Slashdot Mirror
Typosquatters Running .om Domain Scam To Push Mac Malware (threatpost.com)
msm1267 writes from an article on Threatpost: Typosquatters are targeting Apple computer users with malware in a recent campaign that snares clumsy web surfers who mistakenly type .om instead of .com when surfing the web. According to Endgame security researchers, the top level domain for Middle Eastern country Oman (.om) is being exploited by typosquatters who have registered more than 300 domain names with the .om suffix for U.S. companies and services such as Citibank, Dell, Macys and Gmail. Endgame made the discovery last week and reports that several groups are behind the typosquatter campaigns. Mac OS X users are being singled out in this typosquatting campaign with malware. According to Endgame, when a Mac user stumbles on one of the typosquatters' webpages, a fake Adobe Flash update pops up and attempts to trick users to install the advertising component called Genieo. Endgame suspects that typosquatters are exploiting a hole in Oman's domain name registration process. When Endgame tried to register a domain it was asked to verify that it had the authority to registrar a specific commercial domain. "It's unclear how typosquatters were able to register so many domains in such a short period of time," Endgame said.
no it's not.
The easy fix is to switch to a fixed-width, fixed-size font so that things like bankofarnerica don't look like bankofamerica, etc.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
I tried all the domains mentioned with a Mac and didn't see anything, just a bunch of 404s, domain name holding pages and redirects to the proper .com name. I guess investigative reporting isn't what it used to be. I'll be back responding to your comments once I upgrade Flash. Apparently it is out of date.
I didn't know this was a word.
I guess we can thank all the greedy folks at ICANN for the subdomain cash grab that gives typosquatters so many new possiblities.
So, resolve *.om to 0.0.0.0, you say?
I feel obligated to point this out:
https://www.youtube.com/watch?v=qfv6Ah_MVJU
Remember when mac users were using this as definitive proof of Apple superiority? Well, it looks like the chickens have come home to roost.
Oh, typosquatters, I'm always amazed at how much work you're willing to do in the hopes that you'll be able to screw people over.
Just cruising through this digital world at 33 1/3 rpm...
Simple fix: Add a confirmation (with option to not ask again) when domain ends in unusual TLDs like .om. Might as well also create a list for important sites, such as banks, and detect typos.
Have gnu, will travel.
how it was possible for the submitter to not understand this story
Note: Phishing and typo squatting are different things.
Your solution will definitely help if someone's stupid enough to click on a link to bankofarnerica.com.
But it won't change anything if the user doesn't notice that he typed bankofamerica.om and a fancy padlock icon still appears in the browser.
IMO, all banks should be required by international law to use a tightly-regulated TLD, and then browsers could show padlock with the local currency symbol.
So how?
It's run-of-the-mill "sekiooritee" pandering to base fears of the cyber-illiterate. The summary already gives the clues. The intended audience certainly is not "nerds" but "prospective clients" to be scared into giving monies to these purveyors of imperial security blankets.
I'm just guessing here, but:
A web interface for domain registration, and a credit card?
Or "Oman Data Park LLC" where at least a couple of these domains were registered through (from a quick check) was compromised?
They paid someone. Oman is endemically corrupt.
I've worked in Muscat a number of times over the past two years and, from the start, it was immediately clear why it's considered the most corrupt country in the Arabian Gulf. If a foreigner wants some expedient business assistance from the authorities, they bribe someone. If they want the authorities to not do something, or look the other way... they bribe someone. Every business obstacle or impediment is routinely solved with bribes in Oman.
That sounds like we were being picked on as soft targets since we were paying a lot of bribes. But this applied to every foreign company we came across dealing with Oman (in the tech sector at least). You simply cannot believe how often foreign companies dealing with Oman have to pay people to make things happen.
Who the hell types .com? It's 2016 and most modern browsers (anything but IE I suspect) figure out what you mean.
google in the address bar is the same as "google.com" and the only time I specify a root is when I want the Canadian site without turning on location.
That is a good idea. The closest to this is .com, because the "land rush" has long since petered out. However, it would be nice to have a special TLD that has a distinct color when the web page is viewed (similar to EV SSL certs), and can be used in combination with EV. Some rules that sites must follow would be things like using SSL/TLS for all web traffic (other than the initial HTTP redirect to the secure site), staying updated to security levels, some concrete proof that the site is whom they claim to be given to the TLD owner (copies of the DBA), and so on. Ideally, it would mean sites are required to meet a security standard like PCI-DSS3.2, HIPAA, CJIS, FISMA, or some other known standard of security (where violating it will mean actual pain rather than a slap on the wrist.)
Of course, who is the gatekeeper for this domain? Ideally, it should be multiple domains so one country doesn't have the keys to the city for another. Perhaps some form of the TLD of the country with a character before it, like xde, xus, xco, so it is obvious it is a different domain, but the country of origin is standardized.
Tell me again why the US should give up control of the internet?
I am not good with computers