Cloud

10/9/2018
10:30 AM
Ben April
Ben April
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

New Domains: A Wide-Open Playing Field for Cybercrime

As bad actors increasingly exploit new domains for financial gain and other nefarious purposes, security teams need to employ policies and practices to neutralize the threat in real time. Here's why and how.

Thousands of new domain names are created every day as part of the Domain Name System. According to Farsight Security research, there are two to three new domain names observed, per second, on the Internet. While domain names containing a brand's trademark and other brand-related names are the crown jewel of an organization, not all domains are created for good.

Bad actors looking to execute various criminal activities (such as spreading spam, malware distribution, and the operation of botnets) register hundreds to thousands of domains, capitalizing almost instantly on the profits and value that these domains enable. And while many of these domains are abandoned within minutes to avoid detection, the damage to victim organizations is already done.  

One approach to neutralizing the threat of new domains is to detect them in real time. This visibility enables security teams to assess their risk, update security defenses, effectively block them, and fully understand the potential threats to their organization such as to data compromise and irreparable harm to brand and reputation.

Why Age Matters
A domain's age is a valuable factor in determining the threat it poses to an organization. New domains are cheap, "disposable" assets often used by bad actors to quickly deploy an attack. But defining a domain's age can vary. For example, one way to pinpoint a domain's inception is its registration date. Yet many bad actors will register a new domain but not use it right away, so it poses no immediate threat. A more useful way to determine the age of a domain is when it is first seen on the Internet. Once the domain is actually put into service, the race is on for the threat actors to leverage the domain for maximum value before reputation engines can detect and blacklist it. 

New Domains Open the Door for Old Threats
The proliferation of new domains can present a formidable threat to enterprises. For one, these domains are new, unchartered territory that have yet to be labeled as malicious or harmful. Thus, for a limited time, they represent a wide-open playing field on which criminals can easily launch old but successful threats (including phishing attacks and brand impersonation) at their discretion without fear of detection.

New top-level domains (TLDs) present another challenge. A company with an established brand has the potential to create thousands of new domain names. An adversary could register a new "look-alike" domain of an existing brand domain using many of the new TLDs. And while some protections exist for legitimate brand owners, enforcement is slow and erratic at best. In short, finding and blocking adversaries exploiting domains is all too often tantamount to a game of whack-a-mole.

Despite this threat, the good news is that most new malicious domains have a short shelf life — once they're detected and appropriately categorized, they are often shut down or become disabled due to outside sources either via blacklists or registrar takedowns. The bad news is that even in a short window of time, the damage to an organization via malicious domains can be extensive. Domain names are critical to an organization's brand — and the vast majority of domains that users interact with on a daily basis include some reference to the brand in use. As such, any damage to the domain will likely indirectly or directly harm the related brand.

What to Do: Four Broad Strokes
Currently, organizations looking to protect themselves against risks posed by new domains have to rely mostly on blacklists created by reputation services, which can't block new domains in real time. To close this time gap, organizations can turn to response policy zone (RPZ) technology to filter out new domains until the reputation services have had a chance to detect and block the domain.

But as criminals increasingly exploit new domains for financial gain and other nefarious purposes, security teams also will need to employ policies and practices to reduce the threat of new domains. Because every organization varies with regard to security posture, risk exposure and the security controls they have in place, some broad recommendations include:

  1. Consider blocking or alerting on domains that have no reputation or appear in a new domain data source.
  2. Think about what policy to apply to incoming email from "new" domains, as well as policies to apply to outgoing web requests to "new" domains.
  3. Evaluate what policy to apply to DNS resolutions to new domains by way of a DNS firewall or RPZ capability.
  4. Keep in mind that novelty is fleeting; blocking a new domain for the first 24 hours is likely to have minimal impact to your business operations but can significantly reduce risk to your organization.

Looking ahead, security teams need to increasingly find ways to glean insights that only new domains can provide, including early warnings about brand infringement, unauthorized changes, and other malicious activity. For organizations, that critical insight could mean difference between business as usual and falling victim to a devastating attack.

Related Content: 

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Ben April is the chief technology officer at Farsight Security, Inc.  Prior to joining Farsight, Mr. April spent eight years at Trend Micro, where he became the Americas regional manager of the forward-looking threat research team. He has presented to security ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
candolizaalex
50%
50%
candolizaalex,
User Rank: Apprentice
10/10/2018 | 11:45:38 AM
auto parts
This visibility enables security teams to assess their risk, update security defenses, effectively block them, and fully understand the potential threats to their organization such as to data compromise and irreparable harm to brand and reputation.
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
New Mirai Version Targets Business IoT Devices
Dark Reading Staff 3/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Reading Schneier's Friday Squid Blog again?
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.