Combatting domain phishing in the New Age economy

Brian Lonergan at Identity Digital explains the importance of protecting brand names from cyber-criminals

 

The world we live in is constantly innovating. And while businesses have gotten smarter and faster with new technologies, cyber-criminals have tried to use this evolution for their own gain.

 

However, by making some savvy decisions and deploying effective security measures, these risks can be overcome. 

 

Stay one step ahead with the right tools

When checking your blind spots for cyber-attackers, it is essential to consider all the tactics they could try on your brand. This can include anything from domain name spoofing and email spoofing to DNS spoofing.

 

Cyber-attackers will often first try to trick a respected company’s consumers or employees into their scam through email spoofing. How? They disguise themselves as someone the user knows and trusts. They could, for example, act as a well-known employee.

 

From a hacker’s perspective, this can be an easier route to take since most employees are in constant contact with each other. A skillfully forged email signature could be all they need to convince someone they are speaking to an entrusted colleague. 

 

Sometimes, we may only check an email’s signature rather than the address itself, but that’s often the telltale sign of a fraudster. This is what usually leads some users to click on links in an email without thinking twice - especially if the fraudulent website is as carefully camouflaged as the signature (or email address) used.

 

This takes us to domain name spoofing, which commonly takes the form of phishing and, more specifically “homograph attacks”. This is a tactic where hackers act as a respected brand by imitating that company’s domain name or email address.

 

This phishing technique sees bad actors register confusingly similar domain names by swapping parts of a domain name with characters, such as replacing the letter “a” with the Greek letter Alpha “α”, thus passing off an illegitimate website or email address as a genuine one at a quick glance. It’s therefore no surprise that domain name and email spoofing are the most common forms of phishing.

 

So as a first step to prevent such instances, companies should employ cyber-security tools through defensive registrations of their brand or homographic blocking.

 

Top-level domains which support homographic blocking technology help eliminate the opportunity for cyber-attackers to swap characters within your domain name by identifying potentially malicious variations that could come out of your domain name, and making them unavailable for purchase by others. This mitigates the potential for bad actors to register variations of an existing web address, keeping both your brand and its reputation intact. 

 

While homographic blocking provides reliable protection from spoofing the “left of the dot”, companies should also consider protecting their brand authenticity across other relevant top-level domains. For example, a website by the name of “texas.coffee” needs to be protected by controlling top-level domain variations like “texascoffee.pro” or “texascoffee.info”.

 

Blocking services such as Global Block & the Domain Protection Marks Lists (DPMLs) allow brands to protect hundreds of top-level domains at scale with ease. Domain name-blocking services are stand-alone brand protection products which allow brands and trademark holders to protect their intellectual property across hundreds of TLDs via a single subscription. DPML & Global Block are trusted by the world’s largest brands and prevent millions of malicious points of ingress on a daily basis.

 

Sometimes, cyber-attackers go further than the above and attempt Domain Name System (DNS) spoofing. DNS spoofing, which can take the form of DNS cache poisoning or DNS manipulation, is a cyber-attack that corrupts DNS data by manipulating its records to redirect users towards malicious websites instead. Bad actors use both technology solutions and social engineering tactics to gain control of DNS configurations for well-respected brands.  

 

It is always recommended to check if your registrar (and its registry) is backed by a strong Security and DNS Abuse Mitigation Team as a safeguard. This is because these teams often align and work closely with law enforcement to ensure security threats within the DNS are neutralised at all times. In short, they “patrol” the Domain Name System for suspicious activity and report it swiftly.

 

It’s also worth checking with your registrar to see if they provide registry-level locking of DNS records. This simple low-tech solution can successfully prevent loss of DNS control through social engineering.  

 

Uncovering the fraudster

While solutions like the above are readily available to provide peace of mind for countless companies, it never hurts to educate both customers and employees on the signs of a spoofing attack. Knowing what to watch out for can not only save a company’s data, but also save them money. So, what should businesses watch out for, and how should they respond? 

 

One thing is that if your company or provider has asked for new authentication credentials (or asked you to execute sensitive processes), you should contact the company for direct confirmation before providing new information. 

 

Another instance to be vigilant of is if an unusual email or request has come through from a coworker. When this happens, check the email addresses and see if it’s consistent with what you’re expecting to see. If an individual or organisation is suddenly communicating to you in a different tone of voice, compare communication styles from previous, legitimate emails; this could indicate a phishing attempt. Another telltale sign is if you find a few spelling and grammar errors in the text, too.

 

Taking a moment to check key security protocols is also key. For example, is there a padlock icon (the sign of encryption) displayed on the company’s URL field? If not, rather refer back to secure links that you have used in the past and only trust them.

 

Similarly, if you’re visiting a website for the first time and want to make sure you’re in the right place, it’s recommended to cross-check the company’s verified social media pages and the website links they direct to. Should you see that the same website has been linked more than once across their verified platforms, you should be good to go.

 

There’s a lot in a name

Checking for any phishing blind spots in your company’s systems ensures that the business not only protects its private information and assets, but also keeps reputational damage at bay. So in a landscape as unpredictable as cyber-space, businesses must empower themselves by doubling down on security measures. 

 

There’s a lot in a name. It’s one of the business’s most valuable assets. And with a plethora of technological solutions now in reach, we can stay ahead of any fraudsters who try to tarnish it. 

 

---

 

Brian Lonergan is Vice President of Product Strategy at Identity Digital

 

Main image courtesy of iStockPhoto.com and hocus-focus