Typosquatting or Domain Spoofing

Typosquatting (a.k.a., domain spoofing) is a form of cybercrime where an attacker registers lookalike domain names similar to a legitimate domain but with slight alterations to the original domain name or typographical errors that trick the eye. These are the first steps taken to carry out phishing attacks, in which attackers use sophisticated techniques to trick users into revealing sensitive information. 

Typosquatting subsequently involves the creation of a fraudulent site that mimics a legitimate one or diverts users to another fraudulent one. Banks are often targeted through phishing emails that appear to come from legitimate institutions but are actually crafted to capture login credentials or install malware. The use of lookalike domains is a growing tactic that makes it increasingly challenging for users to identify malicious sites. The rise of generative AI aids attackers in building sites that are often indistinguishable from the sites of legitimate brands.

Domain Name System (DNS) Vulnerabilities

The Domain Name System (DNS) serves as a critical backbone of the internet, translating human-readable domain names into IP addresses that computers use to communicate with one another. However, despite its essential role in facilitating seamless online navigation, the DNS is not immune to vulnerabilities. Attackers use mainly two techniques: 

• DNS Spoofing, or DNS Cache Poisoning: These techniques involve corrupting the DNS cache of users so that they are directed to malicious sites instead of legitimate ones. Attackers exploit weaknesses in the DNS infrastructure to insert fraudulent entries, redirecting users and potentially intercepting sensitive information such as login credentials.

• DNS Hijacking: DNS hijacking occurs when attackers redirect domain traffic to malicious servers. This can be achieved through exploiting vulnerabilities in the DNS management system or through unauthorized access to domain registrar accounts. Once users are redirected, attackers can perform a variety of malicious actions, from data theft to deploying ransomware.

Domain Registration and Management Risks

Financial institutions must rely on domain registrars to manage their domain names. However, if a registrar’s security is compromised, it can lead to unauthorized changes or transfers of domains. Locking a company out of its domain can have devastating consequences for the victim organization. The criminal would then have the leverage to blackmail the owner and demand a consequent ransom. 

Domain Expiration

If a domain registration lapses and is not renewed in time, it can also be seized by malicious actors. This risk highlights the importance of keeping track of domain expiration dates and setting up alerts to prevent accidental lapses.

What are the best practices to mitigate domain risk? 

As for all cybersecurity risk management mitigation techniques, banks must combine people, processes, and technology to ensure complete coverage to mitigate domain risk. 

Implement Strict User Access Management 

Banks must choose reliable registrars that adhere to strict security standards and a steadfast commitment to monitoring registrar accounts for any suspicious activity is critical. Access to registrars should be thoroughly restricted, supported by strong and complex passwords, preferably stored in a password manager or managed through a privileged identity management solution. Using multi-factor authentication (MFA) for domain registrar accounts adds an extra layer of security. 

Regular Monitoring and Alerts

Banks should implement continuous DNS monitoring tools that can help detect unusual changes or unauthorized access in domain activity. Setting up alerts for changes in DNS records or registrar details can provide early warnings of potential threats.

Domain Locking

Domain locking is a security feature that prevents unauthorized changes to a domain name’s registration and settings. By enabling domain locking, domain owners can protect their domains from being transferred to another registrar or having settings modified without their explicit consent.

Enable Renewal Warranty 

A renewal warranty for domains is a type of protection offered by some domain registrars that ensures a domain name can be renewed even if the original registrant loses access to their account or fails to renew it before the expiration date. This service is designed to prevent unintentional loss of ownership over a domain due to various circumstances, such as forgetting to renew or losing account access.

Register Similar and Related Domains

Registering similar and related domains is a proactive strategy used by organizations to protect their brand, prevent cyber threats, and maintain a strong online presence. This practice involves acquiring domain names that are variations of or closely resemble the primary domain name of a business or individual. A common practice is to register the same name but with different top-level domains (TLDs) such as “.com”, “.net”, “.org”, or country specific TLDs (e.g., “.ch” for Switzerland). This is useful in preventing malicious actors from using these TLDs for nefarious purposes. The cost of owning these domains is generally much less than the cost of a cyberattack or customer reimbursement.

Enable DNS Security Extensions 

DNS Security Extensions (DNSSEC) add security to DNS queries by providing a way to verify the authenticity of the responses. Implementing DNSSEC helps protect against DNS spoofing and cache poisoning by ensuring that users are directed to legitimate sites.