforcement provides powerful security protection for the ShikaoBang App. The reinforced App not only becomes more secure and stable but also better meets the requirements of the Apple Store review, providing users with a reliable learning environment and learning experience, helping users prepare for exams smoothly.

Dingxiang iOS Reinforcement to Provide a Secure Learning Platform for ShikaoBang Students

Additionally, research by Home Security Heroes found that out of 95,820 Deepfake online videos, 98% were categorized as pornographic content. Furthermore,


Deepfake is a technology that utilizes artificial intelligence to replace one person's face with another in images or videos. The "Deepfake" technique involves various technologies and algorithms that can generate highly realistic visuals. By combining elements of Deepfake's false content with genuine information, it can be used for identity forgery, spreading misinformation, creating fake digital content, and various forms of deception.
![2024032501.png](https://cdn.aisecurius.com/images/c74/c741d39b-04b0-4a84-b517-a4487252b3c5.png)

According to a report by KPMG, there has been a 900% increase in online-provided Deepfake videos. Additionally, research by Home Security Heroes found that out of 95,820 Deepfake online videos, 98% were categorized as pornographic content. Furthermore, 99% of these Deepfake videos featured women, with 94% of them involving individuals from the entertainment industry. A study by cybersecurity provider ESET revealed that 61% of women in the UK are concerned about becoming victims of Deepfake pornography.

A special edition o[ "DEEPFAKE Threat Study and Security Strateg" ](https://www.aisecurius.com/blog/article/55y)egy" released by the Dingxiang Defense Cloud Business Security Intelligence Center highlights that another major factor contributing to the proliferation of Deepfake is the accessibility of tools that make creating fake videos and images easier. Home Heroes' survey indicates that there are currently at least 42 user-friendly tools available for making Deepfake, with these tools being searched online tens of millions of times each month. Furtherm[with the emergence of Cybercrime-as-a-Service, ordinary individuals can easily purchase Deepfake services or technolo.](https://www.aisecurius.com/blog/article/32gy)logy.


# Security Measures: How to Prevent the Spread of AI-Generated Pornographic Videos?


Attackers employ various mediums such as social media, email, remote meetings, online recruitment, and news sources to conduct a range of Deepfake fraudulent attacks on both enterprises and individuals.

["DEEPFAKE Threat Study and Security Strateg"](https://www.aisecurius.com/blog/article/55y)egy" intelligence digest suggests that combating Deepfake fraud requires effective identification and detection of Deepfake manipulated content, as well as measures to prevent the exploitation and dissemination of Deepfake fraud. This not only demands technical countermeasures but also potentially involves complex psychological tactics and raising public awareness of safety. Additionally, regulatory bodies need to impose penalties on producers of "Deepfake" pornography.


## Individuals should take precautions to prevent the theft and replication of their information. 
Avoid sharing personal photos, voice recordings, and videos on social media platforms, minimize the disclosure of sensitive information such as account details, family members, travel schedules, and job positions, to mitigate the risk of fraudsters stealing and forging identities. In the event of identifying false Deepfake videos and images, promptly report them to social media administrators and law enforcement agencies.


## AI tools can enhance facial security usage. 
The ["European Union Artificial Intelligence Act"](https://www.aisecurius.com/blog/article/56) mandates that providers of AI tools have an obligation to design these tools in a manner that permits detection of synthetic/fake content, adding digital watermarks, and timely restricting the use of digital identity cards for identity verification purposes. The principle behind AI watermarking involves embedding unique signals into the output of artificial intelligence models, which can be images or text, aimed at identifying the content as AI-generated to aid in effective recognition by others.


## Social media platforms should restrain the dissemination of pornographic videos.
 Social media platforms typically position themselves merely as conduits for content. The Australian Competition and Consumer Commission (ACCC) believes that platforms like Facebook should be held accountable as accessories to frauds and should promptly remove Deepfake content used for fraudulent purposes.

YouTube stipulates that anyone uploading videos to the platform must disclose certain uses of synthetic media to inform viewers that what they are witnessing is not genuine, thereby reducing the fraudulent exploitation of Deepfake videos. Similarly, on Facebook, any content generated by Deepfake may display an icon clearly indicating that the content is AI-generated.


## Media services should enhance facial application security.
 The Dingxiang Comprehensive Face Security Threat Perception Solution is capable of effectively detecting and identifying false Deepfake videos and images. It conducts real-time risk monitoring for facial recognition scenarios and critical operations (such as hijacked cameras, device forgery, screen sharing, etc.), then verifies through multi-dimensional information such as facial environment monitoring, liveness recognition, image authentication, and intelligent verification. Upon discovering forged videos or abnormal facial information, it can automatically block abnormal or fraudulent operations.
![2024031903.png](https://cdn.aisecurius.com/images/e06/e06b5696-4cde-4099-bdfe-b33389a1def8.png)

## Establishing a multi-channel, full-scenario, multi-stage protection security system. 
Covering various channel platforms and business scenarios, providing security services such as threat perception, security protection, data precipitation, model construction, strategy sharing, etc., can meet different business scenarios, possess industry-specific strategies, and achieve precipitation and iteration based on its own business characteristics, enabling precise platform prevention and control, thereby effectively addressing Deepfake attacks and providing personalized protection. Dingxiang's latest upgraded anti-fraud technology and security products build a multi-channel, full-scenario, multi-stage security system for enterprises to systematically combat new threats brought by AI, including: [iOS reinforcement with adaptive confusion reinforcement, seamless verification capable of generating unlimited images, device fingerprints supporting cross-platform unified device information, and Dinsight risk control engine capable of intercepting complex attacks and uncovering potential threats.](https://www.aisecurius.com/blog/article/60)


## Regulatory bodies should strengthen penalties for the production and dissemination of Deepfake pornography.
 Imposing legal consequences on individuals who create or disseminate [Deepfake manipulated content can prevent the spread of harmful content and hold perpetrators accountable for their actions](https://www.aisecurius.com/blog/article/56). Qualifying Deepfake fraud as a criminal offense can serve as a deterrent, preventing the misuse of this technology for fraudulent or other malicious purposes. It is an effective method to mitigate the harmful impacts of Deepfake technology, and those who intentionally create or promote harmful Deepfake dissemination should be subject to criminal penalties.

Deepfake pornography troubles the UK, with 60% of women fearing becoming victims

By conducting comprehensive risk prevention and control measures before, during, and after incidents, Dingxiang aims to prevent AI threats that have formed industrialized and mature attack patterns.

On April 2nd, in the latest installment of the "Business Security Seminar," Dingxiang's data scientist, Yilong, and senior solution expert, Fengyu, delved into the current highly scrutinized AI threats and facial recognition risks, providing in-depth insights and detailed introductions to the latest anti-fraud technologies and security products aimed at combating AI threats.
![2024040209.jpg](https://cdn.aisecurius.com/images/abd/abd96723-306e-4b50-99c5-1757852a5e20.jpg)


# AI Threats: Posing New Challenges for Enterprises


In November 2023, fraudsters disguised themselves as a close friend of Mr. Guo from a certain tech company, swindling 4.3 million RMB. In December 2023, parents of a student studying abroad received a ransom video claiming their child was kidnapped, demanding a ransom of 5 million RMB. In January 2024, 19 multinational corporation employees in Hong Kong fell victim to phishing scams, resulting in a loss of 200 million HKD. In February 2024, the AI virus "GoldPickaxe" emerged, capable of stealing facial information and transferring users' bank balances...
![2024030101.png](https://cdn.aisecurius.com/images/bd5/bd5e497c-540f-4253-af1b-57048fb6bce2.png)

With the widespread application of AI, its associated security threats are increasingly drawing attention and rapidly becoming a new modus operandi, posing unprecedented risks to both enterprises and individual users. Data indicates that in 2023, fraud incidents based on "DEEPFAKE" increased by 3000%, while the number of AI-generated phishing emails grew by 1000%.

[Dingxiang's Defense Cloud Business Security Intelligence Center has released the "DEEPFAKE Threat Research and Security Strategy" ](https://www.aisecurius.com/blog/article/55)intelligence bulletin, which outlines that attackers can utilize AI to fabricate text, images, videos, and audio, creating realistic fake photos, videos, identification documents, financial accounts, statistical data, as well as generating new types of Trojan viruses, cracking account passwords, and launching automated cyber attacks. By combining AI-fabricated false content with elements of real information, attackers can spread rumors, impersonate acquaintances for telecommunications fraud, apply for bank loans under false pretenses, impersonate others for job interviews and employment, mimic logins to steal bank balances, and engage in phishing fraud.
![2024040207.png](https://cdn.aisecurius.com/images/1a9/1a987802-f054-4655-85bc-3fbea4e7821e.png)

Through a range of media platforms such as social media, email, remote meetings, online recruitment, and news outlets, and with the aid of emulators, device alteration software, IP spoofing, registration generators, and group control tools, fraudsters can conduct various types of scams.


# Defending Against AI Attacks Requires New Security Strategies


Enterprises will need to strengthen digital identity recognition, review account access permissions, and minimize data collection. Additionally, there's a need to enhance employee awareness regarding the detection of AI threats.

Multi-channel, comprehensive, multi-stage security system. Covering various platform channels and business scenarios, providing security services such as threat perception, security protection, data accumulation, model construction, and strategy sharing, capable of meeting different business scenarios, possessing industry-specific strategies, and being able to accumulate and evolve based on their own business characteristics, achieving precise platform control. This involves deploying multiple security solutions at different points in the network to protect against various threats, devising comprehensive incident response plans to effectively and swiftly respond to AI attacks, and implementing personalized protection.


## AI-driven security tool system. 
Anti-fraud systems that combine manual review with AI technology to enhance automation and efficiency in detecting and responding to AI-based cyber attacks.


## Enhanced identity authentication and protection. 
This includes enabling multi-factor authentication, encrypting data at rest and in transit, and implementing firewalls. Strengthening frequent verification for activities such as account login from remote locations, device changes, phone number changes, and sudden activity on dormant accounts, with persistent checks to ensure consistency of user identity during usage. Comparing and identifying device information, geographic location, and behavioral operations to detect and prevent abnormal activities.
![2024040206.png](https://cdn.aisecurius.com/images/9ce/9cec24d7-8246-4d6d-9e55-57af93c5dd34.png)

## Principle of least privilege for account authorization.
 Restricting access to sensitive systems and accounts based on the principle of least privilege to ensure access to resources required by their roles, thereby reducing the potential impact of account hijacking and preventing unauthorized access to your systems and data.


## Continuous understanding of the latest technology and threats.
 Keeping abreast of the latest developments in AI technology to adjust security measures accordingly. Continuous research, development, and updating of AI models are crucial to maintaining a leading position in the increasingly complex security landscape.


## Continuous security education and training for employees.
 Ongoing training on AI technology and its associated risks, using methods such as simulated attacks, vulnerability discovery, and security training to help employees identify and avoid AI attacks and other social engineering risks. Maintaining vigilance and promptly reporting anomalies significantly enhances an organization's ability to detect and respond to deepfake threats.

To mitigate AI-based threats, it's necessary to effectively identify and detect AI threats while also preventing the exploitation and proliferation of AI fraud. This requires not only technological countermeasures but also complex psychological warfare and the enhancement of public safety awareness.


# Dingxiang: Full Product Line Upgrade to Combat AI Threats


In this live broadcast, Dingxiang's data scientist, Yilong, and senior solution expert, Fengyu, provided detailed insights into Dingxiang's latest upgraded anti-fraud technology and security products, aimed at systematically combating new threats posed by AI: adaptive obfuscation strengthening for iOS, seamless verification capable of generating infinite images, device fingerprinting supporting unified device information across platforms, Dinsight risk control engine capable of intercepting complex attacks and uncovering potential threats, and Dingxiang's comprehensive panoramic facial security threat perception solution tailored to address "DEEPFAKE" risks. These enhancements aim to establish a multi-channel, comprehensive, multi-stage security system for enterprises.
![2024040204.png](https://cdn.aisecurius.com/images/84e/84e46951-2573-4065-97a9-fee5bcf93f1b.png)
## Safeguarding App Security to Prevent Automated AI Hacking.
ing. Dingxiang's adaptive iOS reinforcement, based on graph neural network technology, analyzes and extracts code features to automatically select appropriate obfuscation methods based on different code blocks, significantly increasing the difficulty of reverse engineering and reducing computational performance consumption by 50%. Through encryption and obfuscation engines, App code is encrypted, obfuscated, and compressed to greatly enhance code security, effectively preventing attacks such as cracking, duplication, and repackaging.


## Ensuring Account Security to Prevent Malicious AI Registration and Login Attempts.
 Dingxiang's atbCAPTCHA, based on AIGC technology, prevents AI brute force attacks, automated attacks, and phishing attacks, effectively preventing unauthorized access, account hijacking, and malicious operations, thus protecting system stability. It integrates 13 verification methods and multiple prevention and control strategies, aggregating 4380 risk policies, 112 types of risk intelligence, covering 24 industries and 118 risk types. With a precision control rate of up to 99.9%, it enables rapid transformation from risk to intelligence. It also supports seamless verification for secure users, with real-time response and disposition capabilities within 60 seconds, further improving the convenience and efficiency of digital login services.


## Identifying AI-fabricated Devices to Prevent Malicious AI Frauds.
 Dingxiang Device Fingerprinting generates unified and unique device fingerprints for each device by integrating internal information from multiple devices. It builds multi-dimensional recognition strategy models based on device, environment, and behavior to identify risks such as virtual machines, proxy servers, and manipulated simulators. By analyzing whether devices exhibit abnormal behaviors or deviations from user habits, it tracks and identifies fraudulent activities to help enterprises achieve unified operation of the same ID across all scenarios and channels, facilitating cross-channel risk identification and management.

## 
Uncovering Potential Fraud Threats to Prevent Complex AI Attacks. 
Dingxiang Dinsight assists enterprises in risk assessment, anti-fraud analysis, and real-time monitoring to enhance risk control efficiency and accuracy. Dinsight's average processing speed for daily risk control strategies is less than 100 milliseconds, supporting configurable access and accumulation of data from multiple sources. It utilizes mature metrics, strategies, and model experience reserves, along with deep learning technology, to achieve self-performance monitoring and iterative risk control mechanisms. Paired with the Xintell intelligent model platform, it automatically optimizes security policies for known risks and configures different scene support risk control strategies based on risk control logs and potential risk data mining. With its standardized data processing, mining, and machine learning processes based on associative networks and deep learning technology, it provides a one-stop modeling service from data processing, feature derivation, model construction to final model deployment.


## Intercepting "DEEPFAKE" Attacks to Ensure Facial Application Security. 
Dingxiang's comprehensive panoramic facial security threat perception solution intelligently verifies multiple dimensions of information such as device environment, facial information, image authentication, user behavior, and interaction status. It rapidly identifies over 30 types of malicious attacks including injection attacks, live forgery, image forgery, camera hijacking, debugging risks, memory tampering, Root/jailbreak, malicious Rom, simulators, and system operation risks. Upon detecting forged videos, fake facial images, or abnormal interactions, it automatically blocks operations. It can flexibly configure video verification strength and user-friendliness to achieve seamless verification for normal users and dynamically strengthen verification for abnormal users.

By conducting comprehensive risk prevention and control measures before, during, and after incidents, Dingxiang aims to prevent AI threats that have formed industrialized and mature attack patterns.


Dingxiang: Full Product Line Upgrade to Combat AI Threats

overseas game apps face many security risks, such as account theft, password leakage, in-game payment fraud, and unauthorized charges. The leakage and loss of player personal information and game data are also issues that cannot be ignored.

According to an industry analysis report, the global mobile game market size is expected to reach $116.4 billion in 2023, of which overseas markets account for nearly 70%. In overseas markets, mature markets such as the United States, Japan, and South Korea are still the main sources of revenue, while emerging markets such as Southeast Asia, the Middle East, and Latin America are growing rapidly.
![2024033102.png](https://cdn.aisecurius.com/images/53a/53ab9033-398f-4008-824d-9b6e830d0685.png)

Medium and heavy games are performing strongly overseas, with strategy, role-playing, and shooting games being popular. Casual games are popular with players, but the market competition is fierce. High-quality games are more popular, and the excellence in game content, gameplay, art, and other aspects has become key.

To stand out in the highly competitive overseas game market, game products need to be competitive enough. It is crucial to carry out differentiated operations and localization adjustments for players with different regional, language, and cultural backgrounds. At the same time, using data analysis tools to understand player behavior and needs and optimize the game experience is also key to success.
![2024033103.jpg](https://cdn.aisecurius.com/images/e8a/e8a136cb-c6d7-4156-9a6f-62a66ceb008c.jpg)
However, overseas game apps face many security risks, such as account theft, password leakage, in-game payment fraud, and unauthorized charges. The leakage and loss of player personal information and game data are also issues that cannot be ignored.

Shenzhen Tiantianwan Company, as a professional overseas mobile game publisher, is committed to providing professional operation services for a wide range of game manufacturers. The company is based on products, with operation as the core and service as the purpose. It has a complete distribution process and working mode.

To ensure App security and improve App developer efficiency, Tiantianwan Company has configured Dingxiang App Security for its distributed games. This reinforcement technology can perform security checks on existing applications, discover and fix risk vulnerabilities in applications, and protect sensitive data, code obfuscation, code integrity, memory data, etc. It can prevent system vulnerabilities from affecting application security from the source and effectively prevent data information from leaking. After App security, the machine audit pass rate is increased, attracting more players to download.

Through Dingxiang App Security technology, Tiantianwan Company has provided solid security guarantees for overseas game operations, helping game developers achieve greater success in overseas markets. It provides a solid security guarantee for overseas game operations and provides comprehensive operation support for game manufacturers, providing strong support for improving the competitiveness and market share of game products.

App Security Empowers Overseas Game Operations

Commercial Espionage: The Full Process of Impersonating a Job Seeker in an Interview

July 2022,  the U.S. Federal Bureau of Investigation's Internet Crime Complaint Center (IC3) issued a new public service  announcement warning that scammers are increasingly using "deepfake" technology to impersonate job seekers in remote job  interviews, defrauding companies of payroll and stealing their trade secrets.
![2024031806.png](https://cdn.aisecurius.com/images/4fd/4fd34d1a-175b-4bce-a775-d9277239f31a.png)

The COVID-19 pandemic has driven the popularity of remote work. According to statistics, as of 2022, approximately 35% of people can work remotely full-time.  The rise of remote work has brought many benefits to employers  and employees.  However, it has also created opportunities for fraudsters to exploit.


# Commercial Espionage: The Full Process of Impersonating a Job Seeker in an Interview


From posting fake job postings to using "deepfake" technology to fake interviews,  to finally impersonating others to get hired, scammers have orchestrated a detailed fraud process.

![2024031807.png](https://cdn.aisecurius.com/images/7af/7afd55df-f839-42dc-b0d3-d3a99af80805.png)

First, scammers will cleverly post fake job postings on recruitment websites,  using them as bait to attract real job seekers to apply for their resumes.  This step is key for them to collect  information on real job seekers.

Next,  scammers will cleverly disguise themselves as job seekers and submit these fake resumes to real companies' job openings.   Their goal is to deceive the company's initial screening and get an interview opportunity.

Once they successfully pass the resume screening and receive an interview notification,  the scammers will use "deepfake" technology to precisely superimpose the job seeker's face onto their own,  so that the virtual interviewee's actions and lip movements perfectly match the speaker's audio.  Even coughing,  sneezing, or other subtle auditory actions can be precisely aligned with the visual content,  creating the appearance of a seemingly real interviewee that passes the company's remote interview.

Through such a well-designed fraud process, scammers successfully enter the company as job seekers.


# Commercial Espionage: The Harm to Enterprises


The FBI did not specify the ultimate goal of the scammers in the announcement. However, the agency pointed out that these fake job seekers, once successfully interviewed and hired, will be allowed to access sensitive data such as "company personal identifiable information, financial data, company IT databases and/or proprietary information".

![2024031808.png](https://cdn.aisecurius.com/images/3de/3de1aed9-6bd5-4332-9fe6-3f56033fbcea.png)


## Stealing confidential company information. 
Once scammers are successfully employed, they may gain access to key confidential business information such as new products, confidential technologies, password accounts, and database information, and they can sell or leak this information at any time, causing huge financial losses to the company. For example, in the financial industry, data is usually heavily protected and can be difficult to access through traditional scams, but security or IT positions can access it directly.


## Increase the company's recruitment costs.
 When a company discovers that it has hired a fake job seeker, it not only needs to immediately dismiss the current imposter, but also needs to quickly start a new recruitment process to find a suitable replacement. This not only leads to a loss of salary, but also increases the time cost of recruitment and employment. Moreover, the re-recruitment process itself can be very expensive, and the longer it takes to find new candidates, the greater the loss to the company.


## Conduct internal sabotage on the company. 
Using traditional methods to install ransomware or shut down systems can be time-consuming and labor-intensive for scammers. However, once they successfully enter the target company by impersonating a job seeker, they can exploit security vulnerabilities in the company's system to install malware on the intranet and office system at any time.


## Impersonating others for background checks. 
The FBI pointed out that some victims reported that their personal information was stolen and used for pre-employment background checks on other job seekers. This suggests that scammers may use the stolen personal information to impersonate the victim to accept the investigation of the employer or background check agency. They will attempt to provide false or tampered information to deceive investigators in order to obtain the opportunity to pass the background check. Companies may make inappropriate hiring decisions based on false background check results, and other honest job seekers may lose the opportunity to compete fairly.


## Affect the company's brand reputation. 
The fraudulent behavior of impersonating others to enter the company can also cause serious damage to the company's reputation and trust. Customers and partners may have doubts about the company's security management capabilities, which may affect business cooperation and market competitiveness.


# How HR Can Identify Fake Job Seekers

The Dingxiang Defense Cloud Business Security Intelligence Center released a special intelligence report "Research on  "DEEPFAKE" Threats and Security Strategies" (free download),  which systematically introduces the composition of "DEEPFAKE" threats, the harm of "DEEPFAKE", Which systematically introduces the composition of "deepfake" threats, the harm of "deepfake ", the process of "AI face-changing" fraud, typical threat patterns, the chain behind it, the current mainstream identification and detection strategies,  regulatory regulations of various countries on "DEEPFAKE",  and the responsibilities that each party needs to bear in "DEEPFAKE" fraud cases.

In response to the threat of being impersonated in remote interviews,  [the Dingxiang Defense Cloud Business Security Intelligence Center recommends that companies can adopt multiple  technologies and methods.](https://www.aisecurius.com/blog/article/55)


## 1. Identification of "DEEPFAKE" fraudulent videos


(1) During video interviews,  the other party can be asked to press their nose and face to observe the changes in their face. If it is a real person's  nose,  it will deform when pressed. The other party can also be asked to eat food and drink water to observe the changes in  their face. Alternatively, ask them to do some strange actions or expressions, such as waving,  making a difficult gesture, etc., to distinguish the truth from the false. During the waving process,  the data of the face will be interfered, which will produce certain jitter, flicker, or some abnormal situations.

(2) "DEEPFAKE" can copy voices, but it may also contain unnatural tones, rhythms,  or subtle distortions that will be particularly noticeable after careful listening. At the same time,  voice analysis software can help identify voice abnormalities.

(3) The generative adversarial network (GAN) based on deep learning can train a neural network model called  "discriminator". Through training,  the "discriminator" can more accurately identify fake images. The goal is to distinguish real from fake image videos and  identify any differences between the real version and the created version.

## 
2. Prevention of "DEEPFAKE" utilization


(1) By comparing and identifying device information, geographic location, and behavioral operations,  abnormal operations can be detected and prevented. Dingxiang device fingerprint can identify legitimate users and  potential fraudulent behaviors by recording and comparing device fingerprints. Its technology uniquely identifies and  identifies each device, identifies virtual machines, proxy servers, emulators and other maliciously controlled devices,  analyzes whether the device has abnormal behaviors such as multiple account logins, frequent IP address changes,  and frequent device attribute changes, and helps Track and identify fraudulent activity.

(2) Frequent verification is required for account logins in different places, device changes,  mobile phone number changes, dormant account activation, etc. In addition,  continuous identity verification during the session is crucial,  and persistent checks should be maintained to ensure that the user's identity remains consistent during use. Dingxiang's  frictionless verification can quickly and accurately distinguish whether the operator is a human or a machine,  accurately identify fraudulent behavior, and monitor and intercept abnormal behavior in real time.
![2024031903.png](https://cdn.aisecurius.com/images/e06/e06b5696-4cde-4099-bdfe-b33389a1def8.png)

(3) Face anti-fraud system based on AI technology and artificial review to prevent fake videos and pictures of  "DEEPFAKE". Dingxiang's full-link panoramic face security threat perception solution conducts real-time risk monitoring  of face recognition scenarios and key operations (such as camera hijacking, device counterfeiting, screen sharing,  etc.), and then performs face environment monitoring, liveness detection, image authentication,  and intelligent verification. After verifying multiple dimensions of information,  if forged videos or abnormal face information are found,  abnormal or fraudulent operations can be automatically interrupted.

On-site interviews are an effective way to prevent fraud by impersonating others. Arrange on-site interviews as much as  possible to communicate with job seekers face-to-face and better observe their words and deeds and their real situation.  However, if on-site interviews are not possible,  we can ask in-depth and specific questions during the interview. These questions may be difficult for scammers to  answer, or may take a long time to think about and respond. In this way,  companies can better identify the true abilities and background of job seekers.


Commercial Espionage: Using "Deepfake" Technology to Infiltrate Your Company

The digital wave is surging,  and traditional business models are facing unprecedented challenges and opportunities. In this digital age,

The digital wave is surging,  and traditional business models are facing unprecedented challenges and opportunities. In this digital age,  the key for businesses and merchants to expand sales channels and seize market share is to accurately locate customer  groups and adopt appropriate advertising channels and marketing methods. This way,  they can achieve twice the result with half the effort, winning more new customers at a lower cost.

The "Smart Life" platform, with the help of the "production + supply + sales" integrated digital consumption system,  helps merchants expand sales channels and promote efficient and convenient transactions. Through various digital tools,  the platform helps merchants achieve data precipitation and repurchase conversion,  and further flows back to online and offline, realizing multi-channel sales conversion and scene re-reach,  forming a virtuous cycle of closed-loop ecosystem with strong "blood-making" ability.

The "Smart Life" platform provides a variety of services, including food, desserts, drinks, daily necessities,  personal care, health care products and medicines. Through the diversified physical and online business formats,  the platform has established a wider intersection with consumers,  promoting the rapid expansion of the product side and channels to meet the needs of consumers in more regions.

The "Smart Life" platform is built on H5,  which can achieve good cross-platform adaptation. It can be seamlessly embedded in App, mini program,  or it can be opened directly on PC end as a page with independent link address. However,  while H5 brings convenience to users, it also brings many business risks to enterprises, such as information leakage,  account cracking, collecting wool, etc. According to the data of Dingxiang Defense Cloud Business Security Intelligence Center, in the attack of malicious crawler stealing data, H5 pages account for 46% of the total attack volume,  mini program accounts for 29%, Web end accounts for 18%, App end accounts for 5%, and other platforms account for 2%.

In order to prevent network crawler risks and ensure user account security,  the "Smart Life" platform is equipped with Dingxiang atbCAPTCHA code,  which is used for the registration and login verification of various services,  so as to ensure the security of the pl![2024032101.jpg](https://cdn.aisecurius.com/images/b63/b63730ca-f154-4c68-9339-fc3b3e3bebfa.jpg)atform.

The verification code can effectively prevent automated programs from maliciously registering, batch login attempts,  and malicious attacks during registration,  login and password retrieval. It ensures that the users who try to perform these operations are real human users,  not malicious programs or hackers. At the same time, by requiring users to enter the verification code,  it increases the difficulty of the account being cracked or stolen. Remind users to pay attention to account security  and enhance users' trust in the platform.

atbCAPTCHA, as one of Dingxiang Defense Cloud modules,  is an effective way to distinguish human users from automated robots. By requiring users to enter the verification code  when registering or logging in,  it can ensure that the account and password entered by the user are not obtained by malicious means,  thus effectively preventing unauthorized access and attacks. atbCAPTCHA can not only prevent malicious users or  advertisers from entering a large amount of spam information or abusing the registration and login window through  automated means, effectively blocking malicious crawlers from misappropriating and stealing data,  but also in the registration, login, query and other key links, real-time verification,  judgment and interception of malicious accounts and malicious crawling behaviors.

The "Smart Life" platform is launched by Shushang Cloud,  which mainly provides enterprises with full-chain digital operation services such as supply chain, supplier,  procurement, channel distribution, B2B e-commerce system development, etc. Through technical data,  it helps enterprises achieve digital transformation and create digital value, and meet the challenges of the times. of the times.

atbCAPTCHA Secures the "Smart Life" Platform

they were arrested by the Miami-Dade Police Department on charges of making nude photos of their classmates using "DEEPFAKE" technology.

On December 6, 2023, two students from Pinecrest Cove Academy in Miami, Florida, USA, were suspended. A few days later, on December 22, they were arrested by the Miami-Dade Police Department on charges of making nude photos of their classmates using "DEEPFAKE" technology.
According to information released by the police, the two 13- and 14-year-old middle school boys were accused of using an unnamed "artificial intelligence application" to generate nude images of other students aged 12 to 13.
According to a law passed in Florida in 2022, they were charged with a third-degree felony for transmitting pornographic images of "DEEPFAKE" without the victim's consent.
Media reports suggest that this case may be the first criminal case in the United States involving AI-generated nude images.
[The Dingxiang Defense Cloud Business Security Intelligence Center released the "Research on "Deepfake" Threats and Security Strategies", ](https://www.aisecurius.com/blog/article/55)which specifically mentioned that by imposing legal consequences on individuals who create or distribute deepfakes, the spread of harmful content can be prevented and those responsible for their actions can be held accountable. Criminalizing deepfake fraud can have a deterrent effect and prevent the abuse of this technology for fraud or other malicious purposes. It is an effective way to mitigate the harmful effects of deepfake technology and those who intentionally create or facilitate the spread of harmful deepfakes must be subject to criminal penalties.

# EU's AI Act: Strengthening Regulation on "DEEPFAKE"


The governance of artificial intelligence (AI) is crucial to the future of humanity, and it is a common challenge faced by countries worldwide. Many countries and organizations have introduced initiatives or regulations, unanimously calling for strengthened security oversight of AI. Therefore, it is necessary for countries to implement strong legal measures to address this urgent challenge.
![2024031901.png](https://cdn.aisecurius.com/images/69d/69d38348-a893-4e01-b046-8b89ab710862.png)
On March 13 local time, the European Parliament officially voted and approved the Artificial Intelligence Act (AIA), aiming to strictly regulate the use of AI. It is expected to come into effect in early 2025 and be implemented in 2026, with some provisions taking effect earlier. The draft of the AI Act was first proposed by the European Commission in April 2021. The Act will regulate high-impact, general-purpose AI models, and high-risk AI systems, which must comply with specific transparency obligations and EU copyright law.
Regarding high-risk AI systems, the AI Act formulates a series of safety provisions and requirements, mainly including the following four aspects.

## Data governance:
 Ensure the legality, fairness, and security of data collection, processing, and use. Data subjects enjoy rights such as data access, correction, deletion, and restriction of processing.

## Risk assessment: 
Developers must conduct risk assessments to identify and mitigate potential risks posed by AI systems. The risk assessment must cover aspects such as the accuracy, reliability, security, fairness, and privacy protection of the AI system.

## Transparency: 
Provide information about the functionality, performance, and risks of AI systems to enable users to make informed choices. The information must be presented to users in a clear and understandable manner.

## Human-machine interaction: 
Be designed for human-machine interaction to ensure that users can understand and control the behavior of the AI system. Users must be able to terminate the operation of the AI system at any time.

![2024031902.png](https://cdn.aisecurius.com/images/b4e/b4e26b43-ecf6-434a-b6e6-c30670fcc732.png)
The AI Act also requires that AI providers establish effective supervision and accountability mechanisms to ensure the safe and reliable operation of AI systems. Developers and users must be held responsible for any harm caused by AI systems. Penalties for violations of the regulations can reach up to 6% of the global turnover of the illegal act or 30 million euros, whichever is higher.


# Countries: Strengthening the Security Regulation of "DEEPFAKE"


"DEEPFAKE" involves a variety of technologies and algorithms,  which can work together to generate highly realistic images or videos. By piecing together the false content of  "DEEPFAKE" with the elements of real information, it can be used to forge identities, spread misinformation,  create false digital content, and engage in various frauds. This is a threat in the digital age,  where attackers are unseen and elusive. They not only create information but also manipulate the reality structure  perceived by each participant. Therefore,  using laws to regulate the abuse of "DEEPFAKE" is a unified action of all countries.
As early as November 2022, the Cyberspace Administration of China, the Ministry of Industry and Information Technology,  and the Ministry of Public Security jointly issued the "Regulations on the Management of Deep Synthesis of Internet  Information Services,"  which formulated a series of regulations and requirements for deep synthesis fraud. For deep-synthesized information  such as intelligent dialogue, synthetic voices, facial generation, facial replacement, facial manipulation,  virtual characters, and virtual scenes,  it is required to be significantly labeled to avoid public confusion or misunderstanding. At the same time,  the content of deep-synthesized information should be true and accurate,  and deep-synthesized information should not be used to create fake news, distort the truth,  mislead the public's perception, or damage the legitimate rights and interests of others.
On March 1, 2024,  the National Cybersecurity Standardization Technical Committee released the "Basic Requirements for the Security of  Generated AI Services,"  which clarified the basic requirements for the security of generated AI services, including language material security,  model security, and security measures. In terms of language material content security,  service providers need to focus on three aspects:  language material content filtering, intellectual property rights,  and personal information. In terms of personal information,  it emphasizes that before using language materials containing sensitive personal information,  the corresponding individual's separate consent or compliance with other circumstances stipulated by laws and  administrative regulations should be obtained.
On February 8, 2024,  the US Federal Communications Commission announced that AI-generated voices in robocalls were illegal,  and legislators in various states had already introduced legislation to combat AI- generating false and incorrect information.


# Technology: Preventing "DEEPFAKE" fraud

To combat "DEEPFAKE" fraud, in addition to legal regulations, technical identification and defense are also required:  [on the one hand, it is necessary to identify and detect forged videos, pictures,  and information (effectively identifying out false and forged content); on the other hand,  it is necessary to identify and detect the channels and platforms used for "DEEPFAKE" fraud (improve the security of  digital accounts in multiple ways).](https://www.aisecurius.com/blog/article/55)

## Enhance facial information security

The "EU AI Act" requires providers of AI tools to design these tools in such a way as to allow the detection of  synthetic/false content, add digital watermarks,  and promptly restrict the use of digital IDs for verifying personal identities. The working principle of AI watermarking  is to embed a unique signal into the output of the artificial intelligence model, which can be an image or text,  aiming to identify the content as AI-generated content to help others identify it effectively.
In addition, digital signatures and blockchain ledgers have uniqueness,  which can be used to track the source of behavior and mark it for review. Their immutability means that they can be used  to detect any tampering with the original file by using hash functions to ensure the authenticity of digital content.  Key functions such as timestamps and traceability can be used to determine the source and time of content creation. Of  course, these data are operated in a secure environment called Trusted Executive Environment (TEE).

## Identify forged false information

Based on deep learning,  generative adversarial networks (GANs) can train a neural network model called "discriminator". Through training,  the "discriminator" can more accurately identify the target of false images to distinguish between real and false images  and videos, and identify any differences between the real version and the created version.
In addition,  big data models can quickly analyze large amounts of audio data to identify "DEEPFAKE" audio content. For example,  Prisa Media, a Spanish media giant, has launched a tool called VerificAudio,  which can identify real and forged voices in Spanish for the detection of "DEEPFAKE" audio. The tool is currently  available to newsrooms in Mexico, Chile, Colombia, and Spain,  and is working to roll it out to journalists around the world.

## Ensure the security of face application

Based on AI technology and artificial review,  face anti-fraud systems can prevent the use of false videos and false images from "DEEPFAKE". Dingxiang's full-link  panoramic face security threat perception solution can effectively detect and identify false videos and false images  from "DEEPFAKE". It can monitor real-time risks in face recognition scenarios and key operations (such as camera  hijacking, device forgery, screen sharing, etc.),  and then verify and identify through multi-dimensional information such as face environment monitoring, live detection,  image authentication, and intelligent verification,  and automatically block abnormal or fraudulent operations after discovering forged videos or abnormal face information.
![2024031903.png](https://cdn.aisecurius.com/images/e06/e06b5696-4cde-4099-bdfe-b33389a1def8.png)
By comparing and identifying device information, geographical location, and behavior operations,  it is possible to detect and prevent abnormal operations from "DEEPFAKE" fraud. Dingxiang's device fingerprint  technology can record and compare device fingerprints to identify virtual machines, proxy servers, simulators, and other devices that are maliciously manipulated,  and analyze whether there are abnormal or inconsistent behaviors that do not conform to user habits,  such as multi-account logins, frequent IP address changes, frequent device attribute changes, etc.,  to help track and identify the activities of fraudsters.

## Ensure the security of content distribution channels

Social media platforms usually position themselves as merely channels for content,  and the Australian Competition and Consumer Commission (ACCC) is suing Facebook. The ACCC also believes that Facebook  should be held responsible as an accessory to fraud - because it failed to remove misleading advertisements in a timely  manner after receiving a notice of a problem. At least,  platforms should be responsible for promptly deleting deep-fake content for fraudulent purposes. Many platforms have  claimed to be doing so, for example, on Facebook,  any AI-generated content may display an icon clearly indicating that the content was generated by artificial  intelligence.
Social media companies have the greatest influence in restricting the spread of false content and can detect and remove  it from their platforms. However, the policies of major platforms, including Facebook, YouTube, and TikTok,  stipulate that they will only delete fraudulent content if it causes "serious harm" to people.

13-Year-Old Middle School Student Arrested on Charges of Creating Fake Pornographic Photos of Classmates Using AI Technology

Dingxiang Defense Cloud Business Security Intelligence Center has recently released an intelligence monograph entitled  "Research on "Deepfake" Threats and Security Strategies", 

Dingxiang Defense Cloud Business Security Intelligence Center has recently released an intelligence monograph entitled  ["Research on "Deepfake" Threats and Security Strategies", ](https://cdn.aisecurius.com/files/764/%E3%80%8AResearch%20on%20Deepfake%20Threats%20and%20Security%20Strategies%E3%80%8B%E8%8B%B1%E6%96%870313.pdf) 

![2024031204.jpg](https://cdn.aisecurius.com/images/3d5/3d57849d-f5df-4638-9af1-548f1434b1f7.jpg)

![2024031205.jpg](https://cdn.aisecurius.com/images/a7d/a7df2f97-bcaf-4a48-aba2-9a4e9a4342fb.jpg)

which conducts an in-depth study of the currently highly concerned "Deepfake" risks. The monograph consists of 8 chapters and 32 sections, systematically introducing the composition of "Deepfake" threats, the harms of "Deepfake",  the process of "Deepfake" fraud, typical "Deepfake" threat patterns, the industry chain behind "Deepfake",  the current mainstream "Deepfake" identification and detection strategies,  regulatory regulations of various countries on "Deepfake",  and the responsibilities that each party needs to bear in "Deepfake" fraud cases.

[Click to Read the Full Intelligence Report of "Research on "Deepfake" Threats and Security Strategies"](https://cdn.aisecurius.com/files/764/%E3%80%8AResearch%20on%20Deepfake%20Threats%20and%20Security%20Strategies%E3%80%8B%E8%8B%B1%E6%96%870313.pdf)。

# Fraud: 6 Common Types of "Deepfake" Fraud


##  1、Fake accounts to spread rumors


 With "Deepfake" technology, fraudsters are able to create and distribute highly customized and convincing content that can target individuals based on their online behavior, preferences, and social networks and can be seamlessly integrated into user feeds, facilitating rapid and widespread dissemination. This makes cybercrime more efficient and challenging for users and platforms.

Identifying fake accounts for "Deepfake" is a challenging task because they often involve combinations of real elements (such as real addresses) and fabricated information. This makes detection and prevention extremely difficult. The detection effort is further complicated by using legitimate components and false details. Moreover, because these fraud sexual identities lack a previous credit record or associated suspicious activity, it is difficult to identify them through a conventional fraud detection system.

![2024030802.png](https://cdn.aisecurius.com/images/c46/c46e4bd4-35a7-4774-a59e-d10fbfa069ef.png)

## 2、posing as acquaintances to commit fraud


 In January 2024, employees of Hong Kong multinational companies were cheated of HK $200 million, and the fraud cases reported by police in Baotou, Inner Mongolia in November 2023 were both fake acquaintances.

The "Deepfake" technology allows fraudsters to easily imitate the video and voice of the target person. These fake video and audio can imitate not only sound, but also intonation, accent and speaking style. In order to further increase the credibility of the fraud, the fraudsters will also obtain the sensitive information of the victims (such as work style, living habits, travel trends, etc., etc.) on social media and public channels, to prove the authenticity of their imposter identity, making it difficult for the victims to distinguish the truth from the false. After obtaining the trust of the victim, and then to the victim of financial funds, trade secrets and other fraud.


## 3、Fake your identity to apply for bank loans



 According to the McKinsey Institute, synthetic identity fraud has become the fastest growing type of financial crime in the United States and is on the rise globally. Indeed, synthetic identity fraud, accounts for 85% of all current fraud behaviors. Moreover, the UK GDG study shows that more than 8.6 million people in the UK use false or other identities to obtain goods, services or credit.

 For financial institutions, the "Deepfake" fraud is even more worrying.scammers use "Deepfake" technology to fake information, sounds, videos, pictures, and then combine real and false identity information to create new false identities to open bank accounts or make fraud purchases. What's more, fraudsters can use the "Deepfake" technology to learn different banking businesses and processes, and then quickly launch a fraud on different banks at the same time.

In the future, the bank for the user's credit application, perhaps not only to evaluate " he / she is suitable for credit 100,000? Or $200,000?", also need to tell" this loan applicant is human? Or Artificial intelligence?", 92% of banks are expected to face a" Deepfake " fraud threat.


## 4、Make "phishing" even more difficult to identify


 Phishing has long been a prominent topic in security, and despite such forms of fraud for decades, it is still one of the most effective ways for fraud to attack or penetrate organizations. Fraudsters based on social engineering principle, by email, website, and phone calls, SMS and social media, using human nature (such as impulse, discontent, curiosity), as trusted entities, induce the victims click on false links, download malicious software, induced transfer funds, provide sensitive data such as account password behavior.

With the development of technology, Internet telephers are also changing their strategies, especially with the help of AI, where fraudsters use "Deepfake" technology to deceive victims, making phishing attacks more complex and extremely difficult to detect. In 2023, the deep forgery phishing fraud incidents surged by 3,000%.


## 5、pretend to be others remote interview entry


In July 2022, the FEDERAL Bureau of Investigation (FBI) warned that a growing number of fraudsters are using "Deepfake" technology to pose as job seekers in remote job interviews to defraud salaries and steal business secrets.


 The FBI did not specify the ultimate goal. But the agency noted that the fake interviewers, if successful and hired, will be allowed to successfully access sensitive data such as "customer PII (personal identity information), financial data, corporate IT database and / or proprietary information."

![2024031001.jpg](https://cdn.aisecurius.com/images/2e3/2e32efb4-ea58-4ad5-803d-854724efa040.jpg)

The FBI also said stolen personal information from some of the victims of the scam had been used to conduct remote interviews and had been used to conduct pre-employment background checks with other applicants' profiles.


## 6、fake login to steal the bank balance


On February 15,2024, the foreign security company Group-IB announced that it had found a malware named "GoldPickaxe". The iOS version of the malware lured users into face recognition, submitting identity documents, and then making deep forgery based on the user's face information.

Through the deeply forged fake face video, fraud molecules can log in the user's bank account, intercept the mobile phone verification message sent by the bank, and can transfer money, consume, change the account password, etc.


# Process: The "Deepfake" Deception Process Consists of Four Main Steps


 With Dingxiang defense cloud business security intelligence center to intercept a "Deepfake" financial fraud cases, for example, fraud molecules fraud process mainly has four stages, "Deepfake" technology is just a key factor in the process of fraud link, other links, the victim if unable to identify and judgment, it is easy to fraud molecular instructions step by step into the trap.

![2024030805.jpg](https://cdn.aisecurius.com/images/5fd/5fd2b3ee-9bd5-49db-8a42-9813f8d2767e.jpg)


##  The first stage, to cheat the victim's trust. 
Fraudsters contact the victim through text messages, social tools, social media, phone calls, etc., etc. (for example, can directly tell the name of the victim's name, home, phone, unit, address, ID number, colleagues or partners, or even some experiences) and gain trust.

 
## The second stage, steal the victim's face. 
Fraudsters make video calls with victims through social networking tools, video conferences, video calls, and other methods. During the video call, they obtain the victim's face information (face, bow, turning, mouth, blink and other key information) to make "Deepfake" fake videos and portrait production. During this period, victims will also be induced to set up phone call transfer or induce victims to download malicious App software, which can call transfer or intercept the bank's customer service phone or phone.


##  The third stage, log in to the victim's bank account. 
The fraudsters log in the victim's bank account through the bank App, submit the fake videos and fake portraits made by "Deepfake", pass the bank's face recognition authentication, and intercept the mobile phone SMS verification code and risk tips sent by the bank on the victim's mobile phone.


## The fourth stage, transfer the victim's bank balance.
 The bank calls the manual access phone call to the virtual number set by the fraudsters, posing as the victim, through the manual verification of the bank customer service staff, and finally successfully transferred the balance of the victim's bank card.


"Deepfake" danger is not only to generate false video and images, but also contributed to the whole fraud ecosystem: a robot, false accounts and anonymous service of intricate network operation, all of these are designed to make, enlarge and distribute fabricated information and content, with difficult identification, detection and traceability problems.

 Identification is difficult. Has developed to the point of convincingly generating realistic personal simulations, making it increasingly difficult to distinguish between true and false content to identify unless specifically trained, realizing that this threat is the first step in defending against it.

 Detection is difficult. To improve the quality of "Deepfake", detection is a big problem. Not only the naked eye can not effectively identify, some conventional detection tools can not be found in time.

 Traceability is difficult. There is no digital fingerprint, simulator forged address, false IP address, false device information, no clear digital clues to follow, or even no direct malicious software signature that can be detected, and traditional network security measures cannot effectively protect them.

It is a form of threat in the digital age, in which attackers are invisible and elusive, who not only produce information but also manipulate the realistic structure perceived by each participant. Therefore, to combat "Deepfake" fraud, on the one hand, it needs to identify and detect fake videos, pictures and information (effectively identify fake content); on the other hand, it is necessary to identify and detect "Deepfake" mode channels and platform networks (to improve the security of digital accounts in many aspects). This requires not only technical countermeasures, but also complex psychological warfare and the promotion of public safety awareness.
sychological warfare and the promotion of public safety awareness.

[Click to Read the Full Intelligence Report of "Research on "Deepfake" Threats and Security Strategies"](https://cdn.aisecurius.com/files/764/%E3%80%8AResearch%20on%20Deepfake%20Threats%20and%20Security%20Strategies%E3%80%8B%E8%8B%B1%E6%96%870313.pdf)。

First! Dingxiang Releases "Research on "Deepfake" Threats and Security Strategies"

Furthermore, foreign darknet marketplaces offer dedicated channels and groups for deepfakes, ranging from self-creation tools to personalized services. 

*This excerpt is from DingXiang Defense Cloud Business Security Intelligence Center's white paper on "deepfakes," which are highly realistic synthetic videos or audios used for malicious purposes. If you're interested in learning more, you can contact marketing@dingxiang-inc.com to receive a free electronic copy upon completion.*


Deepfakes pose a significant threat, enabling criminals to steal identities, spread misinformation, and create fake content for malicious purposes. Real-world examples include:

January 2024:[ Employees of a multinational company in Hong Kong lost HK$200 million due to phishing fraud involving deepfakes](https://www.aisecurius.com/blog/article/50).
December 2023: [An overseas student's parents were tricked into paying a 5 million yuan ransom after receiving a deepfake video depicting their child's "kidnapping."](https://www.aisecurius.com/blog/article/47)


A KPMG report reveals a staggering 900% year-on-year increase in the number of deepfakes available online. Notably, bandeepfakes reports that nearly all deepfakes (98%) are pornographic and target women.


# Investigating the Deepfake Industry Chain


According to a new report by iProov, a biometrics company, fraudsters commonly use tools like SwapFace, DeepFaceLive, and Swapstream to create deepfakes. These tools often work in conjunction with:

**Simulators:** Changing location data for virtual "presence" anywhere.

**Device modification software**: Forging device attributes to bypass security systems.

**IP changers**: Rapidly switching IP addresses across regions.

By combining these tools, criminals can distribute deepfakes through various channels, including video conferencing platforms, work networks, and social media, ultimately enabling further fraudulent activities.


The emergence of "Cybercrime as a Service" (CaaS) has unfortunately made acquiring deepfake services and technologies easier than ever. This raises concerns as platforms like GitHub, a software development platform, host over 3,000 repositories related to deepfakes, highlighting their widespread development and potential for misuse.

Furthermore, foreign darknet marketplaces offer dedicated channels and groups for deepfakes, ranging from self-creation tools to personalized services. The pricing structure, with options ranging from $2 for basic deepfakes to $100 for more complex ones, further facilitates deepfake-related crimes due to their affordability and ease of use.
![2024030502.png](https://cdn.aisecurius.com/images/1a6/1a645258-f162-46ea-9a39-517e171eda3c.png)

By improving the language clarity, conciseness, and flow of the original text, this revised version aims to be more appealing and informative for American audiences.


# Process: Steps involved in creating a "deepfake" video


"Deepfakes" involve AI algorithms and deep learning. Overall, the process of creating a "deepfake" video involves the following steps:

**1. Data Collection**

Collect a large amount of data on the target subject, including multi-angle facial photos, work information, life information, etc., of which a large amount of images, information, and videos are collected from public social media.

**2. Feature Extraction
**
Using deep learning algorithms, accurately identify and extract key facial features such as eyes, nose, and mouth.
![2024030501.png](https://cdn.aisecurius.com/images/418/418958be-c87d-40ba-bc6e-c42b42f8e4d1.png)
**3. Image Synthesis**

Overlay and blend the target's face onto the face of the subject in the video to be faked, aligning facial features to ensure they match and replace between the source and target.

**4. Voice Processing**

Use machine learning and artificial intelligence to replicate a person's voice with startling accuracy, such as pitch, tone, and speaking style, and match the lip movements in the video with the synthesized speech.

**5. Environment Rendering**

Use lighting and color tools to further refine the coordination and matching of the characters, voice, movement and environment, costumes in the video.

**6. Video Synthesis and Export**

The video can then be used for online playback, live streaming, video conferencing, and other fraudulent activities.


# Difficulties: Challenges in Identifying and Detecting "Deepfakes"


**Difficult to Identify**

"Deepfakes" have evolved to the point where they can generate convincingly realistic personal simulations, making it increasingly difficult to distinguish between real and fake content. It is difficult for people to identify them without specialized training, and recognizing this threat is the first step in defending against it.

**
Difficult to Detect**

The increasing quality of "deepfakes" makes detection a major challenge. It is not only difficult for the naked eye to identify effectively, but some conventional detection tools cannot detect them in time.

**Difficult to Track**

Traditional cybersecurity measures cannot effectively protect against "deepfakes" when there is no digital fingerprint,  There are no clear digital clues to follow, no IP address to blacklist, and even no direct malware signature to detect.
![2024021801.png](https://cdn.aisecurius.com/images/66a/66a1d8dd-4927-4743-8970-4348957ed771.png)
**The "Deepfake" Fraud Ecosystem**

What's even more frightening is that the danger of "deepfakes" lies not only in the technology, but also in the entire fraud ecosystem it facilitates.** The "deepfake" fraud ecosystem operates through a complex network of bots, fake accounts, and anonymous services, all designed to create, amplify, and distribute fabricated information and content. **This is a form of guerrilla warfare in the digital age, in which attackers are invisible and elusive. They not only create information, but also manipulate the reality structure perceived by each participant. **Therefore, combating "deepfake" fraud requires not only technical countermeasures, but also complex psychological warfare and public safety awareness.**


# Security: Four Defense Measures Against "Deepfake" Fraud

As technology advances,  methods for detecting and identifying "deepfake" scams are also evolving. Businesses and individuals need to verify  identities through multiple channels and adopt multiple strategies to identify and defend against "deepfake" fraud.
## 1. Behavioral and Biometric Recognition
ion

(1) [During video calls,  you can ask the other person to press their nose or face to observe the changes in their face.](https://www.aisecurius.com/blog/article/52) If it is a real person's  nose,  it will deform when pressed. You can also ask the other person to eat food or drink water to observe the changes in  their face. Alternatively, you can ask them to do some strange actions or expressions,  such as waving or making a difficult gesture, to distinguish between real and fake. In the process of waving,  the data of the face will be interfered, and there will be some shaking or flickering,  or some abnormal situations. In one-on-one communication,  you can ask some questions that only the other person knows to verify their authenticity. At the same time,  when someone makes a remittance request in a video or recording,  it is necessary to call or repeatedly verify from other channels.

(2) In point-to-point communication,[  you can ask some questions that only the other person knows to verify their authenticity.](https://www.aisecurius.com/blog/article/47)

(3) "Deepfakes" can replicate voices, but they may also contain unnatural tones, rhythms,  or subtle distortions that will be particularly noticeable after careful listening. At the same time,  voice analysis software can help identify voice anomalies.

(4) In the case of files, an automatic document verification system can analyze the document for inconsistencies,  such as font changes or layout diff
## 2. Device and Account Recognition
 Recognition

(1) Digital signatures and blockchain ledgers are unique and can be used to track the source of behavior and mark it for  review.

(2) Comparing and identifying device information, geographic location,  and behavioral operations can identify and prevent abnormal operations. DingXiang Device Fingerprint can distinguish  between legitimate users and potential fraudulent behavior by recording and comparing device fingerprints. Its  technology uniquely identifies and identifies each device, identifies virtual machines, proxy servers,  simulators and other maliciously controlled devices, analyzes whether the device has multiple accounts logged in,  whether the IP address is frequently changed, whether the device attributes are frequently changed,  etc. Abnormal or unusual behavior, helping to track and identify the activities of fraudsters.

(3) [Account login from different places, changing devices, changing phone numbers, ](https://www.aisecurius.com/blog/article/52) dormant accounts suddenly becoming active, etc., need to be strengthened frequent verification;  in addition, continuous identity verification during the session is crucial,  maintaining persistent checks to ensure that the user's identity remains consistent during use. DingXiang's frictionless  verification can quickly and accurately distinguish whether the operator is a human or a machine,  accurately identify fraudulent behavior, and monitor and intercept abnormal behavior in real time. In addition,  based on the principle of least privilege,  restrict access to sensitive systems and accounts to ensure access to the resources required for their roles,  thereby reducing the potential impact of account theft.
![2024030504.jpg](https://cdn.aisecurius.com/images/818/8181db92-6201-4fcf-8627-f84e238c47a6.jpg)

(4) Face anti-fraud system that combines artificial review and AI technology to prevent fake videos of "deepfakes".  DingXiang's full-link panoramic face security threat perception scheme can effectively detect and discover fake videos. It conducts intelligent risk assessment and risk rating on user face images through multi-dimensional information such as face  environment monitoring information, liveness detection, image forgery, intelligent verification, etc.,  and quickly identifies fake authentication risks. DingXiang's full-link panoramic face security  threat awareness scheme, real-time risk monitoring for face recognition scenarios and key operations, targeted monitoring such as camera hijacking, device forgery, screen sharing and other behaviors, and trigger the active defense mechanism to deal with. After discovering forged videos or abnormal face information, the system supports automatic execution of defense policies, and the corresponding defense disposal after the device hits the defense policies can effectively block risky operations.


## 3. AI Recognition and Evidence Collection

(1) Generative Adversarial Networks (GANs) based on deep learning can train a neural network model called a  "discriminator" to identify any differences between the real and created versions. Big data models can quickly analyze  large amounts of video and audio data to identify anomalies faster than humans can. Additionally,  machine learning models can identify characteristic patterns of "deepfake" production algorithms,  thereby identifying "deepfake" content. Machine learning models can also be retrained and adjusted to keep up with  real-time iterative evolution.

(2) AI forensics tools play a critical role in investigating and attributing "deepfake" content. These tools analyze  digital footprints, metadata,  and other traces left behind during the creation process to help identify the source of the attack and assist in legal  investigations.


## 4. Social Prevention and Public Education

(1) [Reduce or eliminate the sharing of sensitive information such as accounts](https://www.aisecurius.com/blog/article/47), family members, travel,  and work positions on social media to prevent fraudsters from stealing and downloading them, and then "deep forge" pictures and sounds, Then they forged their identities.

(2) Continuously educating the public about "deepfake" technology and its associated risks is critical. Encouraging the  public to be vigilant and quickly report suspicious situations can also significantly improve organizations' ability to  detect and respond to "deepfake" threats.

Technology is constantly evolving,  and new frauds are constantly emerging. Stay up-to-date on the latest developments in AI and "deepfake" technologies  whenever possible to adjust your security measures accordingly. Continuous research, development,  and updating of AI models are critical to staying ahead of the increasingly sophisticated "deepfake" technology.

"White Paper: Deepfake Industry Chain Investigation and Four Defense Measures"

amounting to HK$200 million (approximately US$25 million).  This case involved the use of deep forgery technology, a form of artificial intelligence.


A recent CCTV report highlighted a concerning case of "AI face change" video conference fraud in Hong Kong, amounting to HK$200 million (approximately US$25 million).  This case involved the use of deep forgery technology, a form of artificial intelligence.
![2024030101.png](https://cdn.aisecurius.com/images/bd5/bd5e497c-540f-4253-af1b-57048fb6bce2.png)
The fraudsters meticulously targeted a company by:

Collecting data: They gathered face and voice data of the target company's senior management personnel beforehand.
"Face-changing": Using AI technology, they superimposed the stolen data onto their own faces, creating a seemingly real video conference.
This deceptive tactic ultimately deceived the company's employees into transferring HK$200 million to the fraudsters' accounts.

On February 5, the Hong Kong Police Force disclosed the case and urged the public to be vigilant.  Subsequently, on February 7, Dingxiang Defense Cloud Business Security Intelligence Center provided an analysis of the case, offering several effective security detection and prevention methods.

The scam began in January 2024 when a company employee received an email supposedly from the company's Chief Financial Officer (CFO) at headquarters.  The email initiated a video call, inviting the targeted employee and several "colleagues" from various locations to participate.  During the video conference, the employee, misled by the seemingly familiar appearance and voices, dismissed his initial suspicions.

Following the meeting, the employee, under the instructions of the fraudulent "CFO," made 15 transactions within a week, totaling HK$200 million.  In maintaining communication, the fraudsters employed various channels: WhatsApp, email, and individual video calls.  Finally, after reporting the transactions to company officials, the employee realized he had been tricked.
![2024030102.png](https://cdn.aisecurius.com/images/adf/adf5df9b-0956-421f-bbc8-40a7c4861811.png)
The Hong Kong police investigation revealed an intricate scheme.  The fraudsters scoured social media and video platforms, acquiring photos and videos of the CFO and other individuals.  Utilizing deep forgery technology, they then manipulated voices and combined them with the stolen visuals to fabricate the fraudulent video.  Notably, except for the targeted employee, all participants in the video conference were deepfakes.  The transferred funds were distributed across five local bank accounts and swiftly dispersed further, making recovery difficult.

This case underscores the growing sophistication of cybercrime and the importance of implementing robust security measures to combat such threats.  By remaining vigilant and adopting recommended security practices, individuals and organizations can better protect themselves from falling victim to similar scams.


# How to Spot "Face-Swapping" Impostors in Video Calls

This fraud case serves as a warning to both businesses and individuals. Deepfakes have become so sophisticated that they  are undetectable to the naked eye. AI-generated fake identities can be very difficult to recognize unless you have been  specifically trained to spot them. The increasing quality of deepfakes poses a significant challenge for detection. Not  only are they difficult to identify with the naked eye,  but some conventional detection tools also fail to timely detect them. When faced with similar "video" scenarios,  businesses and individuals should be vigilant and adopt a multi-pronged strategy to identify and defend against deepfake  fraud.

During video calls:

Ask the other person to touch their nose or face to observe facial changes. A real nose will deform when pressed.
Ask the other person to eat or drink to observe facial changes.
Ask them to do strange actions or expressions,  such as waving or making a difficult gesture. This can disrupt the facial data and cause some. Jitter, flicker, or other anomalies.
In a one-on-one conversation, ask questions that only the other person would know to verify their identity.
Always verify any requests for money transfers by calling or otherwise contacting the person through a different  channel.
In addition:

Face anti-fraud systems that combine manual review with AI technology can help businesses improve their anti-fraud  capabilities.
![2024030301.png](https://cdn.aisecurius.com/images/02a/02a50ca7-944b-4ba3-88fd-18b042221b8b.png)
The DingXiang full-link panoramic face security threat Perception scheme can effectively detect and identify fake videos. It performs intelligent risk assessment and risk rating on user face images through multi-dimensional information such as face  environment monitoring information, liveness detection, image forgery detection,  and intelligent verification. It can quickly identify fake authentication risks.
The DingXiang full-link panoramic face security threat awareness solution provides real-time risk monitoring for face recognition scenarios and key operations, targeted at behaviors such as camera hijacking, device forgery, and screen sharing, and triggers an active defense mechanism for disposal.
Upon detecting fake videos or abnormal face information, the system supports automatic execution of defense. Strategy. The corresponding defense measures will be taken after the device hits the defense strategy, which can effectively block risky operations.
Reduce or avoid sharing sensitive information such as account services, family members, travel,  and work positions on social media. This prevents fraudsters from downloading and using the information to deep forge pictures and sounds, and then identity forgery.
Continuously educate the public about deepfake technology and its associated risks. Stay up-to-date on the latest  developments in AI and deepfake technology and adjust your security measures accordingly.

Security Alert: How to Spot "Face-Changing" Fraudsters in Video Conferences

Deepfakes, which are manipulated media using artificial intelligence, are being weaponized by cybercriminals to create highly personalized and convincing attacks.


Phishing has always been a prominent topic in the security field. Despite its existence for decades, it remains one of the most effective methods for fraudulent attacks or infiltrating organizations.

Based on social engineering principles, scammers use emails, websites, phone calls, text messages, and social media to impersonate trusted entities and trick victims into clicking malicious links, downloading malware, transferring funds, or providing sensitive data such as account passwords.

As technology advances, phishers are also changing their strategies. With the help of AI, scammers are using sophisticated social engineering techniques and deepfake technology to deceive victims, making phishing attacks more sophisticated and extremely difficult to detect. In 2023, deepfake phishing scams saw a staggering 3,000% increase.


# Deepfake Phishing: A Growing Threat with Evolving Techniques

Sophisticated technology is fueling a new wave of phishing scams, posing a significant risk to individuals and organizations alike. Deepfakes, which are manipulated media using artificial intelligence, are being weaponized by cybercriminals to create highly personalized and convincing attacks.

Unlike traditional phishing attempts, deepfakes can mimic not only writing styles, but also voices and even faces. This allows scammers to exploit specific vulnerabilities based on an individual's interests, hobbies, and social networks. For instance, they could impersonate a familiar contact, such as a colleague, friend, or even a company executive, to gain trust and lure victims into compromising situations.

## Elevating Email Scams


[Deepfakes have taken email phishing to a new level of danger. Fraudsters can now impersonate real people, like corporate executives, with near-perfect accuracy, ](https://www.aisecurius.com/blog/article/38)making emails appear more believable and increasing the chances of victims falling prey. Phishing emails often employ urgency tactics and language emphasizing "requests," "payments," or other prompts designed to pressure recipients into clicking malicious links or sharing sensitive information.
![2024010303.png](https://cdn.aisecurius.com/images/cc1/cc1c7a27-cb01-4179-b9eb-e2e5f05c062b.png)


## Video Phishing on the Rise


[Beyond emails, deepfakes are increasingly utilized in video conferencing scams. In a recent case from Hong Kong, a deepfake video call involving a fraudulent CEO tricked an employee into transferring a staggering HK$200 million to unauthorized accounts. This exemplifies how deepfakes can bypass traditional security measures and manipulate victims in real-time.](https://www.aisecurius.com/blog/article/50)
![2024020601.png](https://cdn.aisecurius.com/images/0c7/0c71c6c2-5294-40da-8e7d-766f4b571f96.png)



## Voice Cloning Adds Another Weapon


Deepfakes now extend to voice cloning, allowing fraudsters to create synthetic voices that sound remarkably like real people. These voice deepfakes can be used for various nefarious purposes, such as leaving convincing voicemails or participating in real-time conversations, further blurring the lines between reality and deception. [Statistics indicate that nearly 40% of organizations encountered deepfake voice fraud in 2022, highlighting the prevalence and growing threat of this tactic.](https://www.aisecurius.com/blog/article/47)

![2024013101.png](https://cdn.aisecurius.com/images/973/9733f426-d5b4-4d69-a71c-f3d2c58b505e.png)


 A recent incident involving a Chinese student overseas illustrates the chilling potential of deepfakes. [The student's parents were duped into believing their son had been kidnapped through manipulated videos depicting him being harmed. Fortunately, authorities were able to locate the student safely, and the incident was revealed to be a meticulously crafted "virtual kidnapping" scam targeting overseas students and their families.


# Combating the Challenge


 To mitigate the risks posed by deepfake-assisted phishing, both individuals and organizations must adopt a multi-layered approach. This includes promoting cybersecurity awareness through education programs, [implementing multi-factor authentication protocols, utilizing digital signature verification, and actively updating software and systems. Furthermore, collaborating with anti-fraud systems and leveraging AI technology to identify and mitigate emerging phishing threats can help create a more secure online environment.](https://www.aisecurius.com/blog/article/50)

Deepfake phishing is a rapidly evolving threat, requiring a collective effort from individuals, organizations, and technology developers to stay ahead of cybercriminals and protect ourselves from falling victim to these sophisticated scams.

Deepfake: Making Phishing More Difficult to Detect

The iOS version of this malware tricks users into performing facial recognition and submitting identification documents, then uses the user's facial information to create deepfakes.

[On February 15, 2024, cybersecurity company Group-IB announced the discovery of a new malware called "GoldPickaxe."](https://www.group-ib.com/blog/goldfactory-ios-trojan/) The iOS version of this malware tricks users into performing facial recognition and submitting identification documents, then uses the user's facial information to create deepfakes.

![2024022102.png](https://cdn.aisecurius.com/images/362/362f70e6-3486-4c85-acb1-7cf368d543b1.png)

Using the fake facial video created by deepfake, fraudsters can log into the user's bank account, intercept the mobile verification SMS sent by the bank, and then perform transfers, consumption, and modify the account password.

The iOS version of "GoldPickaxe" places great emphasis on social engineering, and its description of sensitive information acquisition and collection is very detailed. For example, before taking a picture of the user's face, the malware will prompt "Please keep the camera stable" and "Please blink", and even uses Google's ML kit for face detection. It also requires identification documents or bank card information. The software will prompt the victim to upload the front and back of the ID or bank card, and automatically open a series of views with prompts to guide the victim to perform the necessary steps. Once the facial information and ID photos are taken, they will be automatically sent to the fraudster's server.

![2024022603.png](https://cdn.aisecurius.com/images/acb/acb18a37-56a5-4eec-be9d-ad7f36edfbeb.png)

The Android version of "GoldPickaxe" has more features. In addition to collecting and stealing the victim's facial information, ID card, bank card information, etc., the Android version can also search for more facial pictures in the phone's album and request facial recognition and other authorization services from the bank app.

# Infection: How Does This AI Virus Infect Users' Phones?

According to the disclosure of the Thai police,  the fraudsters using the "GoldPickaxe" malware first contacted the users through social software, emails,  and collected text messages, claiming that elderly relatives are eligible for additional pension benefits,  and attached a link to download the malware, guiding users to download and install.

Researchers from security company Group-IB have discovered that the Android version of "GoldPickaxe" can disguise itself  as more than 20 different counterfeit apps from government, financial and utility companies,  such as a counterfeit Thai "Digital Pension App". In addition,  fraudsters also create fake government and financial institution websites to provide downloads of the "GoldPickaxe"  Android malware.
![2024022604.png](https://cdn.aisecurius.com/images/6c2/6c2b08c4-0877-4a18-91f7-421662d1f6bf.png)
Apple's iOS system has higher security and stricter control over app permissions. To prevent malware from entering,  Apple only allows apps to be distributed through the Apple App Store. The iOS version of the "GoldPickaxe" malware  bypassed Apple Store's review in two ways.

1. Abuse of TestFlight. TestFlight is a software testing platform for iOS systems. Based on TestFlight,  developers can test their Beta apps on iOS (iPhone, iPad, Mac, Apple TV,  etc.). iOS devices can directly install Beta apps through TestFlight without downloading through the Apple Store.

2. Abuse of Mobile Device Management (MDM). MDM is a service of iOS that helps IT administrators deploy and manage  devices in an enterprise environment,  and ensure device security and compliance. It can remotely manage iOS devices (iPhone, iPad, Mac,  etc.) within the enterprise. Developers choose an MDM server (including Apple's DEP and third-party MDM solutions) and  obtain an MDM certificate. Then submit for review,  and the MDM service permission will be opened after the review is passed. Then manually add the company's MDM server  address in the specified iOS device,  or add the specified device through the management interface of the MDM server. Devices added to the company's MDM can  be remotely managed, and apps, configuration files, data collection, function restrictions,  and even device locks and device information can be directly installed on the specified device.

Fraudsters induce iOS users to install TestFlight or download MDM configuration files,  and then they can install the iOS version of the "GoldPickaxe" malware on users' iPhone, iPad, Mac and other devices.

Features: What Are the Harmful Features of This AI Virus?

The Group-IB security report describes in detail the harm of the "GoldPickaxe" malware.

![2024022103.png](https://cdn.aisecurius.com/images/743/743b6907-e818-48ff-bdd1-943c97b78bb9.png)

1. The "GoldPickaxe" malware has both iOS and Android versions. Currently,  only groups in Vietnam and Thailand have been found to be affected by the malware.

2. The "GoldPickaxe" malware does not directly steal users' bank funds,  but only collects and steals users' sensitive information such as facial information, ID documents, and bank cards,  and intercepts mobile phone text messages.

3. The "GoldPickaxe" malware will use the stolen facial information to create deepfakes, create fake victim videos,  and then directly log in to the victim's bank account to steal money.

4. The iOS version of "GoldPickaxe" is spread through Apple's TestFlight or by social engineering victims to install MDM  configuration files;  the Android version of "GoldPickaxe" is spread through mobile phone text messages, emails,  phishing websites and Android markets.

5. Security researchers have also discovered several new variants of the "GoldPickaxe" malware. Among them,  a new variant called "GoldDiggerPlus" can forge alarms and customer service. When the victim clicks the fake alert to  contact the customer service button,  the malware will try to find a free carrier to call. It's as if cybercriminals are running a real customer service  center.

6. Social engineering is used throughout the "GoldPickaxe" malware. The malware is associated with the cybercrime group  GoldFactory and is closely related to the "Gigabud" malware that ravaged financial institutions in 2023.


# Defense: How Do Banks and Individuals Defend Against AI Viruses?


Dingxiang Defense Cloud Business Security Intelligence Center previously warned that with the wide application of AI in  various industries,  the security threats it brings have also attracted people's attention. [AI is becoming a new means of threat. Attackers  using AI technology will bring unprecedented risks to enterprises and individual users,  and listed the five trends of business fraud risks in 2024:  new attacks brought by AI are increasing exponentially, accounts and identities are more difficult to distinguish,  and data crawling is still rampant , Account theft and impersonation will become more common and difficult to prevent,  and internal data breaches.](https://www.aisecurius.com/blog/article/38)

**The main reasons behind this growth trend are the continuous advancement of technology and social engineering. As more  and more people turn to online and mobile channels for shopping, frauds



##  Security Recommendations for Financial Institutions


Dingxiang Defense Cloud Business Security Intelligence Center recommends that financial institutions need to ensure the security of their apps and educate their customers about security.

1. Strengthen App security detection and ensure security and compliance.

Dingxiang App Hardening, which was the first to perform iOS source code free hardening, supports Android, iOS, H5, mini programs and other platforms. It has unique cloud strategy, business security intelligence and big data modeling capabilities. It can effectively defend against attack threats such as memory injection, Hook, debugging, injection, multi-open, memory dump, simulator, secondary packaging and log leakage, prevent App from being invaded, tampered, cracked, secondary packaged and other malicious damages, protect 16 kinds of data and files of Android, and provide 7 kinds of encryption forms.

Dingxiang App Hardening can perform security detection on existing Apps, discover the risk vulnerabilities existing in the applications and make targeted repairs and rectifications, protect sensitive data, code obfuscation, code integrity, memory data, etc., avoid the security impact of system vulnerabilities on the application itself from the source, prevent data information leakage, and ensure App security. It can also provide security monitoring for the operation of mobile applications, and monitor the terminal devices, operating environment and operation behavior of mobile applications in real time, helping App to establish a security system for monitoring, early warning, blocking and tracing of runtime risks.

In response to the risk of financial App face being stolen, Dingxiang Business Security Perception and Defense Platform is an active security defense platform based on advanced technologies such as threat probes, stream computing and machine learning. It integrates device risk analysis, running attack identification, abnormal behavior detection, early warning and protection and disposal. It can detect malicious behaviors such as camera hijacking and device counterfeiting in real time, and effectively prevent and control various risks of face recognition system. It has the characteristics of threat visualization, threat traceability, device association analysis, multi-account management, cross-platform support, active defense, open data access, defense customization and full-process prevention and control.

2. Pay close attention to various threat warnings, take security measures, and be able to respond quickly to new threats.

3. Educate users about security and improve 
## their security awareness by explaining fraud cases.

Security Recommendations for Individual Users
For individuals,  Dingxiang Defense Cloud Business Security Intelligence Center recommends that you must download Apps from formal channels and always maintain safe usage habits.

1. Do not click on unfamiliar links received in mobile phone text messages, social software, or emails.

2. Do not disclose sensitive information such as SMS verification codes, bank cards, and ID cards to others.

3. When receiving strangers calls or text messages, be sure to stay calm. If you feel suspicious, please call the police immediately.

4. Be sure to download Apps through the AppStore, Android Market,  and the official website of the financial institution. Do not download through third-party platforms or links sent by  others.

5. Do not install unfamiliar, unknown, or unfamiliar Apps.

6. When installing Apps,  be sure to carefully check the permissions requested by the App and be highly vigilant when the App requests auxiliary  functions.

7 When contacting a financial institution, be sure to call the inquiry number. Published by the official channel.



First AI Virus of 2024: Steals Your Face Photos and Empties Your Bank Account Balance

The Rise of Deepfakes。With the popularity of artificial intelligence technology, AI tools are also abused, which brings new threats. Even criminals and ordinary people can use AI tools to generate deepfake images, videos, 

According to Radio Television Hong Kong (RTHK), an employee of a multinational company's Hong Kong branch was scammed into transferring over HK$200 million (over US$25 million) after a video conference call.

The scam began in January 2024 when the victim received an email from someone claiming to be the company's CFO. The victim dismissed the email as a phishing attempt![2024020601.png](https://cdn.aisecurius.com/images/0c7/0c71c6c2-5294-40da-8e7d-766f4b571f96.png).

Later, the fraudster impersonating the CFO organized a video conference, inviting the victim and several other "colleagues" working in other locations to participate.

In the video, the victim found that the CFO and several colleagues looked, sounded, and spoke in a similar manner to the real people he knew, which dispelled his earlier suspicions. He believed that everyone in the early email and video conference was real.

Following the meeting, the victim, under the instruction of the CFO impersonator, made 15 transactions within a week totaling HK$200 million (over US$25 million). During this time, the fraudster kept in touch with the victim via WhatsApp, email, and one-on-one video calls, and told the victim that he had contacted two other colleagues in the branch using the same method.

After the fact, the victim reported the entire transaction process to the company's management and realized that he had been scammed.

The police found that this was a carefully planned scam. The fraudster searched and downloaded photos and videos of the company's CFO and several other people from social media and video platforms, and then used deepfake technology to synthesize different voices and integrate them into the fake video clips. Except for the victim himself, all the other participants in the video conference were fake. The defrauded funds were sent to five local bank accounts and then quickly dispersed.

The Hong Kong police also said that between July and September 2023, they discovered more than 20 cases of AI-based deepfakes being used for loan applications and bank account registration.

Hong Kong media reported that this is the first case in the city involving such a large amount of money in a deepf


# New Fraud: Challenges Brought by Deepfakes


The Rise of Deepfakes。With the popularity of artificial intelligence technology, AI tools are also abused, which brings new threats. Even criminals and ordinary people can use AI tools to generate deepfake images, videos,  and voices for dissemination and fraud. A recent report by KPMG showed that the number of deepfake videos available  online has increased by 900% year-on-year.
![2024020602.png](https://cdn.aisecurius.com/images/76d/76d59b36-0053-469a-acca-66cb9c365cd2.png)
High-Profile Victims。Elon Musk, two BBC presenters, YouTube personality MrBeast,  and pop star Taylor Swift have all been victims of identity fraud in scam videos.

Impact on the Banking Industry。The banking industry is the main target of this type of identity fraud. 92% of companies in the industry see synthetic  fraud as a real threat,  and 49% of companies have recently encountered such scams. Fraudsters not only forge information, voices, videos,  and images,  but also combine real and fake identity information to create entirely new artificial identities for the purpose of  opening bank accounts or making fraudulent purchases.

Cross-Industry Threat。Deep synthetic fraud is not limited to the financial sector,  but spans all industries. 46% of organizations globally have experienced synthetic identity fraud in the past year.

Overconfidence in Detection。However, 52% of respondents believe they can detect deepfake videos. This sentiment reflects consumer overconfidence,  but in fact deepfake technology has developed to the point where it is undetectable to the naked eye. Without special  training,  it can be very difficult for ordinary people to identify AI-generated fake identities. As the quality of deepfakes  improves, so does the difficulty of detection.ake fraud case.


# Effective Detection: How to Detect Deepfakes


**The Battle Against Deepfakes**：The rise of deepfake technology has created new opportunities for fraud and posed significant challenges for detection and identification. The difficulty of distinguishing deepfakes from real content with the naked eye and the limitations of traditional detection tools have made deepfake fraud a major concern in the cybersecurity landscape.

**Multi-dimensional Strategies to Decipher Deepfakes**：With technological advancements, various methods for detecting deepfakes have emerged, providing powerful tools for preventing fraud. Enterprises and individuals can adopt the following strategies for identification:

**Visual Recognition: Capturing Subtle Inconsistencies**：While deepfake technology is sophisticated, it can still produce subtle inconsistencies in facial features. For example, micro-expressions, eye movements, and the interaction between hair and facial features may exhibit abnormalities. Additionally, lighting and shadowing are often challenging aspects of deepfakes, which may result in inconsistencies in light source, missing shadows, or misaligned reflections.

**Auditory Recognition: Distinguishing Voice Anomalies**：Deepfakes can imitate voices, but may not perfectly replicate tone, rhythm, and other subtle details. Careful listening may reveal unnatural voice characteristics. Additionally, voice analysis software can assist in identifying voice anomalies, such as changes in pitch, timbre, and speaking speed.

**Document Recognition: Analyzing Document Details**：For document-based deepfakes, automated document verification systems can analyze inconsistencies in fonts, layout, and other aspects to determine authenticity.

**AI-based Automatic Recognition: Intelligent Countermeasures against Deepfakes**：With the continuous evolution of fraud techniques, machine learning has become a critical tool in the fight against deepfakes. By leveraging large data models, AI can rapidly analyze massive amounts of video and audio data to identify anomalies that may be imperceptible to the human eye. Furthermore, machine learning models can learn the characteristic patterns of deepfake generation algorithms, enabling precise identification of forged content. Critically, machine learning models can be continuously trained and refined, ensuring real-time iterative evolution of detection capabilities.


# Security: How to Ensure Enterprise and Personal Security

In an era where deepfakes are increasingly being used for financial fraud,  it is becoming more and more important to protect against them.
![2024020504.png](https://cdn.aisecurius.com/images/10d/10d77db3-d716-40a1-8d0c-155db40db898.png)

1. Increase biometric and liveness verification.Adopt liveness verification methods that utilize advanced biometrics,  such as facial recognition, combined with motion analysis and infrared scanning,  to detect deepfake videos to a certain extent.

2. Increase digital signature verification.Digital signatures and blockchain ledgers are unique and can be used to track  the source of an action and flag it for review.

3. Increase device and operation verification.Based on devices that have been previously authenticated or identified,  compare device information, geographic location, and behavior operations to identify and prevent

Dingxiang Device Fingerprinting refers to the technology of uniquely identifying and recognizing each device by  collecting and analyzing the hardware, software, and behavior data of the device. It can identify virtual machines,  proxy servers, emulators, and other maliciously controlled devices,  and analyze whether the device has multiple accounts logged in, whether it frequently changes IP addresses,  and whether it frequently changes device attributes. It can also help track and identify the activities of fraudsters.  By recording and comparing Device Fingerprinting,  legitimate users and potential fraudulent behavior can be distinguished.


4. Increase account verification frequency.Account login from a different location, device change,  mobile phone number change, dormant account suddenly active, etc.,  need to strengthen frequent verification. In addition, continuous identity verification during a session is critical,  maintaining persistent checks to ensure that the user's identity remains consistent during use.

Dingxiang atbCAPTCHA can quickly and accurately distinguish whether the operator is a human or a machine,  accurately identify fraudulent behavior,  and monitor and intercept abnormal behavior in real time. When users perform operations such as login and registration,  they can quickly complete identity verification without the need for. Cumbersome operation and verification code recognition. This not only improves the convenience and fluency of the user experience,  but also greatly reduces the risks caused by human operational errors. Since Dingxiang atbCAPTCHA is based on AIGC  technology, it can prevent brute force cracking, automated attacks, and phishing attacks,  effectively preventing unauthorized access, account theft, and malicious operations.

5. Increase anti-fraud system verification.Anti-fraud systems that combine manual review with AI technology can help  enterprises improve their anti-fraud capabilities.

For example,  the average processing speed of Dingxiang Dinsight's daily risk control strategy is within 100 milliseconds. It  aggregates data engines, integrates expert strategies,  and supports parallel monitoring and replacement and upgrade of existing risk control processes. It can also build  dedicated risk control platforms for new businesses. It aggregates anti-fraud and risk control data,  supports the configuration and precipitation of data from multiple parties, can be configured graphically,  and can be quickly applied to complex strategies and models. It can realize the mechanism of self-performance monitoring  and self-iteration of risk control based on the accumulation of experience of mature indicators, strategies,  and models,  as well as deep learning technology. It integrates expert strategies and is based on system + data access + indicator  library + strategy system + expert implementation of actual combat. It supports parallel monitoring and replacement and  upgrade of existing risk control processes, and can also build dedicated risk control platforms for new businesses.

6. Reduce the sharing of sensitive information on social media.Reduce or avoid sharing sensitive information such as  account services, family members, transportation,  and work positions on social media to prevent fraudsters from stealing and downloading it, and then deep forge pictures and sounds, Then they forged their identities.

7. Strengthen public safety training and education.It is crucial to continuously educate the public about deepfake  technology and its associated risks. By conducting simulations and mimicking phishing and deepfake attacks,  encouraging the public to be vigilant and quickly report suspicious situations,  the organization's ability to detect and respond to deepfake threats can also be significantly improved.

 Keep up with the latest developments in AI and deepfake technology.Technology is constantly evolving,  and new frauds are constantly emerging. Try to keep up with the latest developments in AI and deepfake technology to  adjust your security measures accordingly.


Deepfake Fraud Case in Hong Kong: Analysis of Risks and Detection Methods

Singapore's e-commerce platforms face a variety of risks,  from scalping to malicious crawling. These criminals exploit platform vulnerabilities,  posing serious threats to platforms and consumers. such as fake reviews and brushing orders, 


Visa-free Entry between China and Singapore Takes Effect on February 9th, Facilitating Travel and Boosting Tourism
On February 9th, 2024, the visa-free policy between China and Singapore officially came into effect, simplifying the entry procedures for Chinese tourists holding ordinary passports and making customs clearance more convenient. According to the agreement, ordinary passport holders from both sides can enter each other's country visa-free for tourism, family visits, business, and other private matters, with a stay of no more than 30 days, providing greater convenience for travelers from both countries.

According to statistics from the Shanghai Airport Border Inspection Station, in the six days since the implementation of the visa-free agreement, the number of visa-free personnel entering and leaving China through Shanghai Pudong Airport has exceeded 20,000. According to statistics from the Shenzhen Airport Border Inspection Station, in the 10 days since the mutual visa exemption was implemented, the number of visa-free personnel entering and leaving China through Shenzhen Airport has exceeded 11,100.

Singapore is culturally close to China with relatively few language barriers. The visa-free policy reduces visa costs and procedures, making it easier for tourists to travel. In 2023, the number of Chinese tourists visiting Singapore was close to 2 million. After the implementation of the visa-free policy, the number of tourists visiting Singapore is expected to increase significantly, and Chinese tourists will bring more consumption and investment to Singapore..

![2024020501.jpg](https://cdn.aisecurius.com/images/d55/d5592b85-56bb-44d1-a05b-0bee37811097.jpg)
Singapore is culturally similar to China with relatively few language barriers. The visa-free policy lowers the cost and procedures of visas, facilitating tourist travel. In 2023, the number of Chinese tourists visiting Singapore was close to 2 million. After the implementation of the visa-free policy, the number of Chinese tourists visiting Singapore will increase significantly, and Chinese tourists will bring more consumption and investment to Singapore.
# E-commerce: The State of Singapore's E-commerce Market
rket
Singapore's e-commerce market is developing rapidly. The size of Singapore's e-commerce market is expected to reach 5.9 billion USD in 2023, a year-on-year increase of 12%. With the rapid development of new models such as social e-commerce and live streaming e-commerce, and the widespread application of technologies such as personalized recommendation and artificial intelligence, it is expected that the size of Singapore's e-commerce market will reach 10.3 billion USD by 2025.
![2024020502.png](https://cdn.aisecurius.com/images/2d8/2d89d457-3e2c-4051-8892-59b173611a89.png)
Singapore's e-commerce market has been booming in recent years, and each major e-commerce platform has its own characteristics. Shopee is one of the largest e-commerce platforms in Singapore. It has the main advantages of a wide variety of products and favorable prices. Its business scope covers fashion, electronics, home, maternal and child, food and other multiple fields, providing consumers with a comprehensive shopping experience. Next is Lazada, which is characterized by a complete range of products, fast logistics speed, and an official self-operated platform. It provides various products from fashion, electronics, home, maternal and child to food. With its advantages of rich product variety, genuine product guarantee, and fast logistics speed, Amazon.sg has developed rapidly in the Singapore e-commerce market. Qoo10 is an e-commerce platform that mainly focuses on Korean products. It has a large number of Korean trendy products with relatively low prices. Carousell is the largest personal idle trading platform in Singapore, similar to the domestic "Idle Fish". It provides consumers with a convenient platform for trading second-hand goods and services. In addition, RedMart, as Singapore's leading online fresh supermarket, is characterized by fresh products, timely delivery, and same-day delivery service. Zalora, which focuses on fashion clothing and footwear and has its own brand, also has a place in the Singapore e-commerce market.

Singapore's e-commerce market presents a diversified development pattern. The above seven major e-commerce platforms are the most popular shopping platforms in Singapore. They have different positioning and characteristics and can meet the shopping needs of different consumers. In addition, there are also some small and medium-sized e-commerce platforms that meet the needs of different consumers.


# Risks: Various Frauds Faced by Singapore E-commerce and Consumers

Singapore's e-commerce platforms face a variety of risks,  from scalping to malicious crawling. These criminals exploit platform vulnerabilities,  posing serious threats to platforms and consumers. such as fake reviews and brushing orders, not only disrupt market order but also harm the interests of consumers. Price fraud, delayed delivery,  and out-of-stock fraud are also rampant,  damaging consumer rights. These risks not only cause huge economic losses to the platform but also affect the platform's  reputation and consumer shopping experience.
![2024020503.png](https://cdn.aisecurius.com/images/016/0162300c-487c-4357-9ac5-cf82305659a7.png)

Scalping risks that rob consumers of welfare benefits. Scalping on e-commerce platforms has become a common phenomenon. Criminals exploit loopholes or preferential policies on  e-commerce platforms to register multiple accounts or use software/scripts for automated operations to obtain more  discounts and gain improper benefits. Some e-commerce platforms in Singapore have suffered severe scalping attacks in the past. These attacks are often  launched by professional scalping groups who exploit platform vulnerabilities to obtain a large number of discounted  products, causing huge economic losses to the platform.

Websites scraping risks that steal consumer privacy and transaction data. Website scraping is also a major risk facing e-commerce platforms in Singapore. Criminals use website scraping programs  to crawl a large amount of product information from e-commerce platforms and then sell the information to other  businesses or use it for illegal profits. In addition,  the user databases of some well-known e-commerce platforms have also been stolen by website scraping,  leading to the leakage of a large amount of personal information of users.

Fake reviews and brushing orders risks that mislead consumer buying decisions. A large number of merchants in Singapore's e-commerce increase product sales and rankings through fake transactions to  deceive consumers. Brushing orders usually involves a large number of fake orders, reviews,  and accounts. Merchants use brushing orders to create a false high sales volume and good reviews to attract more  consumers. However, once the brushing behavior is discovered by the platform,  the merchant will face the risk of punishment and account closure.

Fake advertising risks under orders for goods. False advertising refers to merchants exaggerating or falsely. in advertisements to deceive consumers. False advertising refers to merchants exaggerating or falsely. In advertisements to deceive consumers. False advertising may involve false publicity of product functions, quality, and price, and may even use false pictures and reviews to mislead consumers.

Price fraud that low prices attract high prices. Price fraud refers to merchants attracting consumers with fake low prices and then charging additional fees during the  transaction. This type of fraudulent behavior usually attracts consumers to click into the product page with low prices, but finds that the price is much higher than the price tag when checking out, but finds that the price is much higher than the price tag, when checking out, and there may be hidden fees or additional conditions. Merchants lose consumer trust due to price fraud and face risks  such as fines.

Fraud that merchants are late in delivery or out of stock. Delayed delivery and out-of-stock fraud refer to merchants delaying delivery or after receiving the order to deceive  consumers. This type of fraudulent behavior usually delays the delivery time or claims that the product is out of stock  for various reasons to obtain more orders or increase the price.


# Anti-fraud: How E-commerce Platforms Can Effectively Defend

The above frauds each have their own characteristics. The scalping criminal group holds a large number of accounts,  professional tools are constantly updated, new methods emerge in an endless stream, and the sources are complex,  which makes it difficult to identify and prevent risks. Website scraping is becoming more intelligent,  and attacks are becoming more covert and complex. If the crawler's attributes cannot be distinguished and the crawler's behavior cannot be judged,  then targeted defense cannot be achieved. Brushing orders and fake reviews have formed an industrial chain. In each link  of fake transactions, a large number of fake accounts are reserved. There are multiple accounts on the same device,  and the characteristics are highly unified,  such as the IP address of the same device switching frequently in a short period of time,  the browsing and ordering operations are highly unified, and the delivery address are highly unified.
![2024020504.png](https://cdn.aisecurius.com/images/10d/10d77db3-d716-40a1-8d0c-155db40db898.png)

Defend against brushing orders and fake reviews risks. E-commerce platforms need to integrate security SDKs into the  App, regularly check the App's running environment, and effectively monitor and intercept risks such as code injection, hook, simulators, cloud phones, proxies, VPNs, root, and jailbreaks. At the same time,  H5 confusion protection and terminal security reinforcement can be deployed on the App and website of the e-commerce  platform to ensure access security. In addition,  it is necessary to encrypt the communication link to prevent the black and gray produced in the business communication transmission link from tampering with the message data and ensure the data of the terminal security detection module.

Defend against scalping risks. E-commerce platforms need to access the business security risk control system in the United States Place an order scenario,  transmit the device fingerprint information and user behavior data collected by the terminal to the risk control system, and effectively identify and intercept risks by configuring corresponding security in the risk control system.

Defend against brushing orders, fake reviews,  and fake comments risks. E-commerce platforms and regulators are also using advanced technologies such as risk control  and big data to prevent, investigate,  and prosecute. Dingxiang provides a full-link prevention and control system. from the client to the business side, which can effectively prevent brushing orders and fake reviews,  identify and prevent abnormal behaviors such as fake transaction reviews, fake voting, brushing fans, and brushing without affecting the normal user experience, ensuring business security,  and promoting the healthy development of e-commerce platforms.

Singapore: Must-Know E-commerce Frauds

Dingxiang is one of the first batch of HarmonyOS system native application development partners. Several business security products have been perfectly adapted to the HarmonyOS system, which can provide identity verification

Dingxiang Device Fingerprinting has successfully adapted to the HarmonyOS system, becoming one of the first batch of HarmonyOS native applications, contributing to the rapid development of the HarmonyOS ecosystem.

![2024011902.jpg](https://cdn.aisecurius.com/images/aaf/aafa920d-846a-4b44-ab28-3d227a641173.jpg)

As a full-scene distributed operating system, HarmonyOS aims to break down the boundaries between different devices and achieve rapid discovery, rapid connection, hardware mutual assistance, and resource sharing. So far, the number of ecological devices has exceeded 800 million, and there are more than 200 leading companies' HarmonyOS native applications covering convenient life, travel and culture, financial management, social information, productivity tools, audio and video entertainment, and games.

![2024012201.png](https://cdn.aisecurius.com/images/901/901d2fdf-be8c-4317-8ca3-28749687c6b8.png)

Dingxiang is one of the first batch of HarmonyOS system native application development partners. Several business security products have been perfectly adapted to the HarmonyOS system, which can provide identity verification, device verification, and device protection for HarmonyOS ecosystem users. It can help developers develop efficient end-to-end tools, promote the deployment and operation of enterprise businesses on the HarmonyOS platform, and help the rapid development of the HarmonyOS ecosystem.

With the popularity of smart terminals, security issues have also become increasingly prominent. Dingxiang Device Fingerprinting provides strong security protection for the business security of the HarmonyOS ecosystem. By generating a unique identifier for the device through the hardware, network, and environmental characteristic information of the user's online device, it can effectively identify risks such as simulators,刷机改机, Root,越狱, and hijacking injection. It can timely discover malicious devices and users, and achieve more accurate risk control and anti-fraud prevention. It can also collect and analyze the device information of customers comprehensively. Through Device Fingerprinting, it can identify virtual machines, proxy servers, simulators, and other maliciously controlled devices. It can analyze whether the device has multiple accounts logged in, whether it frequently changes IP addresses, and whether it frequently changes device attributes. It can help track and identify the activities of fraudsters.

![2024020401.png](https://cdn.aisecurius.com/images/cb3/cb354b4b-d920-49a1-bde2-bf562c8205d3.png)

Dingxiang Device Fingerprinting can also provide more advanced personalized services for the business security of the HarmonyOS ecosystem. By collecting and analyzing device information comprehensively, enterprises can better understand user needs and behavior patterns, and then provide more accurate services. This personalized service model not only improves the user experience but also brings more business opportunities for enterprises.

Dingxiang Device Fingerprinting supports Android, iOS, H5, and mini programs. It features rapid对抗, efficient risk identification, over 99% stability, and 100% uniqueness.

Dingxiang Device Fingerprinting Perfectly Adapts to HarmonyOS System

Recently, a new type of telephone fraud targeting overseas Chinese students has attracted attention. The authorities confirmed that a Chinese student who was suspected of being kidnapped was actually a victim of "virtual kidnapping" fraud.


Recently, a new type of telephone fraud targeting overseas Chinese students has attracted attention. The authorities confirmed that a Chinese student who was suspected of being kidnapped was actually a victim of "virtual kidnapping" fraud.

![2024013101.png](https://cdn.aisecurius.com/images/973/9733f426-d5b4-4d69-a71c-f3d2c58b505e.png)

The fraudsters posed as officials from the public security, procuratorate, embassy, or customs, and used fake warrants and arrest warrants to intimidate the victims, claiming that they were suspected of committing a crime. They used call-spoofing software to deceive the victims, gain their trust, and ask them to cut off contact with the outside world and download designated software to cooperate with the investigation. Once the victim was out of contact, the fraudsters contacted the victim's parents as kidnappers and demanded a large ransom. Since the parents could not confirm the child's true condition, they were often easily fooled.

Many people may be confident that they can calmly deal with such scams, but it is challenging to stay calm when they really receive such a call.

First, telephone fraud works by increasing the victim's emotional tension to make them react irrationally. Fraudsters know that people often lose their minds in emergencies, so they use various high-pressure tactics to increase the victim's panic, making it difficult for the victim to calmly analyze the situation, making it easier to fall victim to the scam.

Second, fraudsters use personal information to increase the credibility of the scam. In today's highly developed social media era, people's personal information is often easily leaked. Fraudsters can find enough information to construct a seemingly realistic kidnapping scenario by searching on social media. They may mention the victim's home address, family members' work units, and other private information in the call, making the victim think it is true.

Finally, fraudsters will deliberately keep in touch with the victim, making it easier for the victim to fall into the trap of the fraudsters and unable to extricate themselves.

Fraudsters use a variety of tactics to implement their scams, including increasing emotional tension, using personal information, targeting specific groups, and deliberately keeping the victim in touch.


# AI: Giving telephone fraud a boost


Artificial intelligence (AI) has gradually penetrated into all aspects of people's lives, bringing people many conveniences. However, unfortunately, this technology has also been exploited by criminals and has become a new weapon for scammers, making scams more sophisticated.

![2024013103.jpg](https://cdn.aisecurius.com/images/8bb/8bb74c2f-e6e6-40b6-89ed-3f45f998bbff.jpg)

Traditional anti-fraud awareness is no longer enough to deal with this new threat. AI technology allows scammers to easily imitate familiar voices, making scams more difficult to identify. With just 30 seconds to 1 minute of samples, scammers can create highly realistic voice clones.

Here are some of the ways that AI is being used to make telephone fraud more difficult to detect:

Caller ID spoofing: Scammers use AI technology to spoof the caller ID, making it look like the call is coming from a familiar or trusted number. This caller ID spoofing greatly increases the likelihood that the victim will answer the call, giving scammers more opportunities to implement their virtual kidnapping schemes.
Voice cloning: Using AI technology, scammers can imitate the voices of others. They need only obtain a few seconds of audio of someone's voice to create a highly realistic audio clip using AI software. These audio clips not only imitate the voice, but they can also imitate the tone, accent, and speaking style, making it difficult for victims to tell the difference between real and fake.
Personal information: To further increase the credibility of their calls, scammers will also provide important details about the victim or their contacts during the call. This information is often obtained from social media, such as travel plans, job changes, etc. Scammers use this information to weave a seemingly realistic story that will scare the victim and force them to pay money.
Video creation: AI technology can also create realistic videos, making it easier for scammers to manipulate victims' emotions and make the scam seem more real and believable. According to anti-fraud experts from the Dingxiang Defense Cloud Business Security Intelligence Center, scammers often extract voice samples from video clips on social media and then use these samples to create voice clones, and they do not need long recordings.


# Prevention: How can we prevent telephone fraud?


By understanding and identifying the characteristics and methods of this fraud, and taking effective prevention and response measures, people can better protect themselves from it.  It is important to remember that staying calm and vigilant in the face of suspicious situations is essential.  At the same time, timely reporting to the police and cooperating with the police is the key to combating this criminal behavior.
![2024013104.jpg](https://cdn.aisecurius.com/images/d9c/d9c4c45f-4f05-4756-8580-e6faac517080.jpg)
Here are some tips to help you protect yourself from telephone fraud:

Set a special "safe word."  If you receive a suspicious call, ask the caller to provide this "safe word."  If the caller is unable to provide it or avoids it, you can immediately identify the false scam call and avoid falling into panic.
Seek help from people around you.  When you receive a suspicious call, if you have other people around you, you can ask them to call or text to confirm your safety.  This method can quickly expose the scammer's lies and protect your property.
Hang up and redial the phone.  When you receive a suspicious kidnapping call, you can act like you have poor signal and then hang up the phone and immediately call the number of the person being impersonated for confirmation.  It is important to note that scammers may use technical means to spoof caller ID, so you cannot easily believe the authenticity of the call based on caller ID.
Be careful about what you share on social media.  Today, social media has become an indispensable part of people's daily lives.  Avoid sharing sensitive information on social media, which can become a warehouse for scammers to obtain scam materials.  Every post and photo people share on social media can be clues for scammers.  Scammers will use this information to build a more realistic scam, describing the victim's appearance, interests, and lifestyle, thereby increasing its credibility.
In the face of telephone fraud impersonating familiar people, it is necessary to be vigilant and take effective preventive measures.  By setting a special code word, seeking help from people around you, hanging up and redialing the phone, and being careful about what you share on social media, you can effectively identify and prevent telephone fraud impersonating familiar people, ensuring that people's property and personal safety are not violated.


Telephone fraud: Why does it keep succeeding?

Dingxiang's multiple business security products have been perfectly adapted to the HarmonyOS system, providing business security capabilities such as identity verification, device verification, and device protection for HarmonyOS ecosystem users. 

Dingxiang atbCAPTCHA has successfully adapted to HarmonyOS, becoming one of the first native HarmonyOS applications, helping to accelerate the development of the HarmonyOS ecosystem.
![2024012201.png](https://cdn.aisecurius.com/images/901/901d2fdf-be8c-4317-8ca3-28749687c6b8.png)
HarmonyOS aims to break down the boundaries between different devices, achieving ultra-fast discovery, ultra-fast connection, hardware collaboration, and resource sharing. To date, the number of ecosystem devices has exceeded 800 million, and there are over 200 leading enterprises with HarmonyOS native applications, covering convenient life, travel and tourism, financial investment, social information, productivity tools, audio and video entertainment, and games.


As one of the first HarmonyOS native application development partners, Dingxiang's multiple business security products have been perfectly adapted to the HarmonyOS system, providing business security capabilities such as identity verification, device verification, and device protection for HarmonyOS ecosystem users. It helps developers to develop efficient end-to-end tools, promote the deployment and operation of enterprise businesses on the HarmonyOS platform, and help the rapid development of the HarmonyOS ecosystem.

Among them, Dingxiang atbCAPTCHA can provide more reliable security login verification and anti-fraud services for HarmonyOS ecosystem users. With the help of atbCAPTCHA technology, HarmonyOS ecosystem users can quickly complete identity verification without the need for tedious input operations and verification code recognition when performing login, registration, and other operations. This not only improves the convenience and fluency of the user experience, but also greatly reduces the risk of human operation errors.

Dingxiang atbCAPTCHA technology can quickly and accurately distinguish whether the operator is a human or a machine, accurately identify fraudulent behavior, timely identify malicious accounts, and batch registration malicious attacks, and monitor and block abnormal behavior in real time, ensuring the security of HarmonyOS ecosystem users' operations. Compared with the traditional username and password login method, Dingxiang atbCAPTCHA can reduce the input steps, making it more convenient for HarmonyOS ecosystem users to operate and log in, and greatly improving the service experience.
![2024011902.jpg](https://cdn.aisecurius.com/images/aaf/aafa920d-846a-4b44-ab28-3d227a641173.jpg)

In addition, Dingxiang atbCAPTCHA, with the support of AIGC technology, can prevent threats such as brute force cracking and automated attacks, effectively preventing unauthorized access, account theft, and malicious operations, thereby protecting the stability of the system. It integrates 13 verification methods and multiple control strategies, gathers 4,380 risk strategies, 112 risk intelligence, covering 24 industries and 118 risk types. Its control accuracy is as high as 99.9%, and it can quickly realize the transformation from risk to intelligence. At the same time, it supports safe users to pass without feeling, and the real-time countermeasure handling capability is also reduced to 60 seconds, further improving the convenience and efficiency of the digital login service experience.
![2024012801.png](https://cdn.aisecurius.com/images/bba/bba4ade1-9f21-45b6-b004-46095584d1d0.png)
Dingxiang atbCAPTCHA has accumulated rich cases in industries such as banking, e-commerce, aviation, transportation, games, education, tourism, media, government, and intelligent manufacturing, which can better provide HarmonyOS ecosystem users with a safe and secure protection scheme with rich practical experience.

HarmonyOS: Dingxiang atbCAPTCHA Provides Verification Login Security for HarmonyOS Users

Overpayment fraud is a type of fraud in which a scammer tricks a seller into sending them money by pretending to have overpaid for a purchase. 


According to a report by the U.S. Chamber of Commerce, the Federal Trade Commission (FTC) received over 1.1 million complaints of business fraud from January to June 2023, with losses totaling $4.4 billion. Business fraud is on the rise across the United States, with no signs of slowing down.
![2024012301.png](https://cdn.aisecurius.com/images/d6a/d6a2f3b4-b2c1-4353-9af9-0c6efcc94f30.png)

In a webinar on September 22, 2023, FTC Market Director Greisman said that overpayment fraud has become one of the most common payment scams. She explained that someone will send you a check that is more than the amount you owe, and then ask you to wire the difference back to them. The problem is that the original check is often fake, and by the time you realize it, you have already sent your own money to the scammer.


# Overpayment Fraud: Types


Overpayment fraud is a type of fraud in which a scammer tricks a seller into sending them money by pretending to have overpaid for a purchase. The scammer will often use stolen credit card information to make a purchase, then ask for a refund for the excess amount. The scammer will then request that the excess be returned to another payment account or third-party source, in order to convert available credit balance or credit limit into cash.
![2024012302.png](https://cdn.aisecurius.com/images/f37/f377c1ce-1173-4f1e-b239-4e706514e810.png)

## Fake Check


Fake check scams involve a scammer sending a fake check to an individual or business, enticing them to deposit the check and then send back part of the money or pay for certain services. These scams are often targeted at e-commerce merchants and individuals who are seeking work-at-home opportunities or conducting business with people they do not know.

The following are the steps involved in a fake check scam:

The scammer sends the seller a fake check, the amount of which is usually more than the agreed-upon price for the goods or services being sold.
The scammer tells the seller that they accidentally overpaid, and requests that the excess amount be returned.
The seller ships the goods, and then returns the excess amount to the scammer; the bank discovers that the scammer's check is fake.
The seller loses the goods.
Fake check scams can cause significant financial losses to individuals and businesses. It is always advisable to verify the authenticity of checks and payment methods before taking any action, and to be cautious when dealing with individuals who request refunds or overpayments without a legitimate reason.


## Fake Customer Overpayment


Fake customer overpayment is a type of fraud in which a scammer uses stolen credit card information to make a purchase from a merchant that accepts stolen credit cards. They intentionally overpay for the product or service, and then request a refund for the excess amount, usually through a different payment method or by requesting a cash refund.

The following are the steps involved in the scam:

The scammer uses a stolen credit card to make a purchase from a merchant, intentionally overpaying the product or service fee.
The scammer then contacts the buyer, claiming that they made a mistake, and requests that they refund the excess amount.
The scammer provides the seller with another payment account, such as bank account details or other credit cards.
The seller, unaware of the fraudulent nature of the initial payment, processes the refund, effectively transferring legitimate funds to the scammer.
The cardholder discovers that their credit card has been stolen, and contacts the issuing bank to request a refund to recover the lost funds.
The seller not only loses the goods and the sale price, but also the funds they "overpaid" for the refund, as well as any resulting chargeback fees.


# Anti-Fraud: How to Prevent "Overpayment" Fraud


Now that we understand what overpayment fraud is, the next consideration is how to effectively prevent it. Dingxiang Anti-Fraud Cloud Business Intelligence Center experts recommend taking a multi-pronged approach, including transaction security, transaction identification, technical identification, and team security knowledge training.


## Strengthen Transaction Security


Increase the security of payments, reduce the risk of malicious transactions, and create a more secure and reliable payment environment.

Adhere to payment transaction security standards. Ensure that all devices have their default passwords changed and that cardholder data is encrypted. At the same time, establish an effective firewall between the internet and the system used to store data, and create a unique identity identification code for users who process credit card data.
Use the Credit Card Verification Value (CVV). The CVV is a three-digit or four-digit security code printed on the credit card. The payment processing system will automatically verify these numbers and confirm or reject the user's transaction request based on their validity, to ensure the user's legitimacy.
Use the 3DS verification service. The 3DS verification service is a network security authentication service launched by international card organizations such as Visa, MasterCard, and JCB. Before making an online purchase with a credit card, the user needs to enter a pre-set password to confirm that the cardholder is actually making the online transaction.



## Strengthen Abnormal Transaction Identification


The following measures can effectively identify potentially risky abnormal orders and take necessary verification measures to protect the rights and interests of merchants and consumers.

Pay attention to the consistency of billing address and shipping address. If the billing address and shipping address are different, this may be a risk signal for an abnormal order. In this case, we can ask the buyer to provide credit card statements, corresponding cardholder driver's license photocopies, phone numbers, etc., or to conduct a phone verification to confirm the buyer's identity.
Be wary of the same person placing multiple orders with different cards. If you find that the same person places multiple orders with different credit cards, this may also be a risk signal for an abnormal order. You can ask the buyer to provide additional identity verification or conduct a phone verification to verify the buyer's identity information.
Pay attention to the sudden increase in the number of orders. If the order quantity suddenly increases significantly, this may also be a risk signal for an abnormal order. In this case, we can ask the buyer to provide additional identity verification or conduct a phone verification to ensure the buyer's real identity.
Pay attention to the sudden change in the amount of consumption. If you find that the consumption amount is small and suddenly becomes huge, this may be a risk signal for an abnormal order. We can ask the buyer to provide further identity verification, such as credit card statements, driver's license photocopies of the cardholder, and conduct a phone verification to verify the buyer's identity.
Pay attention to buyers who urge delivery. If the buyer repeatedly urges the merchant to ship the goods after the purchase, this may also be a risk signal for an abnormal order. In this case, you can ask the buyer to provide additional identity verification or conduct a phone verification to ensure the buyer's real identity.
Pay attention to buyers with different credit cards and shipping addresses. If the buyer uses a domestic card, but the shipping address is in another country, this may be a risk signal for an abnormal order. We can ask the buyer to provide additional identity verification or conduct a phone verification to verify the buyer's identity information.
Pay attention to the behavior of multiple cards trading under the same IP address. If you find multiple different credit cards trading under the same IP address, this may also be a risk signal for an abnormal order. We can ask the buyer to provide additional identity verification or conduct a phone verification to ensure the buyer's real identity.


## Using Anti-Fraud Technology Identification


Dingxiang Anti-Fraud Cloud Business Security Intelligence Center recommends that, in terms of fraud prevention, it is necessary to have accurate identification, effective defense, and continuous evolution.
### Accurate Identification
tion

By using external mobile number risk scores, IP risk libraries, and proxy email detection tools, you can timely identify malicious mobile numbers, IP addresses, and email addresses, and by detecting the legality of the device fingerprint and the existence of injection, hook, and simulator risks, you can timely identify malicious devices.

Effective Defense

Combined with Dingxiang Anti-Fraud Cloud and Dingxiang Dinsight, build a risk management system that combines machine learning and rule-driven approaches. Through multi-dimensional and in-depth analysis, it can accurately identify abnormal operations and users, and take necessary measures to prevent fraud.

Continuous Evolution

Based on business data and risk data, establish a local name list dynamic operation and maintenance mechanism, consolidate and maintain the corresponding black and white list data, and timely update the risk strategy. At the same time, use the xintell intelligent model platform to build proprietary risk models, explore potential risks, and improve the security level of social media.



## Strengthening Team Fraud Training


Regularly hold fraud knowledge training for team members, explaining the different types of overpayment fraud and the abnormal events that need to be paid attention to, and providing skills for handling suspicious transactions and escalating issues when necessary. Through fraud training, the aim is to raise the awareness of fraud among team members, enhance their ability to identify and prevent fraud, and thus reduce the occurrence of fraud.

Here are some specific examples of how anti-fraud technology can be used to identify and prevent overpayment fraud:

Machine learning can be used to identify patterns of behavior that are indicative of overpayment fraud. For example, a machine learning model could be trained to identify users who frequently place orders with different credit cards, or who make orders for large amounts of goods that are shipped to different addresses.
Rule-based systems can be used to identify transactions that meet certain criteria that are indicative of overpayment fraud. For example, a rule-based system could be configured to flag transactions that are for more than a certain amount, or that are made by users who have recently opened new accounts.
Device fingerprinting can be used to identify malicious devices that are being used to commit overpayment fraud. For example, a device fingerprint could be used to identify devices that are running malicious software, or that are connected to a network that is known to be associated with fraud.
By combining these different technologies, businesses can create a more comprehensive and effective anti-fraud strategy that can help to protect them from overpayment fraud.


Overpayment Fraud: How E-commerce Platforms Can Defend Themselves

As one of the first batch of native application development partners of the HarmonyOS system, Dingxiang's multiple business security products have been perfectly adapted to the HarmonyOS system.

At the HarmonyOS Ecosystem Thousand Sails Launch Ceremony held recently, Huawei Executive Director and CEO of Terminal BG Yu Chengdong said that the HarmonyOS ecosystem has reached 800 million devices and will open up a new trillion-dollar industry blue ocean.
![2024012201.png](https://cdn.aisecurius.com/images/901/901d2fdf-be8c-4317-8ca3-28749687c6b8.png)
At the forum, Huawei announced that HarmonyOS NEXT Star River Edition (developer preview) is now open for developers to apply for. This version can achieve six extreme native experiences: native refinement, native ease of use, native smoothness, native security, native intelligence, and native interconnection.
![2024011901.png](https://cdn.aisecurius.com/images/454/454d8066-ac8d-4d37-9236-3ab54c61ef6b.png)

According to public data, there are currently over 200 leading application companies accelerating native development of HarmonyOS, covering a wide range of fields, including convenient living, travel and tourism, financial management, social information, productivity tools, audio-visual entertainment, and games. The HarmonyOS native application map has basically taken shape. In addition, HarmonyOS campus open classes have reached 135 universities, 305 university students have participated in HarmonyOS activities, 286 companies have participated in the HarmonyOS Ecosystem Academy, and over 380,000 developers have passed the HarmonyOS certification.

The HarmonyOS system was originally launched in 2015. It initially supported smart TVs, then supported lightweight IoT devices in 2020, and expanded to smartphones, tablets, watches, and bracelets in 2021. It is currently running on more devices such as cars. To date, the number of HarmonyOS ecosystem devices has exceeded 800 million, a rapid increase compared to August 2023.

As one of the first batch of native application development partners of the HarmonyOS system, Dingxiang's multiple business security products have been perfectly adapted to the HarmonyOS system. They can provide business security capabilities such as identity verification, device verification, and device protection for the HarmonyOS ecosystem. They can help developers to develop efficient end-to-end tools, promote the deployment and operation of enterprise businesses on the HarmonyOS platform, and help the rapid development of the HarmonyOS ecosystem.
![2024011902.jpg](https://cdn.aisecurius.com/images/aaf/aafa920d-846a-4b44-ab28-3d227a641173.jpg)

Dingxiang is a leading business security company in China, committed to helping enterprises build autonomous and controllable business security systems. It has independently developed a one-stop business security perception and defense cloud, including Device Fingerprinting, atbCAPTCHA, Dinsight, App shielding, and Security Perception and Defense Platform. These products have accumulated rich practical experience in industries such as banking, e-commerce, aviation, travel, games, education, tourism, media, government, and intelligent manufacturing. They provide enterprises with a security system covering the full life cycle of pre-event, in-event, and post-event. As of 2023, it has served nearly 4,000 companies in 24 industries.

Dingxiang will leverage its own advantages to provide all-scenario business security services for HarmonyOS ecosystem businesses, and work with Huawei to promote the rapid development of the HarmonyOS ecosystem, helping more enterprises to expand the HarmonyOS platform and seize the development opportunities of the new trillion-dollar industry blue ocean.

Dingxiang: Multiple security products have been integrated into the HarmonyOS ecosystem

The Dingxiang Defense Cloud Business Security Intelligence Center analyzed that H5 pages have become a preferred platform for illegal attackers due to the following issues:


We often see various H5 posters, product demonstrations, event promotions, and job postings. H5 can not only be seamlessly embedded in Apps and mini-programs, but can also be opened directly on the PC side as a page with an independent link address, which can be said to have good cross-platform adaptation. H5 can be used to create text, graphics, audio, and video, so it can be used for PC websites, mobile websites, microsites, Web Apps, light applications, and Web VR (popularization of virtual reality). Due to its mature technology, short development cycle, low investment and maintenance costs, and good compatibility, it is widely used in display, marketing, surveys, games, and so on.

While H5 brings convenient experiences to users, it also exposes businesses to a variety of business risks, such as link forgery, page tampering, information leakage, account theft, malicious hijacking, and scalping. According to a data from Dingxiang Defense Cloud Business Security Intelligence Center, H5 pages accounted for 46% of total attacks in website scraping data theft attacks, followed by mini-programs at 29%, then the Web at 18%; App at 5%, and other platforms at 2%.

![2024011603.png](https://cdn.aisecurius.com/images/11b/11b9f6dd-fcc5-466c-a26e-e7e516e6037a.png)
In addition to website scraping data theft, H5 is also a hot spot for attacks such as scalping, fake account registration, and dictionary attacks.


# Why H5 Pages Have Become a Preferred Platform for Illegal Attackers


The Dingxiang Defense Cloud Business Security Intelligence Center analyzed that H5 pages have become a preferred platform for illegal attackers due to the following issues:

Page code is often in "cleartext" format. The development language of the H5 platform is JavaScript, and all business logic code is executed directly on the client in a certain "cleartext" way. This means that attackers can easily obtain sensitive data such as account numbers, passwords, and personal information by simply inspecting the page code.
The underlying architecture has security vulnerabilities. Browsers have many restrictions on the H5 development language JavaScript, which also weakens the H5 security protection capabilities at the business layer to some extent. For example, attackers can exploit vulnerabilities in JavaScript to steal sensitive data or take control of user accounts.
There are many automation tools available publicly. The H5 page structure is transparent, and attackers can construct parameters and submit requests using scripts to achieve complete automation. These tools can effectively automate pages without having to reverse the JS code, making it easier for attackers to carry out malicious activities such as website scraping or scalping.
Operators have a weak security awareness. Many operators lack a systematic understanding of the security of H5 pages. They pursue short-term and quick online business, and they do not build a complete protection system for the H5 channel before launching marketing business involving funds. This makes it easier for attackers to exploit H5 pages to steal sensitive data or commit fraud.


# Obfuscation: The Best Security Measure for H5 Pages


To address the security risks of H5 pages, a dedicated obfuscation tool is needed to increase the difficulty of cracking, effectively increasing the cracking cost of attackers.

H5 code obfuscation is an important means of H5 security protection, which can protect the core code and sensitive data of H5 applications that need to be protected. It refers to modifying the H5 code to make it difficult to read and understand, thereby increasing the difficulty of malicious attackers to perform reverse analysis. At the same time, it effectively protects the security of H5 applications, preventing malicious attackers from stealing core code and sensitive data.

The common methods of H5 code obfuscation are mainly divided into four categories:

Identifier obfuscation: Modifying the identifiers in the code (such as variable names and function names) to make them difficult to identify.
Control flow obfuscation: Modifying the control flow structure in the code to make it difficult to understand.
Data structure obfuscation: Modifying the data structure in the code to make it difficult to identify.
Code compression: Compressing the code to make it difficult to read.
Dingxiang H5 Code Obfuscation

Dingxiang H5 Code Obfuscation converts strings, numbers, and regular expressions in the code to strings, then randomly splits the strings, and randomly encrypts the strings after splitting them using a reversed order or random key to encrypt the functions. At the same time, the order of the functions is shuffled, and the obfuscation algorithm is automatically updated and the JS is updated to the CDN, thus ensuring the security of the H5 page.

Dingxiang H5 Code Obfuscation supports a variety of obfuscation methods, including string encryption, string splitting, variable name obfuscation, control flow obfuscation, and constant extraction. It also provides a variety of security features, such as domain binding and anti-debugging. It is compatible with a variety of H5 code runtime environments, such as Android, iOS, WeChat Official Accounts, mini-programs, and web pages. It provides command-line tools and packaging plugins for webpack/gulp, seamlessly connecting to various packaging processes.

# 
Dingxiang: Adaptive Code Obfuscation Technology Based on AI


As the latest upgrade of Dingxiang H5 code obfuscation, Dingxiang AI adaptive code obfuscation is based on graph neural network technology. By deeply analyzing and extracting code features, it can automatically select suitable methods for obfuscation according to the characteristics of different code blocks. It can significantly improve the difficulty of reverse analysis of the code and effectively reduce the calculation performance consumption by 50%. Through the encryption obfuscation engine, H5 code can be encrypted, obfuscated, and compressed to greatly increase the security of H5 code and effectively prevent the product from being copied and cracked by black and gray industries.
![2024011602.png](https://cdn.aisecurius.com/images/f56/f5632d95-d5c6-4652-96ab-a1b9e628a4df.png)

Traditional H5 code obfuscation methods are often general, with a unified structure and logic, and are applicable to all types of H5 code. Once it is cracked by a reverse engineering tool, the entire H5 page will be cracked and invaded. Dingxiang AI adaptive code obfuscation can obfuscate different code blocks, such as short code blocks, long code blocks, simple code blocks, and complex code blocks. Based on deep analysis and extraction of code features, it can automatically select suitable methods for obfuscation, which can significantly improve the difficulty of reverse analysis of the code.

In addition, in traditional H5 code obfuscation, the calculation performance may be sacrificed for the obfuscation effect. For example, for a small piece of code, using instruction replacement obfuscation method can achieve good obfuscation effect, and the obfuscated code has relatively low calculation performance consumption; but for a whole long piece of code, the obfuscation effect of the method with relatively low obfuscation degree is often poor, so it is often forced to choose the obfuscation method with relatively high obfuscation degree, such as false control flow + code block segmentation obfuscation method, but these methods often have a very high consumption of calculation performance, which also leads to low code running efficiency. Dingxiang AI adaptive code obfuscation can reduce the calculation performance consumption by about 50% compared with traditional obfuscation methods while ensuring the obfuscation effect.

Overall, the advantages of Dingxiang AI adaptive code obfuscation mainly lie in the following aspects:

More advanced obfuscation effect: Dingxiang AI adaptive code obfuscation can automatically select suitable methods for obfuscation according to the characteristics of different code blocks, which can significantly improve the difficulty of reverse analysis of the code.
Lower calculation performance consumption: Dingxiang AI adaptive code obfuscation effectively reduces the calculation performance consumption while ensuring the obfuscation effect, which improves the running efficiency of H5.
Higher compatibility: Dingxiang AI adaptive code obfuscation supports a variety of H5 code runtime environments, such as Android, iOS, WeChat official accounts, mini programs, and web pages, with high compatibility.
Dingxiang AI adaptive code obfuscation can be widely applied to various H5 pages, especially in the financial, e-commerce, and gaming industries. It can effectively prevent malicious attackers from performing reverse analysis, protect the core code and sensitive data of H5 applications, and thus ensure business security.

Safety Warning: Unobfuscated H5 Pages Can Leak User Account Passwords

To ensure network security capabilities, Tiansin Technology has taken a variety of security measures and recently introduced Dingxiang atbCAPTCHA technology to further enhance the security of its services. 

Tiansin Technology, a company specializing in intelligent audio and video collaboration tools, has built a low-code-based audio and video collaboration PaaS platform that can quickly generate SaaS-level applications for different scenarios. It provides enterprises with scene-based service solutions based on the deep integration of AI+video, which enhances the ability of marketing lead generation, closing, customer service, and marketing repeat sales. It has been widely recognized by customers in the fields of insurance, banking, and consumer finance.

Through flexible product combinations and diversified product components, Tiansin Technology provides a variety of intelligent video solutions. Its Smart Sales Platform can provide on-demand remote video services, providing customers with functions such as document sharing, bidirectional whiteboard writing and drawing interaction. It can also identify customer questions and conversations in real time, providing service personnel with real-time answer prompts, thereby improving the professional level of service personnel and enhancing customer service quality and satisfaction.

In addition, the Integrated Video Service Platform integrates video with the existing text and voice customer service system to provide customers with online text consultation, telephone consultation, and one-click dial-in video seat service. The seat personnel can use screen sharing, electronic document transfer, and interactive whiteboards to conduct vivid business handling inquiries and business handling guidance remotely. The service recorder uses AI video analysis technology centered on cameras to reveal risks in financial and insurance transactions, realize recording and archiving, record the entire process of business handling, and provide enterprises with visible sales, visible service, and multimedia collaboration video communication services.
![2024011501.png](https://cdn.aisecurius.com/images/681/6819c385-7360-41bd-a666-37fff17c793a.png)

To ensure network security capabilities, Tiansin Technology has taken a variety of security measures and recently introduced Dingxiang atbCAPTCHA technology to further enhance the security of its services. Dingxiang atbCAPTCHA can perform auxiliary verification to prevent machine login and enhance the security of account passwords. When the system account password is cracked, it can intercept machine cracking and password exhaustion attacks; when the attacker steals the account to log in from another location or changes the device to log in, it can timely analyze the risk based on environmental information and device information and issue a security warning; when the attacker uses the password recovery intention to crack the account, it can estimate the possible abnormal operations and provide risk decision-making data for security operations.

Dingxiang atbCAPTCHA, backed by AIGC technology, can prevent threats such as brute force cracking, automated attacks, and phishing attacks, effectively preventing unauthorized access, account theft, and malicious operations, thereby protecting the stability of the system. It integrates 13 verification methods and a variety of control strategies, and has accumulated 4,380 risk strategies, 112 types of risk intelligence, covering 24 industries and 118 types of risk types. Its control accuracy is as high as 99.9%, and it can quickly realize the transformation from risk to intelligence. It also supports safe users to pass without feeling, and the real-time countermeasure handling capability has also been reduced to 60 seconds, further improving the convenience and efficiency of the digital login service experience.

**Free Trial of atbCAPTCHA? Click：**[https://www.aisecurius.com/products/captcha](https://www.aisecurius.com/products/captcha)

atbCAPTCHA: Securing the Login of AI+Video Application Systems

Thais spend an average of over 8 hours online per day, and more than half of the country's population uses or buys products and services through e-commerce channels.  

On January 2, 2023, Thai Prime Minister Prayut Chan-o-cha announced that Thailand and China will permanently waive visas for each other's citizens starting in March.  The news quickly sparked a surge in search interest in the two countries.  Searches for the keyword "Thailand" on a major OTA platform saw a 90% increase in real-time searches, while searches for flights from Shanghai and Beijing to Bangkok surged by more than 40%.  Search interest for the keyword "China" on the same platform's Thailand site also increased by more than 80% from the previous month, with the highest search interest in Guangzhou, Shanghai, Beijing, and Kunming.  Many netizens have said that they have added Thailand to their travel plans for holidays such as Labor Day and National Day this year.

A visa waiver is an agreement between two or more countries or territories that allows citizens of one country to enter the other country without a visa.  In the case of China and Thailand, this means that Chinese citizens with a valid passport can travel to Thailand without a visa, and Thai citizens with a valid passport can travel to China without a visa.

# Thailand: E-commerce booming


Thais spend an average of over 8 hours online per day, and more than half of the country's population uses or buys products and services through e-commerce channels.  The country has a massive e-commerce market, but it is also facing a variety of business frauds.  Thailand's internet economy was the second largest in Southeast Asia in 2022, after Indonesia, and is growing at a rate of about 6% per year.  Retail and wholesale are the most important contributors to the sector's continued growth, as industries such as insurance, transportation, arts, entertainment, and leisure participate in e-commerce.
![2024010901.png](https://cdn.aisecurius.com/images/2a4/2a4f9ce2-d586-4170-ab45-b441a8333f79.png)

Thailand's e-commerce platforms offer a wide range of products and services at competitive prices and promotional offers.  The most popular e-commerce products in Thailand are fashion products.  In the fashion category, the clothing segment generated the highest revenue in 2022.  In recent years, Thai consumers have increasingly turned to buying personal and home care, beverages, and food on e-commerce platforms.  In terms of online payment methods, consumers prefer to pay directly through websites or bank applications.  COD (cash on delivery) has lost some of its popularity since the pandemic.  The rise of digital payments in Thailand, including QR code payments and e-wallets, is also slowly moving the market away from a cash-based society.
![2024010902.jpg](https://cdn.aisecurius.com/images/a57/a57c6ab0-2310-4c17-b3f8-8d1dfd815c94.jpg)
For Thai online shoppers, e-marketplaces such as Shopee and Lazada seem to be the most popular platforms in the country, as they offer a wide range of products, rich promotions, a simple platform structure, and timely delivery.  In contrast, Facebook has emerged as Thailand's most popular online social seller sales channel.  Given the rise of social commerce in Thailand, Thai businesses see opportunities to promote and sell products through Facebook pages, Instagram accounts, LINE SHOPPING, and other platforms.  Additionally, TikTok's user base in Thailand has grown exponentially in the past two years, and the penetration rate of TikTok Shop is expected to expand in the coming years.  Additionally, Grab, traditionally known as a ride-hailing provider, has also joined the e-commerce bandwagon, launching GrabMart, a grocery delivery service, in limited cities in Thailand.


# Fraud: Not just consumers, businesses are also victims


As the demand for online shopping continues to grow, scams targeting consumers and businesses are also increasing rapidly. According to the High-Tech Crime Division of the Thailand Cyber Crime Investigation Bureau, there are currently 700 cases of fraud and scams reported each day, of which 40% involve e-commerce crimes. In the past year and a half, over 365,000 cases of online fraud have been reported, resulting in losses of 45 billion Thai baht.

In 2021, a 19-year-old Thai woman named Piyada Thongkhampan, who was wanted for online fraud, surrendered to police under immense social pressure. Piyada scammed around 500 people through selling on social media, most of whom were teenagers. Police investigation found that a criminal gang opened over 150 bank accounts for Piyada, one of which belonged to her deceased mother. These accounts were used to receive the money from the criminal gang's online sale of used phones. Piyada could earn 8,000 Thai baht each time. More shockingly, a 14-year-old victim died of a hemorrhagic stroke after learning that he had been scammed.
![2024010905.png](https://cdn.aisecurius.com/images/3da/3dad1b3d-a46c-490f-83f2-b9adced04274.png)

This case highlights the money laundering problem facing the Thai e-commerce market. Criminal gangs use "money mule" accounts to launder money, which are accounts that transfer funds from one country to another through unfair means such as online fraud. Police said these "money mule" accounts are used to hide the money trail, making it difficult for police to track down. Once the stolen money enters the account, it is quickly transferred to purchase other goods and services that are suitable for money laundering. This behavior seriously disrupts market order and harms the interests of consumers.

At the same time, the Thailand Cyber Crime Investigation Bureau cracked down on 191 online shopping fraud cases involving 201 people. Police warned consumers to be particularly wary of fake reviews when shopping online on e-commerce platforms. Unscrupulous merchants will hire people to post fake reviews to mislead consumers and sell counterfeit or completely fake products. This type of fraud not only harms the interests of consumers, but also affects the healthy development of the market.

In addition, Thailand has also seen a large-scale bank card skimming incident. On October 18, 2021, major media outlets reported cases of complaints about abnormal bank account deductions. A large number of credit cards, debit cards, and bank accounts linked to apps or shopping websites were skimmed, with each amount being relatively small but multiple transactions were made in succession. Police investigation found that most of these skimmed funds were used to purchase virtual goods such as in-game items or online advertising. Criminals use a variety of methods to steal credit and debit card information, including stealing card information by secretly filming the card information when paying for goods and services at department stores or stealing personal information through phishing.


# Anti-fraud: Government and tech companies join forces to combat it


To address the issues mentioned above, the Thai government and relevant authorities are taking a number of measures to strengthen regulation and crackdown on illegal activities. These include:

Strengthening the formulation and enforcement of e-commerce regulations to increase the transparency and traceability of e-commerce platforms.
Increasing the crackdown on money laundering, fraud, and bank card skimming to punish criminals severely.
![2024010903.png](https://cdn.aisecurius.com/images/775/775e6985-f369-41a5-a930-749bca88b0bf.png)
Strengthening consumer protection to raise consumer awareness and prevention capabilities.
On November 1, 2023, the Thai Anti-Cyber Fraud Operation Center (AOC) was officially launched. The center aims to protect financial institutions and individuals from cybercrime, and to protect the public from rampant online fraud. AOC is located at the National Telecom Headquarters in Bangkok and can be reached 24/7 by hotline 1441. The center is a collaboration between the Ministry of Digital Economy and Society (DES), the Anti-Money Laundering Office, the Cyber Crime Investigation Bureau, the Bank of Thailand, the Thai Bankers' Association, the Special Investigation Bureau, the National Broadcasting and Telecommunications Commission, and other relevant agencies. AOC's 1441 hotline provides the public with information about cybercrime, how to prevent online fraud, and damage control measures after being scammed.


## E-commerce platforms: Guard against fake reviews from merchants


To address the rampant problem of fake reviews on e-commerce platforms, Dingxiang's Anti-Fraud Cloud Business Security Intelligence Center recommends the following steps to effectively prevent fraud:

Identify accounts that modify IP and GPS. Dingxiang can detect whether there are any risks such as rooting, jailbreaking, hijacking, risk injection, hook, and emulator. By comparing with real devices, it can effectively identify cheating behaviors such as operator information, system information, hardware information, user behavior, CPU instructions, and emulator features.
Identify accounts that use fake devices. Dingxiang can quickly identify abnormal behaviors such as multiple activations with the same device, associated IP behavior with the same device, and a large number of aggregations in the same IP within a short period of time. In addition, it is recommended to establish a local blacklist and whitelist management mechanism through registration data, login data, and activation data, and maintain the corresponding blacklist data for user ID, mobile phone number, and device dimensions.
Identify accounts with abnormal behavior. Dingxiang can use user behavior to formulate strategies. Through the accumulation of risk data and business data, Dingxiang can build models for registration, login, browsing, and posting behavior to identify abnormal operations in time. These outputs can be directly used in risk control strategies to improve the security of e-commerce platforms.
Dingxiang's Anti-Fraud Cloud and Dingxiang Dinsight can help e-commerce platforms effectively prevent fake account risks. The risk control system that combines machine learning and rule-based guidance can accurately identify abnormal operations through multi-dimensional and in-depth analysis, conduct in-depth user profiling, and match large data. This helps merchants to timely identify suspicious operations, assess risks, and track and prevent the fraud behavior of fake review accounts.


## Anti-money laundering: Help financial institutions combat money laundering


Fraud and money laundering are becoming increasingly sophisticated, posing challenges for regulators, especially in terms of effectiveness and efficiency. With the rapid development of internet-based financial services, the means and methods of money laundering are becoming increasingly diverse, making it more difficult to review and monitor. Criminal gangs use a variety of technical means and purchased identity information to disguise their identities and open fake accounts, making it difficult for financial institutions to identify their identities and transaction behavior. To effectively combat fraud and money laundering, it is necessary to identify the inherent correlations from the source of the accounts, draw up a relationship map between them, and monitor them specifically. This will help to more effectively identify fraud and money laundering.

Dingxiang can help financial institutions build a security system that covers multiple channels and scenarios, providing multi-stage protection. By providing threat perception, security protection, data accumulation, model building, and strategy sharing, Dingxiang can help financial institutions to timely monitor abnormal transactions, draw a detailed user profile, and accurately locate fraud and money laundering accounts. This helps financial institutions to achieve efficient risk prevention and meet the needs of different business scenarios.

Improving risk perception capabilities。Dingxiang can use business security intelligence to summarize and analyze business security information such as telecom fraud, IP address risk, device risk, drug-related fraud risk, transaction risk, and business security information from different industries. By analyzing and mining attack characteristics and potential hazards, Dingxiang can effectively improve the emergency response ability and formulate scientific and effective prevention strategies.

Strengthening source-based anti-fraud identification capabilities。Dingxiang's deep learning-based correlation relationship graph technology can be applied to banking business scenarios, expanding the perspective and means of risk prevention. By using Dingxiang's intelligent model platform, a complete fraud and money laundering account identification mechanism based on correlation relationship graph can be built.


Online Fraud: A Quick Guide to Common Forms of Fraud in Thai E-commerce

As an important element of user interaction with enterprises, the appearance of a CAPTCHA can reflect the enterprise's style and characteristics.

BMW Conc App strengthens the close relationship between car companies and users. Through providing users with refined services, BMW, based on user research, marketing, product experience and after-sales capabilities, builds a user-centric service system, allowing users to experience a complete and exciting car-use cycle. This application not only has basic functions such as remote vehicle control and vehicle status check, but also elevates the user service experience to a new level.

Conc App provides BMW owners with many conveniences. Users can book BMW authorized dealer maintenance and repair services through Conc App, and obtain vehicle warranty information and user manuals. In addition, through the App, car owners can remotely start or shut down the vehicle, lock or unlock the vehicle, open or close the windows, and open or close the sunroof. More importantly, users can view real-time information about the vehicle's fuel level, electricity level, mileage, and fault codes, so they can have a clear understanding of the vehicle's condition.

Security is one of the most important concerns for users. In order to protect user information and data security, BMWConc App uses Dingxiang atbCAPTCHA and other multiple security measures. Dingxiang atbCAPTCHA combines Device Fingerprinting, behavioral characteristics, access frequency, and geographic location to effectively block malicious logins and batch registrations, and block machine operations and abnormal users, both ensuring user use safety and improving user experience.
![2024010403.jpg](https://cdn.aisecurius.com/images/fc0/fc02b9ac-339a-4ea0-a1a4-2ef157bb7872.jpg)

As an important element of user interaction with enterprises, the appearance of a CAPTCHA can reflect the enterprise's style and characteristics. Customized CAPTCHA appearances can incorporate elements such as enterprise logos, slogans, and advertisements, achieving brand promotion effects. The CAPTCHA appearance of Conc App has been carefully designed to incorporate BMW's brand elements, helping users to deepen their understanding and memory of the brand during use.

In addition to appearance design, Dingxiang atbCAPTCHA also provides an online appearance management function, allowing managers to perform custom configuration, logo configuration, and font configuration, and preview the effects immediately. This convenient operation method makes it easy for BMW to complete the customization and transformation of the CAPTCHA appearance, ensuring that it is in line with the enterprise's brand image and style, while attracting user attention.

With the help of Dingxiang atbCAPTCHA, Conc App has deployed a dedicated CAPTCHA. When users register and log in for verification, they can not only appreciate BMW's latest models, but also participate in them through interactive methods such as manual sliding or puzzles. This design not only ensures user safety login, but also provides users with a convenient interactive experience.

As a key element that often appears in the human-computer interaction interface, CAPTCHA plays an important role in identity verification, risk prevention, and data anti-crawl. Widely used in websites and Apps, CAPTCHA has the function of human identification and identity verification in various scenarios such as registration, login, transaction, and interaction, and also plays an irreplaceable role in ensuring account security.

Dingxiang X BMW Conc App: Convenient Interaction for Car Owners

Dingxiang Defense Cloud Business Security Intelligence Center predicts that the top five business fraud risks in 2024 will be as follows

2024: These Five Business Fraud Threats Are Set to Explode

Global fraud losses are on a staggering growth trajectory, causing significant disruption and losses to businesses and consumers. It is estimated that global fraud losses reach $5.4 trillion, while the UK's fraud losses are about $185 billion. In the United States, the cost of fraud for financial services companies increased by 9.9%, highlighting the severity of the issue.

The main drivers behind this growth trend are technological advancements and the continued development of social engineering. As people increasingly turn to online and mobile channels to shop, fraudsters are following suit, using advanced technological means to carry out fraud activities. Additionally, social engineering exploits the human element, which is the most complex and persistent security vulnerability, making many users who lack information security thinking a target for fraudsters.

Social media platforms have become an important tool for fraudsters. The global 4.8 billion social media users provide a wide pool of potential targets, but most users lack the necessary information security thinking and training to identify and avoid fraudulent behavior. Phishing campaigns continue unabated, and with the maturing and application of AI tools, phishing lures are becoming increasingly convincing. These tools can generate realistic text and content, making people more susceptible to being duped by fraudulent behavior.

Dingxiang Defense Cloud Business Security Intelligence Center predicts that the top five business fraud risks in 2024 will be as follows:


# AI: New Threats from AI Grow Exponentially


As artificial intelligence (AI) becomes increasingly pervasive in all industries, its security implications are becoming a growing concern. AI is becoming a new tool for threats, with attackers using AI technologies to pose unprecedented risks to businesses and individual users. In 2024, all industries will face a surge in cyberattacks using machine learning tools.
![2024010305.png](https://cdn.aisecurius.com/images/dad/dad4884c-9caf-43e5-8e37-5d5cc293f4af.png)

Spreading misinformation. Generative AI can be used to spread misinformation or create realistic phishing emails. Some criminals have reportedly begun using generative AI tools like ChatGPT to create phishing emails that sound as professional as those from legitimate businesses. These emails often pose as representatives from banks or other institutions, asking victims to provide personal information or funds, which could lead to financial loss or identity theft if not followed.

Disrupting cybersecurity. Malicious or faulty code generated by AI could have a devastating impact on cybersecurity. As more businesses use AI for business applications such as data analytics, healthcare implementations, and user interface customization, hackers could exploit vulnerabilities in these applications to launch attacks. According to reports, the number of AI security research papers has exploded in the past two years, and the 60 most commonly used machine learning (ML) models have an average of at least one security vulnerability. This means that hackers could exploit these vulnerabilities to control or destroy devices and systems that use these models.

Increasing fraud risk. Fraudsters can also use AI technologies to mimic legitimate ads, emails, and other forms of communication, increasing the risk of fraud. This AI-driven approach will lead to an increase in low-quality activity, as the entry barrier for cybercriminals will be lowered and the likelihood of deception will increase.

Manipulating data and decisions. In addition to cybersecurity threats, generative AI could also be used to manipulate data and decisions. Attackers could attempt to poison the data that AI uses, leading to organizations that rely too heavily on AI to be systematically misled in their decision-making. This could involve deleting certain key information from the data or adding false information, making AI systems produce inaccurate results.


# Fake Identity: Increasingly Difficult to Identify in 2024


Long-standing, impersonation fraud has always been a common scam tactic. But with the development of artificial intelligence (GenAI), synthetic identity theft and fraud are now easier than ever before. This technology allows fraudsters to create identities at scale, making it easier to generate believable synthetic IDs.

Based on the fusion of “deep learning” and “forgery,” AI can create convincing fake audio, video, or images. This technology allows fraudsters to quickly create new identities that are more believable. By piecing together elements of personal information and combining them with fake identifiers, fraudsters can create new identities. These identities can be used for a variety of fraudulent activities, such as credit card fraud, online scams, and more.

![2024010302.png](https://cdn.aisecurius.com/images/903/903f8e19-3b2b-4574-9004-40c2fed74f68.png)

According to McKinsey Institute data, synthetic identity fraud has become the fastest-growing type of financial crime in the United States and is on the rise globally. In fact, synthetic identity fraud accounts for 85% of all current fraud activity. Additionally, GDG research shows that over 8.6 million people in the UK use a false or someone else’s identity to obtain goods, services, or credit.

Synthetic identity theft is a challenging task because these identities often involve a combination of real elements (such as a real address) and fabricated information. This makes detection and prevention extremely difficult. The use of legal components and false details further complicates detection. Additionally, since these fraudulent identities lack prior credit history or related suspicious activity, they are difficult to identify through traditional fraud detection systems.

Social media platforms have become a major exploitation channel for synthetic identity fraud. Using AI technology, fraudsters can create and distribute highly customized and convincing content that can be targeted to individuals based on their online behavior, preferences, and social networks. This content can seamlessly integrate into users’ feeds, promoting rapid and widespread dissemination. This makes cybercrime more efficient and challenging for users and platforms alike.

For financial institutions, this is even more concerning. Fraudsters using AI to learn the business processes of individual financial institutions, their understanding of how various organizations operate, can write scripts to quickly fill out forms and create what appears to be a credible identity for credit fraud.

This is especially concerning for new account fraud and application fraud. Every bank has its own account opening workflow, its own unique technology, and its own language at onboarding. Individuals must appear credible in order to open an account. Fraudsters can use GenAI tools to learn the different bank screen layouts and stages. With an understanding of how various organizations operate, fraudsters can write scripts to quickly fill out forms and create what appears to be a credible identity to carry out new account fraud. Banks will no longer need to answer the question “Is this a good fit?” but also “Is my customer human or AI?”

It is projected that as AI technology continues to develop and become more widespread, increasingly more impersonation fraud will emerge. Fake identities, fake accounts, and more will become more common. Businesses and individual users need to be vigilant and enhance their security awareness, while businesses and organizations also need to continuously strengthen their AI security measures and internal training to mitigate potential risks.


# Malicious Crawlers: Still Rampant in 2024


As artificial intelligence (AI) technology continues to develop, the demand for data for AI is also growing. The emergence of generative AI and large models has put unprecedented demands on data. For example, the pre-training data size of OpenAI's GPT model was only 5GB for GPT-1, 40GB for GPT-2, and 45TB for GPT-3. The market has gradually reached a consensus: those who have data have the world, and data is the key to the competition of large models.

![2024010304.png](https://cdn.aisecurius.com/images/7a6/7a62e732-59bd-4f07-96b8-babeba38552d.png)

Currently, there are two main sources of AI training data: self-collection and crawling. Self-collected data requires a lot of manpower, material resources, and time, and the cost is high. Crawling data is relatively easy to obtain, posing a huge challenge to data security. Data leaks and privacy violations are becoming increasingly common. In particular, with the emergence of cybercrime as a service (Cybercrime as-a-Service), it is becoming easier to purchase malicious crawler services and technologies. It is estimated that in 2024, the threat of malicious crawlers stealing data will continue to increase.

Malicious crawlers are automated programs that can access and crawl website data by simulating user behavior. Malicious crawlers are often used to illegally obtain user personal information, business secrets, and other data. The data stolen by malicious crawlers not only includes publicly available data on the Internet, such as user data on social media, but also unauthorized data, such as enterprise internal data, personal privacy data, and sensitive data, such as financial data and medical data. In 2022, the National Security Agency (NSA) released a report stating that data stolen by malicious crawlers has become an important source of cyberattacks.


# Account Takeover Fraud: Account Takeover Fraud Will Increase Significantly in 2024


Account takeover (ATO) fraud is a type of identity theft in which fraudsters use phishing and malware methods to obtain legitimate user credentials or purchase privacy information from the dark web. They then use technical means to take over the use of the stolen account.
![2024010303.png](https://cdn.aisecurius.com/images/cc1/cc1c7a27-cb01-4179-b9eb-e2e5f05c062b.png)

ATO fraud has been on the rise for years. In 2022, ATO fraud accounted for more than one-third of all fraud activity reported to the FTC. In 2020, ATO fraud grew by a staggering 350% year-over-year, with 72% of financial services companies experiencing such attacks. In 2021, account takeovers led to 20% of data breaches, resulting in losses of over $51 billion for consumers and businesses.

The increase in account takeover fraud is due in part to the rise in phishing attacks and data breaches, as well as the increasing frequency of data breach events, which make it easier for fraudsters to obtain user personal information and passwords. On the other hand, AI technology can help fraudsters quickly identify suspicious accounts and automatically generate effective attack tools.

Fraudsters will transfer balances, points, and vouchers from the account, and they will also use stolen accounts to send phishing emails, post fake information to brush orders, brush fans, and brush comments, making them look more real. In addition, fraudsters may also use stolen accounts to create fake product or service sales websites, post threatening, harassing, or spreading hate speech. In short, the behavior of fraudsters stealing accounts has caused serious losses to individuals and businesses. Individuals may face economic losses, identity theft, and other problems. Businesses may face financial losses, reputational losses, and other problems.

As AI technology continues to develop and become more widespread, it is expected that account takeover fraud will become more common and difficult to prevent in 2024.


# Internal Leaks: Increased Risk of Enterprise Internal Breaches in 2024


Internal threats have become a major challenge for businesses. Data shows that internal threats have surged by 44% in recent years. These threats can come from the actions of employees, customers, or suppliers, whether malicious or negligent. In particular, employees with privileged access are the biggest source of fraud risk.
![2024010306.png](https://cdn.aisecurius.com/images/52b/52b6aa9f-6255-4312-bfa7-3d2dda31a96f.png)

Early research has found that language models can leak privacy information, and as generative AI is used more and more in business, it brings new risks and challenges. Internal data leaks are expected to become one of the most important business risks in 2024.

The BYOAI (bring your own AI) phenomenon is becoming increasingly common, as employees use personal AI tools in the workplace. This poses a risk of leaking sensitive corporate secrets, albeit unintentionally. In addition, fraudsters are using AI to carry out complex attacks, such as deepfakes, making it more difficult for victims to distinguish and defend against them. For example, fraudsters can create fake emails or documents to deceive employees or bypass security systems.

2024: These Five Business Fraud Threats Are Set to Explode

Decisioning engines are used to identify, assess, and manage risk, helping businesses and individuals reduce risk and improve security. In the financial industry,

Decisioning engines are used to identify, assess, and manage risk, helping businesses and individuals reduce risk and improve security. In the financial industry, risk management can help financial institutions identify and assess credit risk, market risk, and operational risk, thereby reducing financial institution losses. In the insurance industry, risk management can help insurance companies identify and assess insurance risk, thereby improving insurance company profitability. In the manufacturing industry, risk management can help manufacturing companies identify and assess production risk and supply chain risk, thereby improving manufacturing company productivity. For e-commerce platforms, risk management systems can verify user identity, prevent fraudulent registrations, fraudulent orders, malicious cash withdrawals, and counterfeit goods. In addition, they can assess logistics risk, thereby preventing logistics fraud and logistics losses.

Decisioning engines are playing an increasingly important role in all industries, and the security risks of decisioning engine logins are also becoming increasingly prominent. As an important part of the risk management system, the login interface not only affects system configuration management, but is also an important line of defense against external attacks. Once this line of defense is breached, the security of the entire risk management system will be seriously threatened. A security risk survey of decisioning engine login interfaces shows that the main security threats faced by this link include weak password issues, unauthorized access, phishing attacks, and cross-site scripting attacks (XSS). Decisioning engine security is very important. How to timely warn in advance before being stolen?

E-pet Technology, which has been deeply involved in the pet industry for more than ten years, has continued to work hard in the fields of pet functional food research and development, pet food safety, pet psychological health, pet gene technology and medicine. E-pet has a storage system in Chongqing, Hangzhou and other places, and has reached strategic cooperation agreements with imported brands such as渴望 (Kibble), 爱肯拿 (Acana), go, now, 枫趣 (Fengqu), vitalife, 纽顿 (Newton), 欧恩焙 (Oenbei), 益之选 (Yisuixuan), and 耐吉斯 (Nageese). E-pet Technology owns the pet industry e-commerce platform E-pet Mall with its own logistics and storage system, and also provides services to tens of thousands of pet stores.
![2023122908.png](https://cdn.aisecurius.com/images/d9c/d9c36f92-1c99-440c-996b-a2a2e3ee4e69.png)

E-pet Technology attaches great importance to security. In order to further secure the decisioning engine, it deployed Dingxiang atbCAPTCHA at the risk management login. Dingxiang atbCAPTCHA can conduct auxiliary verification to prevent machine logins and enhance security. When the decisioning engine account password is cracked, atbCAPTCHA can intercept machine cracking and password exhaustive matching behavior. In addition, when attackers steal accounts and log in from other places or change devices to log in, the verification code based on environmental information and device information can timely analyze risks and issue security warnings. Finally, when attackers use password recovery to intend to crack accounts, atbCAPTCHA can predict possible abnormal operations based on environmental, device, risk data, and proprietary risk control models, and provide risk decision-making data for security operations.

Dingxiang atbCAPTCHA integrates 13 verification methods and multiple control strategies, and has gathered 4380 risk strategies, 112 types of risk intelligence, covering 24 industries, and 118 types of risk. The control accuracy is >99.9%, and it can be transformed from risk to intelligence within 1 day. The industry risk perception capability is strengthened. At the same time, it supports safe users to pass without feeling, and the real-time countermeasure handling capability is even reduced to within 60 seconds. Help enterprises quickly verify their identity in scenarios such as login, registration, and payment, greatly improving the convenience and efficiency of service experience.erience.


————————————END————————————

atbCAPTCHA,bot management,anti-bot Captcha,captcha,anti-bot solution,captcha security,fraud protection,Mobile Authentication,captcha plugin,vaptcha,botdetect


atbCAPTCHA: Helping Enterprises Secure Decisioning Engine Login

The Dingxiang Defense Cloud Business Security Intelligence Center has analyzed that the following four trends are emerging in business risk in 2023


According to the "2023 Digital Business Risk Data" statistics from the Dingxiang Defense Cloud Business Security Intelligence Center, malicious website scraping is the most common risk, accounting for 37.8% of the total; followed by fake account registration, accounting for 18.79%; ranking third is scalping, accounting for 11.28%; facial recognition risk and facial spoofing risk are gradually emerging, also reaching 1.45%; in addition, other types of risks (loan fraud, cash withdrawal, money laundering, account theft, counterfeit App) account for 30.67%.

![2023122601.jpg](https://cdn.aisecurius.com/images/b10/b10d4bfd-d767-43c6-8a4f-1f0046b4c254.jpg)

# Trends: New Business Risk Trends


The Dingxiang Defense Cloud Business Security Intelligence Center has analyzed that the following four trends are emerging in business risk in 2023:

AI-powered fraud is becoming more sophisticated. The use of AI to create fake news, fake messages, fake accounts, fake voices, and fake images is having an increasingly serious impact on society. This false information can not only mislead public perception and judgment, but also undermine social trust and order, and even trigger panic and violence.

Fraud based on technology and social engineering is on the rise. Criminals have been sending out large numbers of crab vouchers, wet wipes, and phone holders, inviting victims to scan QR codes to enter phishing websites or communities, and then carrying out fraud. This type of fraud combines technical and psychological operations, making it difficult to prevent and detect.

CaaS threats are driving a surge in cyber fraud. "Crime as a Service" (CaaS) allows those with the intent to attack but lack the skills to easily launch attacks using one-stop attack services. For those who provide attack services, manufacturing and selling attack products and services can easily enjoy simple, fast, and repeatable sustainable profits. CaaS lowers the barriers to entry and costs for black and gray industry attacks, increases the scale and efficiency of cyber fraud, and poses greater security challenges to businesses.

Black and gray market attacks are becoming more frequent. In the context of economic change, more and more people are resorting to unscrupulous means to pursue profits, leading to an upsurge in cyber black and gray market attacks.

Analysis: Four New Trends in Digital Business Risks in 2023

Dingxiang atbCAPTCHA intelligently judges the operator and classifies the operator into three levels: normal, suspected risk, and risk.


Captcha is a key element that frequently appears in the human-computer interaction interface, and is an important part of identity verification, risk prevention, and data crawling prevention. It is widely used on websites and apps, and plays a huge role in various scenarios such as registration, login, trading, and interaction. It has the function of real-person identification and identity verification, and is also important in ensuring account security.

Dingxiang atbCAPTCHA intelligently judges the operator and classifies the operator into three levels: normal, suspected risk, and risk. Among them, normal operations can pass without feeling, and even ordinary operations only need to complete the first certification, and can pass without feeling within 5 seconds; suspected risk operations need to be re-verified; and risky operations will be rejected directly.

The judgment standard of Dingxiang atbCAPTCHA is based on multi-dimensional strategies, including device risk identification, human-computer identification models, and behavior feature models. For example, at the device level, if the user logs in from two different devices twice, the system will judge the user as a suspected risk user. Generally speaking, normal users can pass without feeling, ordinary users can also pass without feeling after completing the first certification, suspected risk users need to be re-verified, and risky users will be rejected directly.

To facilitate managers to set up verification, Dingxiang atbCAPTCHA has a built-in verification magic cube. The verification magic cube uses a flowchart to display the verification process, allowing managers to visually edit and configure the verification process.

In the Dingxiang Invisible Verification Management Console, managers can configure the Verification Magic Cube 1 and Magic Cube 2 online, complete the configuration within 10 seconds, and take effect within 60 seconds to achieve rapid attack and defense.
![2023122201.png](https://cdn.aisecurius.com/images/4ad/4ad70457-ebff-418b-8a97-04103b955540.png)

Verification Magic Cube 1 is suitable for embedded, inline, click-through, and pop-up CAPTCHAs. Magic Cube 2 is suitable for pop-up and click-through CAPTCHAs. Managers can choose the verification magic cube based on the limitations of the front-end display method.
![2023122202.png](https://cdn.aisecurius.com/images/e2b/e2b4cd70-7aca-4174-b184-aa514c2b705d.png)

However, it is important to note that when the risk control system directly specifies the required verification method, its priority is higher than the verification magic cube, and the actual risk control is given priority. When there is no risk control intervention, the verification system will automatically call the CAPTCHA magic cube configuration for verification. In addition, the first verification and secondary verification in the verification magic cube will be randomly selected according to the configured verification method.

Dingxiang atbCAPTCHA integrates 13 verification methods and various control strategies, and has gathered 4380 risk strategies, 112 types of risk intelligence, covering 24 industries, and 118 types of risk types. The control accuracy is >99.9%, and it can realize the transformation from risk to intelligence within one day, strengthening the industry's risk perception ability. At the same time, it supports safe users to pass without feeling, and the real-time countermeasure disposal ability is further reduced to 60 seconds. It helps enterprises to quickly verify identity in scenarios such as login, registration, and payment, greatly improving the convenience and efficiency of service experience.

————————————END————————————

atbCAPTCHA,bot management,anti-bot Captcha,captcha,anti-bot solution,captcha security,fraud protection,Mobile Authentication,captcha plugin,vaptcha,botdetect


atbCAPTCHA: Online Management of the "Verification Magic Cube"

In the era of digital interconnectedness, geolocation data is indispensable. Geolocation data is not just a simple coordinate, but also a digital footprint, depicting people's actual existence in the digital world.

In the era of digital interconnectedness, geolocation data is indispensable. Geolocation data is not just a simple coordinate, but also a digital footprint, depicting people's actual existence in the digital world. These data provide us with key background information, allowing us to better understand people's living environment while enjoying digital services.

First, map and navigation services based on geolocation data. By providing accurate and real-time location information, maps and navigation can help us plan the best route, avoid traffic congestion, and effectively reach our destination. Whether we are traveling in the city or strolling on a country road, maps and navigation can provide us with real-time route information and traffic conditions, making our travel more convenient and efficient.
![2023121401.jpg](https://cdn.aisecurius.com/images/edc/edc7ebfb-8a2a-4c94-8cf6-7c5ce8d27048.jpg)
Second, location-based services based on geolocation data. These services can provide customized services based on the user's precise location, such as weather forecast, nearby restaurants, retail stores, and tourist attractions. Through geolocation data, we can better understand the surrounding environment and resources, and thus better plan our lives.

In addition, targeted advertising is also an important application based on geolocation data. By leveraging geolocation data, advertisers can more accurately understand user interests and needs, and thus provide more accurate advertising content. This targeted advertising can reach the audience based on demographics, behavior, and geolocation, optimize marketing resources, increase engagement, and potentially lead to higher conversion rates.

With the continuous development of technologies such as 5G, the Internet of Things, and artificial intelligence, the application of geolocation data will become more intelligent and personalized. For example, by combining the high-speed and low-latency characteristics of 5G technology, more accurate positioning and navigation can be achieved; through the Internet of Things technology, the operating status and location information of various devices can be monitored in real time; through artificial intelligence technology, deep analysis and mining of large amounts of geolocation data can be performed.


# Threat: The threat of faking geolocation data


Geolocation spoofing, also known as location simulation, is a tool that can change the current location by simulating the location of a mobile phone. Originally, geolocation spoofing was used to test apps, helping developers to simulate different addresses to implement the location function of the test. However, geolocation data is also facing the risk of being falsified, which brings multiple business risks to enterprises and consumers.
![2023121402.jpg](https://cdn.aisecurius.com/images/f6e/f6e618fc-3520-4750-951b-87b501f93db9.jpg)

Fake exercise steps, affecting user experience. Running check-in is to identify the movement of the phone, GPS information, and the shaking of the phone itself by using the sensors inside the hardware, and to record the exercise steps in real time. Through the simulator cheating software, it can directly set the location on the system and run automatically according to the distance. If the App cannot distinguish between exercise fraud, it will still record the exercise amount, resulting in exaggerated and false exercise steps.

Snap up urban consumption coupons, disrupt market order. The rules for issuing consumption coupons in various places clearly state that consumers can only receive consumption coupons in their own cities. Black and gray industries can use geolocation spoofing tools to modify the location, change the IP address, and fake GPS positioning to achieve "city crossing". By breaking through the merchant's location restrictions, it is possible to batch receive "urban consumption coupons" from various cities, and then resell them at a low price.

Ride-hailing brushing orders, harming corporate interests. In order to ensure the travel experience of passengers, ride-hailing platforms usually require drivers to take orders on a daily basis, and issue rewards based on the daily order quantity. Some ride-hailing drivers use simulator tools to tamper with the GPS location of their mobile phones, fake passenger orders, and fake driving routes, including straight lines, turning trajectories, freely adjustable running speed, and dynamic running speed. If ride-hailing drivers have multiple accounts and phones, combined with order grabbing cheating tools, they can realize self-dispatching and brushing orders at home.


# Identification: How to effectively identify geolocation fraud?


Compared with real geolocation, fake geolocation can be accurately identified and judged by security technology.

Operator information: Real geolocation devices have a phone number, an operator, and a signal strength that changes; the mobile system of the simulator does not have these.

System information: The brand, specific model, and serial number of the phone; the mobile system of the simulator is not real information.
![2023121403.png](https://cdn.aisecurius.com/images/630/63094355-1702-48fa-aa17-c3a3f69b1637.png)

Hardware information: Sensors, GPS, gyroscope, battery, voltage, battery level, temperature; the real machine will shake when held in the hand, the battery will be depleted, and the phone temperature will rise. Although the simulator has some of this information, it will not shake and is fixed.

Operational behavior: The device on a real machine has a contact book, the call log will not be 0, and there are fixed commonly used apps, because they need to be used. The simulator is generally 0 in the contact book and does not have these commonly used apps.

CPU instructions: ARM vs. X86. The instructions on the phone are ARM, and the simulator is to run on the computer, and the instructions are only X86. ARM vs. X86 is very different, and the machine code and instructions of the two can be used to judge.


# App shielding: Effectively preventing geolocation spoofing


The App shielding service in Dingxiang Defense Cloud supports Android app hardening, iOS app hardening, and hardening apk. It has unique cloud strategies, business security intelligence, and big data modeling capabilities. It can effectively defend against attack threats such as memory injection, Hook, debugging, injection, multi-opening, memory Dump, simulator, App repackaging and cloning, and Safeguard sensitive app data. It can prevent App from being invaded, tampered with, cracked, and repackaged by malicious attacks. It can conduct security testing for existing applications, discover the risk vulnerabilities in the application, and carry out targeted repairs and rectifications. It can protect sensitive data, code obfuscation, code integrity, and memory data, avoiding the security impact of system vulnerabilities on the application itself from the source, and preventing the use of simulator cheating tools.

In addition, the Dingxiang App shielding service can provide mobile application security monitoring for App, and monitor the terminal device, running environment, and operational behavior of the mobile application in real time. It helps App to establish a monitoring, early warning, blocking, and tracing security system for the entire life cycle of App, from design, development, release, to maintenance.

————————————END————————————

++**shared library hardening，Safeguard sensitive app data，anti-reverse engineering，in-app security，hooking frameworks，Hardening apk，Financial fraud，App shielding，App repackaging and cloning，App Hardening，Android Hardening，Android app security，Android app hardening，Android App Bundle hardening，aab hardening**++


App Hardening: A Key Strategy Against Geolocation Spoofing

Websites need to take measures to prevent illegal registration and login, and captcha is one of the effective protection measures.  


Websites need to take measures to prevent illegal registration and login, and captcha is one of the effective protection measures.  Attackers often use automated tools to batch register website accounts to carry out malicious activities such as spam and brushing.  Captcha can effectively prevent these automated tools, effectively prevent malicious programs or personnel from batch registering and logging in to the website.  Malicious programs or personnel often use brute force cracking and other methods to try to log in to website accounts.  Captcha can effectively increase the difficulty of brute force cracking, prevent malicious logins, and protect user privacy and property security.

In addition, malicious crawlers are also a risk faced by tech product websites.  The "Malicious Crawler Report" released by Arkose Labs shows that in the third quarter of 2023, malicious crawler programs and fraudulent traffic accounted for 73% of internet traffic.  Malicious crawlers are often used for content scraping, not only stealing content and republishing it on other channels, but also obtaining information from competitors for unfair competition.  This not only damages the interests and reputation of legitimate websites, but also distorts the entire network ecosystem.  Many times, websites may mistakenly think that their traffic has increased, but in fact they have been attacked by malicious crawlers.

Competitors may use crawlers to collect data from tech product companies' websites to learn about their products, technologies, market strategies, etc.;  attackers may use crawlers to collect data from tech product companies' websites to find security vulnerabilities or steal sensitive information.  In addition, malicious advertising crawler attacks: malicious advertisers may use crawlers to collect data on the traffic of tech product companies' websites to place more effective ads.

![2023121501.png](https://cdn.aisecurius.com/images/c4e/c4ed3bb6-375e-41cf-824f-040609dd27d4.png)

To protect user account security and prevent malicious crawler attacks, Cherrypicks, a local tech startup based in Hong Kong, has chosen Dingxiang atbCAPTCHA to secure its website accounts and data. Dingxiang atbCAPTCHA is one of the modules of Dingxiang Defense Cloud, which can effectively block malicious crawlers from stealing or misusing data. It can also conduct real-time verification, identification, and interception of malicious accounts and malicious crawling behaviors at key stages such as registration, login, and query. Through Dingxiang's invisible verification technology, Cherrypicks can more effectively prevent malicious crawler attacks and protect the security and privacy of its user data.

Cherrypicks is a local tech startup headquartered in Hong Kong and is now a subsidiary of NetDragon. It provides digital transformation, location intelligence, intelligent retail, financial technology, real estate technology, healthcare technology, and enterprise blockchain solutions.**

————————————————END————————————————

*atbCAPTCHA,bot management,anti-bot Captcha,captcha,anti-bot solution,captcha security,fraud protection,Mobile Authentication,captcha plugin,vaptcha,botdetect*

atbCAPTCHA: Can protect company website data and account security

CaaS threats are quietly emerging in China, starting with ticket scalping services and cheating software sales.


Crime as a Service (CaaS) is a cybercrime model that involves experienced hackers providing customized cyber attack services to individuals or groups that want to target a specific organization or company but lack the resources, skills, or time to do so.  In other words, CaaS makes it possible for those with the intent to attack but not the skills to do so to easily launch attacks using a one-stop shop for attack services.  For those providing attack services, creating and selling attack products and services can be a simple, quick, and repeatable way to generate ongoing revenue.

![2023120701.jpg](https://cdn.aisecurius.com/images/c5e/c5edf37a-f57a-4994-9cbe-2ff8abc7c319.jpg)

CaaS is a growing threat.  It was considered one of the biggest cybersecurity issues of 2018, and with the rise of artificial intelligence, machine learning, and cloud computing, it has become an even more powerful tool or target for attackers to improve their attack methods.

CaaS attacks are typically targeted, with specific organization or company objectives.  Their primary purpose is to steal data, damage systems, extort ransom, or carry out other malicious activities.  Because the attackers launching the attacks are experienced, their attack behavior is highly stealthy and flexible, and they can customize the attack plan, timing, and method according to the needs and objectives of the payer.  Additionally, CaaS attacks are highly scalable and replicable.  The attackers providing the services have access to ready-made tools and techniques that allow them to launch large-scale attacks quickly.

CaaS has opened up a new Pandora's box of cybercrime threats.  Common CaaS threats that are currently being seen internationally include malicious crawling, ransomware, distributed denial of service (DDoS), and phishing attacks.

Ransomware as a Service (RaaS): Both skilled and unskilled attackers can rent ransomware tools and launch attacks.  This is one of the reasons ransomware attacks continue to increase.

Attack crowdsourcing: Attackers hold open competitions in the dark web to seek new attack techniques and methods, allowing more attackers to help them improve their research and development processes.

Phishing as a Service: Those who want to become phishing attackers can launch phishing attacks by purchasing a phishing toolkit.  This includes the features and tools needed to launch an attack, such as email templates, deceptive website templates, and a clever list of potential targets.

Purchasing distributed denial of service (DDoS): Attackers can cause a target's website, app, or individual service to be unavailable or disrupted for a short period of time, resulting in significant revenue and reputational losses, for a relatively small fee (for example, in Europe, the price for such services ranges from 5 to 500 euros).


# CaaS: CaaS Attacks Quietly Rising in China


CaaS threats are quietly emerging in China, starting with ticket scalping services and cheating software sales.


### Tickets: Hackers Offer Proxy Ticket Service to the Public


In September 2023, Jay Chou's concert in Tianjin was sold out in less than 30 seconds, with more than 130,000 tickets snapped up. Many Internet users have complained about being unable to secure tickets, while "scalpers" have raised ticket prices to outrageous levels. Some tickets in the first three rows of the infield are said to be selling for 19,800 yuan. Some people even sold tickets for 150,000 yuan, which were originally priced at 2,000 yuan.
![2023120703.png](https://cdn.aisecurius.com/images/b48/b48c7113-b72b-4559-abff-51ccb439285f.png)
In the summer of 2023, museum tickets are popular. Free tickets, which cannot be obtained in official channels, are frequently reported to be obtained by increasing prices or bundling services. This happened at popular museums including the National Museum, Nanjing Museum, Hunan Provincial Museum and Shaanxi History Museum.

By the end of 2020, 53 degrees Feitian Moutai was placed on a large number of e-commerce platforms. At the same time, a large number of "Maotai snatch service" appeared on an online shopping platform, and consumers can buy Maotai liquor through the service for a few hundred yuan.

The so-called snatch service is the attack with the personal information of fans, tourists, consumers to grab tickets, buying behavior. For the same product or service, if A is 1 second faster than B, then A can successfully buy, and B can not buy.

Buyers register, log in, and snap up in batches through cheating tools to quickly, instantaneously, and in batches grab the specified goods or services. These cheating tools have the cracking function, can break through the e-commerce order agreement, bypass the picture verification code, automatically change the IP address, forge the device number and so on. Just fill in the account password, set the running time, you can complete the task of automatic buying.


### Tools: Hackers Sell Cheating Tools to the Public


In January 2022, the Dingxiang Defense Cloud Business Security Intelligence Center monitored that the black and gray industry cracked the attendance systems of many insurance companies and also produced cheating tools. Through this tool, insurance company employees can not go to work and do not have to be on duty, and they can also realize "punching in at work", and easily receive full attendance awards.

Buyers purchase the "face spoofing attendance cheating tool" through e-commerce platforms and IM tools, and then log in to the official App of the insurance company. Upload your personal photos and enter your employee ID information. The cheating tool injects false data into the system to deceive the facial recognition and complete the attendance punching.
![2023120702.jpg](https://cdn.aisecurius.com/images/627/627bcad5-720a-432a-b355-869ac595c298.jpg)

# Security: Using Technology to Protect Against CaaS Attacks


Dingxiang Cloud Security experts have analyzed that CaaS attacks have the following technical characteristics:

CaaS threats typically adopt a modular design, with a large number of attack components or services that can be freely combined as needed. For example, fake accounts and malicious crawlers can both be used as components of CaaS attacks.
Massive fake accounts: Registration is a key process for creating an account. Attackers can use technology to automate account registration in batches, registering hundreds or even tens of thousands of accounts to achieve instant large-scale scalping.
CaaS threats often use advanced encryption and evasion techniques to avoid detection and interception by security software or organizations. For example, they use second dial tools, jailbreak tools, and emulators to hide their real identities and locations.
Quickly spoof IP location: IP addresses are the network information addresses that users use when they are online. Attackers can use second-dial IP tools to automatically call dynamic IP addresses all over the country or even abroad. These tools have functions such as automatic switching, line disconnection and re-dialing, automatic clearing of browser cookies cache, and virtual network card information, which can quickly and seamlessly switch IP addresses in different regions of China and abroad.

Quickly spoof GPS positioning: GPS positioning is the location information of the user when using network services. Attackers can use simulation software or third-party tools to change the latitude and longitude of their location. They can achieve instant "traversal" to any place.

Massively spoof device attributes: Device models, serial numbers, and IMEI numbers are unique. Attackers can use jailbreak tools to hijack device interfaces from the system level. When applications call these interfaces to obtain the parameters of each device, they will get the device attribute information forged by the jailbreak tool. Generally speaking, a jailbreak tool can complete 1,000 device attributes in 2-3 minutes.

CaaS threats often have a high degree of collaboration and sustainability, and can be used to achieve long-term network attack activities through remote control. For example, they use crowd control software to manipulate a large number of accounts to receive instructions, send data, and publish information.
Use crowd control to manipulate accounts: Black and gray industries use crowd control to control dozens, hundreds, or even thousands of devices from one computer, for unified registration, login, scalping, and ordering. Crowd control also provides functions such as simulated positioning, shaking, batch importing of contact lists, and message push.


# Dingxiang: A Security Solution to Prevent CaaS Attacks


Dingxiang defense cloud business security experts suggest that in addition to the complement of business rules and improve the need for more targeted change business security system, in order to effectively prevent CaaS risk attacks.
Device and IP address risk monitoring: Access the IP risk database, match the risks of IP addresses associated with users, identify malicious behaviors such as proxy and second dial IP addresses, and block malicious IP addresses in a timely manner. At the same time, through the device fingerprint recognition technology, judge the legitimacy of the client device, identify whether there is any potential risk such as injection, hook, simulator, and quickly identify illegal behaviors such as machine modification, Root, and jailbreak. It can also further improve risk identification and interception capabilities by monitoring multiple activations of the same device, abnormal IP behavior associated with the device, and abnormal proportion of old device models in the same channel.

Risk account identification and interception: In the user verification process, analyze the verification environment information and token, and discover anomalies and risky operations in a timely manner. The user behavior analysis technology is used to conduct strategic account layout control, and the situation of switching a large number of accounts for order initiation on the same device is implemented to effectively identify and intercept risk accounts.

Data analysis and prediction: Establish a dynamic operation and maintenance mechanism for local lists. Based on registration data, login data, activation data and other information, precipitate and maintain corresponding blacklist and whitelist data, including the blacklist of user ID, mobile phone number, device and other dimensions. At the same time, combined with risk control strategy and business precipitation data, machine learning and data mining technology are used to conduct behavioral modeling, and registration, login, ordering, buying and other behaviors are analyzed and predicted. The output model results can directly support the risk control strategy.

By strengthening the monitoring of devices and IP addresses, identifying and intercepting risk accounts, as well as risk behavior changes based on data analysis and prediction, it can more accurately identify and respond to potential risk factors, and provide users with a safer and more reliable service environment. At the same time, the risk control strategy is updated and optimized in a timely manner to continuously meet the evolving risk situation and needs, and ensure the security of the business.

————————————————END————————————————

*shared library hardening,Safeguard sensitive app data,anti-reverse engineering,in-app security,hooking frameworks,Hardening apk,Financial fraud,App shielding,App repackaging and cloning,App Hardening,Android Hardening,Android app security,Android app hardening,Android App Bundle hardening,aab hardening,atbCAPTCHA,bot management,anti-bot Captcha,captcha,anti-bot solution,captcha security,fraud protection,Mobile Authentication,captcha *

CaaS: A Growing Cyber Threat Trend in 2023

Therefore, third-party payment institutions need to continuously improve their own security capabilities, pay attention to relevant security trends and situations, and take effective measures to ensure business security. 


With the development of the internet and mobile internet, third-party payment has become an indispensable part of people's daily lives. However, while enjoying the convenience and efficiency brought by third-party payment, we cannot ignore the various business security challenges it faces.

For example, in online transactions, there may be fraudsters who use false information or malicious software to conduct unauthorized payments or transfers; users or merchants may encounter personal information or transaction data being leaked or tampered with when using third-party payment platforms; third-party payment institutions may violate relevant laws and regulations or be subject to penalties from regulatory authorities when conducting business. These may cause serious economic losses and credit damage to users or merchants.

Therefore, third-party payment institutions need to continuously improve their own security capabilities, pay attention to relevant security trends and situations, and take effective measures to ensure business security. In addition to complying with national and industry security standards and norms, using advanced security technologies and means, and establishing good security cooperation relationships with other institutions, third-party payment institutions also need to introduce more innovative security solutions to cope with changing security threats and dema![2023121101.jpg](https://cdn.aisecurius.com/images/0fb/0fb9d34b-b106-4797-88b0-333854998c1b.jpg)nds.


Recently, YeePay introduced Dingxiang Device Fingerprinting to further enhance the security of user login and transaction processes. Dingxiang Device Fingerprinting is a technology that analyzes the hardware, software and behavior data of each device and assigns a unique identifier and recognition to each device. Through device fingerprinting, it can identify virtual machines, proxy servers, emulators and other devices that are maliciously manipulated, analyze whether the device has fraudulent, stolen or other abnormal behaviors, and improve the security of user login and transaction processes.

Dingxiang Device Fingerprinting can also achieve cross-platform, cross-terminal, cross-scenario device identification and association, providing users with more personalized and intelligent services.

YeePay independently developed a comprehensive, multi-angle risk monitoring system that monitors risks in real time 7*24 hours a day, protecting user accounts and transaction security at all times. The system can perform risk assessment and early warning on multiple dimensions such as users, merchants, transactions, devices, etc., and timely discover and stop suspicious or abnormal behaviors. At the same time, YeePay also uses a variety of security measures to ensure the storage and transmission security of user personal information and transaction information. For example, using national encryption algorithms for data encryption; using digital certificates for identity authentication; using SSL protocol for data transmission; using distributed storage system for data backup etc. The introduction of Dingxiang Device Fingerprinting will provide YeePay with more powerful risk identification and prevention capabilities, providing users with a safer, more convenient and smarter payment experience.

Dingxiang Device Fingerprinting: Securing Third-Party Payments

Arkose Labs released its Q3 2021 Malicious Bot Report, which shows that malicious bots and fraud traffic accounted for 73% of internet traffic in the third quarter of 2021.

Arkose Labs released its Q3 2021 Malicious Bot Report, which shows that malicious bots and fraud traffic accounted for 73% of internet traffic in the third quarter of 2021.

![2023112901.jpg](https://cdn.aisecurius.com/images/de8/de879402-2da3-418c-9477-47d688af4e18.jpg)

There are two reasons for the growth of malicious bots: one is the widespread availability of artificial intelligence technology, which improves the performance of malicious bots; the other is that the black and gray industry has increased the commercial popularity of attacks through "crime as a service" (CaaS), which speeds up the launch of new attacks and further increases the number of black and gray industries.

The so-called "crime as a service" is that if an individual wants to launch an attack against a certain enterprise or organization, but does not have the resources, technology or time, they can pay another person or organization to launch a cyberattack. In other words, "crime as a service" allows those who have malicious intentions but lack skills to become cyber offenders.


# TCrawlers Can Steal Data, Scam Users, and Disrupt Services


Malicious crawlers are used for various purposes, mainly for stealing data, defrauding users or disrupting services. They bring huge losses and risks to various fields, some of which are cross-industry, and some are targeted at specific industries. The industries that are most attacked by malicious crawlers are: technology (76%), gaming (29%), social media (46%), e-commerce (65%) and financial services (45%).
![2023112903.jpg](https://cdn.aisecurius.com/images/3c6/3c6c0db8-40ea-4297-8738-55c35c6f0d53.jpg)

Ticketing sector. This is one of the most common targets of malicious crawlers, which can help organizations and individuals grab tickets and then resell them at high prices on the black market, making it difficult for normal consumers to buy tickets at reasonable prices.

Financial institutions. Malicious crawlers often try to invade user accounts, conduct financial fraud or steal sensitive information. In addition, some investment companies also use web crawler robots to obtain data and strategies of competitors, in order to improve their own investment and trading performance. For example, hedge funds use web crawler robots to collect and analyze non-traditional data such as inventory levels, pricing data, etc., to guide their own investment decisions. It is reported that hedge funds paid $2 billion for this in 2020.

Online games. Online games are plagued by database collision robots, which try to steal money or game items from user accounts and sell them online.

Airlines. 25.9% of the traffic of airlines comes from malicious crawlers, and the flight prices and seats of airlines are captured by competitors or travel agents, affecting their revenue and customer experience. More seriously, some black and gray industries use malicious crawlers to steal the accumulated air miles in user accounts and use them for illegal transactions or exchanges.

E-commerce. 18% of the traffic on e-commerce websites comes from these malicious crawlers, which are used for content scraping, account takeover, credit card fraud and various coupons.

Social information. Malicious crawlers are often used for content scraping, not only stealing content and reposting it on other channels, but also obtaining information from competitors, in order to conduct unfair competition. This not only damages the interests and reputation of legitimate websites, but also distorts the entire network ecosystem. Many times, websites may mistakenly think that their traffic has increased, but in fact they are attacked by malicious crawlers.

Stealing accounts. Database collision attacks are another important purpose of malicious crawlers, and accounts with weak passwords or repeated passwords are easily stolen.


# Experts: Here's How to Identify Malicious Web Crawlers


Nowadays, malicious crawlers have features such as random IP addresses, anonymous proxies, identity modification, and human-like operation behaviors, which make them very difficult to detect and block. Experts from Dingxiang Defense Cloud Business Security pointed out that malicious crawlers can be analyzed and identified based on their behavior and attributes.

![2023112902.jpg](https://cdn.aisecurius.com/images/fd9/fd92e936-b2b5-4225-997a-2f84039d58ac.jpg)

One is the access target. The purpose of malicious crawlers is to obtain the core information of websites and apps, such as user data, product prices, comment content, etc., so they usually only access pages that contain this information and ignore other irrelevant pages.

Two is the access behavior. Malicious crawlers are automatically executed by programs, following preset processes and rules for access, so their behavior has obvious regularity, rhythm, and consistency, which are very different from the normal users' randomness, flexibility, and diversity.

Three is the access device. The goal of malicious crawlers is to capture as much information as possible in the shortest time, so they will use the same device to perform a large number of access operations, including browsing, querying, downloading, etc., which will cause the device's access frequency, duration, depth and other indicators to be abnormal.

Four is the access IP address. Malicious crawlers use various methods to change their IP addresses in order to avoid being identified and banned by websites, such as using cloud services, routers, proxy servers, etc. This will cause the IP address's source region, operator, network type and other information to be inconsistent, or deviate significantly from the normal user distribution.

Five is the access time period. Malicious crawlers usually choose to crawl in batches during periods when the website traffic is low and monitoring is weak, such as late night or early morning. This will cause the indicators such as access volume and bandwidth usage to be abnormal during this period.

Six is big data modeling and mining. By collecting, processing, mining and modeling the access data of normal users and malicious crawlers on the website, a crawler identification model that is exclusive to the website itself can be built, thereby improving the identification accuracy and efficiency.


# Dingxiang: Block and Prevent Malicious Web Crawler Attacks


Malicious crawlers are becoming more intelligent and complex, and it is difficult to effectively defend against them by simply limiting the access frequency or encrypting the front-end pages. It is necessary to improve the human-machine recognition technology, increase the identification and interception capabilities of the black industry, and limit the access of robots to their human or system targets, thereby increasing the attack cost of malicious crawlers. Dingxiang provides enterprises with a full-process three-dimensional prevention and control solution, which can effectively prevent malicious crawling behavior.

First of all, use Dingxiang Defense Cloud to regularly detect and strengthen the security of the platform and App's operating environment, and protect App and client with code obfuscation, shell protection and other measures, and encrypt the communication link to ensure the security of the end-to-end full link.

Secondly, based on deploying Dingxiang Defense Cloud and Dingxiang Dinsight, through big data matching and tracking, multi-dimensional and in-depth analysis, accurately identify abnormal behaviors, and achieve accurate identification and interception of malicious crawlers.

Among them, Dingxiang Defense Cloud's intelligent verification code uses artificial intelligence technology to effectively block malicious crawlers from stealing data, and can verify, judge and intercept malicious accounts and crawling behaviors in real time at key links such as registration, login, query, etc. Dingxiang Defense Cloud's device fingerprint technology can effectively monitor and intercept risks such as code injection, hook, simulator, cloud phone, root, jailbreak, etc., and realize accurate identification and risk assessment of devices through unique device identifiers.

Dingxiang Dinsight is based on multiple dimensions of information such as business query scenario requests, device fingerprint information collected by clients, user behavior data, etc., to achieve effective identification of malicious crawler behavior. Based on security prevention and control strategies, it effectively identifies and intercepts malicious crawling behavior.

Finally, based on Dingxiang Xintelll intelligent model platform, it conducts in-depth analysis of risk data and business data, further mines potential risks, and builds exclusive risk control models to realize real-time iteration of security policies and more effectively intercept various malicious attacks.

————————————————END——————————————

shared library hardening,Safeguard sensitive app data,anti-reverse engineering,in-app security,hooking frameworks,Hardening apk,Financial fraud,App shielding,App repackaging and cloning,App Hardening,Android Hardening,Android app security,Android app hardening,Android App Bundle hardening,aab hardening,atbCAPTCHA,bot management,anti-bot Captcha,captcha,anti-bot solution,captcha security,fraud protection,Mobile Authentication,captcha 

Report: 73% of Internet Traffic Comes from Web Crawlers

Dingxiang atbCAPTCHA provides risk control strategy management functions, including adding, deleting, editing, importing, exporting, viewing trend charts, viewing versions, flexibly configuring lists for strategies, and taking effect in real time. 

Dingxiang atbCAPTCHA provides risk control strategy management functions, including adding, deleting, editing, importing, exporting, viewing trend charts, viewing versions, flexibly configuring lists for strategies, and taking effect in real time. At the same time, it supports different treatments for whitelists, graylists and blacklists, allowing managers to add, delete, edit and export lists. In addition, Dingxiang's frictionless verification can also monitor various components, including server node applications, interface calls, middleware status, etc., to help users better manage and operate.


# Online Management of atbCAPTCHA Strategies


The strategy management module provides users with management functions for all current strategies, mainly including adding, deleting, editing, importing, exporting, viewing trend charts, and viewing versions. A strategy refers to setting different verification methods and thresholds according to different scenarios and risk levels to achieve the best risk control effect. Users can flexibly configure strategies according to their own business needs and take effect in real time.

![2023112801.png](https://cdn.aisecurius.com/images/7f7/7f7d3410-bff4-4aa2-9b62-1ff6735668b6.png)

In the "Add Strategy" window, you need to fill in the necessary strategy fields and configure the specific rules in the strategy. After passing the review, it will take effect. If you edit, delete, or export the strategy, you can operate in the relevant window.

![2023112802.png](https://cdn.aisecurius.com/images/7fc/7fc00761-183c-4957-8191-91b8d991d246.png)

At the same time, you can view the trend details according to your own needs in the "Trend Chart" window and check the version number of related strategies.


# Online Management of atbCAPTCHA Black and White Lists


The list management module provides users with the management function of all the current lists, mainly including adding, deleting, editing, and exporting. The list refers to dividing users into white lists, gray lists, and black lists according to the user's verification results, so as to facilitate different processing. Users can flexibly configure the list according to their own business rules and take effect in real time.
![2023112803.png](https://cdn.aisecurius.com/images/ba9/ba9748f2-9a6b-4576-aa66-da7cbcdf041a.png)

In the "List Management" window, fill in the basic information and detailed list data, and you can also edit, delete or export the online list. After passing the audit, it will take effect.


# Monitoring Settings for atbCAPTCHA Modules


The verification monitoring module mainly includes viewing verification details, viewing verification statistics, and viewing verification alarms. Through this module, the administrator can understand the process and result of each verification, as well as the overall situation and trend of verification. Users can also set verification alarm rules, and receive notifications in time when verification is abnormal or failed.
![2023112804.png](https://cdn.aisecurius.com/images/410/410114ff-f676-4d76-9eb8-281e6469b571.png)

**Verification monitoring**: The system will record the relevant verification requests during the verification code, and the administrator can intuitively see the recent request information. This can help the administrator analyze the success rate, failure reason, abnormal situation, etc. of the verification, and optimize the verification strategy and improve the verification efficiency.

**Application node monitoring:** The system will record the health status of the relevant application nodes of the service, and the administrator can intuitively see the health status of the recent application nodes. This can help the administrator monitor the running status, load situation, fault situation, etc. of the application nodes, and timely discover and deal with problems, ensuring the stability and availability of the service.

**Server performance monitoring**: The system will record the server performance status, and the administrator can intuitively see the recent server performance status. This can help the administrator monitor the resource usage, response time, throughput, etc. of the server, and reasonably allocate and adjust resources, improving the performance and efficiency of the service.

**Interface call monitoring:** The system will record the interface call status, and the administrator can intuitively see the recent interface call status. This can help users monitor the number of interface calls, call sources, call results, etc., and analyze the usage and problem situations of the interface, optimizing the design and implementation of the interface.
![2023112805.png](https://cdn.aisecurius.com/images/daa/daa02594-a9a7-4dc7-8571-08800a78658e.png)

**Middleware monitoring:** The system will record the usage status of middleware, and the administrator can intuitively see the recent middleware status. This can help administrators monitor middleware types, versions, configurations, connections, etc., and manage and maintain middleware to ensure their normal operation and collaboration.

Dingxiang atbCAPTCHA combines Device Fingerprinting, behavioral characteristics, access frequency, geographic location and other technologies to effectively block malicious login, bulk registration, machine operation, and intercept abnormal users. Compared with traditional verification codes, users no longer need to think or input operations, just slide lightly to verify. After intelligently identifying normal users, they do not need to slide again within a certain period of time, which not only provides security for enterprises but also allows users to pass through without perception, greatly improving user experience.

————————————END————————————

atbCAPTCHA,bot management,anti-bot Captcha,captcha,anti-bot solution,captcha security,fraud protection,Mobile Authentication,captcha plugin,vaptcha,botdetect


atbCAPTCHA: Business Users Can Manage Strategies and Lists at Any Time

According to a report released by Google, Temasek and Bain, the digital economy in Southeast Asia is expected to generate about $100 billion in revenue by 2023, despite the slowdown in economic growth in the region.

According to a report released by Google, Temasek and Bain, the digital economy in Southeast Asia is expected to generate about $100 billion in revenue by 2023, despite the slowdown in economic growth in the region. Digital payments account for more than 50% of the total transactions in the region. This growth is mainly driven by the continuous development of the e-commerce industry in Southeast Asia. In addition, the tourism sector also shows significant signs of recovery, and its performance is expected to increase by about four times, surpassing the previous five years. However, compared with the historical high of $2.7 billion in 2017, the private financing of digital enterprises in Southeast Asia is expected to drop to the lowest level since 2021.

# Southeast Asia: A Hotbed for Various Types of Cyber Fraud


There is a certain degree of economic imbalance in Southeast Asia. Singapore is a developed region, where 98% of the population use banking services. However, in underdeveloped regions such as Indonesia, Vietnam, and the Philippines, only about 30% of the residents have bank accounts, and some have never been exposed to traditional financial services.
![2023110201.png](https://cdn.aisecurius.com/images/eb0/eb0bd2d5-57da-4d53-867d-a3bc6b4ecbbd.png)

Compared with other developed regions, Southeast Asia has been called a "breeding ground for fraudsters" due to the frequent occurrence of online fraud, financial fraud and related criminal activities. On the one hand, most countries in the region have relatively late development of modern financial systems, and the deployment efficiency of related identity verification infrastructure and digital credit anti-fraud systems is low, making risk management difficult and the overall risk management system fragile. On the other hand, local residents generally lack awareness of credit and financial knowledge.

Analysis shows that Southeast Asian enterprises face two major risks: identity fraud risk and financial credit risk.

In terms of identity fraud, Indonesia, Vietnam and Thailand are the most affected countries. These countries have a large online consumer population, and their mobile phone penetration rates rank among the highest in the world, but most people lack awareness of digital fraud risks, and the local digital credit infrastructure is imperfect, resulting in high anti-fraud costs for related industries.

In terms of financial credit risk, various industries in Southeast Asia generally face liquidity risk, which is caused by the economic recession and high unemployment rate triggered by the COVID-19 pandemic. This economic downturn has led to a reduction in corporate investment and a decline in external demand, which has put many enterprises in trouble and even faced the risk of bankruptcy. Many borrowers are unable to repay their debts on time. At the same time, some fraudsters use fake identity documents or other false information to apply for loans to obtain improper benefits. This behavior not only causes losses to financial institutions, but also poses a threat to the stability of the entire financial system.
![2023110202.jpg](https://cdn.aisecurius.com/images/748/7484faa4-74c1-4f2f-b142-578930853f49.jpg)

In addition, due to the popularity of mobile internet, the expansion of young consumer groups and the increase of local residents' disposable income, e-commerce industry is one of the industries with the highest digital fraud rate in Southeast Asia. According to a security alert issued by Vietnamese regulators earlier, there are 24 types of fraud on Vietnamese e-commerce platforms, such as selling counterfeit and inferior goods, using other people's identity information for loans, account theft fraud, etc. At the same time, video call fraud using deepfake and deepvoice technologies is also becoming more and more rampant.

# Technology: Using Technology to Prevent Fraud


To cope with the risk of fraud in Southeast Asia, it is necessary to strengthen financial education, improve identity verification infrastructure, enhance cooperation and regulation, and promote the application of digital technology to improve risk management and prevention capabilities.
![2023112401.png](https://cdn.aisecurius.com/images/3f6/3f66d903-c0cb-4f02-82c1-4f4abaff5943.png)

Dingxiang Defense Cloud Business Security Intelligence Center believes that accurately identifying user identity and effectively verifying credit are common challenges faced by various industries in Southeast Asia. Experts suggest that for fraud prevention, accurate identification, effective defense and continuous evolution are needed.

**Accurate identification is the key.** By using external phone number risk scoring, IP risk library and proxy email detection tools, malicious phone numbers, IP addresses and emails can be detected in time, and at the same time, malicious devices can be detected by checking the legitimacy of device fingerprints and the risks of injection, hook and emulator.

**Effective defense is necessary.** Build a risk control system that combines machine learning and rule-oriented methods with Dingxiang Defense Cloud and Dingxiang Dinsight. Through multi-dimensional and in-depth analysis, it can accurately identify abnormal operations and perform user depth profiling, and perform big data matching. Detect suspicious operations in time, assess risks, and track and block various fraudulent behaviors.

**Continuous evolution is crucial**. Based on business data and risk control data, establish a local list dynamic operation and maintenance mechanism, precipitate and maintain corresponding black and white list data, and update risk control strategies in time. At the same time, use Dingxiang xintell intelligent model platform to build exclusive risk models, mine potential risks and improve the security level of social media.


# Fraud Prevention: Four Things Businesses in Southeast Asia Need to Consider


Due to the uneven economic development and related social and technical factors in Southeast Asia, Dingxiang Defense Cloud Business Security Intelligence Center recommends strengthening work in the aspects of close to the industry, understanding risks, conforming to local characteristics, and continuous security operations, in order to improve the security defense capabilities of various industries in Cambodia and promote their sustainable and healthy development.


**1. Close to the industry.** Since different industries have different business characteristics and application environments, understanding the processes and characteristics of each industry is a prerequisite for effective defense. A deep understanding of the business scenarios of the industry can more accurately analyze risks and respond to threats.

**2. Understand the risks**. Southeast Asia faces various forms of fraud, and attackers show a professional, industrialized, and organized posture. Understanding the tools, paths, and intentions of the black and gray industry chain can help build attacker profiles, thereby responding in a timely manner and promoting the initiative of defense. In addition, a deep understanding of attack techniques is also the key to developing effective security defense solutions.

**3. Conform to local characteristics**. For the Southeast Asian market, it is necessary to adjust the digital experience according to the language, culture, and needs of local users, and adopt localized strategies. Deploying artificial intelligence anti-fraud solutions with localized strategies can improve fraud identification capabilities, better manage risks, and promote business development. The feasibility of having a localized strategy requires a deep understanding of the local situation and combining macro development trends with local market needs.

**4. Continuous security operations**. Since risks are constantly changing, continuous security operations are essential. Timely understand and adapt to new security threats, and keep updating and evolving, in order to effectively defend against attacks.

Fraud Prevention: Businesses in Southeast Asia Need to Be Close to Industry and Operate Locally

Streaming pirates usually use screen recording tools or devices to capture other people's live or streaming media content, and then use virtual cameras or other methods to disguise themselves as live broadcasters on other platforms.


Streaming piracy is an illegal online activity that refers to the unauthorized copying, forwarding or re-broadcasting of other people's live or streaming media content on other platforms, thereby infringing on the copyright and interests of the original creators, and also misleading and deceiving the audience.

Streaming pirates usually use screen recording tools or devices to capture other people's live or streaming media content, and then use virtual cameras or other methods to disguise themselves as live broadcasters on other platforms. Streaming pirates often use various means, such as posting false information, advertisements, inducive language, etc., to attract viewers to enter their live rooms or video pages, and obtain traffic and revenue.

Streaming piracy occurs in various fields, such as sports, esports, e-commerce, etc. According to the data released by the China Internet Copyright Monitoring Center in 2019, only for the first half of the Chinese Super League matches, about 31,800 infringing links were detected. The new season of the Premier League piracy situation is equally severe. As of the third round of the league, nearly 10,000 infringing links were found. Among them, only for the Beijing Guoan vs Guangzhou Evergrande match in August, 26 PC-side infringing websites were detected, with 210 infringing links, and 11 mobile-side infringing apps, with 179 infringing links. And before this match, there were even several big Vs who illegally spread related match piracy links.
![2023112101.jpg](https://cdn.aisecurius.com/images/7d3/7d3670b6-441b-4dfb-8abc-e425eb3301e4.jpg)

CoolCow App is an app that focuses on spreading the national traditional culture and local folk customs. Through CoolCow App, users can watch various interesting videos of local folk customs in Guizhou, and interact with the authors and other netizens in real time. In order to prevent the original videos from being pirated, CoolCow App introduced Dingxiang device fingerprint.

Dingxiang device fingerprint is a technology that collects and analyzes the hardware, software and behavior data of each device, and identifies and recognizes each device uniquely. Through Dingxiang device fingerprint technology, CoolCow App can identify devices that use malicious manipulation such as virtual machines, proxy servers, emulators, etc., analyze whether the device has abnormal behaviors such as recording, and thus timely detect and stop piracy. At the same time, Dingxiang device fingerprint technology can also serve as an additional identity verification factor, improving the security of user login and transaction processes. By recording and comparing device fingerprints, CoolCow App can effectively distinguish between legitimate users and potential fraudsters.

In order to further prevent the infringement of piracy, CoolCow App strengthens its supervision capabilities, establishes a sound copyright protection mechanism and punishment mechanism, strengthens the audit and monitoring of live rooms or video pages, timely handles complaints and reports, and imposes penalties such as banning accounts, fines, publicity on the discovered pirates. And some rights protection measures have been strengthened. As soon as the broadcaster finds a pirated video, he can complain to CoolCow App and take necessary measures such as deleting, blocking, disconnecting links to the pirated video.

CoolCow App establishes a good communication and cooperation relationship with the original creators and netizens, and jointly fights against and resists piracy. It also reminds the original video broadcasters to strengthen their self-protection awareness, use watermarks, copyright statements and other methods to indicate their identity and rights, and add some special marks or information to the live or streaming content for identification and tracing.

 Device Fingerprinting: Live Streaming Apps Face Screen Recording Theft, Use Device Fingerprinting to Prevent  Introduction

The behavior of illegal renting and selling is not a simple phenomenon. Behind it, it directly leads to the production of a large number of bank cards and phone cards that are "real-name but not real-person".

Telecommunication network fraud has become a widespread and extremely harmful criminal behavior. Among them, bank cards and phone cards are the most commonly used tools by fraudsters. These cards are not only used for online and offline fraud activities, but also rented or purchased by criminals through various means. The national public security organs have launched a large-scale crackdown, and continued to carry out the "card-cutting" operation, severely cracking down on the behavior of renting and selling "two cards".

The behavior of illegal renting and selling is not a simple phenomenon. Behind it, it directly leads to the production of a large number of bank cards and phone cards that are "real-name but not real-person". What is more serious is that many unsuspecting individuals not only sacrifice their own bank cards for sale, but also suffer legal punishment or credit sanctions as a result.


# Bank Cards: What are rented or sold bank cards used for?


The criminals who get the rented or sold bank cards are likely to use them for fraud, money laundering, tax evasion, opening fake stock accounts and other illegal activities. These will eventually be traced back to the card owner, resulting in personal credit damage, or even legal liability.
![2023112103.png](https://cdn.aisecurius.com/images/f77/f77f8733-aa93-4ff6-8f37-2abc8ef5d8a9.png)

Used for fraud. Four years ago, Mr. Liu applied for an Industrial and Commercial Bank card, which was not used frequently after several bank system upgrades and card replacements, and was put aside. Through a neighbor's introduction, Mr. Liu joined a WeChat group called "Xiao Wang Opens Cards", and through the group's connections, the bank card soon found a buyer. It was then used by others to commit online fraud. After the crime, Mr. Liu was criminally detained by the public security organs for allegedly assisting in information network criminal activities.

Used for money laundering by gangs. Short of money, Xiao Li rented out his "full set" of identity card, bank card, online banking U shield, and phone card to make some quick money. The criminals opened mobile banking for the bank card and used it for money laundering. The victim transferred the money to the account designated by the scammer, which was Xiao Zhao's bank card, and then it was quickly divided into multiple small amounts and transferred to several bank cards, and then the gang members distributed across the country took away the stolen money. A few months later, the police found Xiao Li and he learned that his bank card was involved in multiple online fraud cases. What awaited Xiao Li was legal punishment.

Used to evade taxes. Xiao Zhou heard that bank cards could also be sold for money, so he sold his idle bank card. After buying Xiao Zhou's bank card, the other party used it to evade taxes. Money in various names such as "salary" and "service fee" was deposited into the bank card, and then quickly withdrawn, thus achieving the purpose of tax evasion by the criminals. And Xiao Zhou had to report his taxes to the tax bureau himself because his "personal annual income" reached a "certain standard".


# Law: What are the penalties for users who rent or sell bank cards?


Credit punishment. The People's Bank of China will transfer the relevant information to the financial credit basic database, and the illegal records will affect the loan and credit card applications of the relevant personnel for a certain period of time in the personal credit report.

Business restriction. Non-counter business of related units and individuals' bank accounts and all business of payment accounts are suspended for 5 years. That is to say, the relevant units and individuals cannot use bank cards to deposit and withdraw money at ATMs, cannot use online banking and mobile banking to transfer money, cannot swipe cards for shopping, cannot use quick payment through shopping websites, cannot register Alipay accounts, and cannot use Alipay, WeChat to send and receive red envelopes, and scan code payment.

Account restriction. Banks and payment institutions shall not open new accounts for related units and individuals within 5 years. If they apply for opening an account after the punishment period expires, banks and payment institutions will increase their review efforts.

In addition to the above punishments, they may also be suspected of crimes such as assisting information network criminal activities, obstructing credit card management, buying and selling state organ certificates, concealing or concealing criminal proceeds, and even fraud, which will bring imprisonment to individuals.

![2023112104.jpg](https://cdn.aisecurius.com/images/29f/29f1a3f7-30b2-4cd0-ab80-98a39c432e14.jpg)

Article 31, paragraph 1 of the Anti-Telecommunication Network Fraud Law stipulates: No unit or individual shall illegally buy, sell, rent, lend telephone cards, Internet of Things cards, telecommunication lines, SMS ports, bank accounts, payment accounts, Internet accounts, etc., or provide real-name verification assistance; nor shall they impersonate others or fabricate agency relationships to open the above cards, accounts, accounts, etc.

Article 28, paragraph 3 of the Measures for the Administration of Bank Card Business stipulates: Bank cards and their accounts shall only be used by the cardholder approved by the issuing bank, and shall not be rented or lent.


# Fraud Prevention: How to accurately identify bank card rental and sale behavior?


First, strengthen customer identity verification and authorization management. By adopting multi-factor authentication, advanced authentication technology and other measures, improve the security of accounts, increase the reliability of identity verification, and prevent accounts from being stolen or abused by criminals. At the same time, update customer information regularly, ensure the accuracy of information, and establish a complete customer profile, ensuring that only legitimate customers can access and use accounts.

Second, effectively identify abnormal account behavior. Based on Dingxiang Defense Cloud and Dingxiang Dinsight, through big data matching and tracking, conduct multi-dimensional and in-depth analysis, accurately identify abnormal operations, and discover abnormal behaviors of renting and selling.

Dingxiang Defense Cloud Business Security Intelligence Center experts analyzed that bank cards that are rented or sold mainly have the following risk characteristics:

Account opening anomaly: large-scale remote account opening, concentrated account opening in a short time.

Device anomaly: in a short time or sensitive time, obvious registration & login operations on the device, and multiple accounts login on a single device.

Transaction anomaly: batch occurrence of concentrated multiple transfers, multiple large transfers, multiple cross-bank transfers to non-same-name accounts, transaction account geographic locations are the same, can be analyzed from the frequency of behavior.

Financial institutions need to formulate and implement monitoring rules based on the risk control system, pay attention to specific types of transaction behavior, such as large transactions, frequent fund transfers, etc. This system can effectively monitor the characteristics of renting and lending bank cards, such as a large number of remote account openings, concentrated account openings in a short time, etc. When an account or transaction reaches the set abnormal threshold, the risk control system can issue an alarm in time.

In addition, mine hidden renting and selling behaviors. In order to evade the review and anti-fraud mechanism of financial institutions, criminals will use various technical means to increase the difficulty of identifying abnormal behaviors. In order to mine the potential risks of renting and selling bank cards, Dingxiang Xintell intelligent model platform can be used to mine hidden and complex renting and lending behaviors.

By collecting a large number of normal transaction sample data and using supervised learning algorithms for training, a model is established to learn the characteristics of normal transactions. Classification algorithms in supervised learning methods, such as support vector machines, can be used to train models, learn normal transaction patterns, and judge whether new transactions are abnormal. Combined with rule engine, it can real-time warn obvious abnormal transactions, while machine learning model tends to detect hidden abnormal patterns.

The model can give the probability of abnormality for each transaction based on the actual new transactions. For transactions that are predicted to have a high probability of abnormality, manual review can be conducted to determine whether they are fraudulent transactions. Then feedback the manually confirmed fraudulent transaction samples to the model and continuously let the model learn and optimize on new samples. In addition regular use of new data to retrain the model can make it better detect new fraudulent transaction patterns. In short by using machine learning and data analysis techniques identify and analyze transactions that do not match normal behavior patterns thereby discovering hidden hidden renting and lending abnormal behaviors.

In addition to the above-mentioned measures regular internal and external compliance reviews are essential to ensure that banking business complies with laws and regulatory requirements. This includes conducting in-depth investigations into possible problems and establishing a compliance review system. By adopting anti-fraud system monitoring and artificial intelligence technology screening combined with manual review it can effectively improve fraud detection capabilities reduce compliance and risk management costs for banks.

Through a series of means banks can better comply with relevant laws and regulatory requirements improve fraud detection capabilities reduce the impact of fraud on banks and customers protect fund security enhance customer experience.

Dingxiang has provided a series of professional anti-fraud services for more than 100 important financial institutions such as Bank of China Bank of Communications China UnionPay Minsheng Bank Hua Xia Bank Yongfeng Bank Jih Sun Bank Starlight Bank Wing Lung Bank Far East Bank Yuan Da Bank Kaohsiung Bank etc. Enhance the risk control capabilities of financial institutions improve customer satisfaction and promote the smooth progress of digital transformation.

Fraud Prevention: Accurately and Effectively Identifying Bank Card Rental and Sale Behavior

The verification code visual background has security advantages and can monitor the usage of the verification code in real time. By analyzing and visualizing the background data, the system performance can be better understood.

Verification codes, as a key element of human-computer interaction interfaces, are an important part of identity verification, risk prevention, and data anti-crawling. They are widely used on websites, apps, etc., and play a huge role in various scenarios such as registration, login, transaction, interaction, etc. They have the functions of real-person recognition and identity verification, and also play an important role in ensuring account security.

Dingxiang's non-perceptual verification provides a visual background, supporting switching queries in two dimensions of channels and scenarios. Managers can view data from different channels such as websites, apps, mini-programs, H5, etc., and statistics from different scenarios under registration, login, password retrieval or other businesses. By supporting the switching of two dimensions of channels and scenarios, managers can more flexibly view and analyze the data statistics of the verification code system.

The verification code visual background has security advantages and can monitor the usage of the verification code in real time. By analyzing and visualizing the background data, the system performance can be better understood. Through the visual background, managers can view the key indicators of the verification code system in real time, including generation volume, usage volume, accuracy rate, etc. These data are displayed in forms such as charts and graphics, making the understanding and analysis of data more intuitive. It provides important decision-making basis for decision-makers to better adjust strategies and optimize operations. In addition, the visual background can also promote team collaboration and enable team members to better focus on and analyze data.


# atbCAPTCHA: View Today's Verification Data


Dingxiang No-Sense Verification provides a series of detailed statistical data on verification code activities, including but not limited to daily request volume, daily verification volume, daily verification success volume, daily interception volume, daily pass rate, etc. Administrators can choose to view the time interval of these data as needed, in order to better understand the operation and business progress of the verification code system.
![2023111601.png](https://cdn.aisecurius.com/images/221/221ad5c9-49da-44b7-be24-2ba1f8e9d319.png)

**Today's request volume**: shows the number of times the verification code is requested on the same day, reflecting the system load and user activity.

**Today's verification volume:** shows the number of times the verification code is submitted for verification on the same day, reflecting user participation and verification pass rate.

**Today's verification success volume**: shows the number of times the verification code is verified successfully on the same day, reflecting the accuracy and reliability of the verification code.

**Today's verification interception volume**: shows the number of times the verification code verification requests are intercepted by the system on the same day, reflecting potential malicious behavior or abnormal requests.

**Today's verification pass rate**: shows the proportion of successful verification codes on the same day, reflecting the accuracy of the verification code and the correct rate of user input.

**Today's verification ratio**: shows the proportion of verification code requests in the total request volume on the same day, helping to understand the use of verification codes in the overall business process.
![2023111602.png](https://cdn.aisecurius.com/images/c54/c545044c-113b-4a8c-84a3-a7b420d43d2c.png)

**Today's request volume TOP10**: shows the request volume percentage of the 10 highest sources or regions on the same day, helping to understand the main user groups and active areas.

**Today's request volume map**: shows the distribution of request volume on the same day in a map form, helping to understand the request volume situation in different regions or areas across the country.

Through these indicators, administrators can better understand the operation of the verification code on the same day, timely discover abnormal situations and make corresponding adjustments and optimizations and stability, ensuring normal business operation.


# atbCAPTCHA: View Future Trend Data


Dingxiang frictionless verification provides the ability to independently choose the desired time interval and conduct in-depth analysis and understanding of the verification system's operation status. It displays the verification activity trends of the verification system in the selected time range in the form of charts, including key indicators such as request volume, verification volume, verification success volume, etc. Managers can choose different time intervals, such as day, week, month, etc., to better understand business progress and change trends.
![2023111603.png](https://cdn.aisecurius.com/images/3a7/3a742ffa-27df-4aa4-9d50-c6446ef4f40f.png)

Through verification statistics and verification trend charts, managers can more comprehensively understand the operation status and development trends of the verification system. This provides them with strong support for making more accurate and scientific decisions, helping them better adjust strategies, optimize operations, and ensure system stability and security.

————————————END————————————

atbCAPTCHA,bot management,anti-bot Captcha,captcha,anti-bot solution,captcha security,fraud protection,Mobile Authentication,captcha plugin,vaptcha,botdetect

atbCAPTCHA: View Risk Data for Different Business Scenarios Online

The latest data released by the telecommunications regulator of Cambodia shows that as of January 2022, the number of mobile phone users in Cambodia has reached 19,458,849 and the number of Internet users has reached 1,7591,396.  

The latest data released by the telecommunications regulator of Cambodia shows that as of January 2022, the number of mobile phone users in Cambodia has reached 19,458,849 and the number of Internet users has reached 1,7591,396. This data shows that the digital trend in Cambodia is becoming more and more obvious, and more and more people are starting to use mobile devices and the Internet for daily life and work.

According to Visa's 2021 Consumer Payment Attitudes Study, 36 percent of Cambodian consumers do not use cash for payments, the highest percentage in Southeast Asia. At the same time, Cambodia also has the highest number of mobile banking users in Southeast Asia, accounting for 29% of Cambodians, and four out of 10 Cambodians use electronic wallets. In addition, QR code payment is the second most popular payment method across all consumer categories in Cambodia, especially for shopping in supermarkets and convenience stores. In 2021, Bank of China Phnom Penh Branch (BOCPP) released a new function for mobile banking UnionPay QR code payment. In Cambodia, UnionPay QR code payment can be used in major shopping malls, supermarkets, brand stores, restaurants and hotels.

Cambodia's e-commerce industry is growing steadily and is expected to grow to well over $100 million by 2025. E-commerce has made it easier for people to shop online, and e-commerce platforms in Cambodia include Nham24, Little Fashion, and Joonaak Delivery. With the increasing popularity of online shopping, it also provides opportunities for fraudsters, and many consumers have suffered from e-commerce fraud.


# Residents: Frequently Swindled by Fraudulent Merchants

She bought two e-bikes and was told she had to pay by 15:30 that day or she would not be able to buy the bikes. However, after making the payment, she did not receive the bike and was even blocked from her Facebook account by the seller, making it impossible for her to contact them by phone anymore.

![2023111001.png](https://cdn.aisecurius.com/images/808/808eb952-5eb0-44bd-aede-29e5b90e44b9.png)
Yuth Somaly, a citizen of Kampong Tung Province, is also an avid online shopper, shopping online at least once a month, mainly for books, clothes, bags, creams and lotions. However, she was also defrauded of money on three occasions. Sometimes the goods received do not match what she ordered or expected, such as the wrong size of the product. Another time, after she transferred money to a seller for a purchase via Facebook, the seller disappeared on Facebook and she never heard back from the seller.

Soeurng Leakhena in Phnom Penh is an avid online seller who likes to buy all kinds of goods online, including clothing, cosmetics and food. Recently, however, she fell victim to an online scam and was defrauded of $50 after transferring Money through a Wing Transfer Money agency.

According to Leakhena, the process of the scam is very suspicious. The seller first asks where she is located, and if she answers that they are in the provinces, they say they are in Phnom Penh; If she says they're in Phnom Penh, they say they're in the provinces. The other person always said they were in different places and asked her to transfer the payment first. After Leakhena transfers money, the other person either excitedly replies to her or simply stops replying in the chat.

Leakhena has some advice for others shopping online: "Be sure to investigate thoroughly before deciding to transfer money to an online seller. Authorities should also step up their crackdown on online scams and fraud." She added that social media users should be proactive in commenting, sharing and spreading such scams, as many Facebook pages and profiles are using the platform to deceive others.

Chhoun Chandararoth, deputy director of the Consumer complaint handling office at the General Bureau of Consumer Protection, Competition and Growth Suppression (CCF) in Cambodia, said that since 2019, the department has received 28 complaints, including online and offline shopping cases, as well as resolved and unresolved cases. Consumers can download a complaint template from CCF's website or go directly to CCF's various branches to file a complaint. They can file complaints online or at the Ministry of Commerce and general departments in 25 provinces.

Sovicheat, head of Cambodia's Commerce Ministry, said that if any user falls victim to online sales scams, including the use of fake names or fake brands, they can file a complaint with the CCF General Bureau under the Commerce Ministry.
![2923110902.jpg](https://cdn.aisecurius.com/images/788/7882b9a8-199e-42c4-b878-14ff651f1c95.jpg)

This series of measures shows that the Cambodian government is strengthening the supervision and protection measures for online shopping to protect the rights and interests of consumers. Consumers should also remain vigilant and shop carefully to avoid falling victim to online scams. However, due to the anonymity and remote nature of online shopping, many cases can be difficult to track down and resolve.


# E-commerce Companies: Taking Multiple Measures to Prevent Fraudulent Merchants from Entering

In order to prevent fraudulent merchants from entering the e-commerce platform, Dingxiang Defense Cloud business Security Intelligence Center suggested that the e-commerce platform in Cambodia strengthen the review of merchants.

Strict audit and verification: the e-commerce platform should conduct a comprehensive audit and verification of merchants to ensure the authenticity of their identities and business qualifications. This includes verifying the merchant's registration information, business license, identification, etc.

Conduct risk assessment: Through the use of risk assessment tools and algorithms, e-commerce platforms can assess merchants to identify potential fraud. This can include analyzing the merchant's history, credit status, sales behavior, and other metrics.

Monitoring of settled merchants: e-commerce platforms should establish monitoring and analysis mechanisms to detect and analyze suspicious activities and patterns in a timely manner. This can include the use of artificial intelligence and big data analytics to quickly identify fraudulent activities such as unusual transactions, false claims, and more.

Effective feedback and complaint mechanism: e-commerce platforms should encourage users to provide feedback and complaints, and establish corresponding handling mechanisms. Responding quickly and resolving user issues helps reduce the impact of fraudulent merchants.

Multi-dimensional evaluation system: Establish a multi-dimensional evaluation and reputation system, so that users can evaluate the goods and services provided by merchants. This can help other users judge the reliability and trustworthiness of the business.

Secure payment and transaction protection: In order to protect the interests of users, e-commerce platforms should provide secure payment mechanisms and cooperate with third-party payment institutions. In addition, encrypting and protecting users' personal and payment information is also very In addition, e-commerce platforms need to prevent fraudulent merchants from settling in through technical means to provide consumers with a safe and reliable transaction environment. Dingxiang Defense cloud is combined with Dingxiang Dinsight risk control engine and Xintell intelligent model platform to build a combination of machine learning and rule-oriented risk control system. Through multi-dimensional and deep analysis, it can accurately identify abnormal operations, conduct in-depth profiling of merchant accounts, and carry out big data matching. This helps the e-commerce platform to detect suspicious operations in a timely manner, track and prevent fraudulent activities that make e-commerce accounts.

First, through the use of external mobile phone number risk score, IP risk database and proxy email detection tools, malicious fraudulent accounts can be detected in a timely manner, and registration and login can be blocked.

Secondly, by detecting the legitimacy of the fingerprint of the device and whether there are risks such as injection, hook and simulator, the registration and login of fraudulent e-commerce accounts can be effectively restrained.

In addition, establish a dynamic operation and maintenance mechanism of the local list, precipitate and maintain the corresponding black and white list data, and update the risk control strategy in time.

Finally, based on risk control data and business precipitation data, the big data of fraudulent account behavior is modeled to explore potential risks and improve the security level of e-commerce platforms.important.



Cambodia: E-commerce Platforms Need to Configure Risk Control Systems to Effectively Prevent Fraudulent Merchants from Entering

Cambodia's electronic payment industry has ushered in a new development opportunity, and more and more merchants are implementing electronic payment methods.  Bank cards and scanning code payment are favored by the public. 

Cambodia's electronic payment industry has ushered in a new development opportunity, and more and more merchants are implementing electronic payment methods. Bank cards and scanning code payment are favored by the public. According to Visa's 2021 Consumer Payment Attitudes Study, 36 percent of Cambodian consumers do not use cash for payments, the highest percentage in Southeast Asia. At the same time, Cambodia also has the highest number of mobile banking users in Southeast Asia, accounting for 29% of Cambodians, and four out of 10 Cambodians use electronic wallets.

However, the rapid development of Cambodia's digital payments sector has also brought new cyber risks. In order to protect consumers, promote fair competition and promote the development of the digital economy, the Cambodian government and businesses need to take a series of measures in an effort to strengthen the cybersecurity infrastructure, combat cybercrime, protect user security and enhance digital competitiveness.

Panda Bank is a digital bank dedicated to providing secure, efficient, convenient and personalized financial services. The bank launched the Panda Bank App, which supports iOS and Android systems, allowing users to open and manage accounts, transfer funds and make financial investments anytime and anywhere.
![2023110901.jpg](https://cdn.aisecurius.com/images/aeb/aeb541de-bca0-481a-a798-e9033067d096.jpg)

In order to ensure the security of App, Panda Bank adopted Dingxiang App reinforcement service. DingxiangApp reinforcement can provide Panda Bank App with a full range of security services such as security reinforcement, risk early warning, and life cycle risk control protection, to help the bank build a strong security line.

Dingxiang App reinforcement is a comprehensive security solution, which can carry out security reinforcement, risk warning and whole life cycle risk control guarantee for Panda Bank App. Through the security testing and repair of the App, Top Image App Reinforcement helps Panda Bank to find and resolve potential risk vulnerabilities. At the same time, it also protects sensitive data, code obfuscation and integrity protection, effectively avoiding the security impact of system vulnerabilities on applications.

In addition, Dingxiang App reinforcement can also carry out real-time monitoring of mobile application running, monitor terminal equipment, operating environment and user operation behavior, and provide a full range of risk monitoring, early warning and blocking capabilities. From App design, development, release to maintenance, Top Image App reinforcement has built a full life cycle security system for Panda Bank and helped it build a strong security defense line.

![熊猫银行1.png](https://cdn.aisecurius.com/images/ceb/ceb8f5b5-348b-4b9c-8c4f-ac1ecadb1f39.png)

By adopting Dingxiang App hardening service, Panda Bank is able to ensure the security of its App and provide users with reliable financial services. At the same time, Panda Bank's security measures also provide strong support for the development of Cambodia's digital economy. As Cambodia continues to strengthen its cybersecurity infrastructure, digital payments and e-banking will continue to flourish, which in turn will drive a more efficient development of Cambodia's digital economy.

Up to now, Dingxiang has provided a series of professional anti-fraud services for more than 100 important financial institutions such as Bank of China, Bank of Communications, China UnionPay, Minsheng Bank, Huaxia Bank, Yongfeng Bank, Sun Sheng Bank, Star Bank, Wing Long Bank, Far East Bank, Yuanta Bank, Bank of Kaohsiung and so on. Enhance financial institutions' risk control capabilities, improve customer satisfaction, and drive digital transformation.

————————————END————————————

shared library hardening,Safeguard sensitive app data,anti-reverse engineering,in-app security,hooking frameworks,Hardening apk,Financial fraud,App shielding,App repackaging and cloning,App Hardening,Android Hardening,Android app security,Android app hardening,Android App Bundle hardening,aab hardening,

Cambodia: Dingxiang in-app security safeguards Panda Bank App security

The rapid development of global artificial intelligence technology has a profound impact on economic and social development and the progress of human civilization, and has brought huge opportunities to the world

The rapid development of global artificial intelligence technology has a profound impact on economic and social development and the progress of human civilization, and has brought huge opportunities to the world. At the same time, artificial intelligence technology also brings unpredictable risks and complex challenges.

![2023110801.jpg](https://cdn.aisecurius.com/images/297/297b4d61-3b2e-4694-a12c-7acbb3c95576.jpg)

Due to the ambiguity in the technical logic and application process of artificial intelligence (AI), a number of risks may arise, including data, algorithmic risk, ethical risk, technology abuse risk, and cyber attack risk. These risks may not only pose a threat to individual privacy and corporate interests, but also have a negative impact on the fairness and stability of society as a whole.

First, algorithmic risk. Since AI is a "black box" based on big data, deep learning, and computer algorithms, its decision-making logic and basis are often difficult to explain, leading to uncertainty risks. In some applications where high fault tolerance is required, this uninterpretability may even lead to security risks.

Second, data risk. Mining the value of data is the key to improving the ability of artificial intelligence, but the circulation of sensitive information such as personal privacy has the risk of being leaked and abused. Once data forms an island due to security considerations, it will restrict the generation of data element value and the development of the AI industry. In addition, using copyrighted material to train AI models can lead to copyright disputes, while inputting information related to identified or identifiable natural persons can raise issues such as trade secret disclosure.

The social ethical risk cannot be ignored. Big data killing, gender discrimination, racial discrimination, regional discrimination, etc., may lead to social equity problems. Although AI is based on massive amounts of data, this data is often biased, making decisions based on this data likely to exacerbate social inequities. In addition, the design process of the algorithm may be affected by the value orientation of the developer, which makes the fairness of the transaction decision difficult to be effectively guaranteed.

The risk of technology misuse is of concern. The use of AI to produce fake news, fake news, fake accounts, fake voices, fake pictures and other behaviors has an increasingly serious impact on society. These behaviors may harm social and economic security, corporate personal reputation and personal property safety. With the continuous development of deep synthesis technology, the use of this technology for fraud, blackmail, framing, slander and other illegal acts and cases are common.

Finally, there is the risk of serious cyber attacks. Attackers may use security vulnerabilities in AI systems to carry out attacks, such as hijacking, attacking, blocking and interfering with AI learning, prediction, etc. In addition, attackers can also use artificial intelligence techniques to launch attacks, such as machine learning algorithms to infer a user's password or encry
# AI Regulation: Global Calls for Strengthened AI Security Regulation

Ai governance has a bearing on the fate of all mankind and is a common task facing all countries in the world. Since the beginning of this year, many countries and organizations around the world have introduced initiatives or norms, and unanimously required to strengthen the safety supervision of artificial intelligence. Artificial intelligence bid farewell to extensive development and ushered in a synchronous stage of security and development.

![2023110802.png](https://cdn.aisecurius.com/images/997/99713565-b12d-422b-af7e-8d3ee10f88c0.png)

 The Declaration encourages relevant actors to take appropriate measures, such as safety testing, evaluation, etc., to measure, monitor, and mitigate the potentially harmful capabilities of AI and its possible impacts, and to provide transparency and accountability. Countries are called upon to develop risk-based policies based on risk, including the development of appropriate assessment indicators, safety testing tools, and the development of public sector capacity and scientific research. We also resolve to support the establishment of an internationally inclusive, cutting-edge AI security science research network that includes and complements existing and new multilateral and bilateral cooperation mechanisms to promote the best science for decision-making and the public interest through existing international forums and other relevant initiatives.

On October 30, the Group of Seven (G7) issued an International Code of Conduct for organizations Developing Advanced Artificial Intelligence Systems. The 11-point code of conduct highlights measures to be taken during the development process to ensure reliability, security and assurance. Among them, developers need to identify and mitigate risks, including red team testing, testing, and mitigation measures. At the same time, developers also need to identify and reduce vulnerabilities, incidents, and misuse patterns after deployment, including monitoring vulnerabilities and incidents, and facilitating third parties and users to find and report issues. In addition, the guidelines highlight the importance of developing and deploying reliable content authentication and provenance mechanisms, such as watermarking. These measures will help ensure the safety and reliability of AI systems and increase user trust in them.

Also on October 30, US President Joe Biden officially issued the "Safe, Reliable and Trustworthy Artificial Intelligence" executive Order, which is the White House's first set of regulations on generative artificial intelligence. The executive order requires multiple U.S. government agencies to develop standards, test artificial intelligence products, seek the best methods for content verification such as "watermarking," develop cybersecurity plans, and attract technical talent to protect privacy, promote fairness and civil rights, safeguard the interests of consumers and workers, promote innovation and competition, and advance U.S. leadership. At the same time, the executive order states that it will protect U.S. users from AI fraud and deception by establishing standards for detecting AI-generated content and certifying official content.

On October 18, the CAC issued the "Global Artificial Intelligence Governance Initiative", with specific measures including promoting the establishment of a risk level test and evaluation system, implementing agile governance, classification and classification management, and rapid and effective response. Research and development entities need to improve the explainability and predictability of AI, improve the authenticity and accuracy of data, ensure that AI is always under human control, and create AI technologies that can be audited, supervised, traceable, and trusted. At the same time, actively develop the development and application of relevant technologies for artificial intelligence governance, support the use of artificial intelligence technology to prevent risks and improve governance capabilities. In addition, the initiative also emphasizes the gradual establishment and improvement of laws and regulations to protect personal privacy and data security in the research and development and application of artificial intelligence, and opposes illegal collection, theft, tampering and disclosure of personal information.

On July 13, the National Cyberspace Administration jointly issued the "Interim Measures for the Management of Generative Artificial Intelligence Services" with relevant state departments. Requiring generative artificial intelligence services with public opinion attributes or social mobilization capabilities, security assessments shall be carried out in accordance with the relevant provisions of the State, and in accordance with the Provisions on the Management of Internet Information Service algorithm Recommendation, algorithm filing and change, cancellation filing procedures.

In June this year, the European Parliament passed the draft authorization of the European Union Artificial Intelligence Act, which, if formally approved, will be the world's first regulation on AI. The bill classifies AI systems into four categories based on the level of risk, from minimal to unacceptable. Among them, "technology robustness and security" requires AI systems to minimize accidental harm during development and use, and to have robust capabilities to respond to unexpected problems in order to prevent malicious third parties from illegally using the system or changing its use or performance. In addition, the bill prohibits the creation or expansion of facial recognition databases by untargeted extraction of facial images from the Internet or CCTV footage, and prohibits the use of AI systems in this way to place on the market, put into service or use. For generative AI systems based on these models, the bill requires compliance with transparency requirements, that is, it must be disclosed that the content is generated by the AI system, and ensure that illegal content is prevented from being generated. In addition, when using copyrighted training data, a detailed summary of that data must be made public.

In addition, in late October, scholars such as Turing Award winners and the "Big Three of Artificial Intelligence" broke out a fierce debate on the control of artificial intelligence. A group of 24 Chinese and foreign artificial intelligence scientists have signed a statement calling for stricter controls on artificial intelligence technology. Establish an international regulatory body, subject advanced AI systems to mandatory registration and audit, introduce instant "shutdown" procedures, and require developers to spend 30% of their research budgets on AI safety.


# Regulation: AI Security Regulation Suggestions Focus on Six Key Areas


Although there are differences in the priorities of regulation, and the artificial intelligence community and industry debate is fierce, governments have basically reached a consensus on strengthening artificial intelligence regulation. At present, the supervision of artificial intelligence mainly focuses on six aspects: security testing and evaluation, content authentication and watermark marking, prevention of information abuse, forced closure procedures, independent regulators, and risk identification and security.

![2023110803.png](https://cdn.aisecurius.com/images/ccb/ccb117b2-5fda-4849-9057-bfc512fe8f4e.png)

Safety testing and evaluation: Require safety testing and evaluation of AI systems to measure, monitor, and mitigate potentially harmful capabilities, and provide transparency and accountability. Developers are required to share security test results and other critical information with the government to ensure that the system is secure and reliable before release.

Content Authentication and watermarking: Establish standards for detecting AI-generated content and authenticating official content to protect users from AI fraud and deception. Emphasis is placed on the development and deployment of reliable content authentication and provenance mechanisms such as watermarking.

Ensure the safety of the face: the face is an important private data of artificial intelligence, and it is also an important application output, and it is particularly important to prevent abuse. It is prohibited to build or expand facial recognition databases by untargeted extraction of facial images from the Internet or CCTV footage. For generative AI systems, it is required to comply with transparency requirements, disclose how content is generated and prevent the generation of illegal content.

Risk identification and security: AI systems are required to be robust and secure, to minimize accidental harm, and to respond to problems and malicious use. Developers need to identify and reduce vulnerabilities, incidents, and misuse patterns after deployment, including monitoring vulnerabilities and incidents, and facilitating users and third parties to find and report issues.

Set up a forced shutdown: Introduce an instant "one-click shutdown" feature to prevent unexpected situations or malicious use of AI programs.

Establish independent tripartite institutions: promote the establishment of an international inclusive cutting-edge AI security scientific research network, establish an international regulatory body, and require advanced AI systems to undergo mandatory registration and audit.


# Dingxiang: Four Abilities to Ensure AI Security


Based on the status quo of artificial intelligence risks and the security supervision needs of various countries, Dingxiang provides four security capabilities of artificial intelligence security detection, security intelligence, security defense and face security.

Ai system security testing: Conduct comprehensive security testing of AI applications, products and apps, identify and detect potential security vulnerabilities, and provide timely repair recommendations. This detection mechanism can prevent attackers from using security vulnerabilities to carry out malicious attacks.

Artificial intelligence threat intelligence: Dingxiang cloud service security intelligence provides artificial intelligence attack intelligence from many angles, combining technology and expert experience to comprehensively predict the threat mode of attackers. Help organizations respond and deploy accurately to protect their AI systems from potential threats.
![20231104.jpg](https://cdn.aisecurius.com/images/d84/d84f8ac9-9999-4258-912f-240599f4b426.jpg)

Whole process security defense: Dingxiang defense cloud is used to harden artificial intelligence applications, apps, and devices and protect them with code confusion to improve their security. At the same time, the confusing encryption of artificial intelligence data communication transmission can prevent problems such as eavesdropping, tampering and fraudulent use in the process of information transmission. In addition, with the Dinsigh risk control decision engine of Dingxiang, the equipment environment can be comprehensively detected, all kinds of risks and abnormal operations can be found in real time, and the overall safety can be improved. In addition, the Xintell modeling platform of Dingxiang can provide strategic support for artificial intelligence security, timely mining potential risks and unknown threats.

Face application security protection: Dingxiang service security awareness defense platform Based on threat probe, stream computing, machine learning and other advanced technologies, set equipment risk analysis, operation attack identification, abnormal behavior detection, early warning, protection and disposal as one of the active security defense platform, can be found in real time camera hijacking, equipment forgery and other malicious behaviors, effectively prevent and control all kinds of face application risks. It features threat visualization, threat traceability, device association analysis, multi-account management, cross-platform support, active defense, open data access, defense customization, and whole-process prevention and control.

Through the four-fold security capability of Dingxiang, enterprises can better protect their AI systems from security risks and threats of attacks, improve the security of AI applications and meet the security regulatory needs of various countries.

AI Security: Government AI Regulatory Measures Focus on Six Key Areas

As AI’s capabilities grow, so do its implications for Americans’ safety and security. With this Executive Order, the President directs the most sweeping actions ever taken to protect Americans from the potential risks of AI systems:

![2023110602.png](https://cdn.aisecurius.com/images/3fa/3fa22aa1-0c53-471b-9bf3-08a8fe1e4722.png)
As AI’s capabilities grow, so do its implications for Americans’ safety and security. With this Executive Order, the President directs the most sweeping actions ever taken to protect Americans from the potential risks of AI systems:

Require that developers of the most powerful AI systems share their safety test results and other critical information with the U.S. government. In accordance with the Defense Production Act, the Order will require that companies developing any foundation model that poses a serious risk to national security, national economic security, or national public health and safety must notify the federal government when training the model, and must share the results of all red-team safety tests. These measures will ensure AI systems are safe, secure, and trustworthy before companies make them public. 
Develop standards, tools, and tests to help ensure that AI systems are safe, secure, and trustworthy. The National Institute of Standards and Technology will set the rigorous standards for extensive red-team testing to ensure safety before public release. The Department of Homeland Security will apply those standards to critical infrastructure sectors and establish the AI Safety and Security Board. The Departments of Energy and Homeland Security will also address AI systems’ threats to critical infrastructure, as well as chemical, biological, radiological, nuclear, and cybersecurity risks. Together, these are the most significant actions ever taken by any government to advance the field of AI safety.
Protect against the risks of using AI to engineer dangerous biological materials by developing strong new standards for biological synthesis screening. Agencies that fund life-science projects will establish these standards as a condition of federal funding, creating powerful incentives to ensure appropriate screening and manage risks potentially made worse by AI.
Protect Americans from AI-enabled fraud and deception by establishing standards and best practices for detecting AI-generated content and authenticating official content. The Department of Commerce will develop guidance for content authentication and watermarking to clearly label AI-generated content. Federal agencies will use these tools to make it easy for Americans to know that the communications they receive from their government are authentic—and set an example for the private sector and governments around the world.
Establish an advanced cybersecurity program to develop AI tools to find and fix vulnerabilities in critical software, building on the Biden-Harris Administration’s ongoing AI Cyber Challenge. Together, these efforts will harness AI’s potentially game-changing cyber capabilities to make software and networks more secure.
Order the development of a National Security Memorandum that directs further actions on AI and security, to be developed by the National Security Council and White House Chief of Staff. This document will ensure that the United States military and intelligence community use AI safely, ethically, and effectively in their missions, and will direct actions to counter adversaries’ military use of AI.
Protecting Americans’ Privacy

Without safeguards, AI can put Americans’ privacy further at risk. AI not only makes it easier to extract, identify, and exploit personal data, but it also heightens incentives to do so because companies use data to train AI systems. To better protect Americans’ privacy, including from the risks posed by AI, the President calls on Congress to pass bipartisan data privacy legislation to protect all Americans, especially kids, and directs the following actions:

Protect Americans’ privacy by prioritizing federal support for accelerating the development and use of privacy-preserving techniques—including ones that use cutting-edge AI and that let AI systems be trained while preserving the privacy of the training data.  
Strengthen privacy-preserving research and technologies, such as cryptographic tools that preserve individuals’ privacy, by funding a Research Coordination Network to advance rapid breakthroughs and development. The National Science Foundation will also work with this network to promote the adoption of leading-edge privacy-preserving technologies by federal agencies.
Evaluate how agencies collect and use commercially available information—including information they procure from data brokers—and strengthen privacy guidance for federal agencies to account for AI risks. This work will focus in particular on commercially available information containing personally identifiable data.
Develop guidelines for federal agencies to evaluate the effectiveness of privacy-preserving techniques, including those used in AI systems. These guidelines will advance agency efforts to protect Americans’ data.
Advancing Equity and Civil Rights

Irresponsible uses of AI can lead to and deepen discrimination, bias, and other abuses in justice, healthcare, and housing. The Biden-Harris Administration has already taken action by publishing the Blueprint for an AI Bill of Rights and issuing an Executive Order directing agencies to combat algorithmic discrimination, while enforcing existing authorities to protect people’s rights and safety. To ensure that AI advances equity and civil rights, the President directs the following additional actions:

Provide clear guidance to landlords, Federal benefits programs, and federal contractors to keep AI algorithms from being used to exacerbate discrimination.
Address algorithmic discrimination through training, technical assistance, and coordination between the Department of Justice and Federal civil rights offices on best practices for investigating and prosecuting civil rights violations related to AI.
Ensure fairness throughout the criminal justice system by developing best practices on the use of AI in sentencing, parole and probation, pretrial release and detention, risk assessments, surveillance, crime forecasting and predictive policing, and forensic analysis.
Standing Up for Consumers, Patients, and Students

AI can bring real benefits to consumers—for example, by making products better, cheaper, and more widely available. But AI also raises the risk of injuring, misleading, or otherwise harming Americans. To protect consumers while ensuring that AI can make Americans better off, the President directs the following actions:

Advance the responsible use of AI in healthcare and the development of affordable and life-saving drugs. The Department of Health and Human Services will also establish a safety program to receive reports of—and act to remedy – harms or unsafe healthcare practices involving AI. 
Shape AI’s potential to transform education by creating resources to support educators deploying AI-enabled educational tools, such as personalized tutoring in schools.
Supporting Workers

AI is changing America’s jobs and workplaces, offering both the promise of improved productivity but also the dangers of increased workplace surveillance, bias, and job displacement. To mitigate these risks, support workers’ ability to bargain collectively, and invest in workforce training and development that is accessible to all, the President directs the following actions:

Develop principles and best practices to mitigate the harms and maximize the benefits of AI for workers by addressing job displacement; labor standards; workplace equity, health, and safety; and data collection. These principles and best practices will benefit workers by providing guidance to prevent employers from undercompensating workers, evaluating job applications unfairly, or impinging on workers’ ability to organize.
Produce a report on AI’s potential labor-market impacts, and study and identify options for strengthening federal support for workers facing labor disruptions, including from AI.
Promoting Innovation and Competition

America already leads in AI innovation—more AI startups raised first-time capital in the United States last year than in the next seven countries combined. The Executive Order ensures that we continue to lead the way in innovation and competition through the following actions:

Catalyze AI research across the United States through a pilot of the National AI Research Resource—a tool that will provide AI researchers and students access to key AI resources and data—and expanded grants for AI research in vital areas like healthcare and climate change.
Promote a fair, open, and competitive AI ecosystem by providing small developers and entrepreneurs access to technical assistance and resources, helping small businesses commercialize AI breakthroughs, and encouraging the Federal Trade Commission to exercise its authorities.
Use existing authorities to expand the ability of highly skilled immigrants and nonimmigrants with expertise in critical areas to study, stay, and work in the United States by modernizing and streamlining visa criteria, interviews, and reviews.
Advancing American Leadership Abroad

AI’s challenges and opportunities are global. The Biden-Harris Administration will continue working with other nations to support safe, secure, and trustworthy deployment and use of AI worldwide. To that end, the President directs the following actions:

Expand bilateral, multilateral, and multistakeholder engagements to collaborate on AI. The State Department, in collaboration, with the Commerce Department will lead an effort to establish robust international frameworks for harnessing AI’s benefits and managing its risks and ensuring safety. In addition, this week, Vice President Harris will speak at the UK Summit on AI Safety, hosted by Prime Minister Rishi Sunak.
Accelerate development and implementation of vital AI standards with international partners and in standards organizations, ensuring that the technology is safe, secure, trustworthy, and interoperable.
Promote the safe, responsible, and rights-affirming development and deployment of AI abroad to solve global challenges, such as advancing sustainable development and mitigating dangers to critical infrastructure.
Ensuring Responsible and Effective Government Use of AI

AI can help government deliver better results for the American people. It can expand agencies’ capacity to regulate, govern, and disburse benefits, and it can cut costs and enhance the security of government systems. However, use of AI can pose risks, such as discrimination and unsafe decisions. To ensure the responsible government deployment of AI and modernize federal AI infrastructure, the President directs the following actions:

Issue guidance for agencies’ use of AI, including clear standards to protect rights and safety, improve AI procurement, and strengthen AI deployment.  
Help agencies acquire specified AI products and services faster, more cheaply, and more effectively through more rapid and efficient contracting.
Accelerate the rapid hiring of AI professionals as part of a government-wide AI talent surge led by the Office of Personnel Management, U.S. Digital Service, U.S. Digital Corps, and Presidential Innovation Fellowship. Agencies will provide AI training for employees at all levels in relevant fields.
As we advance this agenda at home, the Administration will work with allies and partners abroad on a strong international framework to govern the development and use of AI. The Administration has already consulted widely on AI governance frameworks over the past several months—engaging with Australia, Brazil, Canada, Chile, the European Union, France, Germany, India, Israel, Italy, Japan, Kenya, Mexico, the Netherlands, New Zealand, Nigeria, the Philippines, Singapore, South Korea, the UAE, and the UK. The actions taken today support and complement Japan’s leadership of the G-7 Hiroshima Process, the UK Summit on AI Safety, India’s leadership as Chair of the Global Partnership on AI, and ongoing discussions at the United Nations.

The actions that President Biden directed today are vital steps forward in the U.S.’s approach on safe, secure, and trustworthy AI. More action will be required, and the Administration will continue to work with Congress to pursue bipartisan legislation to help America lead the way in responsible innovation.

For more on the Biden-Harris Administration’s work to advance AI, and for opportunities to join the Federal AI workforce, visit AI.gov.

America：New Standards for AI Safety and Security

From October 30th to November 5th, the 2023 Hong Kong Fintech Week was held in Hong Kong and Shenzhen.  

From October 30th to November 5th, the 2023 Hong Kong Fintech Week was held in Hong Kong and Shenzhen. The theme of this technology week is "New Definition of Fintech", focusing on sustainable and green finance; fundraising, venture capital and family office investment, exploring artificial intelligence; Web3.0 and emerging fields; exploring the vigorous development opportunities in the Guangdong-Hong Kong-Macao Greater Bay Area; Hong Kong's innovation path, and other six themes to jointly explore the future development of fintech. Dingxiang in the Hong Kong Fintech Week for the first time and brought a new financial anti-fraud product.
![2023110403.jpg](https://cdn.aisecurius.com/images/3bb/3bb17eaa-be10-4652-b9b3-b779e3b467bc.jpg)

The 2023 Hong Kong Fintech Week is organized by the Hong Kong Financial Services and Treasury Bureau and the Hong Kong Special Administrative Region Government Investment Promotion Agency, and co-organized by the Hong Kong Monetary Authority, the Hong Kong Securities and Futures Commission, and the Hong Kong Insurance Authority. The event attracted more than 300 speakers and over 540 exhibitors from around the world, with 30,000 participants and 5 million online viewers.

# Financial Fraud: Becomes Industrialized


Fraudulent activities such as loan fraud, credit card fraud, insurance fraud, and other fraudulent activities have caused serious losses to banks, customers, and other parties, and have become an important risk faced by financial institutions. In addition, some new types of financial fraud have emerged, posing further threats to financial institutions and customers.

Unlawful elements steal customers' funds and information by forging mobile banking apps or tampering with existing mobile banking apps to inject malicious code. They also use simulators to forge devices, register false accounts, buy marketing benefits, occupy user resources, and forge promotion effects. In addition, they use illegally obtained personal information to synthesize the faces and voices of victims' relatives, leaders, colleagues, or public officials through artificial intelligence technology, and use video calls, voice bombardment, and other means to send fraudulent messages such as bank card transfers, virtual investment and finance, and rebates to victims.

![2023110401.jpg](https://cdn.aisecurius.com/images/8f2/8f2034dc-823b-48b6-a1b0-b4b5fdaf9536.jpg)

Financial fraud has obvious chain characteristics, forming a complete black and gray industrial chain, and showing some new characteristics.

Firstly, with the increasing number of financial transaction scenarios, the threshold for fraud has been lowered, and lawbreakers can use more and more sophisticated technological means to carry out fraudulent activities.

Secondly, the application of AI has increased the complexity of social engineering, and lawbreakers can use AI technology to simulate intimate family members or friends, making fraud more deceptive.

In addition, convenient financial processes and innovative channels provide convenient conditions for fraudulent activities, and criminals turn to emerging and immature channels for fraudulent attacks.


# Dingxiang's Anti-Fraud Products


Technology is a game-changer for the financial industry, and the industry must effectively apply advanced financial technology to provide better services to customers. As a business security enterprise participating in Hong Kong Fintech Week for the first time, Dingxiang brought financial anti-fraud products such as Dinsight and defense cloud to the exhibition.
![2023110402.jpg](https://cdn.aisecurius.com/images/485/4854844f-f41b-4767-914c-7e25f4553722.jpg)

Dingxiang Dinsight's daily risk management strategy has an average processing speed of within 100 milliseconds. It is a data aggregation engine that integrates expert strategies to support parallel monitoring and replacement/upgrading of existing risk management processes. It can also build dedicated risk management platforms for new businesses. By integrating anti-fraud and risk management data, it supports configurable access and data deposition from multiple sources, enables graphical configuration, and can be quickly applied to complex strategies and models. It can achieve self-performance monitoring and self-iterative mechanism based on mature indicators, strategies, models, and deep learning technology. It also integrates expert strategies and is based on the system + data access + index library + strategy system + expert implementation in practice. It supports parallel monitoring, replacement/upgrading of existing risk management processes, and can also build dedicated risk management platforms for new businesses.

As a business security product passing the first batch of inspections and certifications of China's Ministry of Industry and Information Technology, Dingxiang defense cloud includes business security intelligence, business perception defense platform, captcha, device fingerprint, and end-point hardening products. It has six capabilities: equipment authenticity identification, behavior verification, risk perception, high-performance real-time calculation, efficient strategy execution, and attack reduction/reversal. It can integrate network risk situations to provide industry companies with network security attack and defense intelligence. Based on technology refined in attack and defense practices and practical experience, it forms industry-generic strategies and customized exclusive strategies, and iterates in real-time through the cloud. It provides a closed-loop risk handling process including risk identification, defense treatment, attack reduction/reversal, manual review, correlation analysis, and data deposition. In addition, it has the ability to deposit black sample data and risk behavior features, and sends them to various business security systems through the cloud to further improve overall risk prevention and control.

So far, Dingxiang has provided a series of professional anti-fraud services to more than 100 important financial institutions such as Bank of China, China Construction Bank, China UnionPay, Minsheng Banking Corporation Limited, Huaxia Banking Corporation Limited, Yongfeng Banking Corporation Limited, Xingguang Banking Corporation Limited, Yonglong Banking Corporation Limited, Yuanda Banking Corporation Limited, DBS Bank (Taiwan), Bank of Kaohsiung, and more. Its products enhance the risk control ability of financial institutions, improve customer satisfaction, and promote the smooth progress of digital transformation.

Dingxiang Makes Its Debut at Hong Kong FinTech Week

As a key element of human-computer interaction interface, verification code is an important part of identity verification, risk prevention and data backcrawling.

As a key element of human-computer interaction interface, verification code is an important part of identity verification, risk prevention and data backcrawling. It is widely used on websites and apps, and plays a huge role in various scenarios such as registration, login, transaction and interaction. It has the functions of real person identification and identity verification, and also plays an important role in ensuring account security.

As part of an enterprise's business, the design of the CAPTCHA has a significant impact on the user experience. A concise, clear and easily identifiable appearance of the verification code can improve the efficiency of the user to complete the verification, reduce the user's fatigue, and is easier to be accepted and liked by the user. Through the unique design and professional sense, users can feel the concern of the enterprise for security and user experience, and increase their trust in the enterprise. This is particularly important in areas such as finance and e-commerce, where users have high security requirements.

As one of the important elements of the interaction between users and enterprises, the appearance of the verification code can reflect the style and characteristics of enterprises. The customized appearance of the verification code can integrate the enterprise's brand identity, slogan, advertising and other elements into it to achieve the publicity effect of the brand. When users use the verification code, they will unconsciously notice the brand information, thereby enhancing the cognition and memory of the brand, and thus enhancing brand awareness and exposure. Through the customized appearance of the verification code, enterprises can better shape their own image, convey the brand characteristics and values of the enterprise to users, so as to establish a good corporate imag
# CAPTCHA: Replacing the Appearance of Traditional CAPTCHAs is Complex

General verification code, if you need to customize the appearance of the transformation, usually need the following steps.

First, the exterior design. Choose the appropriate colors, fonts, shapes, and other elements, and determine the overall interface layout and interaction. It is important to ensure that the design is consistent with the brand image and style of the company, and that it is visually appealing to the user.
Secondly, according to the use of HTML, CSS and JavaScript technology, the design draft is transformed into an interactive and displayable captCHA interface, and the corresponding dynamic effects and interactive features are added.
Then, you need to test and optimize the appearance of the customized captCHA to ensure that the appearance of the Captcha will display and operate properly on a variety of devices and browsers.
Finally, a custom CAPTCHA look is deployed to a website, App, or application to ensure it aligns with the company's image and goals.
Top image atbCAPTCHA provides a convenient appearance change setting, you can change the appearance of the CAPTCH


# atbCAPTCHA: Can Replace Images Online


Log in to the atbCAPTCHA management background and enter appearance management. You can choose Custom configuration, Logo configuration, and font configuration. The system can adjust some contents of each verification mode and preview them immediately.
![2023102401.png](https://cdn.aisecurius.com/images/932/9325872e-2973-4ec3-a5ad-c21c1f7e22e8.png)

Under custom configuration, administrators can freely set the Settings as required. For example, configure the interference items, watermark depth and background image of the slider verification code, adjust the font, text size, font color, rotation, tilt, hollowing, target word count and total word count of the click verification code, and configure the map and icon of the scratch card verification code. Support font, text size, color, rotation, tilt, hollowing, etc. for the word order point verification code, and configure the atlas of out-of-order puzzles and rotating puzzles to verify dreams.

![2023102402.png](https://cdn.aisecurius.com/images/de4/de470566-dc57-4e7d-90a2-1331bd1c167f.png)
In the custom Settings, it should be noted that the image size can be selected as 300x150 pixels or 600x300 pixels, and the image needs to be less than 100KB
![2023102403.png](https://cdn.aisecurius.com/images/c49/c492c5d9-326e-4141-b068-c5c502370b22.png)

In the Logo configuration, the system can customize the Logo of the verification code. You can upload the corresponding Logo file. The default size of the customized background LOGO image is 78 x 30px in png format. The administrator can customize the width of the Logo size, but the height must be fixed.
![2023102404.png](https://cdn.aisecurius.com/images/b1c/b1c8b54e-9b82-473a-b4e9-ae7e3633b5f7.png)

In addition, under the font configuration, the administrator can upload the corresponding font file as required.
![2023102405.png](https://cdn.aisecurius.com/images/7f9/7f98ba77-43f7-4f48-aba8-fa9f84a9a138.png)

atbCAPTCHA combines multiple technologies such as Device Fingerprinting, behavioral features, access frequency, and geographic location to effectively intercept malicious login, batch registration, block machine operation, and intercept abnormal users. Compared with traditional verification codes, users do not need to think or input operations. Verify with a simple swipe. After intelligent identification as normal users, in a certain period of time do not need to slide operations, not only to provide security for the enterprise but also to let users do not feel through, greatly improving the user experience.

————————————END————————————

atbCAPTCHA,bot management,anti-bot Captcha,captcha,anti-bot solution,captcha security,fraud protection,Mobile Authentication,captcha plugin,vaptcha,botdetect


atbCAPTCHA: Replace Website Registration and Login CAPTCHAs with Your Own Photos

Risk control component refers to the module or tool used in the risk control system to monitor, identify and handle various risk behaviors. 

 Risk control component refers to the module or tool used in the risk control system to monitor, identify and handle various risk behaviors. They assist institutions or enterprises in implementing effective risk management and precautions by using different algorithms, rules and technologies. Through data analysis, model building, rule engine and other technical means, risk control components help institutions or enterprises to timely identify and warn all kinds of risk behaviors, and take corresponding measures to control and prevent risks. Through effective risk control components, institutions or enterprises can reduce risk losses, improve operational efficiency, and protect users' rights and interests and data security.

 Risk control components can include data collection, risk identification, rules, monitoring, decision making, anti-fraud, analysis and reporting and other components.

 Data acquisition module: Collect, organize and analyze user behavior, transactions, and equipment information based on device fingerprint, secure SDK, black and white list data, so as to obtain the basic data for analysis and judgment of possible risk behaviors.

 Risk identification module: through the use of machine learning, data mining and other technologies, the collected data pattern analysis, abnormal detection, used to identify potential risk behaviors, and their risk assessment and classification.

 Rule module: The rule module can match and determine the risk behavior according to the requirements of specific scenarios, such as multiple accounts opening under the same IP address, and high-risk behavior patterns, according to the pre-set rules and strategies, so as to determine the risk degree.

 Real-time monitoring module: real-time monitoring and control the operation of the system, and alert and notify abnormal and suspicious activities according to the preset thresholds and rules. These alerts can be sent to relevant personnel by email, text messages, etc.

 Risk decision module: Make risk decision making and treatment according to the risk assessment results and strategies. For high-risk behaviors or transactions, it can automatically trigger the review, restriction or interception operations, to protect the interests of the institution or enterprise and the security of the system.

 Anti-fraud module: to identify and prevent fraud, including device fingerprint identification, blacklist verification, multi-dimensional cross-verification and other technical means, to reduce the risk and loss of fraud.

 Analysis and report module: generate all kinds of risk reports, provide data analysis and statistics, help institutions or enterprises to understand the risk situation, optimize the strategy, and make corresponding decisions.

 According to their own needs and risk characteristics, enterprises customize and adjust the specific content and functions of their risk control components.


# Dinsight: Step-by-Step Component Management


 Risk control engine is the core system used for managing and executing risk control models, responsible for integrating, deploying and monitoring the operation of various risk control models. According to the actual business needs, the performance and stability requirements should also be considered, in order to achieve efficient and reliable risk management.

 The Dinsight real-time risk control engine provides a visual interface that allows business people to quickly start working, easily configure components, and observe the running status of components in real time.

Take "action" as an example, detail the component configuration steps of Dinsight real-time risk control engine.

1、 After entering the user name and password, log in to the top image Dinsight real-time risk control engine background, enter the "Policy Center-Component Management", and click on the "Basic Information" page in the "Component Mode" drop-down box to select "Action"

![2023092101.jpg](https://cdn.aisecurius.com/images/fb1/fb155b09-ab01-4397-b688-81d5e901a757.jpg)

 In the component configuration interface, you can freely select the configuration actions during the condition. Currently, you support the configuration actions during "Before condition execution", "After condition execution", "conditional hit", "and" conditional miss ". After selecting the conditions, you can configure the action directly.

![2023092102.jpg](https://cdn.aisecurius.com/images/5be/5be83f8b-32b1-4265-b431-11e81e12900b.jpg)
 At present, Dinsight real-time risk control engine can be configured with four types of actions: value assignment, list category, process control and risk level. In each set of action configuration, only one risk level and process control can be configured.
![2023092103.jpg](https://cdn.aisecurius.com/images/bde/bde0782b-ca41-4ce6-a7e5-ce22a5431d98.jpg)

 Assignment class: A function in an action expression can only select the assignment class function.
 List class: The outermost function of the action expression can only select the function of the list class.
 Process control: node exit, process exit, policy exit, and event exit.
 Risk level: normal request, suspected risk request, risk request; add risk type for suspected risk and risk request.

2. Select "Assignment Class" in the "Action Type" drop-down box for function; in "Function Expression", select specific field for assignment: for example, select "prompt Information" to indicate the content of the prompt information when the condition is hit. Assignment types can be Constant, Field, Index, Model, External Data, Function; For example, select the Constant type and edit the constant value in the input box and click the OK button.

![2023092104.jpg](https://cdn.aisecurius.com/images/8f6/8f66f9a3-8a28-4633-a1f9-4b31d845770b.jpg)

3. Select "List Class" in the "Action Type" drop-down box, click the selection box below the expression, pop up the optional function, and configure according to the type of function. For example, select the "Add to List" function, the function needs to input two parameters. The first parameter is any constant, field, index, model, external data, function, and the second parameter is "list".

![2023092105.jpg](https://cdn.aisecurius.com/images/5e1/5e109c1e-8b11-41d4-86ef-331e60a94cc4.jpg)

4. Select "Risk Level" in the "Action Type" drop-down box. The risk level includes "Normal Request", "Suspected Risk Request" and "Risk Request".

![2023092106.jpg](https://cdn.aisecurius.com/images/399/399ad3aa-3cee-47e2-a9fa-189becb83b0d.jpg)

5、 Select Process Control in the Action Type drop-down box. According to the business requirements of the components, select Node Exit, Process Exit, Policy Exit, and Event Exit for the requirements of the components. After all action configurations are complete, you can adjust the priority order and delete settings in the action bar of the action list.
![2023092107.jpg](https://cdn.aisecurius.com/images/733/7338cbd4-f9aa-4f51-a323-dda6129d0606.jpg)

Dinsight: How Operators Can Quickly Manage Components

The model is based on the large-scale sampling data of the target group, dig out the phenomenon nature and operation law of a practical problem or objective thing,

 The model is based on the large-scale sampling data of the target group, dig out the phenomenon nature and operation law of a practical problem or objective thing, use abstract concepts to analyze the existing problems or risks, calculate and deduce the countermeasure process of reducing and preventing problems or risks, and form a set of systematic strategies or rule set. The risk control model refers to a model that evaluates and controls risks by using data analysis and algorithm technology in finance, insurance, e-commerce and other fields. It is a mathematical model built based on a large number of historical data and statistical methods to help institutions or enterprises to effectively identify, quantify and manage the risks associated with their business, so as to reduce economic losses and improve operational efficiency.

 Risk identification: The risk control model can identify potential risk factors and abnormal patterns through statistical analysis and data mining methods, so as to help institutions to find and warn risks in time.

 Quantified risk: The risk control model can quantify the risk, and calculate the probability and probability of the risk, influence degree and loss estimation, so as to provide scientific basis for decision-making.

 Control risk: Risk control model can establish the risk assessment model and decision model, and formulate the corresponding risk management strategies and control measures to help institutions reduce the possibility of risk occurrence and the degree of loss.

Improve efficiency: The risk control model can automatically and process a large number of complex risk data and decision-making process in a standardized manner, improve the efficiency and accuracy of risk management, and reduce labor costs and error rate.

#  Risk: What are the main risk models?

 According to different application scenarios and methods, the risk control model can be mainly divided into anti-fraud model, risk prediction model, score card model, credit model and arbitrage risk model.

 Anti-fraud model: Fraud detection model analyzes user behavior patterns and abnormal behavior characteristics, and uses machine learning and data mining algorithms to identify and predict potential fraud.

 Risk prediction model: Market risk model models and analyzes market price fluctuation, systemic risk and return on investment by modeling and analyzing financial market data.

 Score card model: The scoring card model is based on statistical methods and machine learning algorithms. By analyzing a large amount of historical data, the customer credit score card is built to predict the default probability and credit rating of customers.

 Credit model: Credit risk model is used to evaluate and manage the credit risk of borrowers. It predicts the possibility of default and loss probability by analyzing the financial status, historical credit records and other data of individuals or organizations.

 Arbitrage risk model: The arbitrage risk model identifies arbitrage opportunities and risks by analyzing the price differences and trading rules of different markets or products, and provides a basis for investment decisions.

 Different enterprises have different business scenarios, different process standards and demand objectives, and the direct use of the general standard model is often not satisfactory. Therefore, the types of risk control models may vary in different industries and scenarios, and some models may also be constructed and applied in combination with various methods and technologies.

# Dinsight: Step-by-Step Model Management for Decisioning Engine


decisioning engine is the core system for managing and executing risk control models and is responsible for integrating, deploying and monitoring the operation of various risk control models. Based on actual business requirements, performance and stability requirements must be considered to achieve efficient and reliable risk management.

How does the risk control engine manage the model? Dinsight provides a visual interface that lets business people get started quickly, easily query, import models, and observe model status in real time.

Log in to Dinsight background, go to "Variable Management - Model Management" and click on "Model Warehouse". In the current page, enter the model name, model ID, model state, etc., you can filter the query according to the type of model.

![2023102701.png](https://cdn.aisecurius.com/images/e41/e4171c39-ec2e-407d-8bd3-a932d6a6e7d5.png)

 Under this page, click the "Model Import" button in the upper right corner, and the system popup box to select the model file to be uploaded. The top image Dinsight real-time risk control engine supports PMML model, POython model and platform standard model.
![2023102702.png](https://cdn.aisecurius.com/images/e2a/e2a09100-86b5-40ff-aa66-b1edf2c6eb92.png)

 After importing the model file, you can view the input and output parameters in the model in time, and the output parameters can be used in the policy. Click OK to complete the import operation and view the new model in the Model Warehouse.

![2023102703.png](https://cdn.aisecurius.com/images/093/093e2525-e799-4502-998b-d1092e1909ab.png)

 Statistics on model service monitoring, stability monitoring, and performance monitoring can be viewed under the Model Dashboard. Select any model, and the system will show the relevant data indicators of the model.

![2023102704.png](https://cdn.aisecurius.com/images/4b7/4b783434-7e12-43fb-b0ab-bab4efe1fe26.png)

 When the model is used by the strategy, you can see today's call amount and time consumption to be used in this module. Detailed indicators such as historical call amount trend statistics, historical performance trend statistics, model stability and score distribution can be viewed according to different time dimensions.

Dinsight can perform risk judgment on the requests sent by the business front end in marketing activities, payment orders, credit applications and other scenarios, and return the decision result within milliseconds to improve the risk prevention and control ability of the business system. The average processing speed of daily risk control strategies is less than 100 milliseconds, the aggregate data engine, the integration of expert strategies, the parallel monitoring, replacement and upgrading of existing risk control processes, and the construction of a dedicated risk control platform for new businesses; Aggregate anti-fraud and risk control data, support multi-party data configuration access and precipitation, can be configured graphically, and quickly applied to complex strategies and models; Based on the experience reserve of mature indicators, strategies and models, as well as deep learning technology, self-performance monitoring and self-iteration mechanism of risk control can be realized; Integrated expert strategy, based on system + data access + index library + strategy system + expert implementation of actual combat; It supports parallel monitoring, replacement and upgrading of existing risk control processes, and can also build a dedicated risk control platform for new businesses.


Dinsight: Let Managers Quickly Add Models and Monitor Running Status in Real Time

Scalpers have stolen tickets to museums and concerts this summer. Organizers, museums with decisioning engines, can develop a set of rules to identify and intercept potential scalpers.


Scalpers have stolen tickets to museums and concerts this summer. Organizers, museums with decisioning engines, can develop a set of rules to identify and intercept potential scalpers.

 When making the rules, the comprehensive analysis of multiple factors, such as IP address, Device Fingerprinting, account association, and behavior pattern, should be considered to improve the accuracy and reliability. At the same time, we should effectively intercept the scalpers, and try to avoid causing inconvenience to normal users. It is necessary to analyze according to the actual business situation and user behavior, so it is necessary to set the threshold value and restriction conditions of the rules reasonably.

**Activity period rules**: Set the activity period to limit the ticket purchase time window, to ensure that scalpers cannot obtain and hoard a large number of tickets in advance.

**Real-name authentication rules:** Users are required to conduct real-name authentication to reduce the existence of anonymous accounts and improve the traceability and authenticity of the ticket purchase process.

**Geographic location rules:** According to the user's geographical location information, set the ticket purchase restriction rules for specific areas to limit the ticket purchase behavior in unauthorized areas.

**IP address restriction rule**: set each IP address can only submit one order within a certain period of time, to prevent scalpers from using multiple IP addresses for batch tickets.

 **Device identification rules**: monitor device fingerprint information, intercept abnormal device fingerprints (such as simulator, Root device, etc.), and restrict their access to and submit orders.

** Frequency limit rule:** set the frequency of users to submit orders, for example, limit the same user can only submit a certain number of orders in a short period of time, to avoid malicious ticket brushing or bulk orders.

** Account association rules**: detect the correlation between accounts, identify the accounts that may be operated by the same equipment, the same contact information and the same payment method, and restrict them.

 **Account historical behavior rules**: analyze the historical behavior patterns of users, such as abnormal ticket purchase behavior, frequent refunds, etc., identify potential scalpers' accounts, and strengthen the review and restriction of their orders.

 Rule makers should make comprehensive analysis and decisions based on specific business scenarios and risk characteristics to ensure that the implementation of rules can be effective. Strategies and means for scalpers also need to evolve, and rules also need to be optimized and updated at any time. Based on real-time risk data and feedback information, the rules should be adjusted in time to maintain effective prevention of scalpers.


#  What is a risk rule?


The so-called risk control rules are a set of pre-defined logical rules used to analyze and judge the operator's behavior and identify potential risks or abnormal situations. These rules are designed according to specific business requirements and risk models, and can be defined and implemented through programming language or configuration files, and can be written using predefined semantic modules.

 The rules in the risk control engine usually consof the following:

**Basic rules**: Basic rules refer to the most basic and commonly used rules in the risk control engine that are used to identify common risk behaviors. These rules can include abnormal access to IP addresses, abnormal changes in the device fingerprint, abnormal login of the account, etc. The underlying rules are often defined based on industry experience and common risk patterns.

 **Customization rules**: Custom rules are customized according to specific business needs and risk characteristics. These rules can be designed for specific industries, specific business scenarios, or specific user groups to meet personalized risk identification needs. Custom rules often need to be continuously optimized and adjusted based on actual data and business knowledge to improve accuracy and adaptability.

**Machine learning model:** Machine learning technology can also be used in risk control engines to build models for risk judgment and prediction. These models can learn risk patterns and patterns from a large amount of historical data, and make predictions and decisions based on real-time data. Machine learning models can be flexibly trained and updated according to the changes in the data and new risk patterns, with high accuracy and adaptive ability.

 
# How to create a risk rule?


 The source of risk control rules business practice, data mining and model, enterprises can more flexibly manage and modify business rules.

 Industry experience and best practice: relatively common risk behavior, build rules using industry experience and best practices. These experiences and practices are usually accumulated by professional risk control teams or practitioners, and can provide a more comprehensive and reliable risk judgment basis.

 Data analysis and mining: Through the analysis and mining of historical data, the hidden risk patterns and association rules can be found. These data models can be constructed through data science and technology, and they can generate rules through statistical analysis, association rule mining, and anomaly detection, etc.

 Business requirements and expert knowledge: Some specific rules can be formulated according to the specific business scenarios and requirements, combined with the experience and domain knowledge of the risk management experts. These rules can be customized according to the business characteristics and risk factors, more in line with the actual business needs.

 In short, the rules in the risk control engine come from various sources, including industry experience, data analysis and mining, as well as business requirements and expert knowledge. The design and application of these rules requires a comprehensive consideration of business characteristics, risk patterns and data situations, and is constantly optimized and updated to maintain accuracy and adaptability.


#  Dinsight: Step-by-Step Configuration of Risk Rules


 Rules ultimately need to be delivered to the operation personnel to configure and use, so it must be able to meet the flexible configuration and arrangement, and easy to understand, in order to maximize its power. The Dinsight real-time risk control engine provides a visual interface for business people to quickly get started and configure new, add, and test rules.
 After entering the user name and password, log on to the risk control decision engine, enter the "Policy Center-Component Management-Component Mode", and select "Rules" in the drop-down box.

![2023102601.png](https://cdn.aisecurius.com/images/165/165a4c5b-c1b5-460b-a57c-1536207f1fc3.png)
	
Make rule configuration in Component Configuration. The logical relationship in the configuration condition can be changed according to the actual business needs, with "and" and "or" currently available; a condition setting can be configured by default. If click "Add conditions", in "..."Add a condition setting after the button.
![2023102602.png](https://cdn.aisecurius.com/images/39e/39e513b4-ed1c-4f43-ace8-47838b46b21d.png)

 After the rule configuration is complete, it can be tested. In the "Component Configuration" interface, click the "Component Test" button to display the "Component Test" page; display the test data to be assigned in the component;
![2023102603.png](https://cdn.aisecurius.com/images/388/388fd26a-0579-4f56-a36e-9a435f0bded8.png)

 After manually assigning the variable, click the "Test" button and the component enters the test. After the test, you can view the details of the components. You can also continue to adjust the data, and test the component multiple times to verify the availability of the component.
![2023102604.png](https://cdn.aisecurius.com/images/dbb/dbba29b8-065c-405e-be4d-747001665f50.png)
 Dinsight The real-time risk control engine supports the rule-set configuration. In this mode, multiple rules can be set up, and each rule has a set of actions, and the rules are executed in order. Each rule hit will return according to the corresponding action.

![2023102605.png](https://cdn.aisecurius.com/images/3b1/3b180ced-1c8a-40e6-8c05-336fb0d068b0.png)

 Enter "Policy Center-Component Management", click "New Component" button, select "Rule Set / Rule Match" in the drop-down box to display the configuration box of "Rule Match"; multiple rules can be added; multiple conditions and actions can be set separately in each rule.

![2023102606.png](https://cdn.aisecurius.com/images/fec/fec539e3-f2d6-439c-a255-901394eaafc1.png)
Dinsight can perform risk judgment on the requests sent by the business front end in marketing activities, payment orders, credit applications and other scenarios, and return the decision result within milliseconds to improve the risk prevention and control ability of the business system. The average processing speed of daily risk control strategies is less than 100 milliseconds, the aggregate data engine, the integration of expert strategies, the parallel monitoring, replacement and upgrading of existing risk control processes, and the construction of a dedicated risk control platform for new businesses; Aggregate anti-fraud and risk control data, support multi-party data configuration access and precipitation, can be configured graphically, and quickly applied to complex strategies and models; Based on the experience reserve of mature indicators, strategies and models, as well as deep learning technology, self-performance monitoring and self-iteration mechanism of risk control can be realized; Integrated expert strategy, based on system + data access + index library + strategy system + expert implementation of actual combat; It supports parallel monitoring, replacement and upgrading of existing risk control processes, and can also build a dedicated risk control platform for new businesses.

Dinsight: Managers Can Quickly Edit Risk Rules

Risk control strategy is a collection composed of rules and models and used to achieve risk control goals.  Models and rules complement each other, complement each other, and focus differently in different business stages. 

 Risk control strategy is a collection composed of rules and models and used to achieve risk control goals. Models and rules complement each other, complement each other, and focus differently in different business stages. During the launch period of new business, the data amount is insufficient and the strategy is mainly rules. When the business is running for a period, the data has accumulated, the exclusive model can be built to realize the convergence of model and rules.

 The rules included in the risk control strategy include device dimension rules, behavior data rules, scoring card rules, black and white list rules, social communication rules, local and single dimension rules; the model is the law of the process and the whole.

 Simple risk control strategies need to be developed and written independently, which requires a lot of manpower. With more frequent and complex illegal attacks, risk control strategies also need to be quickly updated and updated.


 The Dinsight real-time risk control engine provides a visual interface that allows business people to quickly get started and configure new risk control strategies. After entering the user name and password, click to log into the risk control decision engine. Users can customize policies according to business requirements and maintain policy information. Support management policies according to the directory, view the hierarchical relationship of products, events and policies, and quickly locate policies and policy nodes through the directory to view details.

**query strategy.** In the Policy Management list interface, the policy is displayed by Product and can be viewed through the dendrogram on the left side of the page; the default displays the policy under all products.
![2023102305.png](https://cdn.aisecurius.com/images/483/48366e60-f76c-4ec6-9983-1de863b43b39.png)

** New strategy**. On the Policy Management list interface, click the New Policy button to jump to the New Policy page.
![2023102306.png](https://cdn.aisecurius.com/images/3ec/3ec07877-5c20-42c3-bbf2-36b2da51d41d.png)
![2023102307.png](https://cdn.aisecurius.com/images/256/256ae0d2-ce1a-4cd9-aaa8-134ab3ac69a6.png)

 Multiple policies can be created under the same event, and the order of execution of the policy under the same event is determined by the priority. The smaller the number, the higher the priority, and 0 represents the highest priority. If the proportion of requests that pass through this policy is set 80%, 80 out of 100 requests pass through this policy, and another 20 requests skip this policy to execute other policies. Furthermore, the policy is executed when the conditions are met.

**Edit policy**. In the Policy Management list interface, on the right side of each policy data, click the edit "" button in the operation bar to jump to the policy edit page.

![2023102308.png](https://cdn.aisecurius.com/images/7ad/7ad54df3-f672-4b1f-b6ba-d5f91ed2c7a0.png)

![2023102309.png](https://cdn.aisecurius.com/images/8cf/8cf07826-8fbd-4472-81cf-eae4df4ea889.png)
![2023102310.png](https://cdn.aisecurius.com/images/694/69419cec-c8e8-4f62-a619-28bfe17bd404.png)
![2023102311.png](https://cdn.aisecurius.com/images/23b/23b59a66-f261-4aab-8e1a-4ec4ff9d518f.png)

 **Deletion policy**. In the Policy Management list, click the Delete "" button in the operation column to pop up a warning and give a prompt " Do you confirm to delete the component?”
![2023102312.png](https://cdn.aisecurius.com/images/704/7041c6c5-4f26-4a34-b445-3015348fa814.png)

 Click the [Cancel] button, the index data does not change; click the [OK] button, the data to be deleted should be submitted for review. If the review passes, the deletion is successful; if the audit refuses, the deletion fails.
![2023102314.png](https://cdn.aisecurius.com/images/c69/c697165e-18ef-4be4-9bd4-4d772066e192.png)

 **Replication strategy.** In the "Policy Management" interface, in the right operation bar of each policy data, click the Copy "Copy" button, and the interface will jump to the "Copy" interface, which can copy this policy, and modify the configuration information to generate a new policy. After copying, the policy name should be re-entered, and other contents remain unchanged and can be modified.
![2023102315.png](https://cdn.aisecurius.com/images/7f9/7f993110-2331-4a7d-bbcb-3ca1dde12d34.png)


 **Strategy trend chart**. In the "Policy Management" interface, in the right operation bar of each policy data, click the trend chart button, the interface will jump to the "Policy Trend Display" interface, you can see "Hit Trend" and "Execution".
![2023102316.png](https://cdn.aisecurius.com/images/6ca/6ca9f0ca-ab2a-4e31-a330-ec158d380d20.png)

Dinsight can perform risk judgment on the requests sent by the business front end in marketing activities, payment orders, credit applications and other scenarios, and return the decision result within milliseconds to improve the risk prevention and control ability of the business system. The average processing speed of daily risk control strategies is less than 100 milliseconds, the aggregate data engine, the integration of expert strategies, the parallel monitoring, replacement and upgrading of existing risk control processes, and the construction of a dedicated risk control platform for new businesses; Aggregate anti-fraud and risk control data, support multi-party data configuration access and precipitation, can be configured graphically, and quickly applied to complex strategies and models; Based on the experience reserve of mature indicators, strategies and models, as well as deep learning technology, self-performance monitoring and self-iteration mechanism of risk control can be realized; Integrated expert strategy, based on system + data access + index library + strategy system + expert implementation of actual combat; It supports parallel monitoring, replacement and upgrading of existing risk control processes, and can also build a dedicated risk control platform for new businesses.


Dinsight: Operators Easily Manage Risk Strategies

Risk control engine is a system based on data analysis and machine learning algorithm, which can identify and deal with various risk problems in real time. It is suitable for finance, e-commerce, 

Risk control engine is a system based on data analysis and machine learning algorithm, which can identify and deal with various risk problems in real time. It is suitable for finance, e-commerce, intelligent manufacturing, transportation and other fields, and can improve the risk management level and business efficiency of enterprises.

 Risk control engine mainly has the following functions:

 Risk management: The risk control engine is used by analyzing operator behavior, transaction patterns, and historical data to identify potential fraud risks and provide timely warnings. And through the monitoring, business conditions, timely find and deal with security risks, so as to avoid heavy losses.

 Transaction verification: The risk control engine can ensure the legality and authenticity of the transaction through technical verification and data analysis, such as confirming the identity of the operator, transaction validity, risk assessment, etc., and formulate security measures.

Real-time monitoring: The risk control engine can evaluate and judge the credit status of customers by analyzing customer information, historical transaction data and public databases, and through real-time monitoring of various risks, transaction abnormalities, credit evaluation, fraud detection, and remind and early warning through instant notification.

#  Data: An Important Component of Risk Engines


 Data is an indispensable part of the risk control decision engine, including historical data, real-time risk data, behavioral data, etc., which not only provides key information and instructions, but also helps to make wise decisions. Policymakers need to analyze various data to identify optimal risk control strategies. Through continuous collection, analysis and utilization of data, the risk control engine can better understand market changes and customer needs, analyze and identify potential risk factors, achieve more accurate prediction and early warning, and then timely adjust risk control strategies.


 Business data. Business data is the business data related to enterprises, including customers' personal information, transaction records, account use, etc., which can be used to evaluate user background, repayment ability, consumption habits, etc.

Government data. Government data refers to data related to government associations and other institutions, including public databases, legal files, blacklists, etc., to identify users who have recorded previous violations.

 Credit investigation data. Credit investigation data refers to the data that records personal credit history and related financial information, including basic personal information, income, occupation, marital status, credit card and loan information,

 Tripartite data. Tripartite data refers to the data collected by the third-party data providers, such as economic data, market data, risk IP, fraudulent devices, and the list of telecom fraud mobile phone numbers, etc.

The quality and accuracy of the data is very important, risk control engine data aggregation products support different types, different call way of external channel data, not only use a large number of government, business data, and the introduction of data through multiple channels, and then unified management and data specification, solve the problem from data source access to data application, comprehensive support risk control engine demand for data application.


# Dinsight: Step-by-Step Data Integration


 There are many ways for risk control engines to access data. For example, the business data of the financial industry is generally connected to the internal database through SQL, the tripartite data is generally connected to the external data vendor through URL, or the external data is associated with the risk control engine by mapping and enables multiple calls to the same external data.

Take the top image Dinsight real-time risk control engine as an example, first access in the console, and then can be configured in the engine.

The Access Console (console), at the application.properties Configuration in:
![2023102301.png](https://cdn.aisecurius.com/images/c0d/c0dc9bb8-62a9-436c-a2e3-b403a0c56b97.png)
 The Access Engine (engine), in the application.properties Configuration in:
![2023102302.png](https://cdn.aisecurius.com/images/4fb/4fb49e83-bb33-446a-8ec8-65f18ca6462a.png)


Dinsight can perform risk judgment on the requests sent by the business front end in marketing activities, payment orders, credit applications and other scenarios, and return the decision result within milliseconds to improve the risk prevention and control ability of the business system. The average processing speed of daily risk control strategies is less than 100 milliseconds, the aggregate data engine, the integration of expert strategies, the parallel monitoring, replacement and upgrading of existing risk control processes, and the construction of a dedicated risk control platform for new businesses; Aggregate anti-fraud and risk control data, support multi-party data configuration access and precipitation, can be configured graphically, and quickly applied to complex strategies and models; Based on the experience reserve of mature indicators, strategies and models, as well as deep learning technology, self-performance monitoring and self-iteration mechanism of risk control can be realized; Integrated expert strategy, based on system + data access + index library + strategy system + expert implementation of actual combat; It supports parallel monitoring, replacement and upgrading of existing risk control processes, and can also build a dedicated risk control platform for new businesses.


Dinsight: How to Quickly Connect Different Data Sources to Risk Engines

On September 26th, AWS Partner's Web3 Solutions Day was held in Hong Kong. Startups, technical experts and venture capitalists from the fields of artificial intelligence and Web3 had in-depth exchanges on the future development of the universe era.

 On September 26th, AWS Partner's Web3 Solutions Day was held in Hong Kong. Startups, technical experts and venture capitalists from the fields of artificial intelligence and Web3 had in-depth exchanges on the future development of the universe era. The scene shows the security practice case of the top image defense cloud in the field of finance and Web3.

![2023101001.jpg](https://cdn.aisecurius.com/images/291/291ee9eb-dc19-4a8d-9766-c6bcdf93aa7d.jpg)

 Web3 is an overall evolution and upgrade of the Internet architecture. Through new agreements, the Internet is more decentralized and more secure, allowing users to master their own digital identity and digital assets, and through the collaborative innovation of technology system and economic system, it promotes the integrated development of digital and real information. This provides technical conditions for the landing of concepts such as universe and universe, and brings more business opportunities and development space. However, this has also triggered a series of security risks and fraud attacks.

 Risk of theft of user accounts and digital assets: Since users have their own digital identity and digital assets in Web3, criminals may steal the user's private key, password and other key information by means such as phishing and malicious software, and then steal the user's accounts and digital assets. An attacker may also pretend to be another person's identity, obtain sensitive information, or commit fraud.

![2023101004.jpg](https://cdn.aisecurius.com/images/e39/e39567e1-ee01-46e7-aad1-e91dd5e0c638.jpg)

 Fraud in marketing activities: in marketing activities, there may be wool, cattle buying and other fraudulent behavior. Attackers may obtain illegal interests through multiple accounts, brushing and other ways, resulting in damage to the legitimate rights and interests of the enterprise.

 Fraud risk in transactions: Due to the correlation between virtual assets and the real world, criminals may forge the transactions or virtual props of virtual assets, induce users to trade or pay, and eventually steal users' assets or personal information.

The characteristics of Web3 determine the ability of users to master the digital identity and digital assets independently. Fraud and user operation are confused together, and it is difficult to effectively protect the traditional black and white security means.


#  Dingxiang's Defense Cloud Protects Web3 Security


 Companies need to use smart contract mechanisms that enable automated rule enforcement and auditing functions to ensure that transactions and operations comply with pre-agreed rules and reduce artificial fraud. At the same time, data analysis and machine learning technology are used to monitor and analyze user behavior and transactions in real time, and a risk assessment model based on user behavior mode is established to identify abnormal behavior and potential fraud risks. In addition, the sharing of fraud information and attacks, through mutual assistance and joint response, improve the overall security protection capability. So as to resist the threat of business fraud, solve the security problems of each business link, and escort the stable and safe operation of Web3 business.
![2023101002.jpg](https://cdn.aisecurius.com/images/351/3512c6a8-c28a-46ee-9d56-3419eded111d.jpg)
 The top image defense cloud includes business security intelligence, business perception defense platform, verification code, device fingerprint and end reinforcement and other products. It has six capabilities, such as device authenticity identification, behavior verification, risk perception, high-performance real-time computing, efficient strategy execution and attack restoration. It can integrate the risk situation of the whole network to provide the security attack and defense information for the whole network, form the general strategy and exclusive strategies customized for the demand, and provide real-time iteration and linkage through the cloud; provide risk identification, defense disposal, attack reduction, manual review, association analysis and data precipitation. In addition, it also has the precipitation of black sample data and risk behavior characteristics, and distributed through the cloud to further improve the overall risk prevention and control.

![2023101003.jpg](https://cdn.aisecurius.com/images/61b/61bf8bdc-9088-40d6-849d-0be3a24fcaac.jpg)

As the first batch of products to pass the inspection and certification of China Information and Communication Institute, Top Elephant Defense Cloud has served dozens of digital collection platforms such as whale storage and fantasy environment. In May 2023, In the "China Network Security Product User Survey Report" jointly released by Ann, the top image ranked second in the marketing security list and first in the blockchain security list.


AWS Hong Kong Web3 Solution Day: Dingxiang's Web3 Security Practice Cases Draw Industry Attention

AISecurius, as a leading business security company in China, has launched the next generation of iOS application protection products based on virtual source code protection technology, targeting the iOS platform. 

 Currently, the global economy is shifting towards a stage of high-quality development, based on the leading foundation brought by the rapid development of new-generation information technology and the new demands created by innovation-driven and high-quality supply. This lays the foundation for embracing the digital era. As an important product of the digital economy, mobile applications, or "Apps" for short, have shown fast development and far-reaching impact. For enterprises, Apps are currently reshaping the operational mode of many businesses. Data shows that by 2022, the annual download volume of mobile applications will reach 258 billion times. Therefore, enterprises need to continue to promote innovation and development of mobile applications to meet the ever-changing customer demands.

 ![ios加固.jpg](https://cdn.aisecurius.com/images/e29/e29b71c3-e0cc-4a83-a28a-4032a52252d1.jpg)

 ![稿件分隔长图.png](https://cdn.aisecurius.com/images/911/911f1550-9646-4a3e-a29f-1ba859971848.png)

# Being rejected by iOS 4.3 is an inevitable "destiny"


"We have never submitted any similar duplicate apps, why does 4.3 consider ours to be a junk app? Apple customer service has been evasive, saying that our app is similar to others. After discussion, the Apple official suggested that we abandon the app, and even if we resubmit it, it will be rejected again, their attitude is very firm." complained an iOS developer.

![ios 4.3.jpg](https://cdn.aisecurius.com/images/669/6690962b-096e-4cf1-8c20-532dc72bd0d6.jpg)

**According to a set of data disclosed by Apple, in 2020, the App Review team assisted over 180,000 new developers in publishing apps. Among them, nearly one million new apps with problems and nearly one million updated versions of apps were rejected or removed from the App Store for a series of similar issues, including:**
• Over 48,000 apps were rejected for containing hidden or unrecorded functions;
• Over 150,000 apps were rejected for containing junk information, plagiarism, or manipulating users to induce them to pay;
• About 95,000 apps were removed from the App Store for violating regulations or even committing crimes by changing their operating methods through tampering after passing the app review;
• Over 215,000 apps were rejected for requiring users to provide data beyond the scope or mishandling the collected data.

The data shows that from 2017 to 2019, Apple received an average of 5 million app submissions per year. Among them, 33% to 36% of the submitted apps were rejected by the Apple review team, with an average of 1.7 million rejections per year. In 2020, a total of 215,000 apps were rejected for violating privacy policies, accounting for 40% of the total number of app submissions in 2020.

Recently, the issue of being rejected by 4.3 has become popular again. The 4.3 rule is a regulation announced by the App Store for app review.

In summary, the App Store's 4.3 rule for app review stipulates that apps with duplicate functions or duplicate applications, as well as apps uploaded through duplicate or sub-packages, will be rejected.

 ![稿件分隔长图.png](https://cdn.aisecurius.com/images/911/911f1550-9646-4a3e-a29f-1ba859971848.png)

# To help iOS apps pass the review and be listed 


**AISecurius' business security engineers have found that the App Store review team focuses on factors such as hidden or unrecorded functions, junk information, plagiarism, and manipulating users to induce them to pay, as well as changing their operating methods through tampering after passing the app review and even committing crimes. These are the "red lines" for App Store review.**

For example, in terms of code issues, submitting a project multiple times, with a code repetition rate of over 60%. Even if your code has been marked by Apple or has a relationship with other projects at the code level, there may be some hidden functions. In terms of metadata issues, if you purchase a domestic or foreign developer account that has been rejected, or if the metadata set in the ITC background has a high degree of similarity, such as title, description, keywords, technical support website, privacy statement, etc.

As we all know, the Apple review team generally has three steps in reviewing submitted apps:

**The first step is pre-review**, which scans for character omissions in the API and plist files. This is divided into two steps: the first step is the Application Loador application check for adapting icons when uploading, and the second step is the functional check by Apple after uploading, such as configuration of the Push function but with missing or unopened functions, which will prompt an email notification, and so on.

**The second step is machine review**, which scans payment SDKs and duplicate applications. The machine scan mainly looks at code blocks.

**The third step is manual review,** which mainly checks the functionality or app experience test, such as logging in with a test account to experience the app's functionality or other significant bugs, including IPv6 detection.

There are almost two situations for App Store review being rejected due to 4.3. One is App Store machine review, which mainly conducts machine review of the code to detect duplicate applications. This eliminates too many similar apps flooding the iOS market and affecting the overall quality of iOS applications. The other is App Store human review, which is mainly to verify the content and functionality of the app by Apple reviewers to prevent app bugs, app imitation, content repetition, and other issues that affect the user experience, resulting in the phenomenon of inferior coins driving out superior ones.

In the process of resolving the 4.3 issue in app review, users and the review team engage in intellectual battles that can take several months or even more than half a year. The solutions for machine review rejections and human review rejections are as follows:

1.	For machine review, the main method is to add code, and the similarity of the code should not be higher than 45%, so that it can pass machine review stably without being rejected.

2. For human review, the main method is to modify the UI style and fill in more pages to improvethe user experience and functionality of the app. In addition, it is necessary to provide clear and concise descriptions of the app's features and functions in the metadata, to avoid any confusion or misunderstanding by the reviewers.

In conclusion, being rejected by iOS 4.3 is an inevitable "destiny" for app developers who do not comply with the strict regulations and policies of the App Store. To ensure that your app passes the review and gets listed in the App Store, it is important to pay attention to issues such as hidden or unrecorded functions, junk information, plagiarism, manipulating users to induce them to pay, and violating privacy policies. By following the guidelines and best practices provided by the App Store, app developers can ensure that their apps meet the highest standards of quality, security, and user experience, and avoid the risk of being rejected by iOS 4.3.

AISecurius, as a leading business security company in China, has launched the next generation of iOS application protection products based on virtual source code protection technology, targeting the iOS platform. This product can perform deep obfuscation and reinforcement on the code in iOS apps, dynamic libraries, and static libraries, and use AISecurius' proprietary virtual machine technology to encrypt and protect the code, preventing any hacker tools from directly reversing or cracking it. It also has perfect compatibility with the iOS environment, supporting Xcode development environments above 9.0 and iOS 9.0 to the latest version of the system.

After the iOS app is reinforced, the original code is obfuscated and reinforced, increasing the machine review pass rate. This in turn increases the chances of getting listed on the App Store and passing the App Store's 4.3 review rule, resulting in a well-reviewed app on the App Store.

 ![稿件分隔长图.png](https://cdn.aisecurius.com/images/911/911f1550-9646-4a3e-a29f-1ba859971848.png)

# Safeguarding iOS App Security


Currently, the growth rate of malicious applications on the iOS platform has exceeded that of the Android platform. iOS applications also face security issues such as reverse engineering, in-app purchase cracking, and second-time packaging and signing. However, AISecurius' iOS application protection can effectively prevent major security issues such as core code theft, program logic cracking, malicious code integration, and API interface exposure.

AISecurius' iOS application protection mainly has the following functions:

**Code virtualization: **Compiles the original code into dynamic DX-VM virtual machine instructions that run on the DX virtual machine, making it impossible to decompile back into readable source code.

**String encryption: **Encrypts the static constant strings defined in the code and decrypts them at runtime, preventing attackers from static analysis and guessing code logic using strings.

**Code obfuscation: **Splits, scrambles, hides, inserts flower instructions, and complicates the code logic of the original code without affecting the original logic.

**Anti-decompilation: **Effectively prevents attackers from decompiling binary code into pseudo-code using reverse analysis tools such as IDA's F5 function.

**Anti-debugging: **Provides runtime anti-debugging capabilities for the app, preventing attackers from dynamically analyzing the app's logic through debugging.

**Anti-tampering:** Prevents malicious tampering of code and resource files in the application, eliminating piracy or second-time packaging behavior such as advertising implantation.

In terms of deployment, AISecurius' iOS application protection has two deployment methods: localized deployment and SaaS deployment, which can meet the security needs of different users. Since there is no need to upload the source code, developers do not have to worry about code leakage issues. The flexible one-click reinforcement function is easy to operate and does not affect normal development and packaging processes. Even if there are code issues during App Store review, protection configurations can be flexibly adjusted according to needs, such as code obfuscation strength, code obfuscation ratio, and virtual machine protection strength, to meet code review requirements.



AISecurius iOS Hardening : How to help apps get listed on the Apple App Store

In summary, anti-tampering is an important technique in app strengthening to prevent tampering and ensure the security of the app package. 


In the field of counterfeiting, no one knows how to imitate better than the black and gray markets.

According to security professionals, for mature counterfeit developers, it only takes a few days to create a front-end framework. Creating servers, source code, domain names, and service providers can all be solved through online leasing.

For example, an app that is launched on Apple's App Store can be replicated at a 1:1 level by the black and gray markets for a price of nearly 30,000 RMB, and it can be completed within 20 days.

If you want these counterfeit apps to be successfully launched on Apple or Android app stores, you only need to pay the corresponding fees after completion.

The reason why counterfeit developers can replicate apps so quickly is because they work on decompiling or tampering with the app.

![稿件分隔长图.png](https://cdn.aisecurius.com/images/911/911f1550-9646-4a3e-a29f-1ba859971848.png)
 

# The Importance of Anti-Tampering



Anti-tampering, as the name suggests, uses technical means to prevent reverse engineers from tampering with key information in an app, thereby strengthening the app's security.

If an app is not strengthened with anti-tampering to prevent tampering, attackers can achieve two attack vectors by inserting malicious code:

1. For app users, the spread of the app with malicious code can be used for phishing, telecom fraud, and other operations, causing users to lose assets or suffer other losses.

2. For the app server, attackers can use some interfaces between the client and the server to attack the server, causing corresponding public opinion and reputation losses to the app.

![稿件分隔长图.png](https://cdn.aisecurius.com/images/911/911f1550-9646-4a3e-a29f-1ba859971848.png)
 

# The Principle of Anti-Tampering in App Strengthening



So, how is anti-tampering implemented in app strengthening?

Let's start with app development.

An app is roughly composed of a developer, app, package name, certificate, and signature. If we compare developers to parents, the app is the child, the package name is the child's name, the certificate is the child's birth certificate, and the signature is the ID number.
 
![加固图.png](https://cdn.aisecurius.com/images/202/2027fb17-10d8-4cdc-ab3d-e7eb4b9568f6.png)

Like a newborn baby, when the developer completes the app development, the app only has a name that can prove its identity, which is easy to be "switched out". To ensure the child's safety, parents need to prepare a birth certificate for the child, and then use the birth certificate to generate an ID number to prove the child's identity.

For attackers, there are two ways to abduct this "child":



###  1.	Stealing certificates for information tampering：


By attacking the app's certificate, including the certificate file itself, the certificate's private key, and the certificate's private key alias, attackers can tamper with the app as the developer once they have successfully attacked the certificate. However, certificates are generally not easily leaked.


### 2.	Bypassing signature and package name verification ：

directly modifying the app itself. This is equivalent to a trafficker abducting a child, and how to deal with the kidnapped child is up to the trafficker.

After understanding this principle, it is easier to understand how to prevent tampering.

To ensure that the app is not tampered with, what we need to do is to ensure the security of the app's package name, signature, certificate, and other information.

The general practice is to collect the package name, certificate, and signature of the application in advance and record them. When the attacker uses a forged certificate to generate a forged signature, we can quickly identify that the identity information of the forged signature is not consistent with the information recorded, so our strengthening program can refuse to use the app.

When the app crashes or malfunctions, we can consider whether we are using a counterfeit app.

![稿件分隔长图.png](https://cdn.aisecurius.com/images/911/911f1550-9646-4a3e-a29f-1ba859971848.png)
 

# Anti-Tampering Measures in App Strengthening



Overall, anti-tampering can be achieved through techniques such as packing, resource encryption, code obfuscation, and virtual execution.

**1. Packing** is the process of protecting DEX files by choosing between overall DEX protection or splitting DEX protection, hiding source code to prevent direct decompilation. When splitting DEX protection, attention should be paid to the data structure of DEX files, selecting the classdata and classcode sections, even if they are split, class data and bytecode data will not be leaked, and decompiled results will not be complete, thus ensuring high security.

**2. Resource encryption** is the process of encrypting resource files such as images, audio, and video in the software package to prevent attackers from replacing or tampering with them.

**3. Code obfuscation** is the process of obfuscating the compiled class files. The obfuscated code and the original code can perform the same function, but the obfuscated code is difficult to decompile. Even if the decompilation is successful, the true semantics of the program are difficult to discern.

**4. Virtual execution** involves compiling raw code into dynamic DX-VM virtual machine instructions and running them on a DX virtual machine. The compiled code cannot be decompiled back into readable source code.

However, as we mentioned in our previous article on code obfuscation, relying solely on code obfuscation and anti-tampering is not enough to stop themost determined attackers. Therefore, it is important to use multiple layers of security measures to make it more difficult for attackers to bypass app security.

![稿件分隔长图.png](https://cdn.aisecurius.com/images/911/911f1550-9646-4a3e-a29f-1ba859971848.png)
 

# Conclusion


In summary, anti-tampering is an important technique in app strengthening to prevent tampering and ensure the security of the app package. It can be achieved through techniques such as packing, resource encryption, code obfuscation, and virtual execution. However, it is important to use multiple layers of security measures to make it more difficult for attackers to bypass app security.

Only in this way can we prevent problems before they arise.


This group of security engineers has put in too much effort to ensure the security of the app.

Web crawlers, also known as web spiders and web robots, are programs or scripts that automatically grab network information and data according to certain rules. In layman's terms, web crawlers simulate human behavior, 

![1.png](https://cdn.aisecurius.com/images/911/911f1550-9646-4a3e-a29f-1ba859971848.png)

## What is a web crawler?
Web crawlers, also known as web spiders and web robots, are programs or scripts that automatically grab network information and data according to certain rules. In layman's terms, web crawlers simulate human behavior, replace human operations with programs, and jump from one link to the next, traversing web pages just like crawling on the Internet. The actions of crawlers such as jumping, opening, and browsing are faster than humans, and the levels of websites they browse are also deeper, so they are called web crawlers.

![1.jpg](https://cdn.aisecurius.com/images/c54/c54b7f5e-d639-4377-b52d-b3e40b0c89c3.jpg)

In 1993, Matthew Gray, a student at the Massachusetts Institute of Technology, wrote a program called "Internet Wanderer", which was used to count the number of servers on the Internet and retrieve the domain name of the website. Thus, the world's first web crawler was born. With the rapid development of the Internet and the explosive growth of web pages, fast and accurate retrieval is becoming more and more difficult. The developers have made many improvements and optimizations on the basis of the "Internet Wanderer" program, which is used to search the entire Internet. At the same time, the popularity of search engines has promoted the development of web crawlers in the direction of multi-strategy, load balancing, and large-scale incremental crawling.

According to the system structure and implementation technology, web crawlers can be divided into four categories: general web crawlers that are applied to search engines and large-scale data collection, focused web crawlers that are oriented to the collection of specified topics and target pages, and that only collect updates and changes of web pages. Quantitative web crawlers, and deep web crawlers capable of collecting ever-changing information behind static links and hidden behind search forms.

![1.png](https://cdn.aisecurius.com/images/911/911f1550-9646-4a3e-a29f-1ba859971848.png)

## Three stages of malicious crawling and technical anti-crawling

Malicious crawling and anti-crawling continue to evolve with technological development and are a dynamic process of attack and defense. Based on the development of web crawlers and changes in malicious crawling behavior, there are generally three stages.

![2.png](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

#### In the first stage, restrict IP and account numbers, and intercept verification codes

At first, the anti-crawling measures of the website were to directly reject the visits that did not originate from the browser. When a malicious web crawler accesses, a 403 error response code will appear, or a "sorry, unable to access" prompt will be received.

In order to bypass the anti-crawling mechanism, the web crawler sets Headers information, simulates a browser, and performs large-scale malicious crawling of static pages with multiple threads.

![23.png](https://cdn.aisecurius.com/images/67e/67ee711d-1d9a-4089-a21c-a50eee9cac9f.png)

Headers is the Http request and the corresponding core, carrying the main information of the user's access to the webpage, including Cookie (username, password), host (requested server host), User Agent (browser, browser kernel, manufacturer, etc.), Referer (browsing track, such as the previous page), etc.

For malicious crawling behavior, websites and platforms restrict and block accounts and devices that frequently change UserAgent (simulated browser) and frequently use proxy IP: when the same IP and the same device visit the website within a certain period of time, the system automatically limits It visits and browses; when a visitor visits too many times, the request is automatically redirected to a verification code page, and the visit can only be continued after entering the correct verification code.

![2.png](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

#### In the second stage, dynamic web technology protects information

Faced with the upgrade of anti-crawling technology, web crawlers have also been upgraded accordingly. The web crawler can automatically identify and fill in the verification code, bypassing the interception of the second verification; use multiple accounts at the same time, configure IP proxy tools, and bypass the platform's restrictions on account numbers and IP addresses.

![4.jpg](https://cdn.aisecurius.com/images/c1a/c1abcfc0-4cb7-472f-a4b3-56819d20eba9.jpg)

In response to changes in web crawlers, many websites and platforms use dynamic web page development technology. Based on dynamic web page technology, the URL address of the web page is not fixed, and the background interacts with the front-end users in real time to complete user query, submission and other actions. Moreover, different pages will be generated when visiting the same URL address at different times and by different users. Compared with traditional static web pages, dynamic web pages effectively protect important data information and effectively curb the malicious crawling behavior of web crawlers.

![2.png](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

#### The third stage is to prevent and control malicious theft in the whole process


In order to bypass the new anti-crawling measures, the web crawler uses Selenium and Phantomjs technology to completely simulate human operations.

Selenium is a tool for web application testing that can run directly in the browser. It supports all mainstream browsers, and can let the browser automatically load the page according to the developer's instructions, obtain the required information data, even take screenshots of the page, or determine whether certain actions on the website have occurred. Since Selenium needs to be used in conjunction with a third-party browser, developers use the Phantomjs tool (or "virtual browser") instead of a real browser.

With the continuous iteration of web crawlers, a single prevention and control measure is no longer effective. Platforms and enterprises need three-dimensional defense measures to effectively deal with malicious crawling behavior.

Explain the dynamic attack and defense of web crawlers and technical anti-crawling

Black and gray products will tamper with data by flashing, changing the machine, changing the IMEI, MAC and other means, thereby causing the company to suffer losses.


To a certain extent, device fingerprints are as important to people as ID cards.

Why do you say that?

Most of you have probably experienced something like this:

When viewing a short video, as long as we like a certain video, the system will recommend more similar videos when viewing the video next time; when you browse a product on a certain shopping software, the shopping software will Items related to the search term appear.

You think you are dominated by the algorithm, but in fact, the fingerprint of the device "betrayed" you.

A device fingerprint, as the name implies, is a device feature or a unique device identifier that can be used to uniquely identify the device. And have a certain offensive and defensive capabilities, with the ability to monitor the equipment environment.

For some websites, being able to accurately identify a certain user, browser, or device is a very tempting ability, and it is also a strong requirement.
![图片1.png](https://cdn.aisecurius.com/images/143/1433ffde-e6c7-4c9b-b7c6-b1e70b87da4b.png)
For example, for advertising companies or search engines, device fingerprints can be used to know what the user has searched for before and what his hobbies are, so that the search results can better meet the user's needs in the search results; for banks, e-commerce, etc. For organizations with higher security requirements, this technology can be used to detect changes in the user environment and devices that are logging in, thereby preventing malicious requests such as account theft and password cracking.

Of course, for black and gray products, this technology can also be used to change user identities. Generally speaking, black and gray production will cause huge economic losses to enterprises in a short period of time through equipment ranching cheating, simulator cheating, manual cheating and other attack methods.

However, the traditional equipment identification technology mainly relies on a single information source, and cannot effectively identify and judge black and gray products. therefore

Enterprises urgently need a new device identification and tracking technology to distinguish between normal users, malicious users and even fraudulent gangs, so as to protect the security of enterprise assets.

Today, we will start with the anti-tampering and anti-hijacking functions of the fingerprint of the top image device.

![1.png](https://cdn.aisecurius.com/images/911/911f1550-9646-4a3e-a29f-1ba859971848.png)

## "Never trust" risky users
As mentioned above, device fingerprints are equivalent to a person's second identity authentication. Once it is tampered with or hijacked, the consequences can be imagined.

Generally speaking, black and gray products will tamper with data by flashing, changing the machine, changing the IMEI, MAC and other means, thereby causing the company to suffer losses. So, how does Aisecurius' device fingerprint technology discourage black and gray products?

The current device fingerprint technology uses multi-dimensional device-side information to complete device identification. It collects the characteristic information of the terminal device, and on the basis of analysis and identification, performs correlation calculations on each group of characteristic information collected from the terminal device through a similarity algorithm to generate a unique device fingerprint ID to identify the terminal equipment. From the technical method of implementation, it can be divided into active device fingerprinting and passive device fingerprinting.

![图片2.png](https://cdn.aisecurius.com/images/b23/b23d8c14-1e20-4f31-aaa8-307cda585848.png)

So, in terms of anti-tampering and anti-hijacking, how does the fingerprint technology of top image devices realize?

The first is identification. Generally speaking, normal users will not easily tamper with information. When a user keeps tampering with information, it is necessary to keep track of its behavior track and then determine whether it is a risk user. Once the identity of the risk user is determined, it also loses If the qualification of "trusted" is obtained, then the system will intercept the user.

The next step is the moment when the top image device fingerprints show their talents. As mentioned above, the device fingerprint itself already has the ability to analyze and identify the characteristics of the device, but to deal with black and gray products, only one layer of protection is not enough. The top image method It's locked and locked.

When the system determines that a user is a risk user, the device fingerprint will analyze and identify the collected device information through an algorithm.

The device fingerprint system is divided into three functional modules: device fingerprint front-end collection, device fingerprint service, and device fingerprint console, and has a supporting data storage module.

The server-side device fingerprint production algorithm is mainly based on the information collected by the client (including web, android, and ios). For the collected device information, the back-end algorithm will divide it into strong feature data and weak feature data. If the terminal device is at risk, the system will display the risk label and score the device based on multiple dimensions such as device environment, vulnerability, and existing risks. The lower the score, the higher the risk.

![图片3.png](https://cdn.aisecurius.com/images/d1f/d1f99973-c8ac-4045-9b26-a95886fa6dd0.png)
![1.png](https://cdn.aisecurius.com/images/911/911f1550-9646-4a3e-a29f-1ba859971848.png)


## Digital business risks are becoming more diverse
Behind the anti-tampering and anti-hijacking functions of device fingerprints is the greater risk of enterprises-digital business security.

With the deepening and popularization of digitalization, businesses are becoming more open and interconnected. The key data, user information, infrastructure, and operation process of enterprises are all in an environment with blurred boundaries and increasingly open. Businesses involving profit streams and high value-added businesses face various security risks and may suffer losses at any time, which in turn affects business operations and develop.

On the one hand, there are various forms of business security risks. In business scenarios such as e-commerce, payment, credit, account, interaction, and transaction, there are various types of fraudulent behaviors; on the other hand, fraudulent behaviors are increasingly specialized and industrialized. And it has the characteristics of gangs, complexity, concealment and contagion.

Therefore, the mature device fingerprint technology has become one of the key technologies for big data risk control of every anti-fraud enterprise.


"Never trust" risky users, tamper-proof guidelines for device fingerprints

As a key element that often appears in human-computer interaction interfaces, verification codes are an important component of identity verification and risk prevention, and are also the first gate of user interaction experience. 

Enter the keyword "crack the verification code" online, and there will be 7,920,000 search results. "Verification code identification, easy cracking, brute force cracking, logical loophole cracking, simple cracking" and other keywords are endless, and there are even more posts about "how to crack a certain verification code with a certain method".
![默认标题__2023-04-04+15_17_33.jpeg](https://cdn.aisecurius.com/images/4a9/4a9e6bef-3763-4992-ad6b-f090d0bfc378.jpeg)
As a key element that often appears in human-computer interaction interfaces, verification codes are an important component of identity verification and risk prevention, and are also the first gate of user interaction experience. They are widely used in services such as reading, education, finance, shopping, and government affairs.

The full name of the verification code is "Full-automatic Turing Test to Distinguish Computers and Humans". The core uses "human beings can easily identify text information in pictures with the naked eye" to distinguish the authenticity of the operator through identification, input, interaction, etc. It plays a huge role in various scenarios such as registration, login, transaction, and interaction. It can prevent operators from using machine software to program garbage registration, counterfeit login, steal information, swipe tickets and traffic, and ensure account security. important role.

![2.png](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)
### Who wants to crack the verification code? Black and gray products
Heihui products are the people who most want to crack the verification code. By cracking the verification code, Heihui can steal data, steal personal information, and collect wool on a large scale.

In 2017, the Chinese police successfully cracked the country's first case of using AI (artificial intelligence) to commit crimes and violate citizens' personal information. The criminal suspect, Yang, trained the machine by using artificial intelligence machine deep learning technology, so that the machine can operate and identify autonomously like ALPHAGO, effectively identify the picture verification code, and easily bypass the verification code security policy set by the Internet company. The recognition system developed by it is very fast, and can recognize thousands of verification codes in a short time, and it is fast and accurate, and can recognize more than 98% of the verification codes.

The tool developed by Yang is dedicated to providing decoding services for black and gray products that steal and sell user information. That is to say, the black and gray production gangs need to "crash" the stolen data, "clean" the various associated accounts and passwords of the stolen information, and then make the victim's information more complete, so as to implement precise fraud. Yang used the system developed by himself to provide black and gray products with the verification code cracking when "crash database".

![2.png](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

### To be safe, the verification code must be better than black and gray production technology

No system is invulnerable, and neither is the captcha. What developers need to do is to increase the attack threshold, improve the anti-cracking ability, and enhance their own security, so that black and gray products feel that the input-output ratio is not worthwhile and give up.

The fifth-generation intelligent verification code launched by Aisecurius, based on data information such as user behavior and environmental information, combined with models and risk control analysis, provides multi-dimensional risk identification, integrates a variety of offensive and defensive confrontation combinations, and has 13+ verification methods of different difficulties. Cloud perception intelligence sharing, self-renewal and evolution capabilities, stronger offensive and defensive confrontation, and better user experience without perception can effectively prevent malicious cracking and prevent and control various business risk threats.

![材料图4.png](https://cdn.aisecurius.com/images/f06/f066df33-ac22-4975-b42b-dfcd0fd5741c.png)
In terms of anti-cracking and self-security, **the fifth-generation smart verification code has five unique skills.**

**Integrate behavioral algorithms to enhance operational protection.** The fifth-generation smart verification code is identified through behavioral trajectory model detection, such as the sliding trajectory of the mouse in the page, the typing rate of the keyboard, the sliding trajectory, speed, and button click of the sliding verification code. At the same time, it uses Isolation Forest (Isolation Forest, an anomaly detection algorithm) to propose the concept of isolation, which isolates abnormal data from the existing data distribution to achieve the purpose of anomaly detection, which can not only effectively improve the performance of verification codes on machines , The ability to identify malicious behavior can enhance the protection of operations.

**Integrated Verification Rubik's Cube to achieve active confrontation.** The fifth-generation smart verification code uses technologies such as random cutting of pictures, regular processing of picture updates, and picture variation, combined with correlation detection to prevent, and judges correlation through built-in rules and strategies, such as the correlation of the same device and the same IP correlation, sliding failure correlation, verification times correlation, etc., to effectively identify abnormal correlations in a short period of time. In particular, the integrated verification Rubik's Cube can be configured within 10s and takes effect within 60s, enabling rapid offensive and defensive confrontation.

![材料图7.png](https://cdn.aisecurius.com/images/93d/93df9de6-3c7e-4a43-81f4-bb443317ab99.png)

**Embedded out-of-order transmission, effectively preventing hijacking.** The fifth-generation smart verification code has a built-in "out-of-sequence cutting image transmission" function in the data transmission link, which can cut the background image out of order and then spread it.

**Dynamic encryption and decryption to defend against known attacks.** Aisecurius' fifth-generation intelligent verification code proprietary dynamic encryption and decryption obfuscation algorithm can obfuscate and compress JS code, automatically update the algorithm regularly, automatically change data encryption, realize rapid and automatic iteration of verification code verification, and greatly enhance the difficulty of cracking.

**Man-machine training model to fight against unknown threats.** Aisecurius' fifth-generation intelligent verification code integrates real-time stream computing and scene strategies, combines man-machine models trained by machine learning, and correlation analysis of historical data. Through graphic algorithms and AI models, machine learning modeling is performed on user-generated behavior trajectory data, combined with Multiple dimensional information such as access frequency, geographical location, and historical records can quickly and accurately return human-machine judgment results, resisting automatic identification of programs, and resisting attacks from new technologies.

![2.png](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)


### Fifth Generation Smart Captcha is part of Aisecurius Defense Cloud
Captchas are improved in constant iterations of attack and defense. As part of the aisecurius defense cloud, the fifth-generation smart captcha has unique features of security intelligence, cloud policy and AI modeling, making it a step further in security verification and self-protection.

Aisecurius defense cloud is based on years of actual combat experience and technical products. It has rich technical tools, tens of thousands of security policies and hundreds of business scenario solutions. It has the capabilities of intelligence, perception, analysis, strategy, protection and disposal, and provides modular configuration. And flexible expansion, helping enterprises build an independent and controllable business security system quickly, efficiently and at low cost.


Do these five points, the verification code will not be cracked again

For example, in the offensive and defensive confrontation of device fingerprinting, the black and gray industry must "disguise" itself in order to bypass the device fingerprint to carry out attacks. 

The principle of sameness and struggle of contradiction applies to almost all offensive and defensive confrontations.

In the last issue, we published How to ensure the uniqueness of device fingerprints when hardware attributes are no longer used as the identifier of device fingerprints". In the article, we introduced the evolution of hardware ID as the basic attribute of device fingerprint - that is, when hardware attribute is no longer used as the unique attribute of device fingerprint, in order to ensure the uniqueness of device fingerprint needs to add more identification criteria and dynamic variable algorithm based on hardware ID, in fact, this is a typical example of attack and defense confrontation.

Let's take another example. For example, in the offensive and defensive confrontation of device fingerprinting, the black and gray industry must "disguise" itself in order to bypass the device fingerprint to carry out attacks. At this point, there are two main ideas for bypassing the black and gray industry.

1. How to turn a device into multiple devices.
For example, in a swipe scenario, making the app repeatedly think it is a new phone and thus repeatedly receiving the newcomer bonus.

2. How to turn a device into another device.
For example, in an authentication scenario, the attacker's phone is spoofed to the victim's phone, allowing the app to log into the victim's account and steal funds, user information, etc.

But there is a spear, there is a shield, black and gray industry bypass ideas naturally can not escape the "eyes" of security researchers.

Today, we will talk about the idea of offensive and defensive confrontation with the theme of Hook.

![2.png](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)
### A first look at Hook technology

First, a brief introduction to Hook technology.

Hook technology is a technology widely used in computer offensive and defensive confrontation. It can monitor various event messages in the system or process and intercept messages sent to the target window for processing.

We can simply compare the person using Hook technology to an angler, and Hook technology is like his fishing gear, the events constantly passed in the system is like a swimming fish, the angler through Hook technology will catch the target events he wants (Hook technology is generally directional), then you can modify the events, and then let it run normally, to achieve the purpose of the technical staff. technology is often used in hotfixes online, API hijacking, software cracking and other technical operations.

For example, we commonly use mouse and keyboard, if your computer is Hooked, then it also means that any operation you do is in the hands of the other party.

Hook technology is not only applicable to x86 systems, but also to mobile platform systems based on simple instruction sets, such as cell phones and other devices. Among them, Hook technology for mobile devices mainly focuses on cell phones.

For Android Hook framework, there are three main categories, one is for Native layer, i.e. system layer Hook framework, using PLT/GOT Hook or inline-Hook framework, such as bhook, xhook, yahfa, etc., one is for Java layer Hook framework, such as Xposed, and one is more special Hook framework - Frida, which is designed for the full platform Hook framework for x86 \ x86_64 \ arm \ arm64 architecture of the system, Hook on the iOS side of the main technical implementation through the Frida framework, and Frida in Hook technology implementation on Android also has a lot of audience, but mainly still Xposed class framework, the main reason is that Xposed on Andorid stability is better, and features are easier to hide.

![图1.png](https://cdn.aisecurius.com/images/417/4179d3c2-07ae-45a0-8076-099b7dde78a4.png)

Next, we'll talk about how to use Hook for offensive and defensive confrontation with Xposed and two other Hook frameworks (Edxposed and Lsposed) that iterate on Xposed as the core.

![2.png](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)
### How to do an attack without knowing its attack - how to do an attack with Hook technology?

With the iterative update of Android version, Xposed framework also iterated with the new Hook framework.

![图2.png](https://cdn.aisecurius.com/images/026/0262e916-8312-471c-8ad3-785c3938e3d4.png)

At present, the main Hook framework for the Android platform is based on Lsposed, we will use Lsposed to Hook Android applications to see how to use Hook to attack.

First, the normal use of Lsposed requires several pre-requisites.

* A phone capable of unlocking BootLoaderLock.
* Prepare the boot.img of your own phone system.
* Preparing the Lsposed module installation package with the Magisk installation package.
* A computer with ADB tools installed.
![图3.png](https://cdn.aisecurius.com/images/08c/08c0505a-0566-436f-b988-f1e3cee524ef.png)
After the above conditions are prepared, you are ready to install and use Lsposed.

Once the installation is complete, we can use Hook to carry out the attack.

The specific process is as follows.

**1. Decompile and analyze the target app.**

To get the fish on the hook you have to know the properties of the fish. So the first step to successfully install Hook is to decompile and analyze the target app. Here we use jadx-gui to decompile and analyze the app.

![图4.png](https://cdn.aisecurius.com/images/19a/19a4dd61-8e44-4540-8e3d-da220770d75f.png)

Using jadx-gui we can see the decompiled source code. As shown in the figure below, by decompiling the app we arrive at the action it wants to pass the Flag, but note that this information is an uncertain value and we need to verify it further.

![图5 补.png](https://cdn.aisecurius.com/images/17c/17c5c272-a1af-42ba-a502-546b31da6e35.png)

As you can see from the verification, no matter how many times you click the button, it will only show "Do you really believe in flags when you click?". This message. So, the next step is to take control of our own "catching" process.

**2、Write code plug-ins to attack the "weakness" of the target app**

At this point, we need to write a Hook plugin, modify some of its parameters, and then you can directly obtain its already calculated MD5 value (MD5 is an encryption algorithm. Also known as: irreversible encryption algorithm. The MD5 value is the password of any file after encryption of the plaintext password, also known as "digital fingerprint", anyone who has made any changes to the file, its MD5 value is the corresponding "digital fingerprint" will change. (Any changes made to the file will result in a change in the MD5 value, the corresponding "digital fingerprint".) What is it.

First we can use Android Studio or Idea with the Android plugin already installed, open a new project and select a project without an interface:

![图6.jpeg](https://cdn.aisecurius.com/images/124/1241366c-c752-4046-82cd-1ac404cedc8f.jpeg)

Note that when writing Xposed Hook modules, in order to be recognized by the Xposed framework, you need to create a file called xposed_init in your project's assets directory (if you don't have one, you can just create a new assets directory) and with the following contents for your package name + your main class name.

![图7.png](https://cdn.aisecurius.com/images/4c6/4c6465d8-cf4a-43a7-9503-a2cc8a31dcca.png)

![图8.png](https://cdn.aisecurius.com/images/6f3/6f3f0929-bf38-4b34-93cf-dd13ae1f6457.png)

Next, open the AndroidManifest.XML file and fill it with the following content.

![图9.png](https://cdn.aisecurius.com/images/f65/f65a1f3c-43f2-46d5-8b43-7838daf6d3e6.png)

![图10.png](https://cdn.aisecurius.com/images/d8e/d8e6e68f-79be-4b07-a36c-5f84096fb25f.png)

After configuring AndroidManifest.xml, we can start writing Xposed Hook module. The details are as shown in the figure.

![图11.png](https://cdn.aisecurius.com/images/dee/dee303b7-a5bd-4eec-9d1d-efa2f5bd7018.png)

![图12.png](https://cdn.aisecurius.com/images/78f/78fc9026-2fb3-4753-b1f6-f45c18443a30.png)

In Xposed, there are two methods of Hook, one is before and the other is after, and the principle of its implementation is realized by the slot of art, which can add two slots before and after the originally called method, and then go to execute our hook, which can be understood figuratively as the following figure.

![图13.png](https://cdn.aisecurius.com/images/631/63197c9a-58c7-4ba3-9972-cc9ed18870be.png)

As we can see from the figure, the target App is mainly composed of two parts, the first is the MainActivity main class, and there are two methods in the class, one is the onCreate method, which is a method of MainActivity initialization, and the second is the getFlag method, this method is also our target, by Hooking this method, we can Through this method, we can know what the MD5 value representing the flag is.

Our idea is to Hook the getFlag method first. Assuming we Hook the getFlag method, we are naturally most concerned about the incoming string value, and the specific Xposed module code is as follows.

![图14.png](https://cdn.aisecurius.com/images/658/65841426-e1c5-44ac-8bff-f82f71385ffa.png)

In this way we can get the MD5 value we want, and then modify the parameters to achieve control of the app.

![图15.png](https://cdn.aisecurius.com/images/b40/b40f8a8f-581b-431b-9c60-fcf286297154.png)

![2.png](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

### How to fight Hook attacks?

As the saying goes, if there is a spear, there is a shield. In response to Hook's attack, a defense has also been derived.

Since Xposed will call a specific ClassLoader when Hooking, then it is possible to detect the Xposed framework by loading the ClassLoader again, for example as follows.

![图16.png](https://cdn.aisecurius.com/images/987/9870e188-550a-495b-a2de-fcdf78466893.png)

1、Use the system API getInstancesOfClassesMethod to get the ClassLoader, through this way can only get once CL, we can traverse the Classloader used within the App.

2. After traversing all CLs, we can detect its Hook by its member cache (target Hook method cache).

![图17.png](https://cdn.aisecurius.com/images/bea/beab1ddf-eb3e-4e92-adb4-aafad8117af4.png)

![图18.png](https://cdn.aisecurius.com/images/307/307c9e17-5133-4e32-8f05-d410ca9980c9.png)

This detection method relies on the VMDebug.getInstancesOfClassesMethod() function provided by Android system, which only exists on Android 9-11, limiting the application of the solution. Moreover, as a counter-detection method, this key function can also be hooked by Xposed, and you only need to control the return of this function to complete the counter-detection.

In addition to the ClassLoader way to fight against Xposed Hook, there are other kinds of more traditional countermeasures, but they all have corresponding countermeasures, and the top image product has a unique countermeasure, and additional anti-detection and countermeasure technology, which can more accurately identify Hook risks.

Of course, at a deeper level, we can also use Hook technology to bring traditional Web attack techniques to the mobile side, and conduct offensive and defensive exercises in the mobile side to complement the skill tree as a red team, as well as against Hook technology and attackers to safeguard their own App security.

Overall, the offensive and defensive confrontation is a protracted war, requiring the continued efforts of security vendors.
In terms of offensive and defensive confrontation, based on years of technical accumulation, Top Elephant has achieved comprehensive security protection for Android, iOS, H5 and applets, effectively defending against debugging, injection, multiple opening, memory Dump, emulator, secondary packaging and log leakage and other attack threats. The unique "honeypot" function protects 16 kinds of data and files of Android, provides 7 kinds of encryption forms, and takes the lead in supporting source code free reinforcement for iOS.
![海外版水印.png](https://cdn.aisecurius.com/images/8ee/8eed1daf-4a23-440b-af93-1a9ae29ce226.png)

Hook technology for offensive and defensive confrontation

"Honeypot" is a proactive defense technology, by simulating one or more vulnerable vulnerabilities or flaws to induce attackers to launch attacks, so as...

In order to capture the prey, the hunter will set fresh bait. When the prey is tempted to eat the bait, it will fall into the trap set by the hunter and then be captured by the hunter, which is a common tactic in hunting. In business security defense, there is also a similar method of defense against attacks, called "honeypots" in the industry.

"Honeypot" is a proactive defense technology, by simulating one or more vulnerable vulnerabilities or flaws to induce attackers to launch attacks, so as to collect and capture attack traffic and samples, analyze the means of attack, discover network threats, extract threat characteristics, is a process of attack and defense game with attackers.

![](https://cdn.aisecurius.com/images/5e1/5e11e6ed-327c-4ea7-8271-ae7ffee3e899.png)

"Honeypot" has many application modes

Honeypots have a wide range of applications and are set up in different scenarios with different ways of capturing attacks.

**Mailbox honeypots.** Test email accounts that defenders will intentionally put out, attackers use scanners to discover these accounts, and after sending phishing or virus emails, they will be flagged by the mailbox honeypot for threats, and the IP source of the sender, etc., will be added to the blacklist to prevent subsequent threat attacks.

**Crawler honeypot.** Defenders set some fake web links on websites and apps, which write fake web pages that only crawlers can access and normal users cannot look at. When malicious crawlers find these pages and crawl them, the crawler honeypot will block the relevant IPs and analyze their crawling behavior.

**Network Honeypot.** The defender deploys one or more network vulnerabilities on the intranet or public network, and when an attacker uses the vulnerability to scan and attack, the honeypot is able to capture the attacker's behavior, IP address, characteristics, etc. and isolate them.

**APP Honeypot.** Pre-place some seemingly useful but actually trap data or code in the app to attract attackers' attention and expose their attacks, thus improving the security of the app. The defender sets one or more vulnerabilities in the App to induce attackers to scan, and after detection and discovery, the attacker's attack information is mastered, and further analysis of the attacker's attack tools, paths, and intentions is required to find their own system and defense vulnerabilities, and to target leak detection and remediation.

With the development of technology, honeypots are integrated with new technology applications, from separate product services, and become an integrated module of many security services. For example, AISECURIUS APP hardening integrated "honeypot" technology, able to identify and detect suspicious attacks, deny the execution of malicious instructions, the moment the attacker enters, its operation and behavior will be recorded by the honeypot, becoming an important information in the hands of the defender.

![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

**Honeypot technology makes App reinforcement both offensive and defensive**

As part of AISECURIUS Defense Cloud, AISECURIUS end reinforcement supports Android, iOS, H5 and other platforms, with unique cloud policy, business security intelligence and big data modeling capabilities. It can effectively defend against memory injection, Hook, debugging, injection, multi-opening, memory Dump, emulator, secondary packaging and log leakage, and prevent the App from invasion, tampering, cracking, secondary packaging and other malicious attacks. Its unique "honeypot" function protects 16 kinds of data and files of Android, provides 7 kinds of encryption forms, and is the first to support the source code free reinforcement of iOS.

The AISECURIUS App hardening with integrated honeypot technology provides both offensive and defensive security capabilities.

**Collects intrusion information and provides security intelligence.** Honeypots are able to record information about any scans, probes and intrusion attempts, helping to identify emerging threats and intrusions, as well as help eliminate blind spots and help defenders use the information gathered to target defensive measures.

**Confuse the attacker and thwart the intrusion.** When the attacker infiltrates the app located outside the vulnerability, it also does not get any valuable information because its intrusion is a trap, which is a sandbox made by the honeypot.

**Discover potential vulnerabilities and improve security protection.** When the attacker invades the honeypot trap, the defender only needs to extract the attacker's attack methods from the honeypot as a way to discover more potential vulnerabilities and use leak detection to further strengthen the app.

![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

**Three main features of AISECURIUS APP reinforcement**

AISECURIUS end reinforcement provides security reinforcement, risk warning and full lifecycle risk control protection for the app, meeting the requirements of personal information protection and security compliance.

**All-round security of the App.**

AISECURIUS end reinforcement can carry out security inspection for existing applications, find out the risk vulnerabilities of applications and carry out targeted repair and rectification, protect sensitive data, code obfuscation, code integrity, memory data, etc., avoid the security impact of system vulnerabilities on the application itself from the source, and ensure the security of app information.

**Provide real-time risk warning for the App.**

Based on Defense Cloud, AISECURIUS end reinforcement can provide App with mobile application operation for security monitoring, real-time monitoring of terminal equipment, operation environment and operation behavior during mobile application operation, and help App establish monitoring, early warning, blocking and traceability security system for runtime risks.

**AISECURIUS is a full lifecycle prevention and control system for App.**

App application security reinforcement shows the trend of normalization, pan-boundary and specialization, which means that enterprises' own simple protection can no longer meet the current new trend of network security protection and need to establish a more comprehensive security defense system. Mobile applications in the core code security, logic security, security function design, data transmission link security and other dimensions of the problem, to help build a solid security line of defense.

What does the "honeypot" service of AISECURIUS APP reinforcement do?

While the CAPTCHA becomes more complicated, new ways to attack it keep cropping up. 
Here, we'll talk about the battle between CAPTCHA and CAPTCHA farm.

As we all know, CAPTCHA is used to distinguish between human and machine. However, with the development of science and technology, some have found lucrative opportunity in it, leading to a protracted battle of attack and defence.

While the CAPTCHA becomes more complicated, new ways to attack it keep cropping up. 

This paper starts from the confrontation between verification code and coding platform.

![](https://cdn.aisecurius.com/images/911/911f1550-9646-4a3e-a29f-1ba859971848.png)

**What is CAPTCHA farm?**

CAPTCHA farm comes on the scene with the advent of artificial intelligence. It's designed to crack CAPTCHA using artificial intelligence technology.

It works as follow:

![](https://cdn.aisecurius.com/images/c6f/c6f662f3-b12a-4449-a0e6-e02a1486f39c.png)

In the past, if one wanted to obtain data illegally, they would first send a request to the data page. If the data page did not have any protection mechanism, the data could be easily obtained; if the data page had CAPTCHA defense mechanism, it would not return directly. Instead, CAPTCHA pops up as a condition for human-machine verification, and data is returned only after the CAPTCHA is passed. Generally illegal and semi-illegal behaviors provide no means to deal with CAPTCHA, so they cannot obtain the data.

That's where CAPTCHA farm comes in. Submit the CAPTCHA information to the CAPTCHA farm, which returns the result after CAPTCHA is cracked. This greatly increases the risk of the CAPTCHA being cracked.

To sum up, the original request process only has two-way communication between the one cracking CAPTCHA and the data page. Due to the addition of CAPTCHA farm, it has evolved into the communication between the cracker, the data page, the verification code, and the CAPTCHA farm.

![](https://cdn.aisecurius.com/images/911/911f1550-9646-4a3e-a29f-1ba859971848.png)

**How does CAPTCHA farm work?**

So, how does the CAPTCHA farm work to crack all types of CAPTCHA?

It has two major advantages:

**Timeliness:**

As the CAPTCHA farm finds way to crack CAPTCHA, the CAPTCHA platform also constantly rolls out new forms of CAPTCHA or increase the difficulty of original CAPTCHA. In the case where the difficulty of cracking increases, if the CAPTCHA farm reacts quick and finds new way to crack, the time spent being blocked by CAPTCHA will be greatly shortened.

**Efficiency:**

After obtaining the relevant data of the CAPTCHA, it will be submitted to the CAPTCHA farm for cracking, and then go to the CAPTCHA page after obtaining the cracking information. If the CAPTCHA farm takes a long time to crack (inefficient), for example, it takes 1ms to solve the slider CAPTCHA and 10ms to solve the click CAPTCHA, then the efficiency is reduced by 10 times. Relatively speaking, it is efficient to solve the slider CAPTCHA, but it is not efficient enough to solve the click CAPTCHA.

Assume the scenario of crawling airline flight data (query flight dynamic information constantly). If the data page adopts the click CAPTCHA, there would be delay compared with slider CAPTCHA.

![](https://cdn.aisecurius.com/images/911/911f1550-9646-4a3e-a29f-1ba859971848.png)

**Two cracking methods used by CAPTCHA farm**

In view of these two points, the current coding platform cracking verification code is mainly machine cracking and manual coding two.

**1. Automatically:**

The advantage of this method is that the recognition speed is fast and the price is low; the disadvantage is that it takes a lot of time to understand method of CAPTCHA, the workload invested in the early stage will be relatively large, and the recognition accuracy rate is relatively low. 

At present, the main forms of verification codes are based on image processing, such as slider and picture click CAPTCHA. Therefore, the automatic cracking is mainly performed by identifying the elements in the picture, such as identifying the gap of the slider CAPTCHA, clicking on the text elements and digital elements in the CAPTCHA, by using image processing, image binarization and sliding trajectory simulation. An example of the key elements supported by CAPTCHA farm is shown below:

![](https://cdn.aisecurius.com/images/4ee/4ee3e323-5413-40b7-bf71-0ab059cb9ce8.png)


![](https://cdn.aisecurius.com/images/e0f/e0f0466b-1953-4ba4-9ed3-2dca5a771fa8.png)

![](https://cdn.aisecurius.com/images/da7/da765fb1-e464-4601-b6ad-5edcc44956b0.png)

Due to the continuous improvement of the image processing technology of the CAPTCHA platform, it's more difficult for CAPTCHA farm to analyze the key elements, as shown in the following figure:

![](https://cdn.aisecurius.com/images/5ea/5ea7c8e9-141a-4c5a-8df7-752a2d558a57.png)

In this regard, the CAPTCHA farm is also improving the ability of its machines, such as introducing machine learning and neural networks to intelligently identify elements in pictures and improve the accuracy of identifying and verifying elements. An example of the cracking process with artificial intelligence is shown below:

![](https://cdn.aisecurius.com/images/663/66352086-5f60-4ebf-9ec4-24298166cbc4.png)

With artificial intelligence, the recognition efficiency is increased expotentially, which further increases the defence difficulty of CAPTCHA platform. It means that the battle between the CAPTCHA platform and the CAPTCHA farm has come to a new level.

**2. Manually**

The shortcoming of cracking automatically is that the workload at early stage is large, the technical threshold is high, and the recognition accuracy is low. These can be made up for by cracking manually.

It works as follow:
The CAPTCHA farm has a task platform. The cracking party will encapsulate the obtained verification code information into tasks and submit them to the platform. The CAPTCHA farm acts as an intermediary and assigns tasks to the markers (people who crack the CAPTCHA). After the cracking is completed, the result is returned to the cracking party and used on the data page.

The CAPTCHA farm will also keep a copy of the result. In case the same CAPTCHA problem comes up again next time, the result will be returned directly. If the verification pictures of the CAPTCHA platform are not updated for a long time, all the verification pictures will be marked. At this time, there is no need for manual marking, and they are solved automatically.

An example of manual cracking is as shown below:

![](https://cdn.aisecurius.com/images/661/66142a65-f541-4d6f-9df2-853bf4467c14.png)


However, the biggest shortcoming of manual cracking is that the request takes a long time, because it depends heavily on the cracking speed of the marker, but it takes at least a few seconds for any person to solve the puzzle, which is considered time-consuming for HTTP requests (equivalent to hundreds of crackings automatically), therefore, it has evolved into the following workflow:

![](https://cdn.aisecurius.com/images/ca5/ca530adf-a469-4a08-82ed-9072c30c9f4e.png)
![](https://cdn.aisecurius.com/images/ca5/ca530adf-a469-4a08-82ed-9072c30c9f4e.png)

As shown above, in the past, the CAPTCHA farm passively received verification requests for cracking. Now, the CAPTCHA farm takes the initial to request CAPTCHA service, and after completing the request, the legal token issued by the CAPTCHA service is stored. When the cracking party access the CAPTCHA platform, the token will be issued to them to bypass the CAPTCHA.

![](https://cdn.aisecurius.com/images/911/911f1550-9646-4a3e-a29f-1ba859971848.png)

**What's the best measure?**

So, how do CAPTCHA platforms fight against CAPTCHA farm to protect data?

AISecurius believes that in order to do improve the efficiency of defense, CAPTCHA platform must focus on the characteristics of the CAPTCHA farm, that is, the efficiency and timeliness mentioned above.

How it works exactly?

For machine coding, generally speaking, there are the following directions:


**1. Increase the frequency of CAPTCHA update:**
The verification code platform can continuously introduce new CAPTCHA forms to increase the difficulty of cracking automatically. If one tries to bypass the CAPTCHA automatically, when a form of CAPTCHA that has never been seen before pops up, he will be blocked out, and cannot access to the data. Undoubtedly, it adds difficulty to CAPTCHA farm.

**2. Improve the difficulty of elements identification:**
The CAPTCHA platform can improve the identification difficulty of verification elements in the original form. For example, the core verification element of text click CAPTCHA is text. If the text element in the picture is recognized, the correct result can be returned. Improve the recognition difficulty of text elements as shown below:

![](https://cdn.aisecurius.com/images/efa/efaa8283-fa9d-4f7d-84a7-4da0cda0565a.png)

The three characters on the left have not been processed, and the first character on the right has been processed with coloring and hollowed out. For automatic cracking, it is more difficult to recognize the text that has been processed, and it can also increase the recognition difficulty by replacing the text, rotating, overlapping, twisting, and adding interference items. As shown below:

![](https://cdn.aisecurius.com/images/6d4/6d4bf5a8-92ee-46c9-8288-9d294fafd7d7.png)

It also applies for other types of CAPTCHA, such as add shadow to slider CAPTCHA. Converting picture elements from 2D to 3D can increase the difficulty of element identification and verification.

**3. Introduce artificial intelligence:**

AISecurius has 7 types of CAPTCHA with constant update.

And it has introduced artificial intelligence. For example, using NLP technology, use the given key words to make sentence, use the words in the thesaurus to make sentence, cut sentence, and finally let users restore the sentence, which greatly improves the difficulty of cracking.

Manual cracking may focus on:

**1、Ensure that the images used for CAPTCHA are constantly updated;**

As mentioned above, it is difficult to identify using manual cracking, and the image used is the key, that's where we should focus on.

AISecurius updates the CAPTCHA pictures frequently, which eliminates the dragging from the source. In this way, the marker needs to continuously verify the new images, which greatly increases the identification cost (and also increases the cost of cracking party), thus protect the users.

**2、Determine whether the collection and verification environment is malicious;**

Based on the manual coding workflow, AISecurius can identify the manual coding platform by collecting verification environment information, such as determine whether the verification environment information when the verification is completed is consistent with the verification environment information when the token is reported. The behavior of the manual CAPTCHA farm is different from illegal and semi-illegal behavior. Therefore, recognizable environmental information can be collected in the verification process and reported together with the verification results. The CAPTCHA platform configures rules and policies to analyze this information, and screen out requests that may be illegal and semi-illegal behaviors for secondary verification or interception, so as to improve security.

At present, AISecurius relies on device fingerprints and risk engine. During verification, the verification environment information is collected and reported to the real-time risk control engine. The rule engine is used to judge the risk factors, and finally determine whether the request is risk request.

As mentioned above, the battle between CAPTCHA platform and CAPTCHA farm is a protracted one, and the challenge and attack between the two will remain an important topic for all CAPTCHA platforms in the near future.


Analysis of battle between CAPTCHA and CAPTCHA farm

In the PC Internet era, the normal way to access websites is through browser on PC, and Internet companies use cookies and IP addresses to identify user devices. Cookie first appeared in the 1990s. 

Tracking is a key service provided by the digital platform. Whether it being PC Internet era, mobile Internet, or rapidly growing metaverse, the platform requires different technical tools to distinguish authenticity, track operations, understand users, and guarantee security. Authentification, in particular, is the premise and base of effective services, as valuable services are based on real data.

![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

**Device fingerprinting emerges with the development of digital technology**

In the PC Internet era, the normal way to access websites is through browser on PC, and Internet companies use cookies and IP addresses to identify user devices. Cookie first appeared in the 1990s. The technology is used to record and track user access records, times, computer information and account information. It has become an important tool for online advertising service providers to identify users, and is widely used for the identification of devices on the Internet.

As Cookie saves user data in local storage, malicious users can easily bypass detection by clearing local data, making its application greatly limited. At the same time, due to increasing concerns about user privacy protection, mainstream browser manufacturers have gradually phased out cookie technology.

In the mobile Internet era, users have more ways to access the Internet, making it difficult to identify and track users. Also, the Internet and new technologies have made faking identity easier, which means more complicated to tackle it. Cookie technology is no longer a reliable way to identify users in the current network environment.

When it's unable to identify the user quickly, one can turn to the suspicious Internet device, and respond to high-risk devices and related operations in a timely manner, which may lead to controlled risk and reduced loss. Device fingerprinting can distinguish the authenticity of the operator, separating valuable user from malicious fraud. Device fingerprinting, which collects device, network, operating behavior, address, and user habit information at the same time, has become a new and more effective device identification and tracking technology.

![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

**5 stages of the development of device fingerprint technology**

**Phase I Based on IP address.** Collect information based on IP address, it is used to track buried points in some services. As the earliest device identification scheme, it is simple and easy to use, and is still the information to be collected.

IP address is a unified address format provided by the IP protocol. It assigns a logical address to each network and each host on the Internet, thereby shielding the difference in physical addresses. IP address is like home address in the real world. If you write a letter to someone, you need to know his or her address, so postman knows where to deliver the letter. Computer works like postman, it must know the unique "home address" so that it doesn't deliver the letter to the wrong person. It's just home address is written in words, while the computer's address is represented by binary digits.

With the development of dynamic IP allocation technology in LAN and mobile network, the resolution and accuracy of IP address as device identification are greatly reduced.

**Phase II Based on IP address and Cookie.** The unique identifier of the device is generated with the collected IP address and browser Cookie

Cookie is simple text file stored, temporarily or permanently, on the user's device. It records the user's personal information, and when the user accesses the network service again, the saved data will be used by the network service.

With the development of dynamic IP allocation technology in LAN and mobile network, the resolution and accuracy of IP address as device identification are greatly reduced; in addition, with the implementation of local storage, users can easily bypass detection by clearing local data, making its application greatly limited, and due to increasing concerns over user privacy protection, mainstream browser manufacturers have gradually phased out cookie technology.

**Phase III Based on the multi-dimensional information of device.** The front-end collects the user's device hardware, network, and operating environment information, and the back-end uses the collected multi-dimensional data to generate a unique ID through certain algorithm, including IDFA (advertising identifier), IDFV (supplier identifier) of iOS devices; IMEI (mobile device identifier), MAC (Ethernet physical address) of Android devices.

With the emergence of new cheating methods and tools, parameters on the device can be tampered with, which compromises the effect of unique identification of the device as specified in Phase II. Parameters on the device can be tampered with, turning it into a new device easily, which compromises the effect of unique identification of the device.

**Phase IV Cross-platform and uniqueness.** After stage III, there comes a unified device fingerprint ID for H5, and APP device fingerprinting (consistency of fingerprint ID of App, H5, and in the same device).

The device fingerprint at this stage needs to have higher reliability against different cheating tools to ensure the uniqueness, stability and security of fingerprint. Many new trends emerged during this phase.

First, all industries are promoting online business, the stakes are too high, resulting in a long-term fierce rivalry with illegal and semi-illegal behaviors.

Second, as mobile phone manufacturers issue stricter privacy policies, it becomes difficult to collect information such as IMEI, MAC, and IDFA. At some point, the collection rate is less than 80%, another concern is the quality of the collected data. For example, one may find the following MAC address: "00:00:00:00:00:00", "00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00", "ff:ff:ff:ff:ff:ff". Therefore, it is necessary to invest more time and energy in research to ensure the stability of fingerprinting.

Third, there are security manufacturers specialized in producing the basic components of device fingerprinting with long-term investment and research.

Fourth, new concepts emerge one after another, and people in the industry are devoted to exploring the new concept, but come up with little real technological breakthrough.

![](https://cdn.aisecurius.com/images/aea/aea0d0b6-1386-4031-926d-d1b25b2baf4a.png)


![图片2.png](https://cdn.aisecurius.com/images/749/7497d1a1-7a15-46f5-ba31-de371d5f3da7.png)


**Phase V ，Cloud linkage and data precipitation.** At this stage, through the cloud + terminal model, in addition to collection of more detailed information, the timeliness and security of equipment have been significantly enhanced, based on the previous experience and data precipitation of the industries. When new attack methods appear, how can fingerprinting technology respond and identify it faster.

AISecurius device fingerprinting integrates business security intelligence, cloud policies and data models, by generating unique fingerprint information for Internet software and hardware, it supports Android, iOS, H5, and is capable of detecting simulator, system reinstallation, root jailbreaking, and injection attack. Built-in security intelligence center, instant trigger of 24 industry risk intelligence information, keeping security operation and maintenance personnel abreast of security situation; integrated with security cloud policy service, real-time upgrade of risk policies of the entire network, providing the latest prevention and control ideas for security operation and maintenance; equipped with AI building modules, precipitate business risk data in real time, learn threat behavior modeling with supervised and unsupervised robot, tap potential risks, upgrade and iterate prevention and control rules, and improve risk prevention and attack defense capabilities.

![](https://cdn.aisecurius.com/images/f86/f869d3ad-f709-4821-8ddf-58aa64d2782f.png)

![](https://cdn.aisecurius.com/images/110/11013fec-8a43-45ec-a474-2d53dbd559e8.png)

Four key features of this stage:

First, high recognition rate and strong security. Accurately identify dozens of risks, including identifying simulator, system reinstallation and modification, injection, and dynamic debugging to avoid being cracked and keep data authenticity.

Second, high update frequency. When encountering new attack methods, the device fingerprinting technology can be synchronized within hours or even minutes, allowing faster risk perception and accurate identification.

Third, capitalize on expert experience. The device fingerprinting has accumulated risk data in different industries and different scenarios, with rich experience in attack and defense to support fraud attacks in the cold start state.

Fourth, cloud linkage. The emergence of a secure cloud form through the cloud + terminal model, capable of responding within minutes.

![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

**Four requisite functions of AISecurius fifth-generation device fingerprinting**

Stability and uniqueness are requisite for the fifth-generation device fingerprinting, as well as experience in security and protection. How to quickly conduct risk perception and offensive and defensive upgrades are essential for device fingerprinting technology. Therefore, the fifth-generation device fingerprinting has the following four requisite functions.


**Stability is guaranteed to be at least 98%.** Once the fingerprint is generated, it will not change, regardless of tampering with device parameters (including IMEI, MAC address, AndroidId, SIM card information, model, and brand), or disabling or clearing cache and cookies, the device fingerprinting must remain unchanged with at least 98% of stability.

**Uniqueness is guaranteed to be at least 99%.** The fingerprints of any two devices cannot be the same. The device fingerprint ID generated for each device needs to be 99% unique and cannot be tampered with.

As mobile phone manufacturers modify the system source code in deeper layer. For example, some enterprises deeply modify device information for the purpose of shielding device information or simulating the purpose of other manufacturers. This may cause the information collected by the device fingerprint to be shielded, modified or the parameter value is a meaningless character string under certain circumstances. It's a challenge to maintain high stability and uniqueness, which requires long-term research.

**Anti-cracking is guaranteed to be 100%.** The SDK code of the device fingerprint itself needs to be protected to prevent the collection logic from being cracked and data being forged, and guarantee authenticity and accuracy of source data. In addition, it requires security detection capabilities for the basic environment and runtime of the device, and capable of accurately identifying different risks, such as emulator, root, jailbreak, debugging, code injection, multi-account, and VPN proxy.

**Fast responsiveness.**

Business applications are exposed to the Internet, while the black and ash industry is hidden behind, so there is a certain lag in attack and defense, which requires the device fingerprint technology to have timely risk intelligence perception and prevention and control upgrade ability in the face of new attack modes and risk characteristics. The background can combine the attack and defense experience of various industries and risk data precipitation through the cloud + terminal method. Perform quick attack and defense upgrades to eliminate service risks within one attack and defense period.

![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

**Different business scenarios of device fingerprinting**

As one of the basic components of the business system, device fingerprinting is widely used in scenarios such as marking, tracking, temporary credentials, analysis, and anti-fraud, and is an important part of the risk control system.

1. **Dynamic anonymous tracking.** The path of unregistered users accessing the website is used as user's identity without revealing the user's private data, device fingerprint technology provides accurate tracking for business.

2. **Temporary user ID.** In some scenarios, users are allowed to visit as tourists. At this time, the business background can obtain limited user information, and the device ID is used as a temporary user ID through device fingerprinting technology. For example, temporary user ID can be used to log in to online game, and the game progress, equipment, and level information are saved under the temporary user ID. After registered, the previous game data is automatically imported into the registered user ID.

3. **Data marking and correlation analysis.** In big data analysis and machine learning scenarios, device fingerprinting can be used as basic field to observe business indicator data from another perspective and perform correlation analysis. For example, through device fingerprinting ID, analyze the number of active devices, the number of new devices, the models used by users, the number and amount of transactions on the same device, and the number of users accessing the same device. When building an association, in addition to using the user's mobile phone number and card number, the device ID can also be used as node to observe the relationship between users.

4. **Anti-fraud.** Device fingerprinting technology is the basic application of anti-fraud, and it is effective in identifying machine attack, false registration, malicious login, multi-account, channel cheating, simulators, etc.

**(1) Identify machine attack.** Machine attack/script attack is generally carried out through automated scripts or tools by initiating requests to the target website in batches and automatically. Device fingerprinting technology is capable of identifying whether the request is initiated by machine or script.

**(2) Identify false registration/malicious login.** Device fingerprinting technology can identify account registrations using simulator, great deal of registrations on the same device within limited period, and whether the registered device is of high-risk. Similarly, in the login scenario, it can effectively identify the risk of frequent login attempts and credential stuffing on the same device, and identify whether the login device is frequently switched.

**(3) Identify multi-account binding.** In marketing activities, generally, the same device and the same account can only participate once. Device fingerprinting technology can quickly identify whether multiple accounts are bound to the device, and whether the same account is logged in on multiple devices.

**(4) Identify channel cheating.** In scenarios such as application promotion and display advertising, speculator may use technical tools to obtain promotion fee by forging traffic data. Fake machines and fake installations of real machines are identifiable through device fingerprint technology, so as to effectively track channel traffic and performance.

**(5) Identify simulator/debugging.** Device fingerprinting is able to detect device terminal environment and runtime risks, such as emulator, jailbreak, debugging, injection, framework attack, etc.

![](https://cdn.aisecurius.com/images/634/634ece84-b561-48dc-8a24-4e7310892655.png)

**Application process of device fingerprinting**

Device fingerprinting can be integrated into apps, small programs, and website in the form of SDK. Consider Android operating system, device fingerprinting usually uses aar package (Android Archiv, binary archive file of Android library project) to provide SDK, and also uses aar package and SO file (dynamic link library) to integrate SDK.

The workflow of device fingerprinting is divided into four steps: Collect and transmit, decrypt, generate unique ID, and return for verification.

![](https://cdn.aisecurius.com/images/7b9/7b9b6c08-011d-490f-b425-7d7d5e06c5ce.png)


1. Open App, H5, and the device fingerprinting starts to collect multi-dimensional data, and encrypt and compress the collected data to ensure data security and network transmission efficiency.

2. After receiving the collected data, the fingerprint background decrypts it, and then optimizes the initial processing of data formatting, filtering, and conversion.

3. Then, the background of device fingerprinting performs weight setting and matching on the data. The weight of some data fields involved in the fingerprint calculation will be higher than others or not involved in the calculation. Some fields are analyzed for similarity calculation, to remove duplicate, and finally a device ID is generated or associated as the fingerprint of the requested device. Finally, the generated device ID is saved for subsequent use.

4. When operating on App, H5, the device fingerprinting will match and verify the operation information, and give the verification result.

The entire process is completed in milliseconds. The most important part lies in the algorithm used to generate fingerprint ID, which requires painstaking research and practice to ensure sufficient stability and uniqueness.


AISecurius: From promotion positioning to risk control and anti-fraud! The 5th generation of device fingerprinting has been released

Intelligent non-cognitive verification, as the name suggests, is to allow trusted users to pass without verification. 

As a link closest to the public users in security services, CAPTCHA is also an almost necessary link for any product in the user login link. From the initial text CAPTCHA to knowledge CAPTCHA to behavior track CAPTCHA, and then to intelligent insensitive CAPTCHA, CAPTCHA manufacturers spent more than ten years. The verification code behind each update is the verification code manufacturers and black ash production non-stop game against the result.

In general, the working procedures of the CAPTCHA is as follows:

1. Request from the client;
 
2. Return the CAPTCHA information (such as pictures, session ID, prompt information, etc.);
 
3. The client rendering display, user clicks or slides the CAPTCHA according to the prompt;
 
4. The client collects user verification data and sends a request to the server for verification, and the server returns the verification result.
 
![](https://cdn.aisecurius.com/images/5be/5beb6f80-8cba-4014-99ef-92f2b71586db.png)

Recently, AISecurius has officially  launched intelligent non-cognitive verification.
 
Intelligent non-cognitive verification, as the name suggests, is to allow trusted users to pass without verification. If the user applies for CAPTCHA for the first time, the client automatically collects device information and reports it, and the server judges the current user risk information through risk control strategies, human-machine identification models, and behavioral feature models. Risk-free users do not need verification, while suspected users must verify again to pass. In some high-risk business scenarios, users can also change the intelligent non-cognitive verification to strong verification mode for stricter management.
 
The security of the CAPTCHA is mainly determined by these two factors:
 
First, the image itself, it is difficult for the machine to recognize the content of the image;
 
Second, the behavior data generated during the verification process, which is used to verify whether the verification process is human behavior.
 
Here, we focus on the image to discuss how it's used against the illegal and semi-illegal behaviors.

![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

![](https://cdn.aisecurius.com/images/803/80320e8f-5294-4067-851d-4b9a4d21c399.png)

Let's take the example of anti-crawler and look at the role of images in CAPTCHA offensive defense.
 
The most popular types of CAPTCHA are rotating image and puzzle, which require association ability, and it is difficult for machine to acquire, and the verification process is similar to a game, which improves the user experience in the process of improving defense.
 
![材料图2.png](https://cdn.aisecurius.com/images/db4/db414ee4-886a-4ce0-85ca-a7170cafd8d0.png)

**Baidu rotate CAPTCHA (left), AISecurius rotate CAPTCHA (center), AISecurius puzzle (right)**
 
However, these types of CAPTCHA are not perfect, the crawler team also has a corresponding method of cracking.
 
 
For example, the general operation process of the crawler in the rotate CAPTCHA is as follow:
 
1. Collect image materials;
 
2. Program simulates the rotation to generate the model library (as shown below);

![图片1.png](https://cdn.aisecurius.com/images/043/0435da6b-b7f2-4d38-83ab-3a4fd094f9c2.png)

3. Search the model library with similarity algorithm to obtain the target angle;
 
4. Simulate the user to rotate the image to the target angle or generate request data packet for verification;
 
5. The certificate is obtained after passing the verification.
 
Similarly, puzzle CAPTCHA also faces the same problem. The process of crack with crawler is as follow:
 
1. Collect image materials;
 
2. Manually solve or forcibly solve the puzzle and write it into the model library;
 
3. Search the model library to find the original image, and solve the puzzle according to the original image.
 
To sum up, it is not difficult to see that the collection of picture materials is a necessary condition for both the rotation type CAPTCHA and the puzzle type CAPTCHA, but in order to achieve defense effect, it is not possible to rely on the picture alone.
 
This leads to two important factors of captcha defense - solution space difficulty and dynamic material.

![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

![](https://cdn.aisecurius.com/images/36a/36a53e90-6014-404a-b36b-5ce73775c0de.png)

First, let's take a look at the definition of solution space.

We can see the solution space as a probability problem, that is, the difficulty of the user or crawler in passing the CAPTCHA.
 
For example, the traditional text CAPTCHA, if it is 4 digits, the solution space is 10^4. The rotate CAPTCHA uses the slider length to convert to the rotation angle. The length of slider CAPTCHA is generally 300px, and the random length may be 300px, so the solution space is about 300~400.
 
Does this mean that the text CAPTCHA is more secure than the rotate CAPTCHA?
 
Not necessarily, because the difficulty of solving space is not fixed.
 
Take the character sequence CAPTCHA as example, without considering the text base, the solution space becomes the probability of finding four words in a given order from five words, that is, A(5,4)=5* 4*3*2=120. That is to say, the crawler has a 1/120 probability of solving the CAPTCHA.
 
It seems rotate CAPTCHA seems to be more secure than character sequence CAPTCHA.
 
It should be noted that the solution space will also continue to degenerate with new cracking scheme. When the solution space degenerates to 1, it means that the crawler can successfully solve the CAPTCHA every time.
 
So, how to solve this problem?
 
![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

![](https://cdn.aisecurius.com/images/af9/af987eb2-d1ca-4a3c-86e8-7f3c7bb8a84f.png)

The defense strategy cannot be effective forever, such is true for the solution space. Dynamic materials (update frequency of materials) are required to ensure the effectiveness of the solution space.
 
Dynamic materials include 3 application scenarios:
 
1. Manual replacement
 
As the name suggests, it refers to replacement of image manually.
 
However, problems exist for manual replacement:
 
- material short effective period, need frequent replacement;
- The copyright of image has to be taken into consideration if it's taken from the Internet;
- Even if the there is no copyright issue, it has to be manually filtered to ensure the effect of CAPTCHA;
- The cost is higher for manual replacement.

Automatically generating background images can solve this problem.
 
2. Program generation
 
One of the solutions is to draw with OpenGL, and generate images for output to the material library. OpenGL draws picture depending on the model, you can choose the model, quantity, size, rotation, coloring, texture, light, and render it into 3D picture, which means there are countless variations. For dynamically generated, almost non-repeating pictures as source for rotate CAPTCHA, it can effectively defend against cracking by those using images collected, which greatly improves the security of CAPTCHA.

![](https://cdn.aisecurius.com/images/2c9/2c95669a-7ec9-40f6-b288-00474e083a3e.png)

Dynamically generated models can take many forms, such as geometric models, virtual physical models, etc.:
 
![](https://cdn.aisecurius.com/images/c9e/c9edd816-f621-4cbe-85c3-ef3713f134d4.png)

![](https://cdn.aisecurius.com/images/3e7/3e761f7f-7927-497c-9bff-3eda1ae85013.png)


![](https://cdn.aisecurius.com/images/6a8/6a8ac22b-467c-4494-b798-fc64dd02239c.png)

For the dynamically generated image of CAPTCHA, simple image will do. After optimization, it can be ensured that the images used in rotate CAPTCHA and puzzle CAPTCHA are dynamically updated and will not be repeated, which is effective against web crawlers collecting image materials.

![材料图4.png](https://cdn.aisecurius.com/images/f06/f066df33-ac22-4975-b42b-dfcd0fd5741c.png)

![材料图5.png](https://cdn.aisecurius.com/images/618/618ced05-b573-4d83-9c99-99badc7e197f.png)

3. Edge processing
 
Another application of dynamic material is the edge processing of pictures, which is particularly important in slider CAPTCHA.

![](https://cdn.aisecurius.com/images/93d/93df9de6-3c7e-4a43-81f4-bb443317ab99.png)

Dynamic restoration CAPTCHA requires the user to restore the picture that has been cut, which requires the same associative ability as the rotate and puzzle CAPTCHA. But it doesn't require web crawlers to have associative ability to solve the rotate CAPTCHA composed of regular image. The web crawler can find the target position by continuously moving the block horizontally and comparing the RGB values of the upper and lower pictures until the RGB values are matched.
 
Therefore, we just simply set the edges of the upper and lower images to similar colors, so that the web crawler cannot determine the target distance based on the RGB values of the upper and lower images. The desired effect can be achieved by overlaying all objects with the same texture through dynamic material program.

![group 7549.jpeg](https://cdn.aisecurius.com/images/d6f/d6f4378a-b724-4027-a58c-b06453cc0f08.jpeg)

To sum up, the principal of CAPTCHA is to constantly adapt itself to the changing circumstances. We can also prove this from the iteration process of CAPTCHA. Although the process has not changed, the complexity of CAPTCHA has increased with its iteration.
 
Just like the non-cognitive CAPTCHA launched by AISecurius, it is not only an iteration of technology, but also an iteration of algorithm. It's integrated with the Ding Xiang DDoS, making the defense effect clear with improved user experience.
 
After all, security defense is an ultimate battlefield, and it takes combination blow to "annihilate the enemy"


Roll with the punch, check out the application of dynamic material in the challenge-response of CAPTCHA

how do you make sure your identity is established and that you can't be easily stolen or copied?

Most of risks come from uncertainty of identity.

For example, the well-known phishing, bogus transaction, account theft, and fraud through registration and login are the direct consequences of the uncertainty of identity.

So, how do you make sure your identity is established and that you can't be easily stolen or copied?

Device fingerprinting provides a solution. Device fingerprinting refers to the unique identification of the device generated by the hardware, network, and environmental information of the user's Internet device, and the most important indicators of device fingerprint are uniqueness and stability.

This article starts with the stability and uniqueness of device fingerprinting.

![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

![](https://cdn.aisecurius.com/images/20e/20ef817b-f7bc-469f-911b-c7476853a528.png)

As a unique ID for identifying mobile phone or browser, it's required to collect data from user devices, but it is not easy for device fingerprinting.

First of all, the legal level of the user's personal information data protection authority increased.

In recent years, the protection provisions of personal information data have been continuously tightening the rights of data collection, and the collection rate of features with the unique identification function of the device is becoming less and less, which increases the difficulty of device fingerprint technology to a certain extent.

In the past, the methods for collecting the unique identification of device fingerprint include MAC address (Ethernet physical address), IMEI (mobile equipment identification number), and IDFA (advertising identifier). With the updage of system and emergence of new cheating methods and tools, parameters on the device can be tampered with, turning it into a new device easily, which compromises the effect of unique identification of the device. Therefore, the device fingerprinting requires more information to ensure the uniqueness and stability of the device fingerprint.

Taking iOS as example, IDFA collection on iOS 14 or later requires user authorization, the same applies for Serial and IMEI. This change has made the generation of stable and unique identity more complicated.

![](https://cdn.aisecurius.com/images/17e/17e368d5-66eb-499d-918a-ac3690b718e4.png)

**The collection rate of some feature statistics (total number of devices &gt; 500,000), the actual availability rate of android-mac here will be lower, because of arbitrary nature of mac**

Second, the amount of abnormal data increases.

Different mobile phone models and operating system versions will lead to different characteristics of the collected data. It's especially so for Android, as there are so many different brands of mobile phones run on Android, with different OS version and ROM, the data collected are inconsistent.

Consider IMEI, the following are actual abnormal data collected.

```
000000000000000
88888888888888
666666666666667
111111111111119
A000005EAAACCC
868686868686863
444646464643346
100000000150705
010000000053015
A0000060A60A0B
A0000070000AAB

00:00:00:00:00:0a
02:00:00:00:00:00
00:00:00:00:00:01
00:00:00:00:00:10
6a:aa:6a:aa:6a:6a
00:02:00:00:00:00
00:00:00:80:00:00
10:00:00:00:00:12
f2:0f:f0:02:f0:22
32:12:31:23:32:32
66:00:44:40:06:66
c0:00:00:00:00:d0
00:00:00:00:00:12
04:00:00:50:54:04
```

These abnormal data may be because the device has been tampered with, or abnormal ROM, or special model device, it's also true for android_id, Seria, etc. If these abnormal data are ignored, the effect of fingerprints will definitely be affected. Therefore, it is necessary to have the support of big data to formulate a reasonable fingerprint algorithm.

![](https://cdn.aisecurius.com/images/2cc/2cc01831-afc7-4073-baef-0e0da6e38ad9.png)

In addition, the fingerprint calculation algorithm is not static. The release of a new version of operating system and a new model of mobile phone may lead to abnormal data collection at any time, which requires the device fingerprint to have the ability to continuously monitor abnormal data.

Last is the impact of illegal and semi-illegal behaviors.

In the field of risk control, device fingerprint is a basic tool to fight against illegal and semi-illegal behaviors, so there are inevitably ways to bypass the tracking and detection of fingerprints. A common way is to modify the device fingerprint by changing the device fingerprint manually.In addition, the tampering of device information may also cause fingerprint data corruption. If the tampered data is associated with normal user's device, the data of normal user will be compromised, and it is difficult to remove such data from the system.

![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

![](https://cdn.aisecurius.com/images/bb4/bb4fb9d7-79d8-407b-adab-6efdd206edfc.png)

So this requires changes made to device fingerprinting, Ding Xiang chooses to do so through the cloud + terminal model, in addition to collection of more detailed information, the timeliness and security of equipment have been significantly enhanced, based on the previous experience and data precipitation of the industries. When new attack methods appear, how can fingerprinting technology respond and identify it faster.

How to ensure the stability and uniqueness of device fingerprints?

Let's consider the stability first.

The stability calculation logic is to construct a multi-dimensional device portrait based on the collected data. After reporting the data, the algorithm matches the closest device and uses the found device fingerprint, otherwise, new device fingerprint is generated.

The reason for emphasizing the stability of the device fingerprint is that many operations will cause the characteristic information of the device to change, such as app reinstallation, permission change, advertising identifier reset, machine restart, system upgrade, device parameter modification, and factory reset.

In order to calculate a stable unique identity of the device in these cases, it is of course impossible to rely on only one or two device parameters, and more comprehensive device information is needed to build a device profile.

To ensure the high stability of device fingerprints, it is necessary to collect multi-dimensional data, analyze the degree of discrimination, stability, and change cycle, and analyze the characteristics of the characteristics, and use the characteristics reasonably.

Taking CPU, storage, and memory as example, it has very good stability, but the discrimination is very poor. So such features are not suitable for use alone, it needs to be used together with other features.

![](https://cdn.aisecurius.com/images/d70/d706a19b-8786-48ea-8b0b-cf9c6957844d.png)

It is necessary for us to further observe the period of feature stability (the size of the period in which the feature remains constant) and the difficulty of the stable change of the feature (the degree of difficulty of changing the feature), and decide how to use the feature based on the different characteristics of the feature, when selecting a feature, it should have an obvious advantage in at least some index.
In order to ensure the stability of the device fingerprint, it is necessary to construct multiple device portraits (short-term and long-term) for the device based on different characteristics. First, a batch of similar devices have to be located through the similarity search algorithm, and then accurately picked by the exact matching algorithm.

![](https://cdn.aisecurius.com/images/9c0/9c0f9e82-b51d-408d-9a81-e144e9a5fafc.png)

The process of basic algorithm (SimHash) is as follow:

1. Select the device information collected as feature pool;

2. Hash coding the features according to the degree of discrimination, stability, and difficulty of change of the collected information after corresponding processing. For example, splice multiple features with weak discrimination, and hash code to obtain coding vector C;

3. Set the weight W of the coding vector C according to features, (note: weight W can be obtained through big data learning, or set according to expert experience, weight W varies depending on the operating system version of device);

4. Multiply the coding vector C by the corresponding weight W to obtain the feature vector C';

5. Add all eigenvectors C' to get a eigenvector, and binarize (values greater than 0 become 1, and values less than 0 become 0) to obtain the final index D;

6. Calculate the similarity between the index D and the indexes of other devices in the server, (calculate the Hamming distance - in the information coding, the number of different bits encoded on the corresponding bits of the two legal codes is called code distance, also known as Hamming distance. The bit number with different values for the corresponding bits of the two code words is called Hamming distance of two code words. For example, the first, fourth, and fifth digit of 10101 and 00110 are different, so the Hamming distance is 3) return the device information whose similarity is within the threshold as candidate pool for further precise matching.

![](https://cdn.aisecurius.com/images/565/565fc9b1-33d6-4330-9478-969e52fc8617.png)

It should be noted that the stability of device fingerprint depends on whether sufficient and appropriate features are selected, whether the characteristics of each feature are properly understood, and whether the matching algorithm used conforms to the current situation of data acquisition.

![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

![](https://cdn.aisecurius.com/images/967/9675bf79-d7b7-45a1-a9e5-621499a06011.png)

Next, let's talk about uniqueness.

Uniqueness is a key indicator of device fingerprinting.

As basic service, device fingerprint is at the core of data services, such as user's commonly used devices, device-dependent policies in risk control, and unique advertising identifier. If there is a deviation in the fingerprint uniqueness calculation, or collision, it may cause serious misjudgment.

![](https://cdn.aisecurius.com/images/78a/78a47f28-8efd-4d63-9c65-9f236aa58867.png)

For example, after collision, the device may be considered to be in wrong area and associated with wrong account, resulting in erroneous punishment; if there is a large-scale collision, a large number of normal users will be blocked. Collision will affect the reliability of fingerprints, as a result, online services no longer rely on fingerprint-based judgments. Therefore, for good device fingerprint, the uniqueness must not have severe deviation.

The collision may be resulted from non-uniqueness of important equipment features that should be unique, or improper feature selection, lack of unique identifier for a combination of features, or bad matching algorithm.

Therefore, to ensure the uniqueness of the device fingerprint, it requires not only real-time dynamic update algorithm, but also collision detection.

![](https://cdn.aisecurius.com/images/b23/b23d8c14-1e20-4f31-aaa8-307cda585848.png)

First of all, as far as the algorithm update is concerned, it is not enough to rely on the application of the daily abnormal data detection, it is necessary to analyze the current data regularly in the offline warehouse, and the abnormal features can be found and extracted in time, and then fed back to the online algorithm optimization.
_________
The collision detection of AISecurius device fingerprinting prevents abnormal data from affecting fingerprint data. As device's uuid is irreversible, it can be used to detect collision. For the same device, the data is collected for calculation, the uuid may change during this period, and it cannot be changed back to the previous uuid. If a device has a historical uuid after calculation, it indicates that the calculation is unreliable because device collision occurs.

![](https://cdn.aisecurius.com/images/c30/c3036101-f2d6-4c1c-aeb4-fa720f33db3f.png)

**Basic principles:**

1. When the device uses the App for the first time, after reporting the device data collected, the fingerprint server issues a credential and saves in cache. The credential issued for the first time is called credential X1;

2. When the device uses the App again to collect and report device data, it first checks whether there is credential X1 in cache; if yes, carry the credentials X1; if no, it is considered that credential X1 is deleted when clearing the cache, and the fingerprint server issues credential X2, which is different to credential X1;

3. After the credential X2 is generated, if the credential X1 appears again when the device data is collected and reported, it indicates the device fingerprint has a collision;

4. After clearing the cache multiple times, it will include credential X3, credential X4... credential XN. If any of credential X1 to credential X(N-1) appears after credential XN, it means the device fingerprint has a collision;

Of course,There are other ways to detect device collisions, but it is not suitable to follow the calculation idea of the fingerprint, because the application has already 'made a mistake' during the collision, so it is more suitable to use the 'bypass' method mentioned above.

In addition, the calculation process of AISecurius device fingerprint covers data analysis, feature selection, algorithm matching, and collision detection.

![](https://cdn.aisecurius.com/images/41c/41cc693d-18bd-41eb-9b94-94342d995ca6.png)

At the same time, for privatized users, AISecurius provides defensive cloud services to synchronize the latest computing algorithms collected by cloud service device fingerprints to the defensive cloud platform, and private fingerprints can be kept up-to-date with cloud services.

![](https://cdn.aisecurius.com/images/a35/a35f1acd-28e3-477e-a486-df62c4a2aefc.png)

In general, in terms of uniqueness and stability, device fingerprinting not only prevent the collection logic from being cracked or data forgery, which ensure authenticity and accuracy from the source of data collection, it prevents the device parameters from being tampered with (including IMEI, MAC address, AndroidId, SIM card information, model, and brand) by disabling or clearing cache and cookies. It guarantees that the device fingerprint remains unchanged and the stability remains above 99%. The device fingerprint ID generated for each device is unique and it's impossible to be tampered with. The uniqueness is maintained at 100%, the response time is less than 0.1 seconds, and the crash rate is less than 1/10000.


Detailed explanation of core algorithm of device fingerprinting 

Device fingerprinting collects information of the device, and then gives the device a unique identification, and uses association and similarity search algorithms to ensure the stability of the identification. 

As one of the basic components of the business system, device fingerprinting is widely used in scenarios such as marking, tracking, temporary credentials, analysis, and anti-fraud, and is an important part of the security system.

Device fingerprinting collects information of the device, and then gives the device a unique identification, and uses association and similarity search algorithms to ensure the stability of the identification. 

The information data collected and reported by the device can be used to analyze the common location of a device associated account, the active time period of the device, and whether the device is risky. 

The device portrait is constructed from multiple dimensions, and the risk of the current device is presented to the user in real time. That is to say, through device fingerprinting, it is possible to learn the behavior habits, network environment, device portrait, location information, and behavior information of the account, which is helpful in identity verification, security protection, and marketing. At the same time, collecting information and data precipitation through device fingerprinting provides strong support for data analysis, risk control decision-making, and model construction.

![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)

![](https://cdn.aisecurius.com/images/1e5/1e518b41-597c-4794-bad1-c9f18708cfb7.png)

Device identification is at the core of device fingerprinting, and it only works if it can accurately identify the devices in the network. Device fingerprinting information involves features including operating system, system plug-ins, browser language settings and time zone, hardware ID, mobile phone IMEI, network card Mac address, font settings, LBS address, etc. Consider AISecurius device fingerprinting, the collected information mainly includes three parts: hardware, network, and system.

**Hardware properties:** Device brand, model, IMEI (International Mobile Equipment Identity), processor, memory, resolution, brightness, battery, gyroscope, Bluetooth MAC, wireless MAC, factory logo.

**System properties:** System, version, language, Ls location, boot time, running time, battery status, whether the device is abnormal, whether it is rooted/jailbroken, whether device information has been tampered with, and whether there are cheating tools.

**Network properties:** WiFi network, carrier network, signal strength, base station information.

![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)


![](https://cdn.aisecurius.com/images/000/0009045a-3b63-45db-8c25-1d027de896dc.png)

Based on the collected information, AISecurius device fingerprinting is capable of monitoring the running status of the device, detecting root (illegal file reading, anti-security detection), automated tools (batch registration, activity cheating), simulator (automatic account registration, automatic order), multi-account (false cheating), keep account active), change device, group control (bogus transaction, fake traffic), app repackaging (plant advertisements, crack restrictions), assisting the risk control and anti-fraud system to identify false registrations, account hacking, malicious logins, bogus transaction, promotion cheating, and keep account active in scenarios such as registration, login, marketing, transaction, top-up, and promotion, and take preventive measures.

**Identify machine attack** Machine attack/script attack is generally carried out through automated scripts or tools by initiating requests to the target website in batches and automatically. Risk identification of device fingerprinting is capable of identifying whether the request is initiated by machine or script.

The device fingerprint technology can be used to identify account registrations on the emulator, a large number of registrations on the same device within a certain period of time, and whether the registered device is high-risk.

Similarly, in the login scenario, it can effectively identify the risk of frequent login attempts and credential stuffing on the same device, and identify whether the login device is frequently switched.

In a marketing campaign, general campaign rules will limit the same device with the same account to one entry. Device fingerprinting technology can quickly identify whether multiple accounts are bound to the device, and whether the same account is logged in on multiple devices.


**Identify channel cheating:** In scenarios such as application promotion and display advertising, speculator may use technical tools to obtain promotion fee by forging traffic data. Fake machines and fake installations of real machines are identifiable through device fingerprint technology, so as to effectively track channel traffic and performance.

**Identify simulator/debugging risk:** Device fingerprinting is able to detect device terminal environment and runtime risks, such as emulator, jailbreak, debugging, injection, framework attack, etc.

![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)


![](https://cdn.aisecurius.com/images/a52/a52d8a1d-b149-4478-a8ae-a9b92f9cb847.png)

In big data analysis and machine learning scenarios, AISecurius device fingerprinting can be used as basic field to observe business indicator data from another perspective and perform correlation analysis. For example, analyze the number of active devices, the number of new devices, the models used by users, the number and amount of transactions on the same device, and the number of users accessing the same device. When building an association, in addition to using the user's mobile phone number and card number, the device ID can also be used as node to observe the relationship between users.

Based on AISecurius device fingerprinting information and business data mining, using application graph data mining, unsupervised algorithm, semi-supervised algorithm, and supervised algorithm to fully mine, combined with application scenarios and the specific needs of actual operators, it is intuitively and intelligently presented on the operation and monitoring platform the most valid information, in order to provide anti-fraud and precision marketing services for multiple industries and scenarios.

**Build an associative graph:** Based on device fingerprinting information and business data, and understanding of scenario requirements and business logic, build a cross-department and cross-product complex network covering individual, device, organization, product, and transaction.

**Association relation mining :** Based on device fingerprinting information and business data, extract static portraits of individuals and groups, analyze dynamic trends, locate potential fraud through graph data mining technology, conduct in-depth mining, feature derivation, and apply machine learning quantitative analysis to develop an anti-fraud model.

**Self-upgrading:** Based on device fingerprinting and business big data, precipitate risk data, accumulate defense strategies, build exclusive risk control models, and implement changes to device fingerprints to upgrade device fingerprint security and prevention and control.

![](https://cdn.aisecurius.com/images/bd4/bd465fea-b61b-4088-88ad-1cf432defd0b.png)


![](https://cdn.aisecurius.com/images/9fb/9fb3a890-2486-424d-b67c-be3a2f9964b9.png)

AISecurius device fingerprinting supports Android, iOS, H5, which is capable of detecting simulator, system reinstallation, root jailbreaking, and injection attack, with fast response, efficient risk identification, more than 99% stability and 100% uniqueness.

![](https://cdn.aisecurius.com/images/d1f/d1f99973-c8ac-4045-9b26-a95886fa6dd0.png)

**Three unique features of AISecurius device fingerprinting:**

**First:** fast responsiveness. The defensive system must react to the illegal and semi-illegal behaviors is hidden behind the Internet business, which requires device fingerprinting technology to quickly perceive risks and quickly upgrade prevention and control in the face of new attack methods. It has to be able to capitalize on the offensive and defensive experience and risk data precipitation of industries, through the cloud + terminal method, to carry out rapid protection upgrade, and solve the business risks within one attack and guard cycle.

**Second:** efficient risk identification capability. Device fingerprinting requires security detection capabilities for the basic environment and runtime of the device, and capable of accurately identifying different risks, such as emulator, root, jailbreak, debugging, code injection, multi-account, and VPN proxy. For example, iOS platform hook, jailbreak behavior, Android root, debug, memory dump, injection, multi-account, simulator, vulnerability attack, browser color depth, resolution on the web, the compatibility and consistency of the browser with the system and UA, whether cookies are disabled, etc.

**Third:** 99% or higher stability and 100% uniqueness. The SDK code of the device fingerprint itself needs to be protected to prevent the collection logic from being cracked and data being forged, and guarantee authenticity and accuracy of source data. Regardless of tampering with device parameters (including IMEI, MAC address, AndroidId, SIM card information, model, and brand), or disabling or clearing cache and cookies, the device fingerprinting must remain unchanged with at least 99% of stability. The fingerprints of any two devices cannot be the same. The device fingerprint ID generated for each device needs to be 100% unique and cannot be tampered with.


AISecurius device fingerprinting: Provide support for risk control decision-making and model construction

Enhance business risk control security with our atbCAPTCHA and app security solutions.  Protect against attacks and safeguard user data. No coding required. Get a free trial now!

Why AISecurius?

Compliance

Intelligent

Professional

Products

Use Cases

E-commerce

Financial

Airline

Logistics

Games

Live Stream

Contact Us