6 ms·
Attackers Used Look-Alike Domains to Steal $1M from a Chinese VC
- mmastrac 7y agoI heard this story from a local startup as well - an investor ended up losing ~$100k because the investor's email account was compromised and a lookalike domain was used to impersonate the startup. I've been calling people out-of-band for verification using phone numbers from past communications, even if I'm working on transactions that don't seem out of the ordinary. Not that SIM card fraud doesn't happen, but at least that adds another layer of security.
- westoque 7y agoIsn’t it time to see more widespread use of encryption in emails? What I’m pertaining to is signing emails to make sure they are coming from correct source.
- bayarrhea 7y agoEncryption doesn’t help Unicode homoglyph attacks. I can send you encrypted messages all day long from google.com, even though they’re not coming from who you think they are.
- DyslexicAtheist 7y agoif you don't care about unicode domains then mitigation can be very simple using dnsmasq, e.g.: in /etc/dnsmasq.conf add something like: # Add domains which you want to force to an IP address here. address=/:xn--*:/0.0.0.0 (in case your dnsmasq doesn't support this then there is a patch here: https://github.com/spacedingo/dnsmasq-regexp_2.76 https://github.com/spacedingo/dnsmasq-regexp_2.76)
- deleted 7y ago[deleted]
- yabadabadoes 7y agoIf you are using web of trust in a gpg style then homoglyph attacks are not particularly effective.. If you are using CAs then homoglyph attacks are the simplest of many attacks based on a system of minimal technical compliance.
- pbhjpbhj 7y agoWhen I use the actual second party's public key, the decryption won't work though, so you'd be found out immediately, surely?
- mirimir 7y agoExactly so.
- zelly 7y agoYou wouldn't be able to sign the fake message with the fake domain unless you compromised the sender's PGP private key, which was not the vector of this attack.
- deleted 7y ago[deleted]
- thaumasiotes 7y agoAs bayarrhea points out, a signature doesn't help you if the attack model is "lookalike domain". Email validation exists; gmail will let you know if email arrived over TLS or not. Validation that the source of an email matches the "From:" header is generally done by checking the domain's SPF record. https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Email_spoofing#Countermeasures https://en.wikipedia.org/wiki/Email_spoofing#Countermeasures
- rozab 7y agoSounds like some brilliant social engineering went on. I'd love to read a more in-depth write-up
- krak12 7y agoWell done!
- rdlecler1 7y agoAsk HN: How are other VCs dealing with this?
- Havoc 7y agoNo idea about VC, but in the PE space call-backs and standing data change procedures are the answer. Pretty safe if people actually follow procedures
- anovikov 7y agoI'm thinking it might have quite likely been people from inside both the VC firm and the startup to be funded, collaborating to phish the money away from their companies...
- smabie 7y agoConsidering that both the countries (Israel, China) are and have been involved in very unsavory stuff, I wouldn’t say that it’s an unreasonable conclusion. Less than 50% likely, probably. But definitely not out of the question.
- miles 7y agoFirefox users: be sure to set "network.IDN_show_punycode" to "true" in about:config. Test with the fake Apple domain https://www.xn--80ak6aa92e.com/ https://www.xn--80ak6aa92e.com/ . See "Phishing with Unicode Domains" for more information: https://www.xudongz.com/blog/2017/idn-phishing/ https://www.xudongz.com/blog/2017/idn-phishing/ .
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- graton 7y agoFor the situation in the article it would not have changed anything. As the fake domains were just adding an 's' to the end of the domain. Also I'm not sure what effect that will have for Chinese users. It might make many of their URLs look strange to them. See: https://www.reddit.com/r/firefox/comments/7ul9p3/why_is_networkidn_show_punycode_default_to_false/?st=k3vyesfg&sh=26d84cc0 https://www.reddit.com/r/firefox/comments/7ul9p3/why_is_netw...
- yorwba 7y agoI'm not aware of any Chinese websites that don't just use Pinyin for their domain name. Some random person is squatting on http://百度.中国/ http://xn--wxtr44c.xn--fiqs8s/ (百度.中国), but Baidu doesn't seem to care. They use http://www.baidu.com/ http://www.baidu.com/ as their primary address.
- thaumasiotes 7y ago> I'm not aware of any Chinese websites that don't just use Pinyin for their domain name. There are tons. One prominent email provider is a three-digit number. There's a job board at 51job.com. (What's 51job? Read in Mandarin, that would be "wǔ yāo job" [five one "job" (the English word)]. This is felt to sound similar to "wǒ yào job" 我要job [I want a job].)
- victorfriedrich 7y agoHow are these cases usually handled in court? Could the Chinese VC possibly require the startup to pay damages over insufficient security measures?
- duxup 7y agoPotentially but then that would probably mean their deal is off. ..not sure they want that.
- EddieCPU 7y ago“Such scams .. show why secondary protection mechanisms — like verbal confirmation — are necessary when making high-value transactions” How about digital signatures and end-to-end email encryption.
- chipperyman573 7y agoEncryption only verifies it hasn't been changed or viewed by a third party, the original email contained the problem so you would just store an encrypted string that would decrypt with the attack in it
- tyingq 7y agoReminded me of "bitsquatting": http://dinaburg.org/bitsquatting.html http://dinaburg.org/bitsquatting.html I wonder if anyone is doing this regularly. I didn't hear much about it after the initial fanfare.
- deleted 7y ago[deleted]