"""Curated seed for the two content-bank games (钓鱼邮件鉴别 / 安全找茬). Content is data (Chinese). Seeded by migration 414; AI generation + admin CRUD extend it. Phishing samples use obviously-fake domains/urls so they can never be mistaken for a real lure; scenes are described element lists. """ from __future__ import annotations # ── 钓鱼邮件样本 ────────────────────────────────────────────────────── # sender_name / sender_email / subject / body / is_phishing / flags / explanation PHISHING_SEED: list[dict] = [ { "sender_name": "IT 支持", "sender_email": "it-support@pingcap-secure-verify.com", "subject": "【紧急】您的邮箱将在 24 小时内停用，请立即验证", "body": "尊敬的用户：\n检测到您的账号存在异常，若不在 24 小时内验证，邮箱将被永久停用。\n请点击链接立即验证：http://pingcap-secure-verify.com/login\n信息安全部", "is_phishing": True, "flags": ["发件域名不是公司官方域名", "制造紧迫感逼你立刻行动", "链接指向可疑站点要求登录"], "explanation": "典型钓鱼:伪造 IT 部门 + 陌生域名 + 紧迫话术 + 诱导点链接登录。应通过官方入口核实,切勿点击。", }, { "sender_name": "财务部 王芳", "sender_email": "wangfang@pingcap.com", "subject": "9 月报销单已通过审批", "body": "各位好:\n9 月的报销已完成审批,款项将于本周五到账,明细见 OA 系统。如有疑问请回复本邮件。\n财务部 王芳", "is_phishing": False, "flags": ["发件域名为公司官方域名", "内容与日常工作一致", "未索要密码或诱导点陌生链接"], "explanation": "正常内部邮件:官方域名、常规业务、无凭据索取,可放心处理。", }, { "sender_name": "HR Team", "sender_email": "hr@pingcap-hr-portal.net", "subject": "薪资调整通知 - 请查收附件并填写", "body": "Dear Employee,\n您的薪资将上调,请下载附件 salary_2026.exe 并运行以确认新的薪资方案。\nHR Team", "is_phishing": True, "flags": ["域名不是公司官方域名", "要求运行 .exe 可执行附件", "以涨薪利诱降低警惕"], "explanation": "钓鱼:陌生域名 + 诱导运行可执行附件(几乎必为恶意程序)+ 涨薪诱饵。任何要求运行 exe 的邮件都要高度警惕。", }, { "sender_name": "Zoom", "sender_email": "no-reply@zoom-meeting-invite.info", "subject": "You have a missed meeting recording", "body": "You missed a meeting. Sign in within 12 hours to retrieve the recording, or it will be deleted:\nhttp://zoom-meeting-invite.info/signin", "is_phishing": True, "flags": ["仿冒品牌但域名可疑", "限时删除制造紧迫", "诱导在陌生站点登录"], "explanation": "钓鱼:仿冒 Zoom,真实 Zoom 不会用这种域名;限时话术 + 诱导登录是典型套路。", }, { "sender_name": "行政部", "sender_email": "admin@pingcap.com", "subject": "本周五团建报名", "body": "同事们好:\n本周五下午团建,请在 OA 的活动页面报名并选择餐食偏好,截止周四中午。\n行政部", "is_phishing": False, "flags": ["官方域名", "常规通知", "走内部系统报名,无外链登录"], "explanation": "正常通知:官方域名、内部系统操作、无凭据索取。", }, { "sender_name": "Microsoft 账户团队", "sender_email": "security@micros0ft-account.com", "subject": "检测到异常登录,请立即确认", "body": "我们检测到您的账户在异地登录。如非本人操作,请点击下方链接冻结账户并修改密码:\nhttp://micros0ft-account.com/verify", "is_phishing": True, "flags": ["域名把 microsoft 拼成 micros0ft(0 代 o)", "制造安全恐慌", "诱导点链接改密码"], "explanation": "钓鱼:仿冒域名用数字 0 冒充字母 o 是经典手法;恐吓 + 诱导改密码。请从官方 App/网站自行检查。", }, { "sender_name": "同事 李强", "sender_email": "liqiang@pingcap.com", "subject": "帮我个忙,方便吗", "body": "在吗?我现在开会不方便打电话,帮我买 5 张 500 元的购物卡,把卡号密码拍给我,回头报销给你,急!", "is_phishing": True, "flags": ["虽是内部域名但话术异常", "索要购物卡卡号密码", "以'急'和'开会不便打电话'阻止你核实"], "explanation": "商务邮件诈骗(BEC):账号可能被盗或被仿冒,索要礼品卡/转账是典型特征。务必通过电话等其他渠道当面核实。", }, { "sender_name": "系统通知", "sender_email": "noreply@pingcap.com", "subject": "您有一条新的审批待处理", "body": "您好:\n您有一条报销审批待处理,请登录 Helix 或飞书查看。此邮件由系统自动发送,请勿回复。", "is_phishing": False, "flags": ["官方域名", "引导到官方系统而非外链", "无凭据索取"], "explanation": "正常系统通知:官方域名、引导到官方系统、不索取任何凭据。", }, ] def _el(key, label, hazard, reason): return {"key": key, "label": label, "hazard": hazard, "reason": reason} # ── 安全找茬场景 ────────────────────────────────────────────────────── # Each scene: title + elements (label + hazard? + reason). Player selects # all hazards; scored by precision/recall server-side. SPOT_SEED: list[dict] = [ { "title": "离开工位前的办公桌", "elements": [ _el("a", "显示器上贴着写有密码的便利贴", True, "密码写在便利贴上并公开张贴,任何人路过都能看到。"), _el("b", "电脑已锁屏", False, "离开工位锁屏是正确做法。"), _el("c", "一个陌生的 U 盘插在主机上", True, "来历不明的 U 盘可能携带恶意程序,不应随意插入。"), _el("d", "桌上放着一杯水", False, "一杯水与信息安全无关(注意别洒到键盘即可)。"), _el("e", "包含客户名单的纸质文件摊开在桌上", True, "敏感文件离开时应收进带锁抽屉,避免泄露。"), _el("f", "工牌挂在椅背上", False, "工牌放在椅背风险较低(但随身更佳)。"), ], }, { "title": "公司前台与门禁", "elements": [ _el("a", "一名陌生人紧跟员工尾随进入刷卡门", True, "尾随(tailgating)是常见物理入侵手段,应请其正规登记。"), _el("b", "访客在前台登记并佩戴访客牌", False, "访客正规登记佩牌是规范做法。"), _el("c", "门禁旁贴着写有门禁密码的纸条", True, "门禁密码公开张贴等于形同虚设。"), _el("d", "前台摆放着绿植", False, "绿植与安全无关。"), _el("e", "快递员被允许自行进入办公区送件", True, "外部人员不应无陪同进入办公区。"), ], }, { "title": "居家办公的书房", "elements": [ _el("a", "连接的是没有密码的公共 Wi-Fi", True, "公共/无密码 Wi-Fi 不可信,处理公司事务应先连 VPN。"), _el("b", "已连接公司 VPN", False, "访问内部资源前连 VPN 是正确的。"), _el("c", "把公司文件转存到个人网盘方便查看", True, "公司数据外传到个人网盘存在泄露与合规风险。"), _el("d", "使用公司发放的笔记本办公", False, "使用公司设备办公是规范做法。"), _el("e", "家人可随意使用这台办公电脑", True, "办公设备不应与他人共用,防止数据泄露与误操作。"), _el("f", "桌上有一盏台灯", False, "台灯与安全无关。"), ], }, { "title": "会议室里的白板与投屏", "elements": [ _el("a", "白板上还留着上一场会议的客户报价和密码", True, "会议信息应及时擦除,尤其是敏感数据。"), _el("b", "投屏结束后已断开并锁屏笔记本", False, "用完断开并锁屏是正确的。"), _el("c", "会议室门大开,路过就能看到屏幕内容", True, "讨论敏感内容时应关门,避免旁人窥屏。"), _el("d", "桌上放着白板笔", False, "白板笔与安全无关。"), _el("e", "有人用手机拍下含敏感数据的屏幕", True, "随意拍摄敏感屏幕可能造成数据外泄。"), ], }, ] __all__ = ["PHISHING_SEED", "SPOT_SEED"]