Slashdot Mirror
Researchers' Typosquatting Stole 20 GB of E-Mail
NeverVotedBush writes "Two researchers who set up doppelganger domains to mimic legitimate domains belonging to Fortune 500 companies say they managed to vacuum up 20 gigabytes of misaddressed e-mail over six months. The intercepted correspondence included employee usernames and passwords, sensitive security information about the configuration of corporate network architecture that would be useful to hackers, affidavits and other documents related to litigation in which the companies were embroiled, and trade secrets, such as contracts for business transactions."
Back in the early days of the web, a friend of mine registered a domain that was a legitimate spelling of a big company; just not the one that company was actually using. He set up a mail server on it and in a day received over 100 e-mails. Was really weird. Why were so many people sending e-mail to the wrong domain? They just assumed it would be right?
Anyway, of the 20 Gig they collected, I am sure 19.9 Gig was this boilerplate text.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Ummm...OK
(posting AC because I'm at work...)
Proof that the biggest security vulnerability remains behind the keyboard.
The attacker relies on the fact that users will always mistype a certain percentage of e-mails they send.
Who is doing this? Who types email addresses and doesn't use a contacts list or similar?
I suppose this is Window's fault but typing is so 20th Century....
Faster! Faster! Faster would be better!
One obvious lesson for this is that using email systems that have autocompletes for addresses you've already used or have had replies from is obviously important. A lot of modern software does this although some does not (my university's default webmail application doesn't for example although gmail does). Another more technical response to this is for people to use public key encryption when they are sending sensitive stuff. There's still some danger that they will at some point look up the public key but this will at least reduce problems. And there are obvious ways of distributing a lot of these keys in a secure fashion. For example, when you go to a bank to open a new account they could hand you a physical USB with their public key on it. Similarly, if one is an employee of a company they could physically do the same thing. One has enough real world interactions with people in the sort of circumstances described by the researchers that the thorny problems of key distribution are much simpler. However, I doubt almost anyone will implement this sort of thing since it is a change from the status quo which involves new technology to prevent what they may see as minor risks.
Even I receive once and again this kind of emails, legitimate emails and almost all from the same people, once they make one mistake, more will follow. Sometimes I warn, sometimes I don't. I'm not their employee.
I get the same situation. I've got a ".ca" with my last name, and a Canadian lawyer with the same last name has the ".com". I get a bunch of their email on my "catch-all", which is awkward, given the confidential nature of things you may discuss via email with your lawyer.
From TFA:
Kim said that out of the 30 doppelganger domains they set up, only one company noticed when they registered the domain and came after them threatening a lawsuit unless they released ownership of it, which they did.
I guess a domain registration police department will become common in large firms now.
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
That has a similarity in name to one of the US Navy's aircraft carriers. I used to get a fair amount of email for people on that ship. Nothing classified (I would've been really disappointed and shocked, but probably not surprised), but there was one sailor in particular who must've had quite a taste for porn because that address got so much porn spam it was amazing.
No mail was stolen. It was delivered exactly where it was addresst.
It's the fault of the monkey behind the keyboard and nobody else.
--
BMO
My domain is a letter off from a big company's, and I used to get what looked like pretty sensitive email all the time. After a few attempts to tell employees to stop doing it, I just turned off the catch-all.
This type of research is priceless to IT, demonstrating the weaknessess of our systems is the best way to plan security strategies.. good work :)
must check if Slashdot.xxx is still available.
Hmm, on second thought, no one would ever go there.
"The intercepted correspondence included employee usernames and passwords, sensitive security information about the configuration of corporate network architecture that would be useful to hackers, affidavits and other documents related to litigation in which the companies were embroiled, and trade secrets, such as contracts for business transactions."
I wondered how they could pay for their research in this era of vastly reduced funding - it's self funding!
Nate
intended for others. I have a full name @mac/@me account and my wife has a full name @gmail.com and I assume these people chose 1stnameLastname+1 account names making it very easy for their friends and business acquaintances to wrongly send us their email instead. I've gotten sensitive business information, invitations to exclusive events (unfortunately in the UK so I can't attend) . My wife has had an interesting time unintentionally following the life of a New York mover and shaker.
We don't know the real recipients actual email addresses so we can't warn them and have to read our own email to find out if it is intended for us or not so we can't help but read their email. Interesting conundrum.
This research result is not at all surprising- it is the same thing, just at a bigger scale and deliberate.
No reason to waste a perfectly good umlaut, right?
Unity? Screw that: XFCE. Slashdot Beta? Screw that: SoylentNews. Australis? Screw that: Pale Moon. UX developers DIAF
They captured 20GB of email.
They didn't really steal it, people addressed the email to them, they just did it errantly.
http://lkml.org/lkml/2005/8/20/95
(back when)
I had two phone lines one strictly for the modem.
The modem line was a prefix away from the local mass transit's
I would use the line for long distance calls as it wasn't limited as my
other line was; anytime I hooked the modem line to a phone it would ring.
Answering it I would get a question, not if this was the right place but
the hours of a bus route.
I ended up never answering it and pity the poor soul who ended up with
the number when I gave it up.
I have a very short (3 letter) AOL email address from days long gone by. I still check it every other week or so. I've been on a boy scout troop mailing list a few states away, a kindly grandmothers All Family contact list, and a few mislabeled business communications, most notably, someone buying a car in England.
I emailed one guy back who was writing to his military son. He got all kinds of pissed off, and accused me of 'intercepting his emails'. Sorry dude...YOU screwed up.
I always try to email them back to correct the problem, and usually they do.
I know the law varies where ever you go. But in general (or for the various locations of people here on /.) how does intent count towards the law?
If I *wrongly* address (e)mail to the wrong person and they open it, sure it was my fault. And the person who opened it should not be liable because it was addressed to their address rightly or wrongly.
But what about when a person does research and sees that the average person makes a certain mistake, fairly regular. (such as spelling teh instead of the)
If you set up and address with the intent to deceive, how does that play out in court? In the case (of the UK quote in these postings) it does say "...without reasonable excuse intentionally..."
My name is David Smith, and I use my name as part of my email address. I get more misdirected mail than I can track. I have even made the acquaintance of several other David Smiths across the world and have been redirecting their mail to them.
I administrate several email domains.
The people who turn off autocomplete and type all their email addresses by hand do not make these mistakes, because they have significant amounts of practice typing them correctly.
The people who use email clients that remember and autocomplete addresses don't ever integrate the RFC822 parse logic into their brains or fingers, so they always type .com for .net and .org addresses, and they always type smith when they mean smythe, and then forever after their mis-populated contacts list misdirects their email.
Seriously, decades of experience here; I remember when SMTP was an exotic protocol. I get many error messages every day from the email servers, and many of those errors are from misaddressed messages, and the people responsible simply are NOT the ones typing in email addresses from memory. It's the contacts list people, always, nearly every single time.
That's an underestimate. Sadly.
I used to work for an Infiniti car dealership. I noticed how many people referred to the brand as "Infinity" instead, so I registered an alternative to the dealerships domain with the last "i" changed to a "y". That domain received well over 50 e-mails a week, not just sales inquiries, but finance and corporate mail too. Management weren't too happy, but I pointed out that it was better I'd registered it than someone outside of the company.
Reminds me of MCI typosquatting ATT's operator-assisted collect call service, 1-800-OPERATOR, by using 1-800-OPERATER. It was about twenty years ago, but I do remember ATT changing that promotion to 1-800-CALL-ATT, after losing something like half a million dollars to MCI in the first month because of poor spellers.
That doesn't cover this case. No mail bag was opened so clause 1 doesn't apply. Clause 2 appears to apply something where a post for "123 Fake street" was delivered to you at "125 Fake Street", saying you can't just open it because the mailman dropped it in the wrong slot. That is not what happened in this case, in this case the mail was addressed to "125 Fake Street", and delivered to "125 Fake Street."
Same thing here -- the title is wrong, the researchers did not steal any E-Mail whatsoever. The E-Mail was addressed to their domains, and simply misaddressed.
I own netapps.com.au for my own business and back in the day I got a lot of email intended for netapps.com. I always notified the originator of the mistake. Bounce spam is so common these days that I configure my mail server to accept all mail. I never bounce for address unknown.
http://michaelsmith.id.au
That's what you get for not using PGP.
If you send secret corporate information on the equivalent of postcards, you have no right to complain.
My grandmother has a home number that was a prefix off from a local movie theater (they have long since changed it). They received a lot of calls for a while, and answered with something along the lines of "No, the correct number is ___." My grandfather had asked the theater to change their phone number, and they refused.
So, since they were uncooperative, my uncles decided to stop being helpful when people called the wrong number. They had a lot of fun making up fake movie times, fake movie names, and bogus specials (Bring a friend for free on Tuesdays! Get free popcorn if you give the following password between 5 and 6 on Saturday night!). Ah, to be a fly on the wall when those patrons walked into the theater...