[論文レビュー] Hiding in Plain Sight: A Longitudinal Study of Combosquatting Abuse

Panagiotis Kintis, Najmeh Miramirkhani+6 more|Research Open (London South Bank University)|Aug 28, 2017

Spam and Phishing Detection参考文献 35被引用数 66

ひとこと要約

本論文は combosquatting の初の大規模かつ縦断的実証研究を実施し、468 billion DNSレコードを分析して、combosquattingドメインの蔓延、寿命、語彙的特性、および実世界での悪用を明らかにします。

ABSTRACT

Domain squatting is a common adversarial practice where attackers register domain names that are purposefully similar to popular domains. In this work, we study a specific type of domain squatting called "combosquatting," in which attackers register domains that combine a popular trademark with one or more phrases (e.g., betterfacebook[.]com, youtube-live[.]com). We perform the first large-scale, empirical study of combosquatting by analyzing more than 468 billion DNS records---collected from passive and active DNS data sources over almost six years. We find that almost 60% of abusive combosquatting domains live for more than 1,000 days, and even worse, we observe increased activity associated with combosquatting year over year. Moreover, we show that combosquatting is used to perform a spectrum of different types of abuse including phishing, social engineering, affiliate abuse, trademark abuse, and even advanced persistent threats. Our results suggest that combosquatting is a real problem that requires increased scrutiny by the security community.

研究の動機と目的

• combosquattingを定義し、それを他のDNS squattingタイプと区別することによって研究の動機付けを行う。
• 6年間にわたる商標とデータセット全体で、combosquattingの規模を定量化する。
• combosquattingドメインの語彙的および時系列的性質を特徴づける。
• フィッシング、マルウェア、アフィリエイト悪用、商標悪用、APTの利用など、実世界での悪用を特定する。
• 他の squatting 現象と比較して、検出と是正措置のギャップを評価する。

提案手法

• 受動的および能動的 DNS ソースからの 468 billion DNS レコードを、almost six years にわたって組み合わせる。
• トップ Alexa ドメインからの 246 US-brand trademarks のシードセットを定義する（後に 22 のビジネスカテゴリ）。
• 商標を含むドメインを含む Combosquatting Passive (CP) および Combosquatting Active (CA) データセットを構築・分析する。
• Public Blacklists (PBL)、APT レポート、Spamtrap、Malware feeds、Alexa ホワイトリスト、Certificate Transparency とデータセットを結合して、悪用セット (C_pbl, C_apt, C_spa, C_mal, C_ale) を研究する。
• Wang らの five typosquatting models を用いて、typosquatting と combosquatting を比較し、蔓延と攻撃モデルを定量化する。
• 語彙的構築、ドメイン長、単語/セグメントへのトークン化、およびカテゴリ全体での一般的な悪用語の分析。

実験結果

リサーチクエスチョン

• RQ1 How prevalent is combosquatting relative to typosquatting and other squatting forms across large DNS datasets?
• RQ2 What lexical and structural properties characterize combosquatting domains?
• RQ3 What is the temporal behavior and lifetimes of combosquatting domains, and how quickly are they remediated or blacklisted?
• RQ4 What real-world abuses are facilitated by combosquatting (phishing, malware, SEO, trademark abuse, APTs)?
• RQ5 What hosting/infrastructure characteristics are associated with combosquatting domains and their abuse?

主な発見

• Combosquatting domains are about 100 times more prevalent than typosquatting domains targeting the same trademarks.
• Almost 60% of abusive combosquatting domains persist for more than 1,000 days.
• About 20% of abusive combosquatting domains appear on public blacklists roughly 100 days after first resolution in DNS data (30% for malware feeds).
• Between 2011 and 2016, the number of combosquatting queries grows year over year, unlike typosquatting.
• 50% of combosquatting domains add at most eight characters to the trademark, and 40% are formed by adding a single token; domains tend to include words related to the trademark’s business category.
• 691,182 TLS certificates were issued to 107,572 fully-qualified combosquatting domains since 2013, with 41.5% issued by Let’s Encrypt, while typosquatting domains had only 3,011 certificates.
• Combosquatting domains support a wide range of abuses including phishing, social engineering, affiliate abuse, trademark abuse, malware C2, and APT-related use.