Biz & IT —

Domain hijacking spear-phisher foiled by the last line of defense—paranoia

An Ars editor's paranoia is all that prevents a successful spear phish—this time.

This carp was not paranoid enough. (The person pictured has nothing to do with the case reported in this post.)
This carp was not paranoid enough. (The person pictured has nothing to do with the case reported in this post.)

As the old joke goes, "Just because you're paranoid doesn't mean that everybody isn't out to get you." Based on the contents of my e-mail inbox lately, I can confirm that my paranoia is well-founded.

Yesterday, I got an e-mail telling me that the domain name server information of my vanity domain had been changed. It purported to be a message from GoDaddy and had enough information to be almost legitimate—I had just regained the domain after another hosting company had neglected to auto-renew it a year ago, and at one point I had put in a domain backorder with GoDaddy to ensure that I could jump on it when the spam Japanese medical device WordPress blog was done sucking all the search engine optimization mojo out of it.

I had changed the DNS server information about two weeks ago, so the alert that it had been changed again made me nervous. I recognized the text in the link in the e-mail as being the URL for GoDaddy's customer login page. However, there were signs that this was not legitimate:

  • The weird notification number in the subject line.
  • The lack of the familiar GoDaddy HTML chrome on the e-mail.
  • The less-than-complete version of GoDaddy's corporate identity in the copyright notice.
  • The strange phrasing of "This notification is generated automatically as a service to you," which struck me as very not-GoDaddy.

Paranoia pays off. A quick look at the raw code of the message revealed it was yet another spear phishing attempt—something I've personally seen more and more of on both my work and personal e-mail accounts. A quick look at the raw code of the message revealed that it had been sent by a PHP-based mailer program from a host system with a .ru domain—and that the HTML link was directed at a malicious page buried in a (now-suspended) WordPress site hosted on BlueHost. I had hoped to sandbox the attack this morning, but BlueHost's security team had apparently beaten me to it; however, it appears the page that was there was a mock-up of a GoDaddy login page designed to steal customer credentials.

This is the sort of thing I've gotten used to. Despite using a spam filtering service that catches the vast majority of evil e-mails destined for my work account, and similar precautions taken with my personal e-mail accounts, I'm seeing at least two or three phishing attempts a day right now. The latest spear phishing attack was clearly based on something scraping data from GoDaddy DNS record changes (the domain, being a vanity account, did not have privacy settings on it, so it was low-hanging fruit).


I sent along the raw code of the e-mail to Ben Butler, director of GoDaddy's Digital Crimes Unit. Butler said that over the past 18 months, there "has definitely been an upswing in phishing attacks targeting new domain registrations." While there are frequent shifts in phishing threats, Butler believes the latest rise in these attacks is at least in part because of the adoption by attackers of DNS tracking tools—sites and services that can alert users when there has been a change in any domains' DNS records. "Backorders are a particularly popular thing to target," Butler said. "When a domain changes over to a new owner, that indicates someone who values the domain more"—so the new owner might be more apt to click on a message telling them of a change.

This sort of spear phishing attack is one of the big drivers in the growing trend of domain hijacking—using compromised or weak credentials for a domain registrant's account to take over the domain for malicious purposes. In part, this is what was involved in the recent DNS fiasco around Megaupload.com and other domains seized by the FBI being hijacked. "That investigation got more complicated because it crossed multiple registrars," Butler said, "and it uncovered a problem where the registree—Verisign in this case—didn't really log where record changes came from." It appears that someone gained registrar credentials to the affected seized sites and changed the DNS servers associated with them—and Verisign didn't log the IP address where the changes came from, making it difficult to determine who made the changes.

It's hard to nail down where these sorts of attacks come from, as in my case, they usually use compromised legitimate websites to host the malicious web pages. And while the phishing attack came from a system with a Russian domain name, Butler said, "it's the age old question of where those attacks really started. It may be that they come from Russia, eastern Europe and China just because of the number of compromised or open e-mail relays in those places." A subcommittee of ICANN's Security and Stability Advisory Committee is working on best practices to improve credential management among domain registars, with a draft proposal due in the next few months.

As far as defending against phishing attacks goes, using an e-mail service that takes advantage of Sender Policy Framework records in the DNS can help screen out most spoofed attacks (as well as a lot of other bulk spam e-mail). "SPF records, if used as a filtering mechanism, would have been an effective countermeasure against this attack," Butler told me—if it weren't for the fact that I use a forwarded e-mail account as the registered mailbox for my DNS record. "If the original receiving server forwards it, the next e-mail receiving server—even if they're checking SPF—may let it through as good," he conceded.

The other thing that could have prevented this particular attack is if I had paid for domain privacy protection. At least then, the e-mail would have been addressed to "Domains By Proxy" instead of Sean Gallagher, and I would have figured out it wasn't a GoDaddy e-mail that much faster.

So, what has your experience with spear phishing been? Drop some of the best (or worst) phishes you've seen in the comments or e-mail me a screen shot so I can mount them over my desk as a reminder of why to stay paranoid.

Listing image by Wikipedia

Channel Ars Technica