1
00:00:00,000 --> 00:00:04,800
So, I guess, uh, we're a little, we're definitely early, we're definitely on the clock.

2
00:00:04,880 --> 00:00:11,120
Uh, welcome to Speaker Workshops, and now it is the, uh, 210 talk.

3
00:00:11,360 --> 00:00:17,260
And, uh, want to say, just have a little bit to say about, uh, our presenters, Sam Erb.

4
00:00:17,260 --> 00:00:28,780
So, Sam Erb, uh, just real quick, Councilor 9, and I, uh, also, I, uh, I think you're the very first black badge holder I know personally.

5
00:00:29,720 --> 00:00:32,940
Ooh, is, wait, is that a radio, that's radioactive, right?

6
00:00:32,940 --> 00:00:35,740
Is that the radioactive one, or thou shall not speak of it?

7
00:00:37,180 --> 00:00:38,800
Are we going to light this thing on fire?

8
00:00:49,010 --> 00:00:51,590
Uh, without much ado, Sam Erb!

9
00:00:53,930 --> 00:00:54,890
Thank you.

10
00:00:55,530 --> 00:01:00,870
Um, so, uh, long-time listener, first-time speaker, um, so let's get going.

11
00:01:00,930 --> 00:01:15,990
Uh, so, you're going to connect to the wrong domain name, so, um, for whatever reason for the past few years, I've been very interested in domain names, and, uh, this is kind of a look at some of the, um, different ways that you can be tricked, or your computer can be tricked,

12
00:01:15,990 --> 00:01:20,930
uh, or you can be phished to connect to, uh, the wrong domain name.

13
00:01:20,990 --> 00:01:37,570
Um, so, uh, a bit about myself, uh, software engineer, I work at a cool company called Akamai, uh, we're hiring people like you, I have to say that, uh, and, uh, I have a, uh, Defcon23 and Defcon24 Uber Black Badge with the Council of Nine.

14
00:01:37,930 --> 00:01:41,730
Um, yeah, that's me at closing ceremonies since last year.

15
00:01:42,290 --> 00:01:51,210
Um, a disclaimer, uh, the opinions expressed here are my own, and no one was phished in the creation of this presentation, which will become a bit more obvious later on.

16
00:01:52,330 --> 00:01:58,070
Um, yeah, so I'm going to start out from kind of least severe and kind of build up from there.

17
00:01:58,210 --> 00:02:02,170
Um, and so, just to get going, um, we have to start out with typosquatting.

18
00:02:02,170 --> 00:02:13,750
Humans aren't perfect, they're going to connect, they're going to mistype the domain name they type in, um, and a malicious person could register these and, uh, trick somebody into entering their bank credentials, for instance.

19
00:02:14,670 --> 00:02:21,070
So this example here is looking at all the one-keyboard-letter-off variants of americanexpress.com.

20
00:02:21,370 --> 00:02:32,350
If you actually look up the registration status of each of these, um, like the example here is qamericanexpress.com, all but two of them are actually currently registered, or actively registered, as of April, I believe.

21
00:02:33,930 --> 00:02:39,630
I did all this, most of the research here in April 2017, so that's roughly when all this data's from.

22
00:02:42,910 --> 00:02:56,850
So the reason why I chose americanexpress here is that it's long enough that no one's company name is going to be qamericanexpress.com, whereas with a shorter website, you might get some legitimate websites, whereas I could argue that none of these are actually legitimate.

23
00:02:58,570 --> 00:03:02,210
So, building up from there, we have to look at bit squatting.

24
00:03:02,350 --> 00:03:06,750
This is one where your computer is actually going to get the domain name wrong by flipping a bit.

25
00:03:07,490 --> 00:03:14,110
The example I gave here is I swapped a bit on Google Analytics, and I end up with Eagle Analytics.

26
00:03:15,630 --> 00:03:26,830
This is a very low-probability event, but as most phones and personal electronic devices don't have error-correcting memory, this happens at a non-zero rate across the internet.

27
00:03:28,210 --> 00:03:38,730
So, in order to give a demo for this talk, I actually wanted to register one of these domains, and so I actually searched for the 1-bit variants of GoogleAnalytics.com.

28
00:03:39,810 --> 00:03:46,710
Part of the reason for looking at GoogleAnalytics.com is you want a website that people are going to visit a lot, but not mistype.

29
00:03:47,210 --> 00:03:50,750
Google Analytics falls in that, as do most CDNs.

30
00:03:51,630 --> 00:03:54,890
When I searched for domains, this was the only one available.

31
00:03:55,650 --> 00:04:04,470
So, I went ahead and registered it, and I put up a server on it and got a TLS certificate for it.

32
00:04:04,530 --> 00:04:08,150
And within 24 hours, I saw two what I would call hits.

33
00:04:08,150 --> 00:04:10,570
One HTTP, one HTTPS.

34
00:04:11,350 --> 00:04:20,100
This is one Android browser and one Android application actually connecting to my server.

35
00:04:20,490 --> 00:04:33,290
If you actually go and look at the source website of where this came from, the source website says GoogleAnalytics.com, but something within their phone caused a bit to flip in such a way that they went to the wrong website.

36
00:04:34,290 --> 00:04:37,830
Now , one other thing, when I actually...

37
00:04:37,830 --> 00:04:42,990
So , with a very popular website, from what I've seen, this is about what to expect.

38
00:04:42,990 --> 00:04:45,290
You'll get a few random hits per day.

39
00:04:46,310 --> 00:04:48,390
Once I got these hits, I actually took this down.

40
00:04:48,390 --> 00:04:54,250
But when I turned on this website, I immediately was getting spammed by this one very particular domain name .

41
00:04:54,250 --> 00:05:06,190
So I went to it, and it was actually a Swedish diving company's website had somehow managed to mess up their Google Analytics tag to point to my website.

42
00:05:06,330 --> 00:05:09,810
So every person that was visiting their website was also connecting to this.

43
00:05:10,630 --> 00:05:13,350
That's a picture of the code at the bottom there.

44
00:05:13,350 --> 00:05:18,330
It's a little bit hard to read from a distance, but it's pointing to EagleAnalytics.com.

45
00:05:20,690 --> 00:05:21,650
Yeah.

46
00:05:25,310 --> 00:05:29,650
So that's just an example of how to do this.

47
00:05:30,930 --> 00:05:36,370
If you're looking for more information on this, there's actually a really great white paper that Cisco put out.

48
00:05:36,370 --> 00:05:39,670
And I believe it's actually on DefCon.org, if you search for it.

49
00:05:41,790 --> 00:05:43,510
Or sorry, no, that's something later.

50
00:05:43,510 --> 00:05:44,590
I'm getting these confused.

51
00:05:44,790 --> 00:05:47,530
There was a talk at DC19 on this, I believe.

52
00:05:47,530 --> 00:05:48,410
That's what it was.

53
00:05:49,390 --> 00:05:49,930
Yeah.

54
00:05:50,570 --> 00:06:11,430
And so, being familiar with BitSquadian, I wanted to look at some other variants of BitSquadian.

55
00:06:11,430 --> 00:06:21,170
And one thing that I noticed is that there have been some recent registered top-level domain names, or TLDs, that actually BitSquad on other TLDs.

56
00:06:21,410 --> 00:06:29,530
So in this case, the registrar requested .got, which BitSquad's .gov.

57
00:06:29,530 --> 00:06:35,930
I reported that one in April of 2016 to the registrar, and they claimed to have implemented a fix.

58
00:06:36,910 --> 00:06:40,270
It's not actually testable right now, because you can't actually register those domains.

59
00:06:40,270 --> 00:06:44,930
But that's a very tractable problem, because there's a limited number of .gov websites.

60
00:06:44,930 --> 00:06:53,730
However, a recent one, which is .bom, actually BitSquads all of .com, which is a much more intractable problem, as there are a large number of .com domain names.

61
00:06:55,690 --> 00:07:06,110
A funny thing about .bom is that it was actually objected to by VeriSign, because it looks too similar to .com, and that objection was overruled, but it also BitSquads on .com, which is very unfortunate.

62
00:07:07,150 --> 00:07:13,990
I know it didn't report that one, as I'm not sure what value there would be from reporting that.

63
00:07:19,110 --> 00:07:26,130
This is actually something that was mentioned in the Cisco white paper, but these are more recent TLDs from that point.

64
00:07:33,050 --> 00:07:37,290
BitSquatting, like I said before, it only really targets random end-users.

65
00:07:37,290 --> 00:07:42,490
You can't really target a specific user with it, but you could target a user base, such as a bank.

66
00:07:42,490 --> 00:07:45,470
If you could only steal a few credentials per day, that could still be a lot of money.

67
00:07:45,470 --> 00:07:54,970
Or if you're BitSquatting a .gov website, that could get you a few inbound emails to intelligence agency per day, which could be significant.

68
00:07:57,910 --> 00:07:59,330
Going to the next slide...

69
00:08:01,110 --> 00:08:03,490
I'm getting a bit more serious.

70
00:08:05,090 --> 00:08:10,190
A lot of the reason why I gave this talk, actually, is I wanted to look at IDN homoglyphs.

71
00:08:10,190 --> 00:08:15,890
Homoglyphs are two characters that look the same, but have different meanings.

72
00:08:16,570 --> 00:08:23,710
IDN is an internationalized domain name, which is something that, if you're an English language speaker, you might not come across very often.

73
00:08:26,570 --> 00:08:38,290
Depending on your browser, you'll either see their source piny code, which is xn dash dash, or the ASCII equivalent of that.

74
00:08:39,070 --> 00:08:48,510
Piny code is a way to encode a larger character set into a smaller space.

75
00:08:48,510 --> 00:08:52,250
In the format that's used, you have the xn dash dash identifier.

76
00:08:52,710 --> 00:09:03,890
This is all standardized, followed by the English alphabet letters, or standard letters, followed by a dash, followed by...

77
00:09:06,270 --> 00:09:10,470
There's a standardized algorithm for actually computing what comes after that.

78
00:09:11,630 --> 00:09:13,850
There's an RFC on it and everything.

79
00:09:14,490 --> 00:09:17,170
I'm not going to give a great explanation of that, so I won't.

80
00:09:17,810 --> 00:09:20,130
With that, you can end up with a...

81
00:09:20,130 --> 00:09:26,750
That same machine will determine which letter and what location it will get placed into the URL that gets rendered.

82
00:09:28,510 --> 00:09:30,790
I gave two examples here.

83
00:09:31,430 --> 00:09:33,770
These are actually both registered domain names.

84
00:09:33,770 --> 00:09:38,030
Google.com, where both the O's are Cyrillic O's.

85
00:09:39,530 --> 00:09:41,830
I believe they're Cyrillic O's.

86
00:09:41,830 --> 00:09:43,190
It might be Latin, sorry.

87
00:09:43,590 --> 00:09:48,290
And Time.com, where every letter is actually from the Cyrillic alphabet.

88
00:09:51,270 --> 00:09:52,910
I'll show you how I found those later.

89
00:09:52,910 --> 00:09:55,450
Those are both actually registered domain names.

90
00:09:58,270 --> 00:10:04,930
I wanted to conduct a survey of existing homoglyphs and IDN domain names against popular.com domain names.

91
00:10:04,930 --> 00:10:08,570
I wanted to look for people who were impersonating .com domain names.

92
00:10:08,570 --> 00:10:14,490
I chose to focus on .com, as that's where most of the popular English language websites are.

93
00:10:14,650 --> 00:10:17,710
I only speak English, so I'm very limited there.

94
00:10:17,890 --> 00:10:20,930
There's really three options if you want to gather a large number of domain names.

95
00:10:21,010 --> 00:10:24,250
One is you could get the zone files for .com.

96
00:10:24,250 --> 00:10:28,230
That requires filling out a form, which really isn't that fun.

97
00:10:28,630 --> 00:10:35,750
And some of the zone files are actually impossible to acquire, such as North Korea's, who actually leaked, I believe, last year.

98
00:10:36,650 --> 00:10:40,670
You could go to Certificate of Transparency, which is a log of certificates.

99
00:10:41,850 --> 00:10:43,370
Or you could go to a third party.

100
00:10:43,370 --> 00:10:47,690
And there are third parties where you could pay a few hundred dollars and get a list of domain names, but that isn't that fun either.

101
00:10:47,690 --> 00:10:49,830
So I chose to go with Certificate of Transparency.

102
00:10:50,070 --> 00:10:53,170
And for this, I pulled down the Google pilot log.

103
00:10:53,170 --> 00:10:55,930
This contains about 100 million certificates.

104
00:10:56,590 --> 00:11:01,170
That's 96.5 million domain names, roughly.

105
00:11:01,170 --> 00:11:04,290
This is also completely searchable if you go to cert.sh.

106
00:11:05,010 --> 00:11:13,170
Certificate of Transparency, if you haven't heard of it before, is an initiative to log every publicly trusted certificate on the internet.

107
00:11:13,910 --> 00:11:16,410
It's largely a Google initiative.

108
00:11:18,190 --> 00:11:21,730
But there are logs hosted by other companies.

109
00:11:21,730 --> 00:11:25,550
I chose the Google pilot log, simply as it's the largest right now.

110
00:11:30,390 --> 00:11:32,590
There's another reason that I wanted to use Certificate of Transparency.

111
00:11:32,590 --> 00:11:37,270
If a certificate was registered, that means it's far more likely to have been used.

112
00:11:38,810 --> 00:11:46,030
Especially with the bit-squatting and typo-squatting domain names, a large number of these are registered but never actually utilized, which I found interesting.

113
00:11:49,530 --> 00:11:51,590
In order to use the CT log, I built a pipeline.

114
00:11:51,590 --> 00:11:58,230
I pulled out the common domain and subject-alternative domain fields from that.

115
00:11:58,230 --> 00:12:02,430
I then filtered out all of the PunyCode domain names.

116
00:12:04,010 --> 00:12:21,190
There's a great Python library called unidecode-package, where somebody actually went through and said what each Unicode character looks like, what its ASCII equivalent looks like, and actually went through character by character and did that, which is a great amount of work.

117
00:12:21,190 --> 00:12:22,310
It's very impressive.

118
00:12:23,290 --> 00:12:30,310
So that maps ASCII letters to what looks like their English equivalent.

119
00:12:30,470 --> 00:12:34,710
I then cross-referenced that list with the Alexa top 1 million domain names.

120
00:12:34,910 --> 00:12:45,030
At the end of the day, I got 1900 CT certificates that impersonated the Alexa top 1 million domain names.

121
00:12:45,030 --> 00:12:57,170
I then also went ahead and modified the Chromium unit test to check whether or not they would actually be rendered as PunyCode or whether an end user would see xn dash dash.

122
00:12:59,210 --> 00:13:06,970
In Chrome and Firefox right now, that test is actually standardized across all languages, so this would be applicable to all end users.

123
00:13:07,470 --> 00:13:19,670
In other browsers, I believe Internet Explorer or Microsoft will take into account your local language to determine whether or not you actually render the PunyCode variant.

124
00:13:20,950 --> 00:13:23,050
I've actually posted that list online.

125
00:13:23,350 --> 00:13:27,450
There are a few false positives in there, like there are valid websites.

126
00:13:27,590 --> 00:13:39,930
They just simply happen to look like their English equivalent website, but I chose to include those as I didn't want to actually filter all of these.

127
00:13:42,510 --> 00:13:45,510
What is much more interesting is actually showing the results.

128
00:13:46,070 --> 00:13:48,570
These are all real domain names.

129
00:13:48,570 --> 00:13:50,910
I would encourage you not to visit any of these.

130
00:13:52,090 --> 00:14:00,810
There are some really bad ones in here in that list, unfortunately, and I spent a decent amount of time actually reporting phishing websites to the Google phishing page.

131
00:14:04,370 --> 00:14:09,710
These are just some of the worst ones that I saw grouped by what character they used.

132
00:14:10,430 --> 00:14:21,450
There's a Latin small letter K, and the L with a stroke looked pretty bad, and then the dotless I was one of my personal favorites.

133
00:14:21,450 --> 00:14:23,410
I didn't know that was actually a thing before this.

134
00:14:23,850 --> 00:14:31,330
That's actually part of the reason why I took this approach, was I'm not an ASCII expert, if there even is such a thing.

135
00:14:31,550 --> 00:14:43,950
I really tried to go about finding the worst abusers without having to necessarily have a knowledge of ASCII in the first place, or knowing which letters to look for.

136
00:14:48,290 --> 00:14:54,410
As expected, the most popular websites towards the top of the list were much more likely to actually be impersonated.

137
00:14:55,210 --> 00:14:59,970
One of the more interesting things that I saw, which actually bypassed the Chromium check.

138
00:15:00,670 --> 00:15:07,970
The formatting here is the last entry in that field, whether or not it bypassed the Chromium check.

139
00:15:07,970 --> 00:15:11,490
In this case, they'd actually be rendered as time.com.

140
00:15:12,170 --> 00:15:20,070
They only used Cyrillic characters to represent the English equivalent.

141
00:15:24,090 --> 00:15:27,910
A breakdown of the Unicode blocks that I observed while going through this.

142
00:15:29,070 --> 00:15:39,770
Latin and Cyrillic are kind of as expected, but there was a long tail, and I really want to call out one at the very end, which is the Canadian Aboriginal Celbic Unicode block.

143
00:15:39,770 --> 00:15:43,270
That one really struck me as odd, as I wasn't really familiar with what that was.

144
00:15:43,290 --> 00:15:48,730
I went ahead and I looked at that Unicode block, and the characters that are contained in it.

145
00:15:50,730 --> 00:16:01,630
I went ahead and made a bunch of sample domain names, and I plugged them into the Firefox and Chrome browser, and they weren't converted to their Unicode equivalent.

146
00:16:02,650 --> 00:16:05,310
None of these were actually registered.

147
00:16:06,210 --> 00:16:13,330
I simply tested whether or not they bypassed the Firefox and Chromium check, and then went ahead and reported security bugs.

148
00:16:14,690 --> 00:16:25,990
The end result of this was that Chromium actually will now not allow the mixture of Canadian Aboriginal Celbic characters and English characters, which they did before.

149
00:16:25,990 --> 00:16:33,730
And they're actually working on a much more comprehensive anti-phishing fix, which I believe is still a work in progress.

150
00:16:35,210 --> 00:16:53,430
Within Firefox, this check is a bit more interesting, because Canadian Aboriginal Celbics actually fell under this thing called aspirational Unicode blocks, which allowed them to be mixed as part of the standard Firefox profile with their English language characters.

151
00:16:53,990 --> 00:17:09,110
And in order to resolve this issue, they simply increased the level of that check to disallow a mixture of English characters and this aspirational character block.

152
00:17:09,390 --> 00:17:15,070
And I believe they actually filed a request with some...

153
00:17:15,070 --> 00:17:28,290
I'm not exactly sure what agency tracks this, some external request to actually update the rules regarding this aspirational block, as some of the characters do look like English characters.

154
00:17:30,050 --> 00:17:38,530
So as was news to me and the Firefox and Chromium engineers, who actually were working on the fixes for these, you can't actually register any of these domain names.

155
00:17:39,090 --> 00:17:42,030
And this is where, believe it or not, policy comes to the rescue.

156
00:17:42,090 --> 00:17:46,750
When you try to register any of these domains, you're stopped.

157
00:17:51,090 --> 00:18:03,650
The reason for this is that VeriSign actually has a policy that you can't mix Canadian original syllabic characters with certain other characters, which includes English language characters.

158
00:18:03,650 --> 00:18:08,710
And they have this for every Unicode block, which I was completely unfamiliar with.

159
00:18:08,810 --> 00:18:19,010
One of the more interesting things about this is when I actually tried to register these domain names, because this is a failure at such a late stage in the registrar process, most registrars actually took my money.

160
00:18:19,110 --> 00:18:21,690
And in one case, I actually had to fight to get it back.

161
00:18:22,170 --> 00:18:23,530
I wasn't the biggest fan of that.

162
00:18:25,610 --> 00:18:34,190
So I kind of walked through three different examples of different ways that you or your computer could connect to the wrong domain name.

163
00:18:34,430 --> 00:18:37,110
So now we're just going to look at personal mitigations.

164
00:18:37,630 --> 00:18:39,790
I'm kind of preaching to the choir here.

165
00:18:40,490 --> 00:18:45,890
So the reason to use a password manager is simply because your computer won't be confused by any of this.

166
00:18:46,470 --> 00:18:53,630
However, if you actually own or are responsible for any popular domain name, it's probably worth looking into whether or not somebody's impersonating you.

167
00:18:53,770 --> 00:18:59,470
You could actually file an ICANN complaint and issue a takedown request, especially if your trademark's being violated.

168
00:19:00,190 --> 00:19:14,830
And if you work in IT or are at all curious, I would be... something that's worth checking is what happens when you plug these into your email client.

169
00:19:14,830 --> 00:19:15,950
What renders.

170
00:19:18,610 --> 00:19:20,810
Yeah, that's probably going to depend on the email client.

171
00:19:24,350 --> 00:19:31,090
So as I had the super transparency log, I went ahead and just had some fun with it.

172
00:19:31,090 --> 00:19:33,330
I graphed the key types over time.

173
00:19:33,330 --> 00:19:40,470
RSA 2K keys dominate, followed by ECJSA P26 keys, and then RSA 4K keys.

174
00:19:42,610 --> 00:19:53,090
There was also this fun long tail, which proves that when you give users options, you can always trust them to be consistent.

175
00:19:53,630 --> 00:20:00,570
Some of my favorite ones in there is somebody actually issued an RSA 500 key, and there's also an RSA 2600 key as well.

176
00:20:03,010 --> 00:20:07,830
And at the very end there, there's a DSA 512 key, which is really unfortunate.

177
00:20:10,370 --> 00:20:18,270
So we actually have an intern this year within my company who's actually looking more into this.

178
00:20:18,530 --> 00:20:30,270
And if you're at all interested in this, I'll publish a link to it on my Twitter feed with much more details on what's actually contained in the super transparency log when you look at the log as a whole.

179
00:20:31,950 --> 00:20:36,430
So, yeah, questions.

180
00:20:37,670 --> 00:20:39,150
Questions, anyone?

181
00:20:39,450 --> 00:20:44,590
If you have any questions, feel free to have the stage and feel free to come to the mic.

182
00:20:44,590 --> 00:20:45,230
Feel free.

183
00:20:53,060 --> 00:20:54,680
Oh, we got a question.

184
00:21:03,620 --> 00:21:14,900
I might have missed something in the beginning, but I think you showed examples of domains that were registered with those mixture of English and non-English characters.

185
00:21:14,920 --> 00:21:17,600
And then later you said that that's not allowed.

186
00:21:17,600 --> 00:21:19,420
Is that just something that changed?

187
00:21:19,660 --> 00:21:24,720
So it depends on which block you're looking for.

188
00:21:24,720 --> 00:21:37,340
So the reason why Canadian Aboriginal syllabics actually appeared in this list, I actually went back later and looked at that domain name, and it was two Canadian Aboriginal characters, not mixed with any English characters.

189
00:21:37,740 --> 00:21:46,920
But it simply, when it was passed through the Python package, looked like a, I believe it was like a BB character.

190
00:21:47,260 --> 00:21:48,560
The characters looked like Bs.

191
00:21:48,560 --> 00:21:54,520
And so it looked like bb.com as the English language equivalent.

192
00:21:54,920 --> 00:21:58,760
So that's why it actually appeared on this list, but you can't actually register the mixture.

193
00:22:00,380 --> 00:22:01,500
Thanks.

194
00:22:03,220 --> 00:22:10,440
So regarding the don't click links suggestion, do you have any recommendations for any other mitigation?

195
00:22:11,180 --> 00:22:16,760
Like, for example, say there's a 40-character hex thingy at the end of a URL.

196
00:22:16,860 --> 00:22:22,120
I don't think most users are going to type in everything, oh, oops, I mistyped the 23rd letter or something.

197
00:22:22,120 --> 00:22:23,580
They're just going to copy and paste it.

198
00:22:23,580 --> 00:22:26,060
So is there another way?

199
00:22:31,280 --> 00:22:32,560
It's a good question.

200
00:22:33,280 --> 00:22:36,340
It's really a question of trust, I feel like.

201
00:22:37,220 --> 00:22:38,560
Do you trust the recipient?

202
00:22:38,560 --> 00:22:44,020
Can you somehow verify that the link is valid in other ways?

203
00:22:45,040 --> 00:22:46,780
Or just cut and paste the end of it?

204
00:22:47,200 --> 00:22:48,560
And type in the start of it?

205
00:22:49,040 --> 00:22:51,840
It's an intractable problem at the end of the day.

206
00:22:51,900 --> 00:22:52,220
Right .

207
00:22:52,420 --> 00:22:53,580
Okay, thanks.

208
00:22:55,800 --> 00:22:57,640
Once again, Shamrp, everyone!

209
00:22:57,660 --> 00:22:58,420
Shamrp!