Global Civil SoCiety at RiSk // Fake Domain attaCkS 1 ONE OF THESE THINGS IS NOT LIKE THE OTHER — A R E P O R T O N F AKE D OMA I N A T T A C K S GLOBAL CIVIL SOCIETY AT RISK Report ONE OF A SERIES detaiLING SOME OF THE MAJOR DIGitaL THreats facinG CIVIL societY ORGANIZations AND HUMAN RIGHTS DEFENDERS Global Civil SoCiety at RiSk // Fake Domain attaCkS 2 OVERVIEW OF REPORTS ON GLOBAL CIVIL SOCIETY AT RISK Civil society organizations and human rights defenders have some of the most sophisticated, relentless, and well-resourced adversaries attempting to surveil and hinder their work. The threat of these adversaries to the operations of civil society groups is compounded by the low capacity of such groups to focus on and mitigate such threats. The situation is even more dire when compared to the growing corporate understanding of digital threats. In the corporate world, many companies periodically report and analyze digital threats to businesses -- McAfee, PandaLabs, Secunia, Symantec, Verizon, to name only a few. But just as the number and sophis- tication of attacks targeting corporations have increased over time, so too have the threats faced by civil society organizations to their operations. With our reports we hope to narrow this gap, and inform civil society groups of some of the digital threats that predominantly target them -- from DDoS and website defacement to fake domain attacks and account compromise. These are attacks we have seen in the operation of our digital security helpline and partner organizations have experienced in the course of their operations. By analyzing the specific threats to civil society organizations and human rights defenders, we aim to provide a higher-level understanding of the technical, socio-political, and legal ways they are perpetrated and mitigated. This report, “One of These Things is Not Like the Other: An Investigation of Fake Domain Attacks,” is the first report in the “Global Civil Society at Risk” series that will be released in the coming months. These reports expand on the general multi-issue report we released in 2012 titled, “Global Civil Society At Risk: An Overview of Some of the Major Cyber Threats Facing Civil Society.”1 In this follow-up report, we trying to delve into more detail on the specific attacks civil society actors face. We see this work as complementary to the tremendous efforts of other organizations in our space such as Citizen Lab in finding and analyzing digital attacks such as targeted malware on civil society organizations. Through this awareness building and information sharing, we aim to improve the ability of users and organi- zations to defend themselves against these digital security threats. 1 https://www.accessnow.org/page/-/docs/Access Tech/Global Civil Society at Risk.pdf Global Civil SoCiety at RiSk // Fake Domain attaCkS 3 AUTHORS AND ACKNOWLEDGEMENT This report was written and managed by Michael Carbone. Data analysis and visualization was provided by Béchir Nemlaghi and Dillon Reisman. Peter Micek, Drew Mitnick, and Wes Paisley contributed policy and legal analysis. Mira Rojanasakul designed the report. Many thanks to the following individuals and organiza- tions for their invaluable input into the fake domains chapter of the report: Gustaf Björksten, Brett Solomon, Jochai Ben-Avie, Patrick Ball (Human Rights Data Analysis Group), James Turnbull, Kayne Naughton (Asymmetric Security), Amin Sabeti, the engine room and May First/People Link. Access is an international human rights organization that defends and extends the digital rights of users at risk around the world. By combining innovative policy, user engagement, and direct technical support, we fight for open and secure communications for all. If you know of any fake domains attacks not covered in this report, please contact us at [email protected]. Global Civil SoCiety at RiSk // Fake Domain attaCkS 4 TABLE OF CONTENTS REPORTS ON GLOBAL CIVIL SOCIETY AT RISK 02 AUTHORS AND ACKNOWLEDGEMENTS 03 I. INTRODUCTION 05 II. METHODOLOGY 06 III. FAKE DOMAIN ATTACKS 07 CATEGORIES OF ATTACKS 07 1. MALWARE 07 2. ALTERNATIVE CONTENT 10 METHODS OF ATTACK 11 1. URL SIMILARITY 11 2. URL OBFUSCATION 11 3. DNS redirection BY state-owned TELECOS 11 4. TARGETING HIGH-PROFILE EVENTS 12 IV. MITIGATION STRATEGIES 12 TECHNICAL STRATEGIES 12 PROTECTING THE USER 12 PROTECTING THE WEBSITE 13 LEGAL/POLICY STRATEGIES -- TARGETING “THE STACK” 13 1. DOMAIN REGISTRIES AND REGISTRARS 14 2. NATIONAL TELECOMS AND ISPs 17 3. WEB HOSTS 18 4. SOCIAL MEDIA PROFILES 19 V. CONCLUSION 20 APPENDIX 22 DATA TABLE 22 HOW TO REMOVE FAKE PROFILES ON SOCIAL MEDIA WEBSITES 24 Global Civil SoCiety at RiSk // Fake Domain attaCkS 5 I. Introduction Civil society organizations and human rights defenders are the targets of a variety of sophisticated attacks to surveil their human and computer networks, impede their work, and dilute or confuse their message. Fake domains have emerged as a unique method employed by the adversaries of civil society organizations towards these goals. Fake domain attacks are defined as attacks in which an adversary creates a similar-looking website or social media profile to the targeted website. This may be done with the intent to draw readership from the original website and display alternative content, create confusion amongst a targeted community, or serve malware to compromise the target audience of the original website. In the past, fake domain attacks were used mainly by spammers and online criminals to trick individuals into sharing their private information (often banking credentials) through a fake look-alike or website. That website would often be promulgated through a “phishing” email purported to come from the original website.2 The attacks analyzed in this report represent an evolution of these attacks, targeting the online presences and user trust of civil society organizations and media organizations for socio-political rather than economic goals. In addition, the perpetrators of these attack are predominantly state-aligned actors, and in some cases leveraged the privileged position of state-owned Internet Service Providers to propagate the attacks. A. B. Figures (A) and (B) are screenshots of two nearly-identical news sites (images taken July 3rd, 2013). These fake domains range are often very faithful imitations of the target domain. Figures (A) and (B) are screen- shots of two nearly-identical websites from July 3rd, 2013. Only one of them is the legitimate BBC Persian news site (officially bbcpersian.com or bbc.co.uk/persian), while the other is a fake domain (persianbbc.ir) serving alternative content under the same logo, design, and layout. The fake website (B) substitutes pro-government content for the original news content on the targeted BBC website (A). The effect of such imitation can be extremely harmful to consumers of media and the supporters of civil society organizations; in the past, they have successfully drawn a significant amount of both domestic and international traffic away from victimized domains. In certain instances fake domains have even garnered better Alexa traffic rankings than their targets. 2 These types of phishing attacks have also perpetrated in political contexts -- most recently in the lead-up to the 2013 Iranian presidential election, Iranian users received such attacks in an attempt to steal their Google account credentials, likely for intelligence and surveillance purposes. See: http://googleonlinesecurity.blogspot.com/2013/06/iranian-phishing-on-rise-as-elections.html Global Civil SoCiety at RiSk // Fake Domain attaCkS 6 AGGREGate internationaL/domestic traffic score (100/LN(ALEXA rank)) of tarGet domain VS. fake domain As news organizations and citizen media increasingly rely on digital means to present their work, state- level adversaries are relying on novel ways of diminishing their impact and targeting their readers. Our data provides a window into the methods and effectiveness of these attacks and the type of government environ- ment that gives rise to them. II. Methodology For each fake domain incident shared with us or encountered during the course of our digital security helpline work, we have sought to distill the most important data points to aid in comparison and analysis. Some of the different aspects we looked at are the domain name and registrar, web host, and attack type for the targeted and fake domains. In addition to similar domain incidents shared with us or encountered during the course of our digital security helpline work, we also endeavored to find additional fake domains we were not aware of. Two strat- egies in particular proved fruitful: analyzing other websites hosted on the same IP address as fake domains, and building an automated tool that searched for fake domains from a list of websites likely targeted. One difficulty in acquiring usable data on these attacks is that the fake domains may only be accessible online for a short period of time, such as around a presidential election. Because of this, we must rely on contemporaneous accounts of these attacks to provide context for the attack, and in malware attacks may be unable to recover the malware itself. With this report, we hope to provide the framing and tools for indi- viduals and organizations to proactively report fake domain attacks, and allow for the more timely collection of data on these attacks. Global Civil SoCiety at RiSk // Fake Domain attaCkS 7 Individuals and organizations can use our online tool at fakedomains.accessnow.org to search for possible fake domains of their website. While it cannot catch all fake domains, it does look for the most common ways fake domains are generated through modified related urls, and we will continue to improve this tool over time to include other mechanisms for detection. III. FAKE DOMAIN Attacks The incidents of fake domain attacks on civil society and media organizations reveal widely divergent methods, uses, and geographies of fake domains.