DOCSLIB.ORG

Is Your Domain Name Safe from an 'Evil Twin?'

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Is Your Domain Name Safe from an 'Evil Twin?' Is Your Domain Name Safe from an ‘Evil Twin?’ By Charles DeBarber, Cybersecurity Advisor An organization’s domain offers adversaries avenues to attack and exploit, which besmirch the reputation of an organization irrevocably. One of the most common exploitation tactics uses “doppelgangers.” To help you protect the good name of your organization, we will discuss what doppelgangers are, the domain registration process, the use of malicious tactics, and mitigation of doppelgangers. What is a doppelganger? A doppelganger is a malicious variation of your organization’s legitimate domain name. The word ‘doppelganger’ comes from German folk tales and is the name of an evil twin.1 In this example, let us assume there is a fictional organization called Amerilegion with an amerilegion.org for both their webpage and mail domain. Legitimate Domain • amerilegion.org Possible Doppelgangers • ameri1egion.org • amerilegion.com • am3rilegion.org • amerilegian.org • amerilegion.or The adversary will create domains that look close to the original or take advantage of ‘typosquatting’ by registering common misspelling and typo variations of the domain. What is not a doppelganger? Closely named domains, or even domain names parodying another organization, are not doppelgangers in themselves. Only domains intended for malicious use are doppelgangers. Examples of domain use that are not doppelgangers: • Domains that are closely named or squatting on trademarks/brand names 1 https://en.wikipedia.org/wiki/Doppelgänger 1 • Domains that exist to parody or be critical of an organization. People can register a domain close to Amerilegion’s or using their brand name to mock or criticize the organization. They can even use it to drive traffic to a rival organization. Who handles and adjudicates domain rights? Domain rights are managed, assigned, and sometimes revoked by one of the five regional internet address registries (RIR). These consist of ARIN (American Registry for Internet Numbers) for North America, LACNIC (Latin America and Caribbean Network Information Centre) for South American. RIPE NCC (Réseaux IP Européens) for Europe, APNIC (Asia Pacific Network Information Centre) for Asia/Australia/Oceania, and AFRINIC (African Network Information Centre) for Africa. In North America, ARIN manages the Internet Corporation for Assigned Names and Numbers (ICANN), which manages domain names. To learn more about ICANN and lookup domains, consult ICANN’s WHOIS database. What do adversaries use doppelganger domains for? Doppelganger domains have multiple malicious uses. These are primarily for phishing, drive-by malware, or stealing logins/passwords. Demonstrated is a fictional example of each. Example - Phishing In this example, the adversary uses a doppelganger domain (ameri1egion.org) posing as Amerilegion’s CFO Mr. Scott McDonald to get the target, Ms. Molly Walker, to wire funds to an offshore account owned by the adversary. 2 By doing information reconnaissance, the adversary obtained a copy/paste of Mr. McDonald’s signature block with Amerilegion’s company logo to make it look even more realistic. Sophisticated phishing attempts often use a company letterhead to ‘hoodwink’ the target. Example – Drive-By Malware Step One: A user intends to go to the website amerilegion.org, but accidentally misspells the domain and instead goes to amerilegian.org. Step Two: The browser goes for milliseconds to doppelganger amerilegian.org and malware is injected using cross-site scripting (XSS) or another exploitation mechanism. It then immediately forwards to the legitimate site amerilegion.org. This action makes the target of the malware installation less likely to notice anything malicious happened. Example – Stealing Logins/Passwords Amerilegion has a webmail portal for employees at subdomain webmail.amerilegion.org. The adversary, in this case, set up a doppelganger domain with a webmail subdomain named webmail.amerilegion.com, counting on some employees of Amerilegion typing the wrong domain extension (e.g., ‘.com’ instead of ‘.org’). In this case, the adversary cloned the Amerilegion webmail page and is quietly collecting logins/passwords employees put on the cloned Amerilegian page. These are then harvested for a possible attack later when the adversary will use the logins and passwords on the company’s 3 accounting portal or the company’s Sharepoint accounts. The adversary will use some variation of these three strategies.2 How do I detect doppelgangers? Sadly, you will often detect doppelgangers when they reach out to you or another organization. There are so many variations of most domains (aka ‘enumerations’) that it is challenging to detect them all; however, there are some early warning signs and methods of detection: 1. There are free Linux tools, such as DNSTwist and URLCrazy, that will look at hundreds of enumerations of a domain and report which ones are registered. These can potentially identify malicious doppelgangers. 2. Commercial off the shelf (COTS) solutions include PhishEye, BitBucket, and SourceGraph. These services will alert you to new domain registrations containing your brand name and variations of it. Recommendations if alerted to a possible doppelganger: • Assess the site using a free sandbox tool, such as urlscan.io, and see if they set up a cloned version of your page. Also, this action allows you to see if it is a legitimate organization with a close name. • Instruct the email team to put in a rule to drop any emails from that domain and submit them to a separate phishing email inbox. These emails suggest malicious intent and must be combated. • Blacklist all web traffic to suspected doppelganger domains. I found a malicious doppelganger on my site. How do I get rid of it? It is essential to know your options for handling the doppelganger. The Uniform Domain-Name Dispute-Resolution Policy (UDRP) is a process established by the ICANN for the resolution of disputes regarding the registration of internet domain names.3 The UDRP process can seize the domain if all three of the following rules are met. 1. The domain name is identical or confusingly like a trademark or service mark in which the complainant has rights.4 2. The registrant does not have any rights or legitimate interests in the domain name.5 2 Anecdotally, I can attest to seeing these strategies more commonly used against vendors of an organization versus the organization itself. 3 Domain Name Dispute Resolution Policies https://www.icann.org/resources/pages/dndr-2012-02-25-en 4 Harvard Cyber Law UDRP https://cyber.harvard.edu/udrp/opinion/ttext.html 5 Harvard Cyber Law https://cyber.harvard.edu/udrp/opinion/itext.html 4 3. The domain name has been registered, and the domain name is being used in ‘bad faith.’6 Evidence must be provided to prove ‘bad faith’ such as screenshots of cloned pages or malicious emails. This process can be expensive because to hire a UDRP provider to handle a complaint can be $1,500+, not counting further civil litigation if the UDRP denies the request. Sometimes focusing on hardening your network and working with your vendors/customers is a more economical tactic. Prevention is better than the cure As a general cybersecurity strategy: prevention is preferable to the incident itself. So, how can you harden yourself against doppelgangers? 1. Determine and register the most common variations of your domain. • In our example, we can register the 10 most common misspellings of Amerilegion, all of the top-level domain variations of it (e.g., .net, .com, .edu), replace the letters e, o, and l with the numerals 3, 0, and 1, and register those variations. Set every one of those domains to forward the user onto the legitimate website. • Register some of your most common subdomains. Let us use Amerilegion’s webmail subdomain webmail.amerilegion.org as an example. An adversary might register webmailamerilegion.org without the ‘.’ counting on users to forget it occasionally. This tactic can forward them on to drive-by malware or a cloned page to harvest logins/passwords. It is recommended, at the very least, that administrators blacklist these variations on their network to prevent their users from accessing them. 2. Detection is always helpful. Set up monitoring of your trademark with a platform for monitoring domain registrations. However, these have varying costs. 3. Harden your network against variations. • Blacklist variations of your domain on your firewall • Quarantine emails from domains with a rule on your mail server to drop the email and BCC a copy to an account for collecting phishing emails • Have all emails from domains outside of your organization tagged with EXTERNAL in the subject. This step can impede the adversary’s ability to ‘blend in.’ • Discuss phishing in your cybersecurity and information assurance training with employees o Show a few examples of doppelgangers and insist they not trust such domains o Ensure they know who to report suspect emails and phone calls to 6 Harvard Cyber Law https://cyber.harvard.edu/udrp/opinion/btext.html 5 4. Organizations with Security Information & Event Management (SIEM) platforms can set alerts for GET requests on ports 80/443 to suspected doppelganger URLs. Keep a list of suspected doppelgangers/domain squats for managing infrastructures. 5. Some adversaries are patient and will purchase the doppelganger domain and wait. If you detect these suspected doppelgangers, use a free third-party tool that alerts you to a webpage changing. People often use these for shopping sites. This tool alerts you if the page changes, indicating they have the item in stock. The alert prompts you to look within the sandbox tool to see if they set up a clone page and that a campaign against you has begun. You can then work with your organization on your UDRP options and alert your vendors/customers to the issue if that is determined necessary. Conclusion Having a domain and web portal gives organizations legitimacy and grants them control of how they interact with their customers, vendors, colleagues, and the public.
Load more

Recommended publications
  • Passive Monitoring of DNS Anomalies Bojan Zdrnja1, Nevil Brownlee1, and Duane Wessels2
    Passive Monitoring of DNS Anomalies Bojan Zdrnja1, Nevil Brownlee1, and Duane Wessels2 1 University of Auckland, New Zealand, b.zdrnja,nevil @auckland.ac.nz { } 2 The Measurement Factory, Inc., [email protected] Abstract. We collected DNS responses at the University of Auckland Internet gateway in an SQL database, and analyzed them to detect un- usual behaviour. Our DNS response data have included typo squatter domains, fast flux domains and domains being (ab)used by spammers. We observe that current attempts to reduce spam have greatly increased the number of A records being resolved. We also observe that the data locality of DNS requests diminishes because of domains advertised in spam. 1 Introduction The Domain Name System (DNS) service is critical for the normal functioning of almost all Internet services. Although the Internet Protocol (IP) does not need DNS for operation, users need to distinguish machines by their names so the DNS protocol is needed to resolve names to IP addresses (and vice versa). The main requirements on the DNS are scalability and availability. The DNS name space is divided into multiple zones, which are a “variable depth tree” [1]. This way, a particular DNS server is authoritative only for its (own) zone, and each organization is given a specific zone in the DNS hierarchy. A complete domain name for a node is called a Fully Qualified Domain Name (FQDN). An FQDN defines a complete path for a domain name starting on the leaf (the host name) all the way to the root of the tree. Each node in the tree has its label that defines the zone.
    [Show full text]
  • Monthly Cybersecurity Newsletter April 2018 Issue
    Monthly Cybersecurity Newsletter April 2018 Issue Enterprise Security and Risk Management Office (ESRMO) From the Desk of the State Chief Risk Officer – Maria Thompson Be Careful What You Type You should be careful when typing a web address into your browser. It is very easy to enter a similar but incorrect domain name and end up somewhere you do not want to be. Unscrupulous individuals use domain names similar to more popular ones on the Internet in order to entice individuals who mistakenly type the wrong web address. This practice of using similar domain names and relying on individuals to type the wrong address is called typosquatting. A typosquatter’s URL will usually be one of several kinds: a common misspelling of the known name (e.g. exemple.com), a differently phrased name (e.g. examples.com), a different top-level domain name (e.g. example.org), or an abuse of a country code (example.cm). In fact, a report published in December 2009 by McAfee found that .cm was the riskiest domain in the world, with 36.7% of the sites posing a security risk to users. Once on a typosquatter’s site, the user may be tricked into thinking he or she is on the intended site, through the use of similar logos, website layouts or content. Visiting such a site, however, may result in malicious software (malware) to be downloaded and installed on the end user’s machine, or it may entice the end user to disclose private information. Most typosquatters are probably just aiming to make money by taking advantage of your errors.
    [Show full text]
  • D-FENS: DNS Filtering & Extraction Network System for Malicious Domain Names
    University of Central Florida STARS Electronic Theses and Dissertations, 2004-2019 2018 D-FENS: DNS Filtering & Extraction Network System for Malicious Domain Names Jeffrey Spaulding University of Central Florida Part of the Computer Sciences Commons Find similar works at: https://stars.library.ucf.edu/etd University of Central Florida Libraries http://library.ucf.edu This Doctoral Dissertation (Open Access) is brought to you for free and open access by STARS. It has been accepted for inclusion in Electronic Theses and Dissertations, 2004-2019 by an authorized administrator of STARS. For more information, please contact [email protected]. STARS Citation Spaulding, Jeffrey, "D-FENS: DNS Filtering & Extraction Network System for Malicious Domain Names" (2018). Electronic Theses and Dissertations, 2004-2019. 6378. https://stars.library.ucf.edu/etd/6378 D-FENS: DNS FILTERING & EXTRACTION NETWORK SYSTEM FOR MALICIOUS DOMAIN NAMES by JEFFREY SPAULDING B.S. Clarkson University, 2003 M.S. SUNY Polytechnic Institute, 2013 A dissertation submitted in partial fulfilment of the requirements for the degree of Doctor of Philosophy in the Department of Computer Science in the College of Engineering and Computer Science at the University of Central Florida Orlando, Florida Summer Term 2018 Major Professor: Aziz Mohaisen c 2018 Jeffrey Spaulding ii ABSTRACT While the DNS (Domain Name System) has become a cornerstone for the operation of the Internet, it has also fostered creative cases of maliciousness, including phishing, typosquatting, and botnet communication among others. To address this problem, this dissertation focuses on identifying and mitigating such malicious domain names through prior knowledge and machine learning. In the first part of this dissertation, we explore a method of registering domain names with deliberate typographical mistakes (i.e., typosquatting) to masquerade as popular and well-established domain names.
    [Show full text]
  • Brief of Internet Commerce Association
    No. 19-46 IN THE Supreme Court of the United States U.S. PATENT AND TRADEMARK OFFICE, ET AL., Petitioners, v. BOOKING.COM B.V., Respondent. ON WRIT OF CERTIORARI TO THE UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT BRIEF OF THE INTERNET COMMERCE ASSOCIATION AS AMICUS CURIAE IN SUPPORT OF RESPONDENT Megan L. Brown Counsel of Record David E. Weslow Ari S. Meltzer Jeremy J. Broggi WILEY REIN LLP 1776 K Street NW Washington, DC 20006 (202) 719-7000 [email protected] February 19, 2020 Counsel for Amicus Curiae - i - TABLE OF CONTENTS Page TABLE OF CITED AUTHORITIES .......................... ii INTEREST OF AMICUS CURIAE ............................1 SUMMARY OF ARGUMENT .....................................3 ARGUMENT ...............................................................7 I. The Government Seeks A Bright-Line Rule That Would Devalue Registered Domain Names As A Class Of Intellectual Property Assets. ...............................................................7 II. The Government’s Rule Would Discourage Investment In The Internet Economy By Precluding Trademark Protection For New Types of Domain Names. ............................... 13 III. The Government’s Rule Would Eliminate A Critical Consumer Protection And Anti-Fraud Tool, Opening The Door To More Domain Name Abuse. ................................................... 15 A. Cybercriminals Abuse Domain Names Through Typosquatting And Domain Name Hijacking To Perpetrate Fraud And Proliferate Malware. .................... 16 B. Companies Rely On Trademark Protection To Combat Domain Name Abuse. ................................................... 20 C. Non-Trademark Remedies Do Not Provide A Sufficient Means For Combatting Domain Name Abuse. ..... 26 CONCLUSION .......................................................... 28 - ii - TABLE OF CITED AUTHORITIES Page(s) Cases Central Source LLC v. annaulcreditreports.com, No. 20-CV-84 (E.D. Va.) ....................................... 23 Central Source LLC v. aabbualcreditreport.com, No. 14-CV-918 (E.D.
    [Show full text]
  • Fast-Flux Networks While Considering Domain-Name Parking
    Proceedings Learning from Authoritative Security Experiment Results LASER 2017 Arlington, VA, USA October 18-19, 2017 Proceedings of LASER 2017 Learning from Authoritative Security Experiment Results Arlington, VA, USA October 18–19, 2017 ©2017 by The USENIX Association All Rights Reserved This volume is published as a collective work. Rights to individual papers remain with the author or the author’s employer. Permission is granted for the noncommercial reproduction of the complete work for educational or research purposes. Permission is granted to print, primarily for one person’s exclusive use, a single copy of these Proceedings. USENIX acknowledges all trademarks herein. ISBN 978-1-931971-41-6 Table of Contents Program . .. v Organizing Committee . vi Program Committee . vi Workshop Sponsors . vii Message from the General Chair . viii Program Understanding Malware’s Network Behaviors using Fantasm . 1 Xiyue Deng, Hao Shi, and Jelena Mirkovic, USC/Information Sciences Institute Open-source Measurement of Fast-flux Networks While Considering Domain-name Parking . 13 Leigh B. Metcalf, Dan Ruef, and Jonathan M. Spring, Carnegie Mellon University Lessons Learned from Evaluating Eight Password Nudges in the Wild . 25 Karen Renaud and Joseph Maguire, University of Glasgow; Verena Zimmerman, TU Darmstadt; Steve Draper, University of Glasgow An Empirical Investigation of Security Fatigue: The Case of Password Choice after Solving a CAPTCHA . 39 Kovila P.L. Coopamootoo and Thomas Gross, Newcastle University; Muhammad F. R. Pratama Dead on Arrival: Recovering from Fatal Flaws in Email Encryption Tools . 49 Juan Ramón Ponce Mauriés, University College London; Kat Krol, University of Cambridge; Simon Parkin, Ruba Abu-Salma, and M.
    [Show full text]
  • PREDATOR: Proactive Recognition and Elimination of Domain Abuse at Time-Of-Registration
    PREDATOR: Proactive Recognition and Elimination of Domain Abuse at Time-Of-Registration Shuang Hao∗ Alex Kantcheliany Brad Millerx Vern Paxson† Nick Feamsterz ∗ y University of California, Santa Barbara University of California, Berkeley x z Google, Inc. International Computer Science Institute Princeton University [email protected] {akant,vern}@cs.berkeley.edu [email protected] [email protected] ABSTRACT content [18, 53]. To mitigate these threats, operators routinely build Miscreants register thousands of new domains every day to launch reputation systems for domain names to indicate whether they are Internet-scale attacks, such as spam, phishing, and drive-by down- associated with malicious activity. A common mode for developing loads. Quickly and accurately determining a domain’s reputation reputation for DNS domain names is to develop a blacklist that curates (association with malicious activity) provides a powerful tool for mit- “bad domains”. A network operator who wishes to defend against an igating threats and protecting users. Yet, existing domain reputation attack may use a domain blacklist to help determine whether certain systems work by observing domain use (e.g., lookup patterns, content traffic or infrastructure is associated with malicious activity. hosted)—often too late to prevent miscreants from reaping benefits of Unfortunately, curating a DNS blacklist is difficult because of the attacks that they launch. the high rate of domain registrations and the variety of attacks. For As a complement to these systems, we explore the extent to which example, every day around 80,000 new domains are registered in features evident at domain registration indicate a domain’s subsequent the .com zone, with a peak rate of over 1,800 registrations in a sin- use for malicious activity.
    [Show full text]
  • The Brave New World of Policing Trademarks by Patrick M
    The Brave New World of Policing Trademarks By Patrick M. Fahey and Susan S. Murphy t’s a brave new world for trademark when the entity tasked with coordination ber of registrars and individuals register owners. By some accounts, “virtu- of the Internet domain name system, the millions of domain names on a daily basis Ially every typographical error and Internet Corporation for Assigned Names that often include brands and typographi- misspelling of a word is monetized by and Numbers (ICANN), implemented the cal errors of brands en masse and free of someone, whether a domain name regis- “Add Grace Period” (AGP), a five-day charge by exploiting the five-day AGP.”8 trar, a domain investor, [or] an ISP. .”1 grace period during which Whether viewed as legitimate or nefar- Trademark owners spend millions of dol- ious, the instances of domain tasting have lars in promoting their marks and taking all the new owner [of a domain name] increased exponentially over the course of reasonable steps to protect that investment. can make full use of the chosen the past three years.9 Several factors are On any given day, however, hundreds or domain name, and no one else can responsible for this. First, the ease with even thousands of permutations of those use that domain name as the address which available domain names can be marks are popping up in domain names on for a website. However, during the identified and registered using automated the Internet, leading customers to websites AGP, the new owner can drop the processes, sometimes referred to as “drop- populated with links to the legitimate mark domain name for any reason, with- catching,” allows for the bulk registration holder’s competitors.
    [Show full text]
  • Large-Scale Analysis of Pop-Up Scam on Typosquatting Urls
    Large-Scale Analysis of Pop-Up Scam on Typosquatting URLs Tobias Dam Lukas Daniel Klausner Institute of IT Security Research Institute of IT Security Research St. Pölten University of Applied Sciences St. Pölten University of Applied Sciences Austria Austria [email protected] [email protected] Damjan Buhov Sebastian Schrittwieser Josef Ressel Center TARGET Josef Ressel Center TARGET St. Pölten University of Applied Sciences St. Pölten University of Applied Sciences Austria Austria [email protected] [email protected] ABSTRACT 1 INTRODUCTION Today, many different types of scams can be found onthe Pop-up ads have been an annoying phenomenon on the inter- internet. Online criminals are always finding new creative net since the 1990s. This type of web advertisement puts the ways to trick internet users, be it in the form of lottery scams, ad banner into a separate browser window instead of directly downloading scam apps for smartphones or fake gambling integrating it with the website [20]. The great popularity of websites. This paper presents a large-scale study on one pop-up ads among advertisement companies contrasted with particular delivery method of online scam: pop-up scam on the dissatisfaction of users because of the ads’ highly intrus- typosquatting domains. Typosquatting describes the concept ive nature. This eventually caused all major browser vendors of registering domains which are very similar to existing ones to implement pop-up blockers in their software in the early while deliberately containing common typing errors; these 2000s [7]. Today, websites rarely make use of pop-ups and domains are then used to trick online users while under the pop-up ads have disappeared almost completely from the belief of browsing the intended website.
    [Show full text]
  • DOMAIN NAME SPECULATION: ARE WE PLAYING WHAC-A-MOLE? Sara D
    DOMAIN NAME SPECULATION: ARE WE PLAYING WHAC-A-MOLE? Sara D. Sunderland Since the inception of the Internet, speculators have sought to monetize web pages, often by selling space to advertisers. Monetized domain parking has emerged as a multi-million-dollar business over the last several years,' evolving from simple cybersquatting to a sophisticated and mostly automated method of delivering pay-per-click advertising on thousands of domains. Similar to the game of Whac-A-Mole,2 whenever the state introduces new legal tools to curb domain speculation abuse, domain name speculators alter their business models to survive. Although federal trademark law has a part to play in the battle against domain name speculation, some academics are concerned about expanding the law for this purpose.3 Additionally, the legal tools currently used most frequently to battle domain name speculation, the Uniform Domain-Name Dispute-Resolution Policy (UDRP) 4 and the Anticybersquatting Consumer Protection Act (ACPA), have been in use for ten years, yet the problem persists.' This Note examines the evolution of the domain name speculation business model and the tools used to fight it, outlines the scope of the problem and the barriers to solutions, and concludes that due to the difficulties of policing domain name speculation using trademark law, a combination of policy changes, technological solutions, and social C 2010 Sara D. Sunderland. 1. David Kesmodel, Thanks to Web Ads, Some Find New Money in Domain Names, WALL ST. J. ONLINE, November 17, 2005, http://online.wsj.com/public/article/SB113 200310765396752-FYV6dsilRSON1fsiVubLf_5nl8_20061116.html?mod=rss-free. 2.
    [Show full text]
  • The Truth in Domain Names Act of 2003 and a Preventative Measure to Combat Typosquatting, 89 Cornell L
    Cornell Law Review Volume 89 Article 3 Issue 6 September 2004 The rT uth in Domain Names Act of 2003 and a Preventative Measure to Combat Typosquatting Christopher G. Clark Follow this and additional works at: http://scholarship.law.cornell.edu/clr Part of the Law Commons Recommended Citation Christopher G. Clark, The Truth in Domain Names Act of 2003 and a Preventative Measure to Combat Typosquatting, 89 Cornell L. Rev. 1476 (2004) Available at: http://scholarship.law.cornell.edu/clr/vol89/iss6/3 This Note is brought to you for free and open access by the Journals at Scholarship@Cornell Law: A Digital Repository. It has been accepted for inclusion in Cornell Law Review by an authorized administrator of Scholarship@Cornell Law: A Digital Repository. For more information, please contact [email protected]. NOTE THE TRUTH IN DOMAIN NAMES ACT OF 2003 AND A PREVENTATIVE MEASURE TO COMBAT TYPOSQUATTING Christopher G. Clarkt INTRODUCTION ................................................. 1477 I. CYBERSQUATTING AND TYPOSQUATTING ON THE INFORMATION SUPERHIGHWAY ............................ 1482 A. The Structure of the Internet: A Brief Overview .... 1482 B. Reserving Your Space in Cyberspace: The Domain Name Registration Process .......................... 1485 C. Typosquatting and Cybersquatting: Profit by D eception .......................................... 1487 D. The Case of the Notorious Typosquatter ............ 1491 II. LIVING IN A TYPOSQUATrER'S PARADISE: LIMITED DETERRENCE THROUGH FRAGMENTED LITIGATION AND INEFFECTIVE ARBITRATION ............................... 1492 A. The Mid-to-Late 1990s: The Federal Trademark D ilution Act ........................................ 1493 B. 1999-2003: The Anticybersquatting Consumer Protection Act ...................................... 1496 C. ICANN and Arbitration Under the Uniform Domain Name Resolution Policy .................... 1501 D. The Return of the Notorious Typosquatter ........
    [Show full text]
  • Measuring the Perpetrators and Funders of Typosquatting
    Measuring Typosquatting How Typosquatting Domains are Used Countering Typosquatting Measuring the Perpetrators and Funders of Typosquatting Tyler Moore and Benjamin Edelman Center for Research on Computation and Society, Harvard University Harvard Business School Financial Crypto, Tenerife, January 27, 2010 http://www.benedelman.org/typosquatting/ university-logo Tyler Moore: http://www.benedelman.org/typosquatting/ Measuring the Perpetrators and Funders of Typosquatting Measuring Typosquatting How Typosquatting Domains are Used Countering Typosquatting Outline 1 Measuring Typosquatting Motivation and Industry Structure Identifying Typosquatting Domains Crawling Typosquatting Websites 2 How Typosquatting Domains are Used Squatter Strategy 1: Pay-Per-Click Ads Squatter Strategy 2: Redirection and Linked Domains Do Pay-Per-Click Ads Promote Typosquatting? 3 Countering Typosquatting Existing Efforts to Regulate Typosquatting Identifying Servers that Distinctively Host Typo Domains The Role and Responsibility of Ad Platforms university-logo Tyler Moore: http://www.benedelman.org/typosquatting/ Measuring the Perpetrators and Funders of Typosquatting Measuring Typosquatting Motivation and Industry Structure How Typosquatting Domains are Used Identifying Typosquatting Domains Countering Typosquatting Crawling Typosquatting Websites Outline 1 Measuring Typosquatting Motivation and Industry Structure Identifying Typosquatting Domains Crawling Typosquatting Websites 2 How Typosquatting Domains are Used Squatter Strategy 1: Pay-Per-Click Ads Squatter
    [Show full text]
  • Email Typosquatting
    Email Typosquatting Janos Szurdi Nicolas Christin Carnegie Mellon University Carnegie Mellon University [email protected] [email protected] ABSTRACT 1 INTRODUCTION While website domain typosquatting is highly annoying for le- Domain typosquatting is the act of registering a domain name very gitimate domain operators, research has found that it relatively similar to an existing, legitimate, domain, in an effort to capture rarely presents a great risk to individual users. However, any appli- some of the traffic destined for the original domain. Domain ty- cation (e.g., email, ftp,...) relying on the domain name system for posquatting exploits the propensity of users to make typographical name resolution is equally vulnerable to domain typosquatting, and errors when typing domain names—as opposed to clicking on links— consequences may be more dire than with website typosquatting. and is frequently used for financial profit. For instance, somebody This paper presents the first in-depth measurement study of registering googe.com would immediately receive large amounts email typosquatting. Working in concert with our IRB, we regis- of traffic meant for google.com. That traffic could then in turn tered 76 typosquatting domain names to study a wide variety of user be monetized, by showing ads or setting up drive-by-downloads. mistakes, while minimizing the amount of personal information ex- Domain typosquatting has been shown to be profitable [18, 24], posed to us. In the span of over seven months, we received millions while requiring no technical skill. of emails at our registered domains. While most of these emails In some jurisdictions, domain typosquatting is considered illegal, are spam, we infer, from our measurements, that every year, three and may trigger trademark infringement cases.1 In 1999, ICANN, of our domains should receive approximately 3,585 “legitimate” the authority which regulates domain names on the Internet, cre- emails meant for somebody else.
    [Show full text]