By Erik Larkin
August 13, 2008
Typosquatting, that seedy practice of registering domain names similar
to legit sites but with typos in the name, has a new twist.
At a Black Hat presentation last week on a Symantec long-term research
on the practice as it cropped up in the 2008 election campaign, Oliver
Friedrichs found an interesting tidbit. A typosquatting domain
registered to someone in China had no Web page, but it did have a record
that allowed it to receive e-mail.
While there isn't any conclusive evidence of spying, typosquatting is
normally done to catch accidental Web surfers. When people mistype a
domain name - such as johnmcain.com instead of johnmccain.com - they end
up at the typosquatting site instead of getting a page not found error.
The junk site typically displays ads.
But this registered domain, the name of which Friedrichs didn't reveal,
didn't have any Web site records or associated pages to catch ad
revenue. Instead, it had what's known as an MX record, which allows it
to receive e-mail. The strong implication is that whoever registered the
typosquatting domain wanted to get e-mail intended for the real company.
Without direct evidence it's a leap to assume this was done for spying
purposes, but it's not exactly a giant vault. Chinese registrant,
defense contractor, MX record with no associated (and potential tip-off)
Web site. Connect the dots.
Visit Defcon Pics - Defcon Memory Repository