Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

10/9/2018
10:30 AM
Ben April
Ben April
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

New Domains: A Wide-Open Playing Field for Cybercrime

As bad actors increasingly exploit new domains for financial gain and other nefarious purposes, security teams need to employ policies and practices to neutralize the threat in real time. Here's why and how.

Thousands of new domain names are created every day as part of the Domain Name System. According to Farsight Security research, there are two to three new domain names observed, per second, on the Internet. While domain names containing a brand's trademark and other brand-related names are the crown jewel of an organization, not all domains are created for good.

Bad actors looking to execute various criminal activities (such as spreading spam, malware distribution, and the operation of botnets) register hundreds to thousands of domains, capitalizing almost instantly on the profits and value that these domains enable. And while many of these domains are abandoned within minutes to avoid detection, the damage to victim organizations is already done.  

One approach to neutralizing the threat of new domains is to detect them in real time. This visibility enables security teams to assess their risk, update security defenses, effectively block them, and fully understand the potential threats to their organization such as to data compromise and irreparable harm to brand and reputation.

Why Age Matters
A domain's age is a valuable factor in determining the threat it poses to an organization. New domains are cheap, "disposable" assets often used by bad actors to quickly deploy an attack. But defining a domain's age can vary. For example, one way to pinpoint a domain's inception is its registration date. Yet many bad actors will register a new domain but not use it right away, so it poses no immediate threat. A more useful way to determine the age of a domain is when it is first seen on the Internet. Once the domain is actually put into service, the race is on for the threat actors to leverage the domain for maximum value before reputation engines can detect and blacklist it. 

New Domains Open the Door for Old Threats
The proliferation of new domains can present a formidable threat to enterprises. For one, these domains are new, unchartered territory that have yet to be labeled as malicious or harmful. Thus, for a limited time, they represent a wide-open playing field on which criminals can easily launch old but successful threats (including phishing attacks and brand impersonation) at their discretion without fear of detection.

New top-level domains (TLDs) present another challenge. A company with an established brand has the potential to create thousands of new domain names. An adversary could register a new "look-alike" domain of an existing brand domain using many of the new TLDs. And while some protections exist for legitimate brand owners, enforcement is slow and erratic at best. In short, finding and blocking adversaries exploiting domains is all too often tantamount to a game of whack-a-mole.

Despite this threat, the good news is that most new malicious domains have a short shelf life — once they're detected and appropriately categorized, they are often shut down or become disabled due to outside sources either via blacklists or registrar takedowns. The bad news is that even in a short window of time, the damage to an organization via malicious domains can be extensive. Domain names are critical to an organization's brand — and the vast majority of domains that users interact with on a daily basis include some reference to the brand in use. As such, any damage to the domain will likely indirectly or directly harm the related brand.

What to Do: Four Broad Strokes
Currently, organizations looking to protect themselves against risks posed by new domains have to rely mostly on blacklists created by reputation services, which can't block new domains in real time. To close this time gap, organizations can turn to response policy zone (RPZ) technology to filter out new domains until the reputation services have had a chance to detect and block the domain.

But as criminals increasingly exploit new domains for financial gain and other nefarious purposes, security teams also will need to employ policies and practices to reduce the threat of new domains. Because every organization varies with regard to security posture, risk exposure and the security controls they have in place, some broad recommendations include:

  1. Consider blocking or alerting on domains that have no reputation or appear in a new domain data source.
  2. Think about what policy to apply to incoming email from "new" domains, as well as policies to apply to outgoing web requests to "new" domains.
  3. Evaluate what policy to apply to DNS resolutions to new domains by way of a DNS firewall or RPZ capability.
  4. Keep in mind that novelty is fleeting; blocking a new domain for the first 24 hours is likely to have minimal impact to your business operations but can significantly reduce risk to your organization.

Looking ahead, security teams need to increasingly find ways to glean insights that only new domains can provide, including early warnings about brand infringement, unauthorized changes, and other malicious activity. For organizations, that critical insight could mean difference between business as usual and falling victim to a devastating attack.

Related Content: 

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Ben April is the chief technology officer at Farsight Security, Inc.  Prior to joining Farsight, Mr. April spent eight years at Trend Micro, where he became the Americas regional manager of the forward-looking threat research team. He has presented to security ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
candolizaalex
50%
50%
candolizaalex,
User Rank: Apprentice
10/10/2018 | 11:45:38 AM
auto parts
This visibility enables security teams to assess their risk, update security defenses, effectively block them, and fully understand the potential threats to their organization such as to data compromise and irreparable harm to brand and reputation.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/14/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10287
PUBLISHED: 2020-07-15
The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documented functionality that helps customer set up however, out of our research, we found multiple production systems running these exact default cre...
CVE-2020-10288
PUBLISHED: 2020-07-15
IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however you can input whatever you like. As long as the field isn't empty it will be accepted.
CVE-2020-15780
PUBLISHED: 2020-07-15
An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30.
CVE-2019-17639
PUBLISHED: 2020-07-15
In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This...
CVE-2019-20908
PUBLISHED: 2020-07-15
An issue was discovered in drivers/firmware/efi/efi.c in the Linux kernel before 5.4. Incorrect access permissions for the efivar_ssdt ACPI variable could be used by attackers to bypass lockdown or secure boot restrictions, aka CID-1957a85b0032.