Typosquatting as Corporate Espionage

August 13, 2008, 08:31 AM —  PC World — 

Typosquatting, that seedy practice of registering domain names similar to legit sites but with typos in the name, has a new twist.

At a Black Hat presentation last week on a Symantec long-term research on the practice as it cropped up in the 2008 election campaign, Oliver Friedrichs found an interesting tidbit. A typosquatting domain registered to someone in China had no Web page, but it did have a record that allowed it to receive e-mail.

While there isn't any conclusive evidence of spying, typosquatting is normally done to catch accidental Web surfers. When people mistype a domain name - such as johnmcain.com instead of johnmccain.com - they end up at the typosquatting site instead of getting a page not found error. The junk site typically displays ads.

But this registered domain, the name of which Friedrichs didn't reveal, didn't have any Web site records or associated pages to catch ad revenue. Instead, it had what's known as an MX record, which allows it to receive e-mail. The strong implication is that whoever registered the typosquatting domain wanted to get e-mail intended for the real company.

Without direct evidence it's a leap to assume this was done for spying purposes, but it's not exactly a giant vault. Chinese registrant, defense contractor, MX record with no associated (and potential tip-off) Web site. Connect the dots.

If this was meant for espionage, it would only collect e-mails with mis-typed addresses that matched the typosquatting domain. Not a massive risk since the majority of e-mail clients auto-fill the address based on an entry in the contact list. But it's so cheap and easy to register a domain and throw up a quick mail server that even a few collected e-mails could be easily worth a spy's time.

So if you're in a company that deals in sensitive information and you think you might be a corporate espionage target, it sure couldn't hurt to proactively check to see if anyone has registered typosquatting domains based on your company's domain name. Type potential domain names (typosquatting variants) into the Whois tool at http://whois.domaintools.com to see if anything turns up.

» posted by ITworld staff

PC World

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

I like it!
Close

On Twitter now

typosquatting

Powered by Twitter
You are logged in | Sign out
Sign in and post to Twitter

What are you thinking?

Cancel Tweet sent

On Twitter now

Post a comment
The content of this field is kept private and will not be shown publicly.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.
peer-to-peer

Brian Proffitt
Microsoft/Novell: Breaking Down the Coupon Numbers

Esther Schindler
Drupal's Dries Buytaert on Building the Next Drupal

Tom Henderson
Top Ten General Operating Systems Rants

pasmith
PS3 motion controller delayed; goes up against Project Natal

sjvn
Neolithic Windows security hole alive and well in Windows 7

claird
Perl source code comparison makes for good reading

mikelgan
Cell phones don't create stress or interrupt much

Sandra Henry-Stocker
How to: The Unix Interview

 

Where Google Chrome security fails: the password
I heard mention that the Chrome OS will have some sort of encryption available a la bitlocker. If it's possible to encrypt personal data using another password or key, then it may have potential for very secure data.... And Ubuntu has an 'encrypt home directory' option, perhaps google should follow suit.
- Dann

Join the conversation here

The Daily Tip

The Daily TipQuick, practical advice for IT pros. Made fresh daily.

Hot tips:

Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.

Newsletters

Subscribe to ITWORLD TODAY and receive the latest IT news and analysis.

I would like to receive offers via email from ITworld partners.
By clicking submit you agree to the terms and conditions outlined in ITworld's privacy policy.
Marketplace