Slashdot Mirror
Domain Resale Market Is Phisher Heaven
Krishna Dagli writes "Finish security firm F-Secure has discovered that alongside the sale of such innocuous domains as filmlist.com comes the resale of domains that obviously belong to banks or other financial institutions. Sedo.com, for example, is reselling domains like chasebank-online.com, citi-bank.com and bankofameriuca.com. 'Why would anybody want to buy these domains unless they are the bank themselves — or a phishing scammer?,' F-Secure asks."
Anyway, I wouldn't count on the registrars changing their business model just because there are stupid people out there.
John
People that want these domains run click farms. They make their money by showing ads based on the site the person meant to visit, from Google or whomever. It doesn't make sense for a phisher to pay big money for these domains when they can phish just as well with ksajdfxdvos.com.
I don't understand why there's not a domain like `.tm` (for example) where you'd need a trademark or some other legal device before you could register it. Some sort of search could be performed before the domains were approved and allowed to be used. If such a system were monitored properly - publicly aired before approval so people could stop any abuses that got past the legal bit - then wouldn't it go some way - if not perhaps the whole way - towards stopping that sort of phishing?
GreyPoopon
--
Why is it I can write insightful comments but can't come up with a clever signature?
I'm not sure I agree. There are 4 reasons someone other than Bank of America might purchase bankofameriuca.com:
;)
1. They're phishing.
2. They're typo-squatting in the hope of selling it to Bank of America.
3. They're link farming/click farming hoping for lots of typo hits.
4. Their name happens to be Banko F. Ameriuca.
In all cases there's no legal compulsion for Sedo to keep the domain out of any one person's hands. It's got nothing much to do with them. However, there is an ethical obligation on the part of Bank of America. They should be looking after their customers and making it difficult for phishers to try and sting them. Bank of America should have bought up all likely typos of their primary domain. If I had an account with them I would consider moving it. If they're willing to risk people losing out to phishing attacks to save the few dollars a domain costs to keep then they must be doing pretty damn badly, or they must not care much about my custom.
http://twitter.com/onion2k
This post expresses my opinion, not that of my employer. And yes, IAAL.
Aside from the, hmm, 2 people in the country who think there is a "u" in America, it would appear that that particular domain isn't being used for fat-fingered folks (u is nowhere near either c or a on the keyboard -- you have to go out of your way to hit it), so it is probably being used for phishing. The hope is that someone is less than cautious in reading it and doesn't recognize the inserted letter. Lets say someone decides to match up the first six letters of the domain exactly and then inserts one letter at an arbitrary point elsewhere. To combat this, bank of america would have to buy over *twenty tril1ion* domains which are equally as likely as bankofamericua.com (26 letters to insert, 8 positions to insert them at, 26^8 = lots). And that would only defend against *one* particular style of typo-squatting. If you combine the "insert a random letter" trick with "replace the I in America with a 1", then that is another twenty trillion domains to you have to buy.
P.S. Slashdotters who think you are immune because you are always a careful reader -- how many of you caught the phisher-style substitution I made in this post? Your brain is hard-wired to ignore the sort of slight differences that your computer is wired to treat as very serious.
Help poke pirates in the eyepatch, arr.
Cost effective? Domains cost like $10 a pop... I think if domain names prove to be a source of identity theft, companies will happily buy domain lookalikes rather than pay people to investigate fraud or suffer the loses...
Reality is nothing but a collective hunch.
I don't know what kind of crazy keyboard you're using, but on mine, the "i" and the "u" are right next to each other.
http://www.mwbrooks.com/dvorak/layout.html
I don't think the phishers care if they don't get to steal your identity, as long as the 99% of web users who don't know what SSL is can still be fooled. So yes, you're missing something.
Don't blame me; I'm never given mod points.
Uhhh ... OK. So while we're at it, let's get rid of copyright law, patent law, and restrictions on identity theft.
Copyright law, ok.
Patent law, ok.
Restrictions on identity theft, no.
Identity can lose its intrinsec value when copied. That's not cool.
The issue with domain ownership is that regulating domains could be bad for the internet itself, because it would impose more regulation, and we all know tat regulation is bad for the net, even if deregulation has its drawbacks.
Don't knock it, I've been a loyal customer of the Bank of Ameriuca for three days. They've given me life insurance dirt cheap, some very fine investment tips (a hot new web 2.0 company guaranteed to soar like an eagle in a week!) and offered free hosting for some homemade porn I've made. Also, I seem to have scored an elephant desktop friend which knows about free screensavers. It was about time banks realized that they have to offer more diverse services for our money.
Forwarding misspelled domains to your .com is a HORRIBLE idea. Here's why:
Lets say you are citibank, you own citibank.com, and your forward citybank.com. Your "setting the expectation" that a forward will happen, in the customers mind. When they go to city-bank.com, and it looks the same, to them, as citybank or citibank (but it's actually phisher owned), they're sunk.
What NEEDS to happen instead, if registering alternate spellings or typos is part of a security strategy, you need to inform the customer on that page with an informative message. "You appear to be looking for citibank.com. To prevent fishing, citibank has registered this and several other names. Please type 'citibank.com' into your browser address bar to continue."
Why no click through link? Whats to keep the fisher from making a fake "bad domain name page" linking to their site? Then they've got you hook, line, and sinker...