WEBVTT 00:00.000 --> 00:04.800 So, I guess, uh, we're a little, we're definitely early, we're definitely on the clock. 00:04.880 --> 00:11.120 Uh, welcome to Speaker Workshops, and now it is the, uh, 210 talk. 00:11.360 --> 00:17.260 And, uh, want to say, just have a little bit to say about, uh, our presenters, Sam Erb. 00:17.260 --> 00:28.780 So, Sam Erb, uh, just real quick, Councilor 9, and I, uh, also, I, uh, I think you're the very first black badge holder I know personally. 00:29.720 --> 00:32.940 Ooh, is, wait, is that a radio, that's radioactive, right? 00:32.940 --> 00:35.740 Is that the radioactive one, or thou shall not speak of it? 00:37.180 --> 00:38.800 Are we going to light this thing on fire? 00:49.010 --> 00:51.590 Uh, without much ado, Sam Erb! 00:53.930 --> 00:54.890 Thank you. 00:55.530 --> 01:00.870 Um, so, uh, long-time listener, first-time speaker, um, so let's get going. 01:00.930 --> 01:15.990 Uh, so, you're going to connect to the wrong domain name, so, um, for whatever reason for the past few years, I've been very interested in domain names, and, uh, this is kind of a look at some of the, um, different ways that you can be tricked, or your computer can be tricked, 01:15.990 --> 01:20.930 uh, or you can be phished to connect to, uh, the wrong domain name. 01:20.990 --> 01:37.570 Um, so, uh, a bit about myself, uh, software engineer, I work at a cool company called Akamai, uh, we're hiring people like you, I have to say that, uh, and, uh, I have a, uh, Defcon23 and Defcon24 Uber Black Badge with the Council of Nine. 01:37.930 --> 01:41.730 Um, yeah, that's me at closing ceremonies since last year. 01:42.290 --> 01:51.210 Um, a disclaimer, uh, the opinions expressed here are my own, and no one was phished in the creation of this presentation, which will become a bit more obvious later on. 01:52.330 --> 01:58.070 Um, yeah, so I'm going to start out from kind of least severe and kind of build up from there. 01:58.210 --> 02:02.170 Um, and so, just to get going, um, we have to start out with typosquatting. 02:02.170 --> 02:13.750 Humans aren't perfect, they're going to connect, they're going to mistype the domain name they type in, um, and a malicious person could register these and, uh, trick somebody into entering their bank credentials, for instance. 02:14.670 --> 02:21.070 So this example here is looking at all the one-keyboard-letter-off variants of americanexpress.com. 02:21.370 --> 02:32.350 If you actually look up the registration status of each of these, um, like the example here is qamericanexpress.com, all but two of them are actually currently registered, or actively registered, as of April, I believe. 02:33.930 --> 02:39.630 I did all this, most of the research here in April 2017, so that's roughly when all this data's from. 02:42.910 --> 02:56.850 So the reason why I chose americanexpress here is that it's long enough that no one's company name is going to be qamericanexpress.com, whereas with a shorter website, you might get some legitimate websites, whereas I could argue that none of these are actually legitimate. 02:58.570 --> 03:02.210 So, building up from there, we have to look at bit squatting. 03:02.350 --> 03:06.750 This is one where your computer is actually going to get the domain name wrong by flipping a bit. 03:07.490 --> 03:14.110 The example I gave here is I swapped a bit on Google Analytics, and I end up with Eagle Analytics. 03:15.630 --> 03:26.830 This is a very low-probability event, but as most phones and personal electronic devices don't have error-correcting memory, this happens at a non-zero rate across the internet. 03:28.210 --> 03:38.730 So, in order to give a demo for this talk, I actually wanted to register one of these domains, and so I actually searched for the 1-bit variants of GoogleAnalytics.com. 03:39.810 --> 03:46.710 Part of the reason for looking at GoogleAnalytics.com is you want a website that people are going to visit a lot, but not mistype. 03:47.210 --> 03:50.750 Google Analytics falls in that, as do most CDNs. 03:51.630 --> 03:54.890 When I searched for domains, this was the only one available. 03:55.650 --> 04:04.470 So, I went ahead and registered it, and I put up a server on it and got a TLS certificate for it. 04:04.530 --> 04:08.150 And within 24 hours, I saw two what I would call hits. 04:08.150 --> 04:10.570 One HTTP, one HTTPS. 04:11.350 --> 04:20.100 This is one Android browser and one Android application actually connecting to my server. 04:20.490 --> 04:33.290 If you actually go and look at the source website of where this came from, the source website says GoogleAnalytics.com, but something within their phone caused a bit to flip in such a way that they went to the wrong website. 04:34.290 --> 04:37.830 Now , one other thing, when I actually... 04:37.830 --> 04:42.990 So , with a very popular website, from what I've seen, this is about what to expect. 04:42.990 --> 04:45.290 You'll get a few random hits per day. 04:46.310 --> 04:48.390 Once I got these hits, I actually took this down. 04:48.390 --> 04:54.250 But when I turned on this website, I immediately was getting spammed by this one very particular domain name . 04:54.250 --> 05:06.190 So I went to it, and it was actually a Swedish diving company's website had somehow managed to mess up their Google Analytics tag to point to my website. 05:06.330 --> 05:09.810 So every person that was visiting their website was also connecting to this. 05:10.630 --> 05:13.350 That's a picture of the code at the bottom there. 05:13.350 --> 05:18.330 It's a little bit hard to read from a distance, but it's pointing to EagleAnalytics.com. 05:20.690 --> 05:21.650 Yeah. 05:25.310 --> 05:29.650 So that's just an example of how to do this. 05:30.930 --> 05:36.370 If you're looking for more information on this, there's actually a really great white paper that Cisco put out. 05:36.370 --> 05:39.670 And I believe it's actually on DefCon.org, if you search for it. 05:41.790 --> 05:43.510 Or sorry, no, that's something later. 05:43.510 --> 05:44.590 I'm getting these confused. 05:44.790 --> 05:47.530 There was a talk at DC19 on this, I believe. 05:47.530 --> 05:48.410 That's what it was. 05:49.390 --> 05:49.930 Yeah. 05:50.570 --> 06:11.430 And so, being familiar with BitSquadian, I wanted to look at some other variants of BitSquadian. 06:11.430 --> 06:21.170 And one thing that I noticed is that there have been some recent registered top-level domain names, or TLDs, that actually BitSquad on other TLDs. 06:21.410 --> 06:29.530 So in this case, the registrar requested .got, which BitSquad's .gov. 06:29.530 --> 06:35.930 I reported that one in April of 2016 to the registrar, and they claimed to have implemented a fix. 06:36.910 --> 06:40.270 It's not actually testable right now, because you can't actually register those domains. 06:40.270 --> 06:44.930 But that's a very tractable problem, because there's a limited number of .gov websites. 06:44.930 --> 06:53.730 However, a recent one, which is .bom, actually BitSquads all of .com, which is a much more intractable problem, as there are a large number of .com domain names. 06:55.690 --> 07:06.110 A funny thing about .bom is that it was actually objected to by VeriSign, because it looks too similar to .com, and that objection was overruled, but it also BitSquads on .com, which is very unfortunate. 07:07.150 --> 07:13.990 I know it didn't report that one, as I'm not sure what value there would be from reporting that. 07:19.110 --> 07:26.130 This is actually something that was mentioned in the Cisco white paper, but these are more recent TLDs from that point. 07:33.050 --> 07:37.290 BitSquatting, like I said before, it only really targets random end-users. 07:37.290 --> 07:42.490 You can't really target a specific user with it, but you could target a user base, such as a bank. 07:42.490 --> 07:45.470 If you could only steal a few credentials per day, that could still be a lot of money. 07:45.470 --> 07:54.970 Or if you're BitSquatting a .gov website, that could get you a few inbound emails to intelligence agency per day, which could be significant. 07:57.910 --> 07:59.330 Going to the next slide... 08:01.110 --> 08:03.490 I'm getting a bit more serious. 08:05.090 --> 08:10.190 A lot of the reason why I gave this talk, actually, is I wanted to look at IDN homoglyphs. 08:10.190 --> 08:15.890 Homoglyphs are two characters that look the same, but have different meanings. 08:16.570 --> 08:23.710 IDN is an internationalized domain name, which is something that, if you're an English language speaker, you might not come across very often. 08:26.570 --> 08:38.290 Depending on your browser, you'll either see their source piny code, which is xn dash dash, or the ASCII equivalent of that. 08:39.070 --> 08:48.510 Piny code is a way to encode a larger character set into a smaller space. 08:48.510 --> 08:52.250 In the format that's used, you have the xn dash dash identifier. 08:52.710 --> 09:03.890 This is all standardized, followed by the English alphabet letters, or standard letters, followed by a dash, followed by... 09:06.270 --> 09:10.470 There's a standardized algorithm for actually computing what comes after that. 09:11.630 --> 09:13.850 There's an RFC on it and everything. 09:14.490 --> 09:17.170 I'm not going to give a great explanation of that, so I won't. 09:17.810 --> 09:20.130 With that, you can end up with a... 09:20.130 --> 09:26.750 That same machine will determine which letter and what location it will get placed into the URL that gets rendered. 09:28.510 --> 09:30.790 I gave two examples here. 09:31.430 --> 09:33.770 These are actually both registered domain names. 09:33.770 --> 09:38.030 Google.com, where both the O's are Cyrillic O's. 09:39.530 --> 09:41.830 I believe they're Cyrillic O's. 09:41.830 --> 09:43.190 It might be Latin, sorry. 09:43.590 --> 09:48.290 And Time.com, where every letter is actually from the Cyrillic alphabet. 09:51.270 --> 09:52.910 I'll show you how I found those later. 09:52.910 --> 09:55.450 Those are both actually registered domain names. 09:58.270 --> 10:04.930 I wanted to conduct a survey of existing homoglyphs and IDN domain names against popular.com domain names. 10:04.930 --> 10:08.570 I wanted to look for people who were impersonating .com domain names. 10:08.570 --> 10:14.490 I chose to focus on .com, as that's where most of the popular English language websites are. 10:14.650 --> 10:17.710 I only speak English, so I'm very limited there. 10:17.890 --> 10:20.930 There's really three options if you want to gather a large number of domain names. 10:21.010 --> 10:24.250 One is you could get the zone files for .com. 10:24.250 --> 10:28.230 That requires filling out a form, which really isn't that fun. 10:28.630 --> 10:35.750 And some of the zone files are actually impossible to acquire, such as North Korea's, who actually leaked, I believe, last year. 10:36.650 --> 10:40.670 You could go to Certificate of Transparency, which is a log of certificates. 10:41.850 --> 10:43.370 Or you could go to a third party. 10:43.370 --> 10:47.690 And there are third parties where you could pay a few hundred dollars and get a list of domain names, but that isn't that fun either. 10:47.690 --> 10:49.830 So I chose to go with Certificate of Transparency. 10:50.070 --> 10:53.170 And for this, I pulled down the Google pilot log. 10:53.170 --> 10:55.930 This contains about 100 million certificates. 10:56.590 --> 11:01.170 That's 96.5 million domain names, roughly. 11:01.170 --> 11:04.290 This is also completely searchable if you go to cert.sh. 11:05.010 --> 11:13.170 Certificate of Transparency, if you haven't heard of it before, is an initiative to log every publicly trusted certificate on the internet. 11:13.910 --> 11:16.410 It's largely a Google initiative. 11:18.190 --> 11:21.730 But there are logs hosted by other companies. 11:21.730 --> 11:25.550 I chose the Google pilot log, simply as it's the largest right now. 11:30.390 --> 11:32.590 There's another reason that I wanted to use Certificate of Transparency. 11:32.590 --> 11:37.270 If a certificate was registered, that means it's far more likely to have been used. 11:38.810 --> 11:46.030 Especially with the bit-squatting and typo-squatting domain names, a large number of these are registered but never actually utilized, which I found interesting. 11:49.530 --> 11:51.590 In order to use the CT log, I built a pipeline. 11:51.590 --> 11:58.230 I pulled out the common domain and subject-alternative domain fields from that. 11:58.230 --> 12:02.430 I then filtered out all of the PunyCode domain names. 12:04.010 --> 12:21.190 There's a great Python library called unidecode-package, where somebody actually went through and said what each Unicode character looks like, what its ASCII equivalent looks like, and actually went through character by character and did that, which is a great amount of work. 12:21.190 --> 12:22.310 It's very impressive. 12:23.290 --> 12:30.310 So that maps ASCII letters to what looks like their English equivalent. 12:30.470 --> 12:34.710 I then cross-referenced that list with the Alexa top 1 million domain names. 12:34.910 --> 12:45.030 At the end of the day, I got 1900 CT certificates that impersonated the Alexa top 1 million domain names. 12:45.030 --> 12:57.170 I then also went ahead and modified the Chromium unit test to check whether or not they would actually be rendered as PunyCode or whether an end user would see xn dash dash. 12:59.210 --> 13:06.970 In Chrome and Firefox right now, that test is actually standardized across all languages, so this would be applicable to all end users. 13:07.470 --> 13:19.670 In other browsers, I believe Internet Explorer or Microsoft will take into account your local language to determine whether or not you actually render the PunyCode variant. 13:20.950 --> 13:23.050 I've actually posted that list online. 13:23.350 --> 13:27.450 There are a few false positives in there, like there are valid websites. 13:27.590 --> 13:39.930 They just simply happen to look like their English equivalent website, but I chose to include those as I didn't want to actually filter all of these. 13:42.510 --> 13:45.510 What is much more interesting is actually showing the results. 13:46.070 --> 13:48.570 These are all real domain names. 13:48.570 --> 13:50.910 I would encourage you not to visit any of these. 13:52.090 --> 14:00.810 There are some really bad ones in here in that list, unfortunately, and I spent a decent amount of time actually reporting phishing websites to the Google phishing page. 14:04.370 --> 14:09.710 These are just some of the worst ones that I saw grouped by what character they used. 14:10.430 --> 14:21.450 There's a Latin small letter K, and the L with a stroke looked pretty bad, and then the dotless I was one of my personal favorites. 14:21.450 --> 14:23.410 I didn't know that was actually a thing before this. 14:23.850 --> 14:31.330 That's actually part of the reason why I took this approach, was I'm not an ASCII expert, if there even is such a thing. 14:31.550 --> 14:43.950 I really tried to go about finding the worst abusers without having to necessarily have a knowledge of ASCII in the first place, or knowing which letters to look for. 14:48.290 --> 14:54.410 As expected, the most popular websites towards the top of the list were much more likely to actually be impersonated. 14:55.210 --> 14:59.970 One of the more interesting things that I saw, which actually bypassed the Chromium check. 15:00.670 --> 15:07.970 The formatting here is the last entry in that field, whether or not it bypassed the Chromium check. 15:07.970 --> 15:11.490 In this case, they'd actually be rendered as time.com. 15:12.170 --> 15:20.070 They only used Cyrillic characters to represent the English equivalent. 15:24.090 --> 15:27.910 A breakdown of the Unicode blocks that I observed while going through this. 15:29.070 --> 15:39.770 Latin and Cyrillic are kind of as expected, but there was a long tail, and I really want to call out one at the very end, which is the Canadian Aboriginal Celbic Unicode block. 15:39.770 --> 15:43.270 That one really struck me as odd, as I wasn't really familiar with what that was. 15:43.290 --> 15:48.730 I went ahead and I looked at that Unicode block, and the characters that are contained in it. 15:50.730 --> 16:01.630 I went ahead and made a bunch of sample domain names, and I plugged them into the Firefox and Chrome browser, and they weren't converted to their Unicode equivalent. 16:02.650 --> 16:05.310 None of these were actually registered. 16:06.210 --> 16:13.330 I simply tested whether or not they bypassed the Firefox and Chromium check, and then went ahead and reported security bugs. 16:14.690 --> 16:25.990 The end result of this was that Chromium actually will now not allow the mixture of Canadian Aboriginal Celbic characters and English characters, which they did before. 16:25.990 --> 16:33.730 And they're actually working on a much more comprehensive anti-phishing fix, which I believe is still a work in progress. 16:35.210 --> 16:53.430 Within Firefox, this check is a bit more interesting, because Canadian Aboriginal Celbics actually fell under this thing called aspirational Unicode blocks, which allowed them to be mixed as part of the standard Firefox profile with their English language characters. 16:53.990 --> 17:09.110 And in order to resolve this issue, they simply increased the level of that check to disallow a mixture of English characters and this aspirational character block. 17:09.390 --> 17:15.070 And I believe they actually filed a request with some... 17:15.070 --> 17:28.290 I'm not exactly sure what agency tracks this, some external request to actually update the rules regarding this aspirational block, as some of the characters do look like English characters. 17:30.050 --> 17:38.530 So as was news to me and the Firefox and Chromium engineers, who actually were working on the fixes for these, you can't actually register any of these domain names. 17:39.090 --> 17:42.030 And this is where, believe it or not, policy comes to the rescue. 17:42.090 --> 17:46.750 When you try to register any of these domains, you're stopped. 17:51.090 --> 18:03.650 The reason for this is that VeriSign actually has a policy that you can't mix Canadian original syllabic characters with certain other characters, which includes English language characters. 18:03.650 --> 18:08.710 And they have this for every Unicode block, which I was completely unfamiliar with. 18:08.810 --> 18:19.010 One of the more interesting things about this is when I actually tried to register these domain names, because this is a failure at such a late stage in the registrar process, most registrars actually took my money. 18:19.110 --> 18:21.690 And in one case, I actually had to fight to get it back. 18:22.170 --> 18:23.530 I wasn't the biggest fan of that. 18:25.610 --> 18:34.190 So I kind of walked through three different examples of different ways that you or your computer could connect to the wrong domain name. 18:34.430 --> 18:37.110 So now we're just going to look at personal mitigations. 18:37.630 --> 18:39.790 I'm kind of preaching to the choir here. 18:40.490 --> 18:45.890 So the reason to use a password manager is simply because your computer won't be confused by any of this. 18:46.470 --> 18:53.630 However, if you actually own or are responsible for any popular domain name, it's probably worth looking into whether or not somebody's impersonating you. 18:53.770 --> 18:59.470 You could actually file an ICANN complaint and issue a takedown request, especially if your trademark's being violated. 19:00.190 --> 19:14.830 And if you work in IT or are at all curious, I would be... something that's worth checking is what happens when you plug these into your email client. 19:14.830 --> 19:15.950 What renders. 19:18.610 --> 19:20.810 Yeah, that's probably going to depend on the email client. 19:24.350 --> 19:31.090 So as I had the super transparency log, I went ahead and just had some fun with it. 19:31.090 --> 19:33.330 I graphed the key types over time. 19:33.330 --> 19:40.470 RSA 2K keys dominate, followed by ECJSA P26 keys, and then RSA 4K keys. 19:42.610 --> 19:53.090 There was also this fun long tail, which proves that when you give users options, you can always trust them to be consistent. 19:53.630 --> 20:00.570 Some of my favorite ones in there is somebody actually issued an RSA 500 key, and there's also an RSA 2600 key as well. 20:03.010 --> 20:07.830 And at the very end there, there's a DSA 512 key, which is really unfortunate. 20:10.370 --> 20:18.270 So we actually have an intern this year within my company who's actually looking more into this. 20:18.530 --> 20:30.270 And if you're at all interested in this, I'll publish a link to it on my Twitter feed with much more details on what's actually contained in the super transparency log when you look at the log as a whole. 20:31.950 --> 20:36.430 So, yeah, questions. 20:37.670 --> 20:39.150 Questions, anyone? 20:39.450 --> 20:44.590 If you have any questions, feel free to have the stage and feel free to come to the mic. 20:44.590 --> 20:45.230 Feel free. 20:53.060 --> 20:54.680 Oh, we got a question. 21:03.620 --> 21:14.900 I might have missed something in the beginning, but I think you showed examples of domains that were registered with those mixture of English and non-English characters. 21:14.920 --> 21:17.600 And then later you said that that's not allowed. 21:17.600 --> 21:19.420 Is that just something that changed? 21:19.660 --> 21:24.720 So it depends on which block you're looking for. 21:24.720 --> 21:37.340 So the reason why Canadian Aboriginal syllabics actually appeared in this list, I actually went back later and looked at that domain name, and it was two Canadian Aboriginal characters, not mixed with any English characters. 21:37.740 --> 21:46.920 But it simply, when it was passed through the Python package, looked like a, I believe it was like a BB character. 21:47.260 --> 21:48.560 The characters looked like Bs. 21:48.560 --> 21:54.520 And so it looked like bb.com as the English language equivalent. 21:54.920 --> 21:58.760 So that's why it actually appeared on this list, but you can't actually register the mixture. 22:00.380 --> 22:01.500 Thanks. 22:03.220 --> 22:10.440 So regarding the don't click links suggestion, do you have any recommendations for any other mitigation? 22:11.180 --> 22:16.760 Like, for example, say there's a 40-character hex thingy at the end of a URL. 22:16.860 --> 22:22.120 I don't think most users are going to type in everything, oh, oops, I mistyped the 23rd letter or something. 22:22.120 --> 22:23.580 They're just going to copy and paste it. 22:23.580 --> 22:26.060 So is there another way? 22:31.280 --> 22:32.560 It's a good question. 22:33.280 --> 22:36.340 It's really a question of trust, I feel like. 22:37.220 --> 22:38.560 Do you trust the recipient? 22:38.560 --> 22:44.020 Can you somehow verify that the link is valid in other ways? 22:45.040 --> 22:46.780 Or just cut and paste the end of it? 22:47.200 --> 22:48.560 And type in the start of it? 22:49.040 --> 22:51.840 It's an intractable problem at the end of the day. 22:51.900 --> 22:52.220 Right . 22:52.420 --> 22:53.580 Okay, thanks. 22:55.800 --> 22:57.640 Once again, Shamrp, everyone! 22:57.660 --> 22:58.420 Shamrp!