Reference: What's in a name?

Test A-R53-8 specifically looks for Domains that are due to expire within the next 90 days that do not have any form of auto renewal. We reference the risk for expired domains to get squatted whereby a third party captures the domain and utilises it for ransom, SEO capture or other nefarious schemes. However, there’s an additional level of risk in the data that the domain has implicit ownership over that has been proven by other researchers in the field.

Concept ¶

Inti De Ceukelaire purchased over 100 domains that were tied to companies, institutions and municipalities that were no longer active. For example, the Belgian municipality of Overpelt was merged with Neerpelt to become Pelt leaving overpelt.be available for purchase. Many domains like this were researched and purchased by Inti.

Impact ¶

Shortly after purchasing the domains Inti researched and configured known email addresses with his email provider for each domain. Over a period of two days Inti recieved active emails sent to those email addresses as well as request password resets to major platforms for the researched email accounts. this included:

• 80 Dropbox accounts
• 142 Google Drive Accounts
• 57 Microsoft Accounts
• 12+ Smartschool and Doccle accounts

Upon proving the concept of his research Inti ceased further activity.

Expansion ¶

Inti’s research was responsible and completed early after proving the impact of squatted domains. An attacker can expand upon this compromise to do the following:

• Implement an email server that accepts all inbound email addresses whether they existed previously or not. This removes the need for researching previous active email addresses and allows for full capture of all inbound email traffic. Each address could potentially be tied to a third party account and data.
• Restore the original website and accept traffic and queries intended for the new domain. In Inti’s article a number of expired domains were simply capturing SEO links however a skilled and targeted attacker would be able to restore the original site and even act as a man in the middle attack proxying legitimate requests to the new domain
• Offer or utilise identity theft services to use official domains for access and identification purposes. A mild example would include use of .edu domains to acquire and sell on education discounts. A more serious matter would include impersonation of exposed persons by mimicking their identity using email accounts administered on the squatted domain

Conclusion ¶

Inti’s example is a great introduction to what’s possible with an expired domain as well as a stark example of how many expired domains are available and how easy it is to acquire them. A knowledgeable attacker would be able to automate the process of data extraction to create a factory of data retrieval capturing old email addresses and providing a full set of recovered accounts. A motivated and targeted attacker would be capable of utilising squatted domains to socially engineer interactions leading to further compromise.

Decommissioning of a domain is a variable endeavour that scales substantially the more the domain was in use. Domains that accept and utilise email are particularly vulnerable and should be considered for full review ahead of any decommissioning.

References ¶