Typosquatting as Corporate Espionage
Typosquatting, that seedy practice of registering domain names similar to legit sites but with typos in the name, has a new twist.
At a Black Hat presentation last week on a Symantec long-term research on the practice as it cropped up in the 2008 election campaign, Oliver Friedrichs found an interesting tidbit. A typosquatting domain registered to someone in China had no Web page, but it did have a record that allowed it to receive e-mail.
While there isn't any conclusive evidence of spying, typosquatting is normally done to catch accidental Web surfers.
But this registered domain, the name of which Friedrichs didn't reveal, didn't have any Web site records or associated pages to catch ad revenue. Instead, it had what's known as an MX record, which allows it to receive e-mail.
Without direct evidence it's a leap to assume this was done for spying purposes, but it's not exactly a giant vault. Chinese registrant, defense contractor, MX record with no associated (and potential tip-off) Web site. Connect the dots.
If this was meant for espionage, it would only collect e-mails with mis-typed addresses that matched the typosquatting domain.
So if you're in a company that deals in sensitive information and you think you might be a corporate espionage target, it sure couldn't hurt to proactively check to see if anyone has registered typosquatting domains based on your company's domain name. Type potential domain names (typosquatting variants) into the Whois tool at http://whois.domaintools.com to see if anything turns up.