[ISN] Typosquatting as Corporate Espionage

http://www.itworld.com/opinion/54235/typosquatting-corporate-espionage

By Erik Larkin
ITworld.com
August 13, 2008

Typosquatting, that seedy practice of registering domain names similar 
to legit sites but with typos in the name, has a new twist.

At a Black Hat presentation last week on a Symantec long-term research 
on the practice as it cropped up in the 2008 election campaign, Oliver 
Friedrichs found an interesting tidbit. A typosquatting domain 
registered to someone in China had no Web page, but it did have a record 
that allowed it to receive e-mail.

While there isn't any conclusive evidence of spying, typosquatting is 
normally done to catch accidental Web surfers. When people mistype a 
domain name - such as johnmcain.com instead of johnmccain.com - they end 
up at the typosquatting site instead of getting a page not found error. 
The junk site typically displays ads.

But this registered domain, the name of which Friedrichs didn't reveal, 
didn't have any Web site records or associated pages to catch ad 
revenue. Instead, it had what's known as an MX record, which allows it 
to receive e-mail. The strong implication is that whoever registered the 
typosquatting domain wanted to get e-mail intended for the real company.

Without direct evidence it's a leap to assume this was done for spying 
purposes, but it's not exactly a giant vault. Chinese registrant, 
defense contractor, MX record with no associated (and potential tip-off) 
Web site. Connect the dots.

[...]


__________________________________________________      
Visit Defcon Pics - Defcon Memory Repository 
http://www.defconpics.org