start	end	text
0	4800	So, I guess, uh, we're a little, we're definitely early, we're definitely on the clock.
4880	13080	Uh, welcome to Speaker Workshops, and now it is the, uh, 210 talk. And, uh,
13080	18980	want to say, just have a little bit to say about, uh, our presenters, Sam Erb. So, Sam Erb, uh,
18980	26940	just real quick, Councilor 9, and I, uh, also, I, uh, I think you're the very first black badge
26940	33300	holder I know personally. Ooh, is, wait, is that a radio, that's radioactive, right? Is that the
33300	38800	radioactive one, or thou shall not speak of it? Are we going to light this thing on fire?
49010	51590	Uh, without much ado, Sam Erb!
53930	60870	Thank you. Um, so, uh, long-time listener, first-time speaker, um, so let's get going.
60930	65350	Uh, so, you're going to connect to the wrong domain name, so, um, for whatever
65350	69630	reason for the past few years, I've been very interested in domain names, and, uh,
69630	74430	this is kind of a look at some of the, um, different ways that you can be tricked,
74430	80930	or your computer can be tricked, uh, or you can be phished to connect to, uh, the wrong domain name.
80990	88290	Um, so, uh, a bit about myself, uh, software engineer, I work at a cool company called Akamai,
88290	93690	uh, we're hiring people like you, I have to say that, uh, and, uh, I have a, uh,
93690	97570	Defcon23 and Defcon24 Uber Black Badge with the Council of Nine.
97930	101730	Um, yeah, that's me at closing ceremonies since last year.
102290	107830	Um, a disclaimer, uh, the opinions expressed here are my own, and no one was phished in
107830	111210	the creation of this presentation, which will become a bit more obvious later on.
112330	118070	Um, yeah, so I'm going to start out from kind of least severe and kind of build up from there.
118210	122170	Um, and so, just to get going, um, we have to start out with typosquatting.
122170	126250	Humans aren't perfect, they're going to connect, they're going to mistype the domain name they
126250	131950	type in, um, and a malicious person could register these and, uh, trick somebody into
131950	133750	entering their bank credentials, for instance.
134670	141070	So this example here is looking at all the one-keyboard-letter-off variants of americanexpress.com.
141370	145490	If you actually look up the registration status of each of these, um, like the example here
145490	149250	is qamericanexpress.com, all but two of them are actually currently registered,
149250	152350	or actively registered, as of April, I believe.
153930	158610	I did all this, most of the research here in April 2017, so that's roughly when all
158610	159630	this data's from.
162910	166810	So the reason why I chose americanexpress here is that it's long enough that no one's
166810	171550	company name is going to be qamericanexpress.com, whereas with a shorter website, you might
171550	176850	get some legitimate websites, whereas I could argue that none of these are actually legitimate.
178570	182210	So, building up from there, we have to look at bit squatting.
182350	185950	This is one where your computer is actually going to get the domain name wrong by flipping
186090	186750	a bit.
187490	192950	The example I gave here is I swapped a bit on Google Analytics, and I end up with Eagle
192950	194110	Analytics.
195630	202610	This is a very low-probability event, but as most phones and personal electronic devices
202610	206830	don't have error-correcting memory, this happens at a non-zero rate across the internet.
208210	212890	So, in order to give a demo for this talk, I actually wanted to register one of these
212890	218730	domains, and so I actually searched for the 1-bit variants of GoogleAnalytics.com.
219810	224250	Part of the reason for looking at GoogleAnalytics.com is you want a website that people are going
224250	226710	to visit a lot, but not mistype.
227210	230750	Google Analytics falls in that, as do most CDNs.
231630	234890	When I searched for domains, this was the only one available.
235650	243430	So, I went ahead and registered it, and I put up a server on it and got a TLS certificate
243430	244470	for it.
244530	248150	And within 24 hours, I saw two what I would call hits.
248150	250570	One HTTP, one HTTPS.
251350	260100	This is one Android browser and one Android application actually connecting to my server.
260490	264530	If you actually go and look at the source website of where this came from,
264530	269890	the source website says GoogleAnalytics.com, but something within their phone caused a
269890	274290	bit to flip in such a way that they went to the wrong website.
275730	277830	Now, one other thing, when I actually...
277830	283230	So, with a very popular website, from what I've seen, this is about what to expect.
283230	286790	You'll get a few random hits per day.
286790	289490	Once I got these hits, I actually took this down.
289490	293850	But when I turned on this website, I immediately was getting spammed by this one very particular
293850	294250	domain name.
294250	301090	So I went to it, and it was actually a Swedish diving company's website had somehow managed
301090	306190	to mess up their Google Analytics tag to point to my website.
306330	309810	So every person that was visiting their website was also connecting to this.
310630	313350	That's a picture of the code at the bottom there.
313350	318330	It's a little bit hard to read from a distance, but it's pointing to EagleAnalytics.com.
320690	321650	Yeah.
325310	329650	So that's just an example of how to do this.
330930	334230	If you're looking for more information on this, there's actually a really great white
334230	336370	paper that Cisco put out.
336370	339670	And I believe it's actually on DefCon.org, if you search for it.
341790	343510	Or sorry, no, that's something later.
343510	344590	I'm getting these confused.
344790	347530	There was a talk at DC19 on this, I believe.
347530	348410	That's what it was.
349390	349930	Yeah.
350570	370590	And so, being familiar with BitSquadian, I wanted to look at some other variants of
370590	371430	BitSquadian.
371430	376650	And one thing that I noticed is that there have been some recent registered top-level
376650	381170	domain names, or TLDs, that actually BitSquad on other TLDs.
381410	389530	So in this case, the registrar requested .got, which BitSquad's .gov.
389530	395210	I reported that one in April of 2016 to the registrar, and they claimed to have implemented
395410	395930	a fix.
396910	400270	It's not actually testable right now, because you can't actually register those domains.
400270	404930	But that's a very tractable problem, because there's a limited number of .gov websites.
404930	410230	However, a recent one, which is .bom, actually BitSquads all of .com, which is a much more
410230	413730	intractable problem, as there are a large number of .com domain names.
415690	419830	A funny thing about .bom is that it was actually objected to by VeriSign, because it looks
419830	424710	too similar to .com, and that objection was overruled, but it also BitSquads on .com,
424710	426110	which is very unfortunate.
427150	433370	I know it didn't report that one, as I'm not sure what value there would be from reporting
433370	433990	that.
439110	443950	This is actually something that was mentioned in the Cisco white paper, but these are more
443950	446130	recent TLDs from that point.
453050	457290	BitSquatting, like I said before, it only really targets random end-users.
457290	460850	You can't really target a specific user with it, but you could target a user base, such
460850	462490	as a bank.
462490	465470	If you could only steal a few credentials per day, that could still be a lot of money.
465470	471350	Or if you're BitSquatting a .gov website, that could get you a few inbound emails to
471990	474970	intelligence agency per day, which could be significant.
477910	479330	Going to the next slide...
481110	483490	I'm getting a bit more serious.
485090	490190	A lot of the reason why I gave this talk, actually, is I wanted to look at IDN homoglyphs.
490190	495890	Homoglyphs are two characters that look the same, but have different meanings.
496570	500410	IDN is an internationalized domain name, which is something that, if you're an English language
500410	503710	speaker, you might not come across very often.
506570	514830	Depending on your browser, you'll either see their source piny code, which is xn dash dash,
514830	518290	or the ASCII equivalent of that.
519070	528510	Piny code is a way to encode a larger character set into a smaller space.
528510	532250	In the format that's used, you have the xn dash dash identifier.
532710	541690	This is all standardized, followed by the English alphabet letters, or standard letters,
541690	543890	followed by a dash, followed by...
546270	550470	There's a standardized algorithm for actually computing what comes after that.
551630	553850	There's an RFC on it and everything.
554490	557170	I'm not going to give a great explanation of that, so I won't.
557810	560130	With that, you can end up with a...
560130	563930	That same machine will determine which letter and what location it will get placed into the
565190	566750	URL that gets rendered.
568510	570790	I gave two examples here.
571430	573770	These are actually both registered domain names.
573770	578030	Google.com, where both the O's are Cyrillic O's.
579530	581830	I believe they're Cyrillic O's.
581830	583190	It might be Latin, sorry.
583590	588290	And Time.com, where every letter is actually from the Cyrillic alphabet.
591270	592910	I'll show you how I found those later.
592910	595450	Those are both actually registered domain names.
598270	601570	I wanted to conduct a survey of existing homoglyphs
602230	604930	and IDN domain names against popular.com domain names.
604930	608570	I wanted to look for people who were impersonating .com domain names.
608570	614490	I chose to focus on .com, as that's where most of the popular English language websites are.
614650	617710	I only speak English, so I'm very limited there.
617890	620930	There's really three options if you want to gather a large number of domain names.
621010	624250	One is you could get the zone files for .com.
624250	628230	That requires filling out a form, which really isn't that fun.
628630	631510	And some of the zone files are actually impossible to acquire,
631950	635750	such as North Korea's, who actually leaked, I believe, last year.
636650	640670	You could go to Certificate of Transparency, which is a log of certificates.
641850	643370	Or you could go to a third party.
643370	644950	And there are third parties where you could pay a few hundred dollars
644950	647690	and get a list of domain names, but that isn't that fun either.
647690	649830	So I chose to go with Certificate of Transparency.
650070	653170	And for this, I pulled down the Google pilot log.
653170	655930	This contains about 100 million certificates.
656590	661170	That's 96.5 million domain names, roughly.
661170	664290	This is also completely searchable if you go to cert.sh.
665010	668310	Certificate of Transparency, if you haven't heard of it before,
668310	673170	is an initiative to log every publicly trusted certificate on the internet.
673910	676410	It's largely a Google initiative.
678190	681730	But there are logs hosted by other companies.
681730	685550	I chose the Google pilot log, simply as it's the largest right now.
690390	692590	There's another reason that I wanted to use Certificate of Transparency.
692590	697270	If a certificate was registered, that means it's far more likely to have been used.
698810	701810	Especially with the bit-squatting and typo-squatting domain names,
701970	704750	a large number of these are registered but never actually utilized,
704750	706030	which I found interesting.
709530	711590	In order to use the CT log, I built a pipeline.
711590	718230	I pulled out the common domain and subject-alternative domain fields from that.
718230	722430	I then filtered out all of the PunyCode domain names.
724010	727950	There's a great Python library called unidecode-package,
727950	732990	where somebody actually went through and said what each Unicode character looks like,
732990	737010	what its ASCII equivalent looks like,
737010	739370	and actually went through character by character and did that,
739370	741190	which is a great amount of work.
741190	742310	It's very impressive.
743290	750310	So that maps ASCII letters to what looks like their English equivalent.
750470	754710	I then cross-referenced that list with the Alexa top 1 million domain names.
754910	760650	At the end of the day, I got 1900 CT certificates that impersonated
762490	765030	the Alexa top 1 million domain names.
765030	770030	I then also went ahead and modified the Chromium unit test
770650	773870	to check whether or not they would actually be rendered as PunyCode
773870	777170	or whether an end user would see xn dash dash.
779210	784890	In Chrome and Firefox right now, that test is actually standardized across all languages,
784890	786970	so this would be applicable to all end users.
787470	791670	In other browsers, I believe Internet Explorer or Microsoft
791670	796610	will take into account your local language to determine whether or not
796610	799670	you actually render the PunyCode variant.
800950	803050	I've actually posted that list online.
803350	807450	There are a few false positives in there, like there are valid websites.
807590	814170	They just simply happen to look like their English equivalent website,
814170	819930	but I chose to include those as I didn't want to actually filter all of these.
822510	825510	What is much more interesting is actually showing the results.
826070	828570	These are all real domain names.
828570	830910	I would encourage you not to visit any of these.
832090	835610	There are some really bad ones in here in that list, unfortunately,
835610	838050	and I spent a decent amount of time actually reporting phishing websites
838050	840810	to the Google phishing page.
844370	849710	These are just some of the worst ones that I saw grouped by what character they used.
850430	857470	There's a Latin small letter K, and the L with a stroke looked pretty bad,
857470	861450	and then the dotless I was one of my personal favorites.
861450	863410	I didn't know that was actually a thing before this.
863850	865550	That's actually part of the reason why I took this approach,
865550	871330	was I'm not an ASCII expert, if there even is such a thing.
871550	877190	I really tried to go about finding the worst abusers
877190	880890	without having to necessarily have a knowledge of ASCII in the first place,
881730	883950	or knowing which letters to look for.
888290	891830	As expected, the most popular websites towards the top of the list
891830	894410	were much more likely to actually be impersonated.
895210	897370	One of the more interesting things that I saw,
897370	899970	which actually bypassed the Chromium check.
900670	905770	The formatting here is the last entry in that field,
905770	907970	whether or not it bypassed the Chromium check.
907970	911490	In this case, they'd actually be rendered as time.com.
912170	920070	They only used Cyrillic characters to represent the English equivalent.
924090	927910	A breakdown of the Unicode blocks that I observed while going through this.
929070	932950	Latin and Cyrillic are kind of as expected, but there was a long tail,
932950	934850	and I really want to call out one at the very end,
934850	939770	which is the Canadian Aboriginal Celbic Unicode block.
939770	943270	That one really struck me as odd, as I wasn't really familiar with what that was.
943290	946890	I went ahead and I looked at that Unicode block,
946890	948730	and the characters that are contained in it.
950730	953570	I went ahead and made a bunch of sample domain names,
953570	958530	and I plugged them into the Firefox and Chrome browser,
958530	961630	and they weren't converted to their Unicode equivalent.
962650	965310	None of these were actually registered.
966210	970410	I simply tested whether or not they bypassed the Firefox and Chromium check,
970410	973330	and then went ahead and reported security bugs.
974690	981310	The end result of this was that Chromium actually will now not allow
981310	984770	the mixture of Canadian Aboriginal Celbic characters and English characters,
984770	985990	which they did before.
985990	989930	And they're actually working on a much more comprehensive anti-phishing fix,
989930	993730	which I believe is still a work in progress.
995210	1000030	Within Firefox, this check is a bit more interesting,
1000030	1003950	because Canadian Aboriginal Celbics actually fell under this thing called
1006330	1008930	aspirational Unicode blocks, which allowed them to be mixed
1008930	1013430	as part of the standard Firefox profile with their English language characters.
1013990	1020890	And in order to resolve this issue, they simply increased the level of that check
1020890	1029110	to disallow a mixture of English characters and this aspirational character block.
1029390	1035070	And I believe they actually filed a request with some...
1035070	1037530	I'm not exactly sure what agency tracks this,
1037530	1045870	some external request to actually update the rules regarding this aspirational block,
1045870	1048290	as some of the characters do look like English characters.
1050050	1053770	So as was news to me and the Firefox and Chromium engineers,
1053770	1055930	who actually were working on the fixes for these,
1055930	1058530	you can't actually register any of these domain names.
1059090	1062030	And this is where, believe it or not, policy comes to the rescue.
1062090	1065230	When you try to register any of these domains,
1065230	1066750	you're stopped.
1071090	1074590	The reason for this is that VeriSign actually has a policy
1074590	1081590	that you can't mix Canadian original syllabic characters with certain other characters,
1081590	1083650	which includes English language characters.
1083650	1088710	And they have this for every Unicode block, which I was completely unfamiliar with.
1088810	1090430	One of the more interesting things about this
1090430	1093050	is when I actually tried to register these domain names,
1093050	1097050	because this is a failure at such a late stage in the registrar process,
1097050	1099010	most registrars actually took my money.
1099110	1101690	And in one case, I actually had to fight to get it back.
1102170	1103530	I wasn't the biggest fan of that.
1105610	1109090	So I kind of walked through three different examples of different ways that
1111270	1114190	you or your computer could connect to the wrong domain name.
1114430	1117110	So now we're just going to look at personal mitigations.
1117630	1119790	I'm kind of preaching to the choir here.
1120490	1122930	So the reason to use a password manager is simply because
1122930	1125890	your computer won't be confused by any of this.
1126470	1130450	However, if you actually own or are responsible for any popular domain name,
1130450	1133630	it's probably worth looking into whether or not somebody's impersonating you.
1133770	1137510	You could actually file an ICANN complaint and issue a takedown request,
1137510	1139470	especially if your trademark's being violated.
1140190	1147710	And if you work in IT or are at all curious,
1147710	1150690	I would be... something that's worth checking is what happens
1150690	1154830	when you plug these into your email client.
1154830	1155950	What renders.
1158610	1160810	Yeah, that's probably going to depend on the email client.
1164350	1171090	So as I had the super transparency log, I went ahead and just had some fun with it.
1171090	1173330	I graphed the key types over time.
1173330	1180470	RSA 2K keys dominate, followed by ECJSA P26 keys, and then RSA 4K keys.
1182610	1185710	There was also this fun long tail, which proves that
1186850	1193090	when you give users options, you can always trust them to be consistent.
1193630	1197430	Some of my favorite ones in there is somebody actually issued an RSA 500 key,
1198130	1200570	and there's also an RSA 2600 key as well.
1203010	1207830	And at the very end there, there's a DSA 512 key, which is really unfortunate.
1210370	1218270	So we actually have an intern this year within my company who's actually looking more into this.
1218530	1222910	And if you're at all interested in this, I'll publish a link to it on my Twitter feed
1224010	1228290	with much more details on what's actually contained in the super transparency log
1228290	1230270	when you look at the log as a whole.
1231950	1236430	So, yeah, questions.
1237670	1240890	Questions, anyone? If you have any questions,
1240890	1244590	feel free to have the stage and feel free to come to the mic.
1244590	1245230	Feel free.
1253060	1254680	Oh, we got a question.
1263620	1268540	I might have missed something in the beginning, but I think you showed examples of
1268540	1274900	domains that were registered with those mixture of English and non-English characters.
1274920	1279420	And then later you said that that's not allowed. Is that just something that changed?
1279660	1284720	So it depends on which block you're looking for.
1284720	1289120	So the reason why Canadian Aboriginal syllabics actually appeared in this list,
1289120	1291820	I actually went back later and looked at that domain name,
1291820	1297340	and it was two Canadian Aboriginal characters, not mixed with any English characters.
1297740	1301800	But it simply, when it was passed through the Python package,
1301800	1306920	looked like a, I believe it was like a BB character.
1307260	1308560	The characters looked like Bs.
1308560	1314520	And so it looked like bb.com as the English language equivalent.
1314920	1318760	So that's why it actually appeared on this list, but you can't actually register the mixture.
1320380	1321500	Thanks.
1323220	1326200	So regarding the don't click links suggestion,
1326200	1330440	do you have any recommendations for any other mitigation?
1331180	1336760	Like, for example, say there's a 40-character hex thingy at the end of a URL.
1336860	1339280	I don't think most users are going to type in everything,
1339280	1342120	oh, oops, I mistyped the 23rd letter or something.
1342120	1343580	They're just going to copy and paste it.
1343580	1346060	So is there another way?
1351280	1352560	It's a good question.
1353280	1356340	It's really a question of trust, I feel like.
1357220	1358560	Do you trust the recipient?
1358560	1364020	Can you somehow verify that the link is valid in other ways?
1365040	1366780	Or just cut and paste the end of it?
1367200	1368560	And type in the start of it?
1369040	1371840	It's an intractable problem at the end of the day.
1371900	1372220	Right.
1372420	1373580	Okay, thanks.
1375800	1377640	Once again, Shamrp, everyone!
1377660	1378420	Shamrp!