Every Second Counts: Quantifying the Negative Externalities of Cybercrime via Typosquatting

Abstract

While we have a good understanding of how cybercrime is perpetrated and the profits of the attackers, the harm experienced by humans is less well understood, and reducing this harm should be the ultimate goal of any security intervention. This paper presents a strategy for quantifying the harm caused by the cybercrime of typosquatting via the novel technique of intent inference. Intent inference allows us to define a new metric for quantifying harm to users, develop a new methodology for identifying typosquatting domain names, and quantify the harm caused by various typosquatting perpetrators. We find that typosquatting costs the typical user 1.3 seconds per typosquatting event over the alternative of receiving a browser error page, and legitimate sites lose approximately 5% of their mistyped traffic over the alternative of an unregistered typo. Although on average perpetrators increase the time it takes a user to find their intended site, many typosquatters actually improve the latency between a typo and its correction, calling into question the necessity of harsh penalties or legal intervention against this flavor of cybercrime.

Dangerous Skills: Understanding and Mitigating Security Risks of Voice-Controlled Third-Party Functions on Virtual Personal Assistant Systems

“…Typosquatting and mobile phishing. Similar to our squatting attacks, Edelman is the first investigated domain typosquatting [17] and inspired a line of research [41,28,10,33] towards measuring and mitigating such a threat. However, our work exploited the noisy voice channel and limitation of voice recognition techniques.…”

GUTI Reallocation Demystified: Cellular Location Tracking with Changing Temporary Identifier

“…Furthermore, exploiting integrity errors, it can be mitigated easily via hardware and software, e.g., by adopting DNSSEC and leveraging its integrity guarantees. Similar to our technique, typo squatting can be used to lure clients on malicious websites [64][65][66]. It remains important to note that in a typo-squatting attack, the attacker needs to register a new domain and hope that users visit that domain.…”

Dial One for Scam: A Large-Scale Analysis of Technical Support Scams

“…In fact, Vissers et al, while researching the types of ads that users who land on parked websites are exposed to, discovered two pages which fit our definition of a technical support scam [16]. To find a sufficient number of parked domains that our crawlers can visit, we take advantage of the fact that prior research has shown that domain parking is the favorite monetization method of domain squatters [17]- [22]. Therefore, as long as we visit typosquatting variants of popular domain names, such as twwitter.com (note the duplication of the ''w'' character), the majority of our visits will end up on domain parking companies which will redirect a fraction of these visits to technical support scams.…”