Hello everybody and welcome back to salted hash. I'm your host Steve Reagan today
We're gonna be talking about Paul vixie and we're gonna get into some things called ID ends
So stick with me and we'll be right back
So Paul, how are you it's good to see you again
Life is good. Good to see you. Nice Paul vixie the CEO of Farsight security and
I'm hoping today
you can give me a little bit of an education on these things called global internationalized domain names ID ins and
I've seen I seen something recently where they were using special characters to spoof a legitimate URL that was wave registered and
They were able to push them out into phishing kits and I've been studying this stuff lately
So when I came across your report
I actually got really interested because I didn't realize it was that simple and yet the browser's are already starting to combat this
So real quickly what our idea is exactly
So quickly
When the internet was first created sort of about a scientific and technical community
It was dominated by the United States
alphabet
Our sort of 26 letters and the various symbols that we need. The encoding is called ASCII for what that matters
and that was fine because
Everyone in that community spoke English and so you didn't really need to display things in other other character sets
But now that the Internet is used by billions of people a day and has taken over kind of the global
Commerce and a lot of culture and and all that
It turns out that people who were not born and raised in the United States or went to school here
I really want to see domain names in their local national language using the local characters that they use in the rest of their lives
So it has taken quite a bit of time
For the internet technical community then adapt to that need and figure out so I had a cram these odd-looking
characters into a system that was never designed to contain them, but the work has been going on in almost 20 years and it is
substantially complete and
These names can now be bought they registered they can be used you can visit them
You can visit websites that are only identified using these
so-called non ASCII or non-us
Character sets so it's actually it's quite an achievement
was very difficult to add these features to that system and it was
highly resistant to being modified in that way, but a lot of creative people but a lot of years into it and
so that's the good-good side as you may expect there is a dark side to this which
Is a bunch of foreseeable things. We're not foreseen
or the you know
The problem was already so hard we could not fix this problem in addition to inventing that system
And so we have this look-alike problem the so-called homographs
Let me stop right there and give you a chance to prompt me differently
So that's the good side of it the
Obviously there's there's a darker side and you and I talked off off camera about this
But my question is on that darker side, you know
And she said this has been a pretty good advance over the last 20 years
But explain the dark side of this the homeo graph aspects
sure, the homograft problem is
probably best
exemplified by a phishing attack
So if you want to send spam
to a bunch of people and you want to pretend that it is from
Some Bank and you're hoping that a lot of them actually do business with that Bank. And so we'll say oh it's from my bank
You will need something for them to click on that is confusingly similar
To the actual name of that actual bank and it doesn't have to be a bank credit card companies
Whatever it is, if you're trying to get them to visit a website that you have built for the purpose of capturing their password
You're gonna need to give them something to click on that. They think is safe
and so a lot of early versions of this would be lets say
Swap out the I for a1 and the famously Microsoft with a1 got registered by somebody and you know microsoft.com
in the early years of
Commercialization and privatization the internet and it was quite a problem because a lot of people certainly senior citizens are easily confused
By something that looks kind of like an ax. Yeah, it's a one but you know, I'm gonna click on it anyway
and that
Problem kind of went away as the web got larger and people got more sophisticated
Now we have the ability to replace that. Let's say an I
Fraudulently present yourself as Microsoft but they've already got their own domain name so you can't have that one
You might be able to get one that actually has an eye there because that little
small letter, I that's the second letter of Microsoft is
Present in a lot of national alphabets not just the American English alphabet and so the Unicode character set that's used
for all of this stuff
Gives you quite a few choices of which small letter I you
actually want and
They don't look like ones they look like eyes they are
Indistinguishable optically, so you're allowing iota
Unicode oh two six nine. It's a dot less I
For example that that would be one example
There are more and what makes this especially hard to solve is that Unicode is an evolving system
We will be adding more lips to it in the future
So pretty much whatever software we come up with to detect confusing similarities
But I have to be updated from time to time as we add more things that could be
confusingly similar
So that's it in a nutshell. We're seeing this a lot
you know, we we did a
exploratory research report on this in January
and
That was kind of on a lark. It's like gee this could be a problem
I wonder if it is and my company has a gigantic global network collecting information in real time about how the DNS is used
So we obviously had the right
Data flowing by to go see if any of it looked like this and quite a bit did so we put out an interim report
in January on that topic
And we're now doing a much
Expanded version of that report saying the problem is way bigger than anybody imagined it is common
It's being commonly abused and it's growing. Yeah, just to talk about that bigger report
you got coming out over the course of a twelvemonth period you looked at a hundred million ID and
resolutions with the focus on the Ford and 250 top brands including those brands in eleven different sectors like finance retail technology and
According this you found eight thousand homograft representing or containing top global brand names that were confusable
So when you looked at those
8,000 names were they?
Is there any way to tell if they're just straight up there for crime or is this a brand doing something to protect themselves by?
Pre-registering ahead of time. How does how do you tell the difference between that?
Well
Yes, they're some of them are defensive registrations
They're just somebody some company who says, you know
I know this could be a problem and I'm willing to pay a few dollars a year tor just register reserve these names
to keep them out of bad hands, but
Really? You have to go visit them. You have to go see how they're being used
What kind of a service?
Do you end up talking to if you sort of resolve that name into an IP address and go visit the server?
That's at that address
Very if it is a defensive registration, which you're probably going to get is a redirect, you know
Your point of web browser does it'll just redirect you to the real site and if we see that then we know it must be
A defensive probably as a defensive registration, it could massacre it is one
if on the other hand, you see a website that looks
Again, I'm going to use this term a lot confusingly similar to the real company's website
But you know, it's not them, you know, it's hosted in some ISP and some out-of-the-way place
You know that that company would never buy those services
Then you have to assume that that the worst is happening and that they are attracting a lot of hits
now that the report here says that
Finance and retail were the hardest hit like you see more
More clones and confusions out of that space than ever so that it set straight to financial crime
What they're trying to do is rip people off as quickly as possible. Just
Low level phishing attacks and things like that or is there more something larger and sinister going on with these types of registrations?
There's nothing new under this particular Rock, some of it is
used to capture credentials
some of it is to install malicious software as a side load various things into your Android phone or your
Windows machine or whatever you happen to use
And they're trying to add you to a botnet
For all the reasons that they want you to be part of that botnet or where they are
Maybe installing Bitcoin mining software so that you can help them make money by creating new bitcoins
Frankly, I think a phone battery is the wrong tool for that job, but I guess if it's not yours, you know
It's the wrong pool. So no, we're not seeing any unique types of crime here. It's the same thing that people have always done
Once they have successfully mislead somebody into visiting a web property. That is not the one they think they're visiting
So to kind of sum this up, what advice do you have for?
administrators looking to guard their network or their brand so
Network being guard to people on their network from being finished or the brand itself in dealing
what what what can they do to deal with this kind of stuff and get ahead of it without
going out to register a bunch of domains using characters that maybe they know of and maybe they don't so you said that
That the character sets are large and very so how do they do it?
Well, there are a couple of approaches and unfortunately, none of them is a
Ironclad guarantee of safety
one thing to do
most of the
important valuable brands in the world
Have got some company who is in the brand protection business who has been, you know
contracted to go look for
Confusing similarities with the company's brands not just inside domain names, but you know all over the place
You know scan the web looking for something that could be harmful to our brand
And you need to need to make sure that whatever company you're working with to get that done
Knows about IDM and this is this is not easy the way that eyes and ones are easy
You actually have to do quite a bit of parsing and building of data structures in real time
In order to detect that this could look like that
in
Just right
That's the first thing to do another thing to do
Which I think is
Maybe less satisfying it's less immediate. It's not the check. You can write to get something better, but it will produce long-term
improve our business conditions is to
Go find the the registrar that you're dealing with
Whoever it is you go to when it's time to buy another domain name or the registry
For example Verisign. Mr. Bicha story for Tom a
Phileas would be the registry for I guess Don is
And so on down the line and and remind them of what your ID is doing
when you register a dot EU
Domain name which you can only do as part of the European Union and so forth. So that's not a global
TLD the wacom is but just the same when you register a name there
They automatically if give a little extra for it, but they will automatically block all of the homographs of that name
So you don't have to defensively register every variation of your brand
in dot EU you just register the one thing that you actually want people to visit and you
reserve essentially all of the variations that could be
confusingly similar and
You should be yelling at your registrar and yelling at the registry for the domain names
You're buying elsewhere in the world and say how come you can't be like those guys?
Because we you know, if we put some market pressure there if we say you could charge a little extra
You know a new source of profit margin for you and I will stop yelling that user
there are plenty of benefits of it then that will eventually turn this around because you know
This is ready to become a forest fire right now. It's you know a house fire but
If we don't do anything about it things will get extremely bad
extremely quickly
Paul thanks a lot for taking the time to talk to me. I really appreciate it
If you'd like to learn more about ID ends or anything else related to dns security or just the web in general remember to check?
Us out online at CSO online com. I'm Steve Reagan, and this has been salted hash. We'll see you next week