Slashdot Mirror
Researchers' Typosquatting Stole 20 GB of E-Mail
NeverVotedBush writes "Two researchers who set up doppelganger domains to mimic legitimate domains belonging to Fortune 500 companies say they managed to vacuum up 20 gigabytes of misaddressed e-mail over six months. The intercepted correspondence included employee usernames and passwords, sensitive security information about the configuration of corporate network architecture that would be useful to hackers, affidavits and other documents related to litigation in which the companies were embroiled, and trade secrets, such as contracts for business transactions."
Anyway, of the 20 Gig they collected, I am sure 19.9 Gig was this boilerplate text.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The attacker relies on the fact that users will always mistype a certain percentage of e-mails they send.
Who is doing this? Who types email addresses and doesn't use a contacts list or similar?
I suppose this is Window's fault but typing is so 20th Century....
Faster! Faster! Faster would be better!
One obvious lesson for this is that using email systems that have autocompletes for addresses you've already used or have had replies from is obviously important. A lot of modern software does this although some does not (my university's default webmail application doesn't for example although gmail does). Another more technical response to this is for people to use public key encryption when they are sending sensitive stuff. There's still some danger that they will at some point look up the public key but this will at least reduce problems. And there are obvious ways of distributing a lot of these keys in a secure fashion. For example, when you go to a bank to open a new account they could hand you a physical USB with their public key on it. Similarly, if one is an employee of a company they could physically do the same thing. One has enough real world interactions with people in the sort of circumstances described by the researchers that the thorny problems of key distribution are much simpler. However, I doubt almost anyone will implement this sort of thing since it is a change from the status quo which involves new technology to prevent what they may see as minor risks.
Even I receive once and again this kind of emails, legitimate emails and almost all from the same people, once they make one mistake, more will follow. Sometimes I warn, sometimes I don't. I'm not their employee.
I get the same situation. I've got a ".ca" with my last name, and a Canadian lawyer with the same last name has the ".com". I get a bunch of their email on my "catch-all", which is awkward, given the confidential nature of things you may discuss via email with your lawyer.
From TFA:
Kim said that out of the 30 doppelganger domains they set up, only one company noticed when they registered the domain and came after them threatening a lawsuit unless they released ownership of it, which they did.
I guess a domain registration police department will become common in large firms now.
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
That has a similarity in name to one of the US Navy's aircraft carriers. I used to get a fair amount of email for people on that ship. Nothing classified (I would've been really disappointed and shocked, but probably not surprised), but there was one sailor in particular who must've had quite a taste for porn because that address got so much porn spam it was amazing.
No mail was stolen. It was delivered exactly where it was addresst.
It's the fault of the monkey behind the keyboard and nobody else.
--
BMO
My domain is a letter off from a big company's, and I used to get what looked like pretty sensitive email all the time. After a few attempts to tell employees to stop doing it, I just turned off the catch-all.
1. Enable catch-all email accounts on all domains you own ...
2.
3. PROFIT!
20 gigs sounds like a lot, but since these were corporations, you can expect that a lot of them were huge Microsoft Word attachments with one-liners like "Peter: Remember to complete your TPS report by Friday." and equally vacuous Powerpoint slide decks. And people trying to email DVDs. And pr0n - lots of pr0n, if it was government employees.
must check if Slashdot.xxx is still available.
Hmm, on second thought, no one would ever go there.
"The intercepted correspondence included employee usernames and passwords, sensitive security information about the configuration of corporate network architecture that would be useful to hackers, affidavits and other documents related to litigation in which the companies were embroiled, and trade secrets, such as contracts for business transactions."
I wondered how they could pay for their research in this era of vastly reduced funding - it's self funding!
Nate
Also, chances are 99% of that was spam.
I read the internet for the articles.
intended for others. I have a full name @mac/@me account and my wife has a full name @gmail.com and I assume these people chose 1stnameLastname+1 account names making it very easy for their friends and business acquaintances to wrongly send us their email instead. I've gotten sensitive business information, invitations to exclusive events (unfortunately in the UK so I can't attend) . My wife has had an interesting time unintentionally following the life of a New York mover and shaker.
We don't know the real recipients actual email addresses so we can't warn them and have to read our own email to find out if it is intended for us or not so we can't help but read their email. Interesting conundrum.
This research result is not at all surprising- it is the same thing, just at a bigger scale and deliberate.
No reason to waste a perfectly good umlaut, right?
Unity? Screw that: XFCE. Slashdot Beta? Screw that: SoylentNews. Australis? Screw that: Pale Moon. UX developers DIAF
They captured 20GB of email.
They didn't really steal it, people addressed the email to them, they just did it errantly.
http://lkml.org/lkml/2005/8/20/95
I have a very short (3 letter) AOL email address from days long gone by. I still check it every other week or so. I've been on a boy scout troop mailing list a few states away, a kindly grandmothers All Family contact list, and a few mislabeled business communications, most notably, someone buying a car in England.
I emailed one guy back who was writing to his military son. He got all kinds of pissed off, and accused me of 'intercepting his emails'. Sorry dude...YOU screwed up.
I always try to email them back to correct the problem, and usually they do.
People aren't dumb, just busy. I do recognize the need for people to do their own due diligence to some extent but comments like yours, no offense, paint people as a bunch of sheep lamely pushing at buttons. The true picture is that these are by and large very busy people conducting business with a multitude of contacts and business correspondence that they have to perform every day, and not all of them, in fact very few of them, are really very IT savvy. IT isn't their business. And its usually not a matter of simply pushing buttons; many times its copying, pasting, attaching forms, scanning, and typing new contact names into contact books. With millions of people conducting transactions on the web every day some domains are going to get munged. Yeah, they need to make sure they are addressing their business correctly, but simply painting them as "dumb" is dismissive and disingenuous.
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
They do the same with SSH. The other day I mispelled homelinux.org (that's a dyndns domain) and ended up in some server asking my password. They listen to SSH for all domains *.mispelled-homelinux.org (I don't remember the exact name) and harvest logins and passowrds. Luckily I only allow public keys in my home router so I could notice.
I administrate several email domains.
The people who turn off autocomplete and type all their email addresses by hand do not make these mistakes, because they have significant amounts of practice typing them correctly.
The people who use email clients that remember and autocomplete addresses don't ever integrate the RFC822 parse logic into their brains or fingers, so they always type .com for .net and .org addresses, and they always type smith when they mean smythe, and then forever after their mis-populated contacts list misdirects their email.
Seriously, decades of experience here; I remember when SMTP was an exotic protocol. I get many error messages every day from the email servers, and many of those errors are from misaddressed messages, and the people responsible simply are NOT the ones typing in email addresses from memory. It's the contacts list people, always, nearly every single time.
but simply painting them as "dumb" is dismissive and disingenuous
You *really* must be new here.
Yeah, that's a good argument. Another one is "People are dumb", and as lame as "I'm too tired to get a glass of water, why don't you get if for me."
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
Could be lots of reasons. I'm not sure it'd be the same now, but when I was doing home end-user tech support in the late 90's and early 2000s a lot of people genuinely didn't get that email didn't work like the postal service where typos would likely be corrected and the mail still get where it was going. I was yelled at by more than one (mostly older) person who didn't understand why their email didn't arrive after we "fixed it".
I kind of expect it's also just a lot of people don't know/don't care and aren't paying attention.
That's an underestimate. Sadly.
I used to work for an Infiniti car dealership. I noticed how many people referred to the brand as "Infinity" instead, so I registered an alternative to the dealerships domain with the last "i" changed to a "y". That domain received well over 50 e-mails a week, not just sales inquiries, but finance and corporate mail too. Management weren't too happy, but I pointed out that it was better I'd registered it than someone outside of the company.
Reminds me of MCI typosquatting ATT's operator-assisted collect call service, 1-800-OPERATOR, by using 1-800-OPERATER. It was about twenty years ago, but I do remember ATT changing that promotion to 1-800-CALL-ATT, after losing something like half a million dollars to MCI in the first month because of poor spellers.
I own netapps.com.au for my own business and back in the day I got a lot of email intended for netapps.com. I always notified the originator of the mistake. Bounce spam is so common these days that I configure my mail server to accept all mail. I never bounce for address unknown.
http://michaelsmith.id.au
Back when webrings were popular was contacted by a guy who wanted to create a Michael Smith webring. I think we had about fifty members. Thats not bad considering that everybody had to have their own web site and this was in the mid 1990s. Don't ask me about creating a "smith" webring though.
http://michaelsmith.id.au
I do key authentication over the Net for the same exact reason. If I log into the wrong site, who cares if they get a public key ID or material, unless they have a TWIRL machine or a quantum computer to factor keys in logarithmic time.
Plus, it is only common sense to have public key only authentication, especially with all the brute force attempts done these days. Of course, systems like SSHGuard or custom scripts to have iptables deny IP addresses are useful, but nothing beats completely locking out an attack avenue completely.
Really, store e-mails in an address book. It should also be obvious that any e-mail addresses communicated verbally are prone to typos.
I guess the other question is why such sensitive stuff is being sent in an e-mail in clear text.
And in fact "typosquatting" does happen in the UK with real physical mail and it is not illegal.
One of the obsolete UK railway companies ceased to legally exist. Making it possible to create a new company named that. Somebody did so, presumably intending to some day create merchandise which would legally use this significant name, which would have some cachet in the hobbyist market, but wouldn't cause any real confusion.
But instead they got piles of mail intended for whatever railway company was currently responsible for this or that problem somewhere in the country. Demands for payment of utility bills, requests for authority to dig things up, and so on. They opened these letters, and they wrote very caustic replies, pointing out the foolishness of sending letters to a company based on the fact that it has the same name as a company which was at some previous time responsible for something.
After a while they got threatening legal letters, and they began writing back to the client (not the lawyer) pointing out that a lawyer who can't even send their threatening letters to the right people is maybe not worth hiring. This resulted in even more useless threatening legal letters.
I'm fairly sure I've heard of this. But this new company wasn't deliberately set up for confusion; and it has no other running company to be confused with. If the company name or addressee is the same, it would be difficult for them to know it was a misdelivered package.
Its not relevant whether it was delivered to the right box; because the law clearly states "without reasonable excuse, opens a postal packet which they know or suspect to have been delivered incorrectly".
That is, unless you can think of a way of ensuring post is misdelivered to you, whilst making sure you never even begin to suspect that it wasn't meant to be delivered to you.
My reply was meant to be a poke at the lack of knowledge surrounding the postal system (the OP was misinformed over the law), and how these laws cannot be related to email. However, if you want to apply them - you can't simply interpret them how you want. This thread has taken it way too seriously and completely missed the point.
Not when accessing a misspelled domain name, but being the first connection to a new server, SSH would ask if it should add the keys to known_hosts.
That's what you get for not using PGP.
If you send secret corporate information on the equivalent of postcards, you have no right to complain.
SUDO Get me a glass of water.
When you sympathize with stupidity, you start thinking like an idiot.
My grandmother has a home number that was a prefix off from a local movie theater (they have long since changed it). They received a lot of calls for a while, and answered with something along the lines of "No, the correct number is ___." My grandfather had asked the theater to change their phone number, and they refused.
So, since they were uncooperative, my uncles decided to stop being helpful when people called the wrong number. They had a lot of fun making up fake movie times, fake movie names, and bogus specials (Bring a friend for free on Tuesdays! Get free popcorn if you give the following password between 5 and 6 on Saturday night!). Ah, to be a fly on the wall when those patrons walked into the theater...