Slashdot Mirror
Typosquatters Running .om Domain Scam To Push Mac Malware (threatpost.com)
msm1267 writes from an article on Threatpost: Typosquatters are targeting Apple computer users with malware in a recent campaign that snares clumsy web surfers who mistakenly type .om instead of .com when surfing the web. According to Endgame security researchers, the top level domain for Middle Eastern country Oman (.om) is being exploited by typosquatters who have registered more than 300 domain names with the .om suffix for U.S. companies and services such as Citibank, Dell, Macys and Gmail. Endgame made the discovery last week and reports that several groups are behind the typosquatter campaigns. Mac OS X users are being singled out in this typosquatting campaign with malware. According to Endgame, when a Mac user stumbles on one of the typosquatters' webpages, a fake Adobe Flash update pops up and attempts to trick users to install the advertising component called Genieo. Endgame suspects that typosquatters are exploiting a hole in Oman's domain name registration process. When Endgame tried to register a domain it was asked to verify that it had the authority to registrar a specific commercial domain. "It's unclear how typosquatters were able to register so many domains in such a short period of time," Endgame said.
no it's not.
The easy fix is to switch to a fixed-width, fixed-size font so that things like bankofarnerica don't look like bankofamerica, etc.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
I tried all the domains mentioned with a Mac and didn't see anything, just a bunch of 404s, domain name holding pages and redirects to the proper .com name. I guess investigative reporting isn't what it used to be. I'll be back responding to your comments once I upgrade Flash. Apparently it is out of date.
I didn't know this was a word.
I guess we can thank all the greedy folks at ICANN for the subdomain cash grab that gives typosquatters so many new possiblities.
Oh, typosquatters, I'm always amazed at how much work you're willing to do in the hopes that you'll be able to screw people over.
Just cruising through this digital world at 33 1/3 rpm...
Good idea. We should set up a Kicksquatter to try and get this done..
Yes
I doubt that most of us will miss being able to visit websites in Oman.
Have gnu, will travel.
From what I understood from the article, you still have to click something on a webpage, which downloads a file you have to double click on in your file system. So you should still get
"This was a file downloaded from the internet that has no trusted developer certificate - are you sure you want to run it" warning - where you have to update the security level in control panels to let you run it.
For people who only run apps from the App Store (which to be fair, I wouldn't recommend) would not get into this situation thanks to App Store sandboxing. Not sure what else can be done.
This is probably on par with Windows 10 Security, but that advert was made in the days where just previewing an email with Outlook could get you infected with a virus.
It's turtles all the way down.
Or "Oman Data Park LLC" where at least a couple of these domains were registered through (from a quick check) was compromised?
They paid someone. Oman is endemically corrupt.
I've worked in Muscat a number of times over the past two years and, from the start, it was immediately clear why it's considered the most corrupt country in the Arabian Gulf. If a foreigner wants some expedient business assistance from the authorities, they bribe someone. If they want the authorities to not do something, or look the other way... they bribe someone. Every business obstacle or impediment is routinely solved with bribes in Oman.
That sounds like we were being picked on as soft targets since we were paying a lot of bribes. But this applied to every foreign company we came across dealing with Oman (in the tech sector at least). You simply cannot believe how often foreign companies dealing with Oman have to pay people to make things happen.
RPZ policy in BIND, .OM added to backlisting. If someone interested on it, I will give a link to the tutorial I wrote.
Looks like kicksquatterc.om is free...
I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
That is a good idea. The closest to this is .com, because the "land rush" has long since petered out. However, it would be nice to have a special TLD that has a distinct color when the web page is viewed (similar to EV SSL certs), and can be used in combination with EV. Some rules that sites must follow would be things like using SSL/TLS for all web traffic (other than the initial HTTP redirect to the secure site), staying updated to security levels, some concrete proof that the site is whom they claim to be given to the TLD owner (copies of the DBA), and so on. Ideally, it would mean sites are required to meet a security standard like PCI-DSS3.2, HIPAA, CJIS, FISMA, or some other known standard of security (where violating it will mean actual pain rather than a slap on the wrist.)
Of course, who is the gatekeeper for this domain? Ideally, it should be multiple domains so one country doesn't have the keys to the city for another. Perhaps some form of the TLD of the country with a character before it, like xde, xus, xco, so it is obvious it is a different domain, but the country of origin is standardized.
Tell me again why the US should give up control of the internet?