CAPEC-631 SoundSquatting

An adversary registers a domain name that sounds the same as a trusted domain, but has a different spelling. A SoundSquatting attack takes advantage of a user's confusion of the two words to direct Internet traffic to adversary-controlled destinations. SoundSquatting does not require an attack against the trusted domain or complicated reverse engineering.

1. [Explore] [Determine target website] The adversary first determines which website to impersonate, generally one that is trusted, receives a consistent amount of traffic, and is a homophone. 2. [Experiment] [Impersonate trusted domain] In order to impersonate the trusted domain, the adversary needs to register the SoundSquatted URL. 3. [Exploit] [Deceive user into visiting domain] Finally, the adversary needs to deceive a user into visiting the SoundSquatted domain.

• An adversary requires knowledge of popular or high traffic domains, that could be used to deceive potential targets.

• [Low] Adversaries must be able to register DNS hostnames/URL’s.

• Other: Other

• Authenticate all servers and perform redundant checks when using DNS hostnames. • Purchase potential SoundSquatted domains and forward to legitimate domain.