Hackers are abusing trusted domain names

Database and Network Journal, Dec, 2007

Finjan Inc. have announced that hackers and cyber-criminals are exploiting a loophole in the domain name registration process to infect visitors to legitimate websites and increase the life cycle of cyber-attacks. Attacks using this method typically involve a "copycat" domain name that is strikingly similar in spelling to the domains of legitimate sites. Leveraging the similarity to legitimate and frequently used domain names enables these attacks to go unnoticed by webmasters and security solution providers.

The abuse of trusted domain names attack vector was spotted during October by Finjan's Malicious Code Research Center (MCRC) when searching for popular services with a slight change of the top level domain. When Finjan's MCRC investigated http://go*gle-stat******.org (where * has obscured some of the characters of the domain) it was found that it took advantage of a domain name similar to a legitimate popular service, which contains malicious code that is designed to download and execute a Trojan on the visitor's machine. The malicious code itself is located on the abused domain name. For more details contact www.finjan.com/Content.aspx?id=1367 When Finjan researched where the domain name hosting the malicious site was located, it came across another interesting finding. The code was located on a trusted controlled IP address. Shortly after contacting the security team of that domain, Finjan was notified that the necessary action had been taken. A subsequent check showed that, indeed, the malicious code is no longer available on the hosting servers. Since registering a domain name is not a process that is being adequately policed and scrutinized, cybercriminals can potentially create a malicious website using any domain name they like (provided it isn't already taken). Finjan's research indicates that criminals have taken advantage of this loophole to create "'copycat" sites intended to host web-based attacks, using intentionally misleading domain names.