HIDING IN PLAIN SIGHT: A LONGITUDINAL STUDY OF COMBOSQUATTING ABUSE - - PowerPoint PPT Presentation
HIDING IN PLAIN SIGHT: A LONGITUDINAL STUDY OF COMBOSQUATTING ABUSE P . K I N T I S , N . M I R A M I R K H A N I , C . L E V E R , Y . C H E N , R . R O M E R O - G M E Z , N . P I T R O P A K I S , N . N I K I F O R A K I S , M
P . K I N T I S , N . M I R A M I R K H A N I , C . L E V E R , Y . C H E N , R . R O M E R O - G ó M E Z , N . P I T R O P A K I S , N . N I K I F O R A K I S , M . A N T O N A K A K I S O C T O B E R 3 1 , 2 0 1 7
2
A BRIEF STORY…
3
IS IT THAT EASY?
4
discountnikeshopping.com. flynike.com. ilovenike.com. lanike.com. lanikekobe.fr. nike1000.com. nikeairxmaxuk.com. nikeapps.de. nikecortez.org. nikecowboyjerseys.com. nikeelastico.com. nikees.com. nikefreerun2016.fr. nikefreerunpaschere.org. nikefreerunshoes5.com. nikelava.com. nikelebronsoldier10.net. nikenbahmarkets.com. nikenergy.com. nikenew.fr. nikeoutletclearancestore.com. nikes4wholesale.com. nikeschoenenkopennl.nl. nikestory.com. niketnrequins.com. niketopanky.net. nikebrockosweilerjerseys.com. nikedemarcuswarejerseys.com. nikefoot.com. nikefreerun2016.se. nikeirelandonline.net. nikejerseycheapest.com. nikejerseysbigsale.com. nikekd8shoes.com. nikekobev.com. nikens.com. nikerunningshoe.com. nikesbchronicles.com. nikesbs.com. nikesize-chart.com. nikestore.taipei. nikestorenl.net. nikesystems.com. nikeuktrainersshop.com. sycoairmaxnike.us.com. nikefreeog.com. nikefreerunpascherhomme2014.fr. nikefreerunstore.com.tw. nikefreerunweb.com. nikemyadventurecamper.com. nikeplusapp.com. nikesairjordanheels.com. nikewear.co.uk. senikeairmaxrea.se. wwwfashionnike.blogspot.com. 1-800-806-nike.com. chaussurenikedunks.com. chaussurenikeoutletsoldes.com. cheapnikeairmaxkx.com. cybermondaynikeshoes.com. enjoynikeruningtrainersuk.com. forbiddenluv-nike.blogspot.com. jp.msn.com.office.nike-poc.myshn.net. nike-promo-code.com. nike5666.com. nike712.net. nikeairmax90ous.us. nikeespana.trade. nikefree2017.se. nikefree50.fr. chinanike.cn. mujer2016nikeairmax.top. nike3333.com. nikeaina.com. nikeairjoredan3.site. nikeairmax2016shoesfr.top. nikeairmax90-shop.co.uk. nikeboing.org. niketrainer1.com. niketravels.com. nikevipmall.com. nikewrites.com. pickyanike.com. nikediscountshoesonlinebuy.com. nikehyperdunk.org. nikelaufschuhesaleonline.de.com. nikelivefabregas.com. nikeplusbook.com.
5
COMBOSQUATTING DEFINITION
^[a-zA-Z0-9-]* [a-zA-Z0-9-]*
6
TRADEMARKS
7
COMBOSQUATTING DOMAINS
Passive DNS Active DNS
8
Passive DNS Active DNS
Domains Used Existing Domains
COMBOSQUATTING DOMAINS
Typosquatting Upper Bound
9
Dec 2012 – Sep 2016 610M Jul 2009 – Sep 2016 966K Oct 2008 – Nov 2016 22K Jan 2011 – Oct 2016 1.1B
Malware
PBL
Spam
APT
COMBOSQUATTING DNS DATASETS
10
bankofamerica-com-login-sys-update-online.com PHISHING ATTACKS
11
airbnbforbeginners.com SOCIAL ENGINEERING ATTACKS
12
TIP OF THE ICEBERG
13
Domain name resolutions by clients in North America
Collection Errors
COMBOSQUATTING DOMAIN RESOLUTION
14
15
PERSISTENCE
16
IN X.509 WE TRUST
17
18
LEXICAL CHARACTERISTICS
19
Financial Sector Social Networks Comcast Chevron
WORD DISTRIBUTION
20
21
Init
combosquatting domains from the Active DNS dataset Affiliate Abuse
through affiliates
Phishing
domains with login forms
identified 174 unique phishing pages Processing
most popular domains
and labeled 8.7K domains
Unknown 86.6% Unrelated 11.23% Suspicious 88.77% Malicious 13.39% Phishing 0.9% Social Engineering 13.62% Affiliate Abuse 15.56% Trademark Abuse 69.9%
COMBOSQUATTING ANALYSIS
22
23
CAN WE SOLVE THE PROBLEM?
24
REGISTRARS TAKING ACTION
25
26
Aug 22
Sep 8
THE EQUIFAX CASE
27
bit.ly/combosquatting-john-oliver: equifaxfraudprevention.com