暗影初现：走进网络安全的隐秘战场 / The First Shadow: Entering the Hidden Battlefield

第一章 暗影初现：走进网络安全的隐秘战场

Chapter 1 The First Shadow: Entering the Hidden Battlefield

凌晨三点十七分，林夜从梦中惊醒。

3:17 AM. Lin Ye woke with a start.

手机屏幕正以病态的频率闪烁——二十三条未接来电，九十一条微信消息，四封标注为"紧急"的邮件。他眨了眨眼，以为是手机故障。直到他点开第一条短信，心脏骤然收紧。

His phone was flashing with a sickly frequency — 23 missed calls, 91 unread WeChat messages, 4 emails flagged "Urgent." He blinked, assuming the device had glitched. The moment he opened the first SMS, his heart seized.

"您的账户于02:41发生异常登录，登录地点：基辅。如非本人操作，请立即冻结。"

"Your account was accessed abnormally at 02:41. Login location: Kyiv. If this was not you, please freeze your account immediately."

他颤抖着打开银行 App。余额：0.00 元。

Trembling, he opened his banking app. Balance: ¥0.00.

这不是噩梦。这是 2024 年某个秋夜里，发生在一名普通大三学生身上的真实故事。骗子利用他在某社交平台泄露的旧密码（那是他高三时注册的邮箱，已经五年没换过密码），通过"撞库"攻击（credential stuffing，即用泄露过的用户名密码批量尝试其他平台）批量登录了三十六个网站，最终攻入他的银行账户，将他四年攒下的三万七千元——准备毕业后去西部做志愿服务的全部积蓄——洗劫一空。

This was not a nightmare. It was a real story that happened to an ordinary junior in college on an autumn night in 2024. The scammers exploited an old password he had carelessly leaked on a social platform — the email he registered in his senior year of high school, which he had not changed in five years. Using credential stuffing (an attack that batches leaked username-password pairs against other platforms), they systematically logged into 36 websites, eventually breaching his bank account and draining all ¥37,000 he had saved over four years — money earmarked for his post-graduation volunteer service in western China.

林夜后来才明白，这场灾难不是因为他犯了什么惊天大错，而是因为整个数字世界早已对他这样的人布下了陷阱。他不知道"撞库"是什么，不理解"双因素认证"为何重要，更没意识到一个 2019 年的旧密码在 2024 年依然可以成为打开他整个数字生活的钥匙。

Lin Ye would later understand that this disaster did not result from any catastrophic mistake on his part; rather, the entire digital world had already laid traps for people like him. He did not know what "credential stuffing" was, did not understand why "two-factor authentication" mattered, and certainly did not realize that a 2019 password could still serve as a master key to his entire digital life in 2024.

而这，正是本书第一章要回答的问题：在 21 世纪，为什么网络安全是每一个数字公民都必须了解的话题？

And this is precisely the question Chapter 1 aims to answer: In the 21st century, why is cybersecurity a topic every digital citizen must understand?

---

一、夜幕之下：林夜坠落的那一夜 / Under the Night: The Night Lin Ye Fell

让我们把时间往回拨一些。

Let us rewind time a little.

林夜，22 岁，某 985 高校计算机科学与技术专业大三学生。他的成绩中上，不算天才，但足够勤奋。高考填志愿时，他觉得"计算机"三个字听起来很酷——他想象自己会写出精巧的算法，会设计漂亮的产品。三年下来，他确实学会了一些 Python（一种广泛使用的编程语言，以简洁易读著称）和 Java（一种企业级应用主流语言），能做课程设计，也跟同学组队参加过小程序比赛。

Lin Ye, 22, a junior majoring in Computer Science and Technology at a top-tier Chinese university. His grades were above average — not a genius, but diligent enough. When filling out his college application, he thought the words "Computer Science" sounded cool — he imagined himself crafting elegant algorithms and designing beautiful products. Three years on, he had indeed learned some Python (a widely used programming language known for its simplicity) and Java (a mainstream language for enterprise applications), could complete coursework, and had even teamed up with classmates for a mini-program competition.

但他的知识结构里，有一个巨大的空洞：安全。

But there was a massive void in his knowledge structure: security.

他没有系统学习过网络安全课程。学校虽然开了"信息安全概论"作为选修，但他大三上学期排课太满，没选。他以为"安全"是一个遥远的概念——那是 NSA（美国国家安全局）、那是腾讯安全部门、那是电影里的黑客——跟他这样写业务代码的普通学生无关。

He had never systematically taken a cybersecurity course. Although his school offered "Introduction to Information Security" as an elective, his packed junior fall schedule prevented him from enrolling. He assumed "security" was a distant concept — something belonging to the NSA, to Tencent's security division, to hackers in movies — entirely unrelated to ordinary students like him who wrote business code.

那个秋夜之前，林夜的数字生活是典型的"便利优先"模式：

Before that autumn night, Lin Ye's digital life followed a typical "convenience-first" pattern:

• 邮箱注册于 2019 年高三毕业季，密码是 `LinYe2002@qq`，六年来从未更换；

His email was registered in the summer of 2019 after high school graduation, with the password `LinYe2002@qq`, unchanged for six years.

• 在 36 个不同网站使用同一密码或相近变体（`LinYe2002!`、`LinYe2002#`）；

He used the same password or close variations across 36 different websites (`LinYe2002!`, `LinYe2002#`).

• 所有账号都仅依赖"密码"这一单一因素，没有任何 2FA（双因素认证 / Two-Factor Authentication，即除了密码外还需要第二种验证方式，比如短信验证码或手机 App 动态口令）；

All accounts relied solely on "password" as a single factor, with no 2FA (Two-Factor Authentication, meaning a second verification method beyond the password, such as an SMS code or a dynamic token from a mobile app).

• 手机里安装了 47 个 App，从未仔细阅读过任何一份"隐私政策"。

His phone carried 47 apps, none of whose "Privacy Policies" he had ever carefully read.

这些习惯在 2019 年看起来无伤大雅。六年后的 2024 年，它们构成了完美的攻击面。

These habits seemed harmless in 2019. Six years later in 2024, they constituted a perfect attack surface.

那晚的攻击不是随机的。攻击者从一个名为"暗网聚合库 #17"的泄露数据库中（这类数据库汇集了过去十年间各大平台泄露的用户名密码对，总量常达数十亿条），精准匹配到了他的邮箱和原始密码。脚本（一种自动执行命令的程序）以毫秒级速度在 300 个常见中国网站（包括电商、网盘、社交、支付、票务等）发起撞库尝试。林夜的 QQ 邮箱命中率最高——他 2019 年注册 QQ 邮箱时填写的密码，与 2020 年某大型社交平台泄露的密码完全一致。

The attack that night was not random. The attacker, working from a leaked database known as "Darknet Aggregator #17" (such databases pool username-password pairs leaked over the past decade from major platforms, often totaling tens of billions of entries), precisely matched his email and original password. A script (a program that automatically executes commands) launched credential-stuffing attempts against 300 common Chinese websites (e-commerce, cloud storage, social, payment, ticketing) at millisecond speed. Lin Ye's QQ email scored the highest hit rate — the password he used to register his QQ email in 2019 was identical to the one leaked from a major social platform in 2020.

攻击者用他的 QQ 邮箱登录了某网盘，从中提取出他的身份证照片（他大一做家教兼职时上传过）、手机号、真实姓名。随即登录某支付平台，发现绑定了银行卡，便通过"找回密码"流程重置了支付密码。整个过程，攻击者没有与他进行任何"对话"——没有冒充客服打电话，没有发钓鱼链接，没有任何需要他配合的环节。

The attacker used his QQ email to log into a cloud storage service and extracted his ID photo (uploaded during a freshman-year tutoring gig), phone number, and real name. They then logged into a payment platform, found a linked bank card, and reset the payment password through the "Forgot Password" flow. Throughout the entire process, the attacker had no "conversation" with him — no fake customer service calls, no phishing links, no steps requiring his cooperation.

这是无声的入侵。

This was a silent intrusion.

林夜第二天醒来时看到的，是一个已经"被清空"的数字身份。银行余额为零；支付账户显示三笔"已完成的转账"，收款方是一个他不认识的开户行在乌克兰哈尔科夫的对公账户。

When Lin Ye woke the next morning, he saw a digital identity that had already been "emptied out." Bank balance: zero. Payment account displayed three "completed transfers" to a corporate account he did not recognize, opened at a bank in Kharkiv, Ukraine.

报警之后，他得到的回复是："跨境电信诈骗案件，追回概率不足 3%。"保险公司拒绝赔付，因为他的账户开通时没有购买"账户安全险"。学校辅导员让他"吸取教训"。而那些攻击者——根据后来网安部门的溯源（追踪攻击源头）——位于东南亚某地，受雇于一个松散的国际诈骗团伙，他们"周工作制"，每月按成功提成的 8% 抽成。

After reporting to police, he was told: "Cross-border telecom fraud case. Recovery probability under 3%." His insurer refused to pay because he had not purchased "account security insurance" when opening the account. His school counselor told him to "learn a lesson." The attackers — according to later cybersecurity forensics — were located in a Southeast Asian country, employed by a loose international fraud syndicate running a "weekly work system," taking 8% commissions on successful withdrawals.

林夜想不通。他到底哪里做错了？

Lin Ye could not understand. Where exactly did he go wrong?

答案残酷而简单：他什么都没做错。或者说，他"什么都没做"本身就是错。

The answer is cruel and simple: He did nothing wrong. Or rather, his "doing nothing" itself was the mistake.

在一个威胁不断演化的世界里，默认配置（default settings，即系统出厂时自带的初始安全设置）不再安全。浏览器不会主动帮你启用 2FA，操作系统不会自动帮你更换六年前泄露的密码，邮箱服务不会主动帮你检查历史密码是否已被泄露在公开数据库里。这些"保护动作"，需要你自己去完成——而大多数普通人，根本不知道这些动作的存在。

In a world where threats continuously evolve, default settings are no longer safe. Browsers will not automatically enable 2FA for