Cloud

10/9/2018
10:30 AM
Ben April
Ben April
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

New Domains: A Wide-Open Playing Field for Cybercrime

As bad actors increasingly exploit new domains for financial gain and other nefarious purposes, security teams need to employ policies and practices to neutralize the threat in real time. Here's why and how.

Thousands of new domain names are created every day as part of the Domain Name System. According to Farsight Security research, there are two to three new domain names observed, per second, on the Internet. While domain names containing a brand's trademark and other brand-related names are the crown jewel of an organization, not all domains are created for good.

Bad actors looking to execute various criminal activities (such as spreading spam, malware distribution, and the operation of botnets) register hundreds to thousands of domains, capitalizing almost instantly on the profits and value that these domains enable. And while many of these domains are abandoned within minutes to avoid detection, the damage to victim organizations is already done.  

One approach to neutralizing the threat of new domains is to detect them in real time. This visibility enables security teams to assess their risk, update security defenses, effectively block them, and fully understand the potential threats to their organization such as to data compromise and irreparable harm to brand and reputation.

Why Age Matters
A domain's age is a valuable factor in determining the threat it poses to an organization. New domains are cheap, "disposable" assets often used by bad actors to quickly deploy an attack. But defining a domain's age can vary. For example, one way to pinpoint a domain's inception is its registration date. Yet many bad actors will register a new domain but not use it right away, so it poses no immediate threat. A more useful way to determine the age of a domain is when it is first seen on the Internet. Once the domain is actually put into service, the race is on for the threat actors to leverage the domain for maximum value before reputation engines can detect and blacklist it. 

New Domains Open the Door for Old Threats
The proliferation of new domains can present a formidable threat to enterprises. For one, these domains are new, unchartered territory that have yet to be labeled as malicious or harmful. Thus, for a limited time, they represent a wide-open playing field on which criminals can easily launch old but successful threats (including phishing attacks and brand impersonation) at their discretion without fear of detection.

New top-level domains (TLDs) present another challenge. A company with an established brand has the potential to create thousands of new domain names. An adversary could register a new "look-alike" domain of an existing brand domain using many of the new TLDs. And while some protections exist for legitimate brand owners, enforcement is slow and erratic at best. In short, finding and blocking adversaries exploiting domains is all too often tantamount to a game of whack-a-mole.

Despite this threat, the good news is that most new malicious domains have a short shelf life — once they're detected and appropriately categorized, they are often shut down or become disabled due to outside sources either via blacklists or registrar takedowns. The bad news is that even in a short window of time, the damage to an organization via malicious domains can be extensive. Domain names are critical to an organization's brand — and the vast majority of domains that users interact with on a daily basis include some reference to the brand in use. As such, any damage to the domain will likely indirectly or directly harm the related brand.

What to Do: Four Broad Strokes
Currently, organizations looking to protect themselves against risks posed by new domains have to rely mostly on blacklists created by reputation services, which can't block new domains in real time. To close this time gap, organizations can turn to response policy zone (RPZ) technology to filter out new domains until the reputation services have had a chance to detect and block the domain.

But as criminals increasingly exploit new domains for financial gain and other nefarious purposes, security teams also will need to employ policies and practices to reduce the threat of new domains. Because every organization varies with regard to security posture, risk exposure and the security controls they have in place, some broad recommendations include:

  1. Consider blocking or alerting on domains that have no reputation or appear in a new domain data source.
  2. Think about what policy to apply to incoming email from "new" domains, as well as policies to apply to outgoing web requests to "new" domains.
  3. Evaluate what policy to apply to DNS resolutions to new domains by way of a DNS firewall or RPZ capability.
  4. Keep in mind that novelty is fleeting; blocking a new domain for the first 24 hours is likely to have minimal impact to your business operations but can significantly reduce risk to your organization.

Looking ahead, security teams need to increasingly find ways to glean insights that only new domains can provide, including early warnings about brand infringement, unauthorized changes, and other malicious activity. For organizations, that critical insight could mean difference between business as usual and falling victim to a devastating attack.

Related Content: 

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Ben April is the chief technology officer at Farsight Security, Inc.  Prior to joining Farsight, Mr. April spent eight years at Trend Micro, where he became the Americas regional manager of the forward-looking threat research team. He has presented to security ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
candolizaalex
50%
50%
candolizaalex,
User Rank: Apprentice
10/10/2018 | 11:45:38 AM
auto parts
This visibility enables security teams to assess their risk, update security defenses, effectively block them, and fully understand the potential threats to their organization such as to data compromise and irreparable harm to brand and reputation.
WSJ Report: Facebook Breach the Work of Spammers, Not Nation-State Actors
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/19/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.