CAPEC-630 TypoSquatting

An adversary registers a domain name with at least one character different than a trusted domain. A TypoSquatting attack takes advantage of instances where a user mistypes a URL (e.g. www.goggle.com) or not does visually verify a URL before clicking on it (e.g. phishing attack). As a result, the user is directed to an adversary-controlled destination. TypoSquatting does not require an attack against the trusted domain or complicated reverse engineering.

1. [Explore] [Determine target website] The adversary first determines which website to impersonate, generally one that is trusted and receives a consistent amount of traffic. 2. [Experiment] [Impersonate trusted domain] In order to impersonate the trusted domain, the adversary needs to register the TypoSquatted URL. 3. [Exploit] [Deceive user into visiting domain] Finally, the adversary needs to deceive a user into visiting the TypoSquatted domain.

• An adversary requires knowledge of popular or high traffic domains, that could be used to deceive potential targets.

• [Low] Adversaries must be able to register DNS hostnames/URL’s.

• Other: Other

• Authenticate all servers and perform redundant checks when using DNS hostnames. • Purchase potential TypoSquatted domains and forward to legitimate domain.