impact of domain name drop-catching on business security Research - - PowerPoint PPT Presentation

▶
impact of domain name drop catching on business security
SMART_READER_LITE
LIVE PREVIEW

impact of domain name drop-catching on business security Research - - PowerPoint PPT Presentation

Mar 22, 2023 367 likes •1k views

impact of domain name drop-catching on business security Research carried out by: Kirils Solovjovs Mrti Rozenbergs Toms Liepjnieks relevance When was the last time your non-IT friend typed something like this

slide-1
SLIDE 1

impact of domain name drop-catching on business security

Research carried out by:

  • Kirils Solovjovs
  • Mārtiņš Rozenbergs
  • Toms Liepājnieks
slide-2
SLIDE 2

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

relevance

  • When was the last time your non-IT friend

typed something

– like this 172.217.18.78? – or this 2a00:1450:4016:809::200e?

  • Yep, 100%-ε of non-malicious connections start

with a DNS request

slide-3
SLIDE 3

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

domain expiration

  • Negligence:

– forgot to renew

domain

– credit card expired

  • Abandonment:

– project is over – company merger – court order

  • Most domains aren’t free
slide-4
SLIDE 4

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

research scope

  • mid-2018
  • .lv ccTLD

– including IDN

  • no phishing
  • no active attacks
  • quantitative and

qualitative methods

  • ftp, ssh, telnet, smtp,

dns, http, pop3, imap, https, rdp, vnc

  • What attack vectors can be observed in real life?
slide-5
SLIDE 5

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

literature review

  • C. Healey. Domain tasting is taking over the internet as

a result of ICANN’s “Add Grace Period”, 2007

  • S. Hao, M. Thomas, V. Paxson, N. Feamster, C.

Kreibich, C. Grier, S. Hollenbeck. Understanding the domain registration behavior of spammers, 2013

  • G. Szathmari. Hacking law fjrms with abandoned

domain names, 2018

slide-6
SLIDE 6

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

terminology

  • Drop-catching

re-registering a freshly expired domain name

  • Domain back-orders

– many registrar ofger a service to catch the domain – some registries (.ru, .pl, ...) cooperate on that service

  • Domain tasting

– registering a domain name for the add-grace period

slide-7
SLIDE 7

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

gTLD life-cycle

slide-8
SLIDE 8

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

.lv ccTLD life-cycle

slide-9
SLIDE 9

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

enough theory; let’s dig in!

slide-10
SLIDE 10

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

challanges

  • 180 domains on 1 IP
  • Lots of scanners and other bad guys
  • Bots vs humans
slide-11
SLIDE 11

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

tools

  • custom DNS server

based on twisted

  • a bunch of honeypots:

– mailoney, netwatch,

imap-honey, malbait, RDPY, vnclowpot

  • netfjlter
  • apache

– custom PHP honeypot

  • acme.sh

+ custom dns api

  • custom .sh & .py
slide-12
SLIDE 12

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

methodology/setup

  • Register recently expired domains that:

– have search engine presence – relate to an existing company/person – are typos of popular domains

  • Request SSL certifjcate for those domains ASAP
slide-13
SLIDE 13

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

methodology/analysis

  • Link DNS request logs with other request logs

– heuristics: timing + AS

  • Detect bots (web)
  • Detect network scanners and bruteforcers
  • Look at the remaining data in detail

– qualitative analysis on e-mails and web requests – quantitative analysis on other protocols

slide-14
SLIDE 14

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

yeah, yeah, yeah, but have you got any data?

slide-15
SLIDE 15

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

domains registered

slide-16
SLIDE 16

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

dns/requests (weighted)

slide-17
SLIDE 17

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

dns/record_types

slide-18
SLIDE 18

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

dns/subdomains

slide-19
SLIDE 19

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

dns/subdomains/record_types

slide-20
SLIDE 20

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

dns/avg_req_by_length (weighted)

slide-21
SLIDE 21

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

dns/countries

slide-22
SLIDE 22

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

ftp/top10

Username: 1) ** lol :p ** 2) changeme 3) webmaster 4) admin 5) root 6) test 7) clearvision 8) ubuntu 9) nagios 10) ftpuser Password: 1) 1q2w3e4r 2) test 3) admin 4) 123456 5) 1q2w3e 6) 12345 7) test123 8) qwerty 9) q1w2e3 10) 1234

slide-23
SLIDE 23

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

ssh/top10

Username: 1) root 2) admin 3) test 4) user 5) support 6) ubnt 7) oracle 8) ubuntu 9) postgres 10) adm Password: 1) 123456 2) password 3) 12345 4) 1234 5) 123 6) admin 7) test 8) wubao 9) 1 10) root

slide-24
SLIDE 24

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

telnet/top10

Username: 1) root 2) admin 3) guest 4) supervisor 5) default 6) support 7) user 8) ubnt 9) Administrator 10) 888888 Password: 1) 1234 2) admin 3) 12345 4) password 5) 123456 6) 7ujMko0admin 7) 5up 8) 888888 9) aquario 10) 54321

slide-25
SLIDE 25

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

mail/open_relay_attempts

slide-26
SLIDE 26

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

web/requests

slide-27
SLIDE 27

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

enough of looking at bad guys; from now on — only legit data

slide-28
SLIDE 28

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

web/protocols

slide-29
SLIDE 29

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

web/methods

slide-30
SLIDE 30

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

web/referrers

slide-31
SLIDE 31

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

web/cookies

lrn2cookie plz

slide-32
SLIDE 32

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

web/subdomains

slide-33
SLIDE 33

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

web/countries

slide-34
SLIDE 34

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

mail/sender_domains/attachments

slide-35
SLIDE 35

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

mail/attachment_types

slide-36
SLIDE 36

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

mail/sender_domains/attachment_types

slide-37
SLIDE 37

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

I think it’s about enough of this; let’s look at some qualitative data

slide-38
SLIDE 38

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

a torrent tracker

slide-39
SLIDE 39

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

cron requests from abandoned wordpress instances

slide-40
SLIDE 40

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

embedded HTML elements from .gov.lv

slide-41
SLIDE 41

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

inter-connector of e-government systems

slide-42
SLIDE 42

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

notifications from a social network

slide-43
SLIDE 43

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

notification from a latvian social network

slide-44
SLIDE 44

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

notification from a belgian social network

slide-45
SLIDE 45

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

group reservation for a hotel

slide-46
SLIDE 46

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

e-mail from a lawyer

slide-47
SLIDE 47

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

message from state revenue service

slide-48
SLIDE 48

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

flight reservation

slide-49
SLIDE 49

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

bill with a lot of private data

slide-50
SLIDE 50

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

telecommunications bill

slide-51
SLIDE 51

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

electronically signed letter from the government

slide-52
SLIDE 52

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

  • fficially binding electronically signed government decision
slide-53
SLIDE 53

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

GPS tracking alert on a car

slide-54
SLIDE 54

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

full bank statement

slide-55
SLIDE 55

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

sensitive health documents (encrypted)

slide-56
SLIDE 56

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

  • ccupational health check-up sheet
slide-57
SLIDE 57

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

damn, that was intense! let’s wrap up & chill out

slide-58
SLIDE 58

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

abandoner risks

  • Previous owner endangers:

– their clients and business partners – employees who’ve used e-mails for personal

accounts

  • via password reset

– banking, insurance and sensitive health information

slide-59
SLIDE 59

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

attacker benefits

  • Attackers may gain control over:

– commercial secrets – old installations of your website – government systems – information about passwords of the users

  • via breach notifjcation sites

– SSL certifjcates for the future website

slide-60
SLIDE 60

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

what can you do

  • Use 2FA
  • Pay for your damn domains
  • If not, then:

– notify everybody — partners, employees, and third parties

using your API

– remove old e-mail addresses from online accounts

  • Check for suspicious behavior of mail servers; blacklist them
slide-61
SLIDE 61

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

further work

  • Gather a larger, more representative data set
  • Practically verify the following attack scenarios:

– Use AGP to request SSL certifjcates valid for as long as possible

  • mitm connection to the domain after it’s been re-registered
  • write an advisory, if needed

– Locate and access the old server by looking at cron-like

requests

– Register breach notifjcation alerts for a domain and wait

slide-62
SLIDE 62

#BalCCon2k18 http://kirils.org @KirilsSolovjovs

impact of domain name drop-catching on business security visit for more goodies