Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

10/9/2018
10:30 AM
Ben April
Ben April
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

New Domains: A Wide-Open Playing Field for Cybercrime

As bad actors increasingly exploit new domains for financial gain and other nefarious purposes, security teams need to employ policies and practices to neutralize the threat in real time. Here's why and how.

Thousands of new domain names are created every day as part of the Domain Name System. According to Farsight Security research, there are two to three new domain names observed, per second, on the Internet. While domain names containing a brand's trademark and other brand-related names are the crown jewel of an organization, not all domains are created for good.

Bad actors looking to execute various criminal activities (such as spreading spam, malware distribution, and the operation of botnets) register hundreds to thousands of domains, capitalizing almost instantly on the profits and value that these domains enable. And while many of these domains are abandoned within minutes to avoid detection, the damage to victim organizations is already done.  

One approach to neutralizing the threat of new domains is to detect them in real time. This visibility enables security teams to assess their risk, update security defenses, effectively block them, and fully understand the potential threats to their organization such as to data compromise and irreparable harm to brand and reputation.

Why Age Matters
A domain's age is a valuable factor in determining the threat it poses to an organization. New domains are cheap, "disposable" assets often used by bad actors to quickly deploy an attack. But defining a domain's age can vary. For example, one way to pinpoint a domain's inception is its registration date. Yet many bad actors will register a new domain but not use it right away, so it poses no immediate threat. A more useful way to determine the age of a domain is when it is first seen on the Internet. Once the domain is actually put into service, the race is on for the threat actors to leverage the domain for maximum value before reputation engines can detect and blacklist it. 

New Domains Open the Door for Old Threats
The proliferation of new domains can present a formidable threat to enterprises. For one, these domains are new, unchartered territory that have yet to be labeled as malicious or harmful. Thus, for a limited time, they represent a wide-open playing field on which criminals can easily launch old but successful threats (including phishing attacks and brand impersonation) at their discretion without fear of detection.

New top-level domains (TLDs) present another challenge. A company with an established brand has the potential to create thousands of new domain names. An adversary could register a new "look-alike" domain of an existing brand domain using many of the new TLDs. And while some protections exist for legitimate brand owners, enforcement is slow and erratic at best. In short, finding and blocking adversaries exploiting domains is all too often tantamount to a game of whack-a-mole.

Despite this threat, the good news is that most new malicious domains have a short shelf life — once they're detected and appropriately categorized, they are often shut down or become disabled due to outside sources either via blacklists or registrar takedowns. The bad news is that even in a short window of time, the damage to an organization via malicious domains can be extensive. Domain names are critical to an organization's brand — and the vast majority of domains that users interact with on a daily basis include some reference to the brand in use. As such, any damage to the domain will likely indirectly or directly harm the related brand.

What to Do: Four Broad Strokes
Currently, organizations looking to protect themselves against risks posed by new domains have to rely mostly on blacklists created by reputation services, which can't block new domains in real time. To close this time gap, organizations can turn to response policy zone (RPZ) technology to filter out new domains until the reputation services have had a chance to detect and block the domain.

But as criminals increasingly exploit new domains for financial gain and other nefarious purposes, security teams also will need to employ policies and practices to reduce the threat of new domains. Because every organization varies with regard to security posture, risk exposure and the security controls they have in place, some broad recommendations include:

  1. Consider blocking or alerting on domains that have no reputation or appear in a new domain data source.
  2. Think about what policy to apply to incoming email from "new" domains, as well as policies to apply to outgoing web requests to "new" domains.
  3. Evaluate what policy to apply to DNS resolutions to new domains by way of a DNS firewall or RPZ capability.
  4. Keep in mind that novelty is fleeting; blocking a new domain for the first 24 hours is likely to have minimal impact to your business operations but can significantly reduce risk to your organization.

Looking ahead, security teams need to increasingly find ways to glean insights that only new domains can provide, including early warnings about brand infringement, unauthorized changes, and other malicious activity. For organizations, that critical insight could mean difference between business as usual and falling victim to a devastating attack.

Related Content: 

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Ben April is the chief technology officer at Farsight Security, Inc.  Prior to joining Farsight, Mr. April spent eight years at Trend Micro, where he became the Americas regional manager of the forward-looking threat research team. He has presented to security ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
candolizaalex
50%
50%
candolizaalex,
User Rank: Apprentice
10/10/2018 | 11:45:38 AM
auto parts
This visibility enables security teams to assess their risk, update security defenses, effectively block them, and fully understand the potential threats to their organization such as to data compromise and irreparable harm to brand and reputation.
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18885
PUBLISHED: 2019-11-14
fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verify_dev_extents NULL pointer dereference via a crafted btrfs image because fs_devices->devices is mishandled within find_device, aka CID-09ba3bc9dd15.
CVE-2019-18895
PUBLISHED: 2019-11-14
Scanguard through 2019-11-12 on Windows has Insecure Permissions for the installation directory, leading to privilege escalation via a Trojan horse executable file.
CVE-2019-18957
PUBLISHED: 2019-11-14
Microstrategy Library in MicroStrategy before 2019 before 11.1.3 has reflected XSS.
CVE-2019-16863
PUBLISHED: 2019-11-14
STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL.
CVE-2019-18949
PUBLISHED: 2019-11-14
SnowHaze before 2.6.6 is sometimes too late to honor a per-site JavaScript blocking setting, which leads to unintended JavaScript execution via a chain of webpage redirections targeted to the user's browser configuration.