14 ms·
Scammers registering date-based domain names
- acvny 7y agoso what do you propose / want?
- wongarsu 7y agoI think the article covers that in detail: > Is there any way to stop this? No, not really. [...] There are no technical gatekeepers to keep us safe. We have to rely on our own wits He is pointing out that this a danger to be aware of, and that the only thing we can do is be careful not to fall for it
- acvny 7y agoYes, but that's obvious.
- sm4rk0 7y agoMaybe they want to warn other people?
- StavrosK 7y agoWebAuthn for everything.
- acvny 7y agoAnd by the way, what's with this cracked smartphone screen phenomenon?
- paulgb 7y agoIs there a phenomenon? If anything I feel like about five years ago nearly every phone I saw in the wild had a cracked screen and now it's far fewer, but my sample bias probably also changed with age.
- wongarsu 7y agoAnecdotally glass screen protectors seem to have grown a lot more popular. When you buy your phone at a store chances are they will tell you it's a must-have addon (and they are not entirely wrong). Screens also get more shatter resistant all the time, but at the same time the industry seems to constantly find new phone geometries that look very prone to fall damage, so that probably balances out.
- giancarlostoro 7y agoHah and will it really be cracked in the same spot for every single person?
- bonoboTP 7y agoPeople like glass phone screens but drop them on the floor by accident and it cracks. I don't think it's any more complicated than that. Perhaps it also projects some aloofness and coolness, the way torn and worn jeans are fashionable.
- Forge36 7y agoIt's a pretty common problem many experience for some period. Explaining a problem which "is easy to avoid" and coupling it with another you've already experienced "that made using my phone harder" reinforces the idea "this could happen to you".
- nkrisc 7y agoPeople buy expensive phones, drop them/don't treat them like they're expensive, and then can't afford to replace them.
- acvny 7y agoYes, indeed, that's the problem. People buy a $1000 iphone without actually being able to afford it, pay monthly instalments for 5 years and then they drop the phone and can't afford to repair it.
- NullPrefix 7y agoCracked screen is a serious price reducer in the second hand market. Great opportunity to get better specs if you want a purely functional device. Unless you're after fashion accessories. Cracked screens are no go for fashion accessories. Can't let other people think you're too poor to buy an un-cracked phone.
- 435676 7y agoIf you are even a 4th tier Instagram influencer, you can't have anything but a pristine latest generation iPhone. If your phone back is visible in the picture and you cant see the three iPhone 11 lenses, you are basically screwed.
- saagarjha 7y agoiPhone 11 Pro lenses. iPhone 11 only has two.
- endorphone 7y ago"Unless you're after fashion accessories" Having a crack in the display is an enormous functional detriment on the device. Holding it as a fashion element is absolutely ludicrous.
- TeMPOraL 7y agoNothing. Smartphones are still very fragile. Eventually, pretty much everyone will crack their screen. Because usually the phone is perfectly usable with cracked glass, and because most smartphone designs are user-hostile, repairing the damage ranges from not economical to not possible in practice - so you see a lot of regular people walking around with cracked phones.
- 435676 7y agoThe funny thing is that each generation of Gorilla Glass is much stronger than the previous one. And what do phone manufacturers do? They make the glass thinner since it's now stronger. The end result is that the phone is as easy to crack as with the previous generation glass.
- overcast 7y agoI've abused every single iPhone since the first one, only recently in the last couple of years putting a case on because they are too slippery now. Never had a single cracked screen, even dropping on pavement. You have to be quite unlucky to hit things just right.
- 113 7y agoThat's great, good for you.
- overcast 7y agoThanks! I appreciate it.
- Izkata 7y agoLikewise here with a Samsung Galaxy S that lasted 8 years, without a case or cover. Plenty of dropping on all sorts of hard surfaces, no cracked screen. Some of the finish started smudging off on the back though. I have no idea what people are doing to cause such damage. (Only ended up replacing that phone because it started just not picking up calls and texts for days at a time)
- alistairSH 7y agoI'm not sure what you're asking. People drop their phones; the screens crack. People are too busy|lazy|cheap to get it fixed in a timely manner. Anecdotally, this group has a high percentage of people with younger kids - why replace the screen today if your toddler is going to drop the phone again tomorrow?
- endorphone 7y agoI have four children. I've been using all-screen smartphones for the entire time that there have been all-screen smartphones. I've endured zero cracked screens. Ever. A couple of my kids are old enough to have had smartphones for a couple of years now (kids these days) -- they've had zero cracked screens as well. This is one of those posts that tend to raise people's ire, but I'm just pointing out that a lot of us manage to never have cracked screens. It isn't just a normal that we all tolerate. And yes, I've always used a case -- I have a case in hand before I even take the phone out of the box. It seems insane to not have a case. Maybe when phones are unbreakable I can enjoy the sleek design, but until then it's a Spigen 100% of the time.
- _-___________-_ 7y agoYeah, don't understand it either. Never cracked a screen in my life, and I've never even used a screen protector or a case. Always confused by all the cracked screens I see around me.
- Hnrobert42 7y agoYou are lucky/well prepared. I am similarly protective of my phone. But lots of folks can only afford cheap phones and/or cheap cases. I don’t see many cracked screens in the US anymore, but I see them all the time in Vietnam.
- slumdev 7y agoI've cracked a screen exactly once. I was at a beer festival. I bought a new phone and a Spigen case the following day.
- alistairSH 7y ago
- layoutIfNeeded 7y agoLooks like your typical Microsoft domain, e.g. https://www.microsoftedgeinsider.com/ https://www.microsoftedgeinsider.com/
- giancarlostoro 7y agoI hate that companies do this. I get why they might do this to avoid red tape but it just piles on the phishing / scamming possibilities for people who dont know better.
- heipei 7y agoYup, I have seen both extremes: Global brands which redirect all their country-specific domains to their one global .com domain (good!) as well as global banks where every small branch and sub-organisation like funds and charitable foundations have their own domains, along with similar but not identical corporate branding. Training users of the latter brands to not fall for phishing in the latter case is gonna be next to impossible, as is whitelisting the legitimate domains.
- saagarjha 7y agoI hate that Microsoft does it but I have heard that it enables cookie partitioning and other similar domain-based isolation.
- giancarlostoro 7y agoWould subdomains not achieve this though?
- badrabbit 7y ago> And that's the price we pay for anyone being able to buy their own domain and run their own secure site. No, that's the price we pay for using a name resolution system from the 80's (70's?) that was not built with trust validation in mind,decoupled from the infrastructure we use to establish domain ownership and authority. And also without user friendliness or of a layman's ability to independently validate authority in mind. e.g.: reverse order of hierarchy where in english you read left to right but dns has least authoritative/lowest level on the left and most authoritative on the right,why would I evaluate trust worthiness of site.com if 'secure' is evaluated first in secure.site.com (another example:google.com.site.info). Cracked foundations make shaky buildings.
- acvny 7y agoyes, very wrong conclusion. the author blames cheap domains and easy to get https. You could as well blame cheap computers, cheap internet access, cheap electricity. Since that looked like an SMS, I would report it to your mobile provider, let them track who sent the message.
- edent 7y agoI'm the author. I'm not blaming cheap domains. I'm saying that spam like this is a consequence of cheap domains. The blame lies at the feet of the spammers. And, I've worked for a couple of mobile providers. This spam was likely sent from a disposable pre-paid SIM. There's no realistic way to check who sent it.
- bostik 7y agoSo the phone/device IMEI is not recorded for the session? Not that it would tell who sent it, but would allow to track if the same devices were used as part of ongoing campaign.
- edent 7y agoThe sending network may have a record of the IMEI, but I don't think the receiving one gets it. But SMS sending devices are cheap and disposable. Sure, it's illegal to alter your IMEI in the UK - but if they're already committing one crime, I don't think that'll stop them.
- Kenji 7y agoIf you're stood up on a crowded train, with your phone screen cracked, would you notice that a . is where a / should be? If you do your payments in a crowded train while standing and using an outdated, broken Android phone, you're a dumbass who deserves to get ripped off.
- hartator 7y ago> Luckily, she's not with EE - because it's a pretty convincing text. Not it’s not. billing-jan-2020.info looks suspicious as hell. Recognizing domain names from url is very 101 Internet security.
- edent 7y agoI suggest you go and talk to people outside your normal tech bubble. Recognising which parts of a URl mean what is tricky for most people. Here's some examples I've collected of people clicking on links in suspicious texts: https://twitter.com/edent/status/1193147685370552322 https://twitter.com/edent/status/1193147685370552322 https://twitter.com/edent/status/780317797855395841 https://twitter.com/edent/status/780317797855395841
- hartator 7y agoI don’t agree. We don’t school marketing people as a whole when people fall for pyramid schemes. Not sure why your average engineer should take the blame for scammer actions. Yes, life is hard and complicated. Tech is no exception.
- SahAssar 7y agoNobody is saying to "blame" all engineers for these scams. But you make it seem like that URL would be immediately obvious for everyone, and that clearly isn't true.
- brlewis 7y agoDo you think browser makers should do more to distinguish the host part from the path part of a URL? Right now Firefox uses a darker color for the domain and Chrome uses a darker color for the full hostname.
- Nextgrid 7y agoI hate it how browsers always screw with how they display URLs. Some hide protocols, some hide the path, etc and the display of HTTPS is inconsistent. I could see this weird domain name being slightly confusing and looking like a full URL in a browser that normally hides the path part. It would be much easier if browsers just cut the crap and displayed the full URL (including the protocol) consistently. It's just one thing everyone can learn and then apply across all platforms & browsers.
- toohotatopic 7y ago>It starts with https:// https:// - that means it's secure, right? Is .info even recognisable as Top Level Domain? It's not his wife, it's him who needs to be protected.
- Hnrobert42 7y agoHe is speaking in the voice of a less tech savvy user to help the reader understand how this attack my fool people.
- thexa4 7y agoToo bad domain names are generally written in the 'wrong' order. These issues would have been preventable if domain names were written the following way: https://org.example.www/index.html https://org.example.www/index.html The domain referenced would have been: https://info.billing-update-jan02.uk.co.ee/ https://info.billing-update-jan02.uk.co.ee/ vs https://uk.co.ee/billing-update-jan-02 https://uk.co.ee/billing-update-jan-02
- zentiggr 7y agoI remember (very vaguely) reading into the debates around domain name sequence and being irritated that natural readability won out over scope order. Codified so deeply for so long that there''s no hope of ever changing it except in limited circumstances (Java class hierarchy for example). Sigh.
- SmellyGeekBoy 7y agoI don't see how this is any more informative to your average layman?
- thexa4 7y agoIt means that information to the left is always the important part. Right now you have to find the '/', evaluate the components leftwards, return to the '/' and evaluate components rightwards. Given that finding the '/' is not always trivial (broken screen example in the article) and doing this requires you to think a lot of people won't do it.
- Buge 7y agoLook at these 2: https://ee.co.uk.billing-update-jan02.info https://ee.co.uk/billing-update-jan02.info There's just a single character difference. The layperson will think they mean the same thing. Now look at these 2: https://info.billing-update-jan02.uk.co.ee https://uk.co.ee/billing-update-jan02.info There's a big difference there. People can easily see something is abnormal.
- thexa4 7y ago
- MrGilbert 7y ago> Money and technical expertise used to be strong barriers to prevent people from registering scam domains. Cannot confirm. I registered my .de-Domain in 2005. That was 15 years ago. It wasn't that difficult, and quite cheap (imho 12€ for a year). So the tech barriers vanished a long time ago.
- edent 7y ago.info domains can now be bought for around €1. If, like the scammers I mentioned, you're buying one for every day of the year, that's a several thousand Euro difference. Spammers are in business. When certain costs fall, it makes their enterprise more profitable.
- ryanlol 7y agoThese spammers make thousands of euros a day if they’re any good. UK fullz can go for like 40usd a pop.
- ailideex 7y agoWhy do they need date specific domain names?
- penagwin 7y agoThey don't have to be date specific but they need fresh ones constantly. They get flagged as malicious quickly (within a day or so for large spam campaigns) so they need fresh ones that aren't flagged. The date is sometimes used to confuse people when they're reading it so they think it's part of the URL and not the actual domain name.
- bduerst 7y agoIntentionally creating inhibitive costs for the sole purpose of preventing bad actors is playing a game of whack a mole. It only temporarily solves the problem and ruins it for the rest of the customers. There are other ways to address scammers that do not involve making the entire market more expensive for expensive's sake.
- cpach 7y agoThis is probably a case where MFA with a Yubikey would help. AFAIK it would choke on the invalid hostname.
- jrockway 7y agoThe site would just say "for added security, we are requesting your backup code this time."
- potatoz2 7y agoThat may be true, but it's an added opportunity to notice something is wrong. If and when people are used to U2F/Webauthn security, it'll feel very wrong to have to manually enter a code. Although routing information isn't protected either way and is probably fundamentally unsafe.
- Ragnarork 7y ago> Money and technical expertise used to be strong barriers to prevent people from registering scam domains That should not be, and should never have been considered the main line of defense against that. This guy has it backwards. The problem is not that it's affordable or accessible. It's that there's no clear alternative to user vigilance to truly avoid these scams.
- squarefoot 7y agoWouldn't a soundex-like algorithm catch the similarity between the legit domain and a substring of the malicious one? An alert could be fired upon reception from any address resembling domains where online transactions or any other sensitive activities are involved.
- heipei 7y agoWeb-based phishing has become a game of speed. Domains are not expected to survive more than an hour (and few do), even with all kinds of countermeasures in place (browser / geo detection, destroy-after-first-use links, etc). Yet it's still economically viable to do. Companies offering blocking products like Google Safe Browsing have been forced to increase the frequency of their blacklist, up to the point where Google had to resort to checking suspicious URLs against their online database rather than a cached local index. This is a classical arms-race and will only intensify. With domains that look generic enough and only serve malicious traffic when hit with the right URL, parameters, user-agent and geographical location, blocking will have to rely on sourcing these URLs directly from the targeted endpoints (e.g. SMS/WhatsApp/Email), rather than "crawling" or relying on users to report these. Another approach is to do some of the blocking locally, which of course means pushing the detection logic to the client and thus exposing the classification mechanism. Neither approach is sustainable long-term in my opinion.
- solarkraft 7y agoIt seems to me that a list of known good domains provided by a large browser vendor (Google) with extra treatment in the browser might be the most effective against phishing and other scams. This could be sold as an add-on for a certificate, or something like that, with a just high enough barrier for proving authenticity. Known-good domains could then additional treatment, like a blue padlock or one with a star (ok, I'm not an icon designer). Of course you can argue against it on a freedom basis, but I think for protecting vulnerable web users it'd be pretty useful.
- Spivak 7y agoYour idea isn’t that weird. If you do it right you’re basically inventing the Web of Trust. As long as you put the user in control of what entitles they trust to validate sites it would actually be a super useful feature. The problem is always the political one. What does, say, Microsoft vouching for a site actually mean?
- heipei 7y agoYou're not that far off. If you took the Alexa Top 100k sites and display some kind of indication whenever a page isn't on that list you would be able to stop the most obvious phishing attempts. Google has a Safe Browsing Extension which, as its first steps, checks the 15k most common sites or so. If you tailor these lists to specific countries I'd wager you can get away with even fewer entries. There's other tricks that scammers pull though, like compromising legitimate domains with a certain reputation and then adding their scammy subdomains, but that's a lot harder to pull off than just registering 100 free domains everyday and hoping one sticks.
- ailideex 7y agoI actually don't see how the date in the domain name is integral to this scam? Maybe someone can clarify it for me.
- Hnrobert42 7y agoIt is supposed to look like the path. It is supposed to look like https://ee https://ee[.]co[.]uk/billing-jan-02.info
- ailideex 7y agoIs this what the URls look like normally? (not from UK so I would not know) Why not just https://ee.co.uk.billing.info/jan-02 https://ee.co.uk.billing.info/jan-02 ? I mean if someone does not notice it is a domain name and not path would they really notice where the info part is?
- SmellyGeekBoy 7y agoBecause ee.co.uk.billing.info would get taken down pretty quickly. Using this method the domain only has to work for one day before they move on to the next one.
- 113 7y agoBecause even if you could buy billing.info it would get blocked pretty quickly.
- function_seven 7y agoIn addition to the sibling comments, there's also the problem of having an actual slash in your example, which may cause the mark to notice it and therefore notice the "missing" slash after the 'co.uk' part.
- multidim 7y agoThere's been a lot of talk about the benefits of browsers showing URLs in a stylized way that makes it more obvious to the user what is the domain and what is not the domain. I should have realized this earlier but: it's also important to have anything that displays clickable URLs (like a messaging app) to also style the URL to help it be more obvious what domain is being linked to. The problem of better stylized URLs is so much bigger than browser URL bars that show where you are right now; it's also everywhere that displays clickable URLs.
- yellow_lead 7y agoDoes hacker news even do this? https://example.randomsite.phishyourbank.com/Jan3 https://example.randomsite.phishyourbank.com/Jan3
- gpm 7y agoHacker news is probably one of the least important places to do this. It has a high concentration of technical users, only supports public posts (where technical users will notice and comment on such urls), and has very active moderation. Texting apps seem like the most important place to implement it... judging by the spam that I get.
- yellow_lead 7y agoThat kind of attitude will put people off guard though. These things pop up in places where you least expect them. I agree it's less important than other places, but also would be nice for us to practice what we preach.
- zamadatix 7y agoHow you get to a page can't matter in terms of security or you've already lost the battle. What's important is once you're on the page you can validate where you are.
- lonelappde 7y agoIt's even worse. Websites don't display clickable URLs, they display clickable links. Browsers used to show the URL in the status bar, but then started hiding that too. Anyway, links don't matter much, because if clicking a link is dangerous, your browser is broken. The destination location is what matters.
- codegeek 7y agoDomains are one area where I support more regulation. It should be harder to buy a domain in my opinion. Right now, it is way too easy. I am not even talking about domain hoarders. The price can remain the same but whenever someone wants to purchase a domain, they need to go through an additional audit of some sort. Add more entry to barrier. Legit folks will be a little inconvenienced but it will help weed out the scammers a bit more. Yes I know dedicated scammers will still bypass at times but it will surely deter them. Thoughts ?
- save_ferris 7y agoWhat would you audit to prevent scammers?
- zxter 7y agoÇlkjhnşçffaswas
- ttul 7y agoApple could do some basic spam filtering on SMS messages directly on the device (ditto for Google on Android). Querying a domain reputation service will very quickly tell you whether a URL is a risky click. At a bare minimum, show me a warning when an SMS comes through containing a risky URL. I just don’t see why these giant companies with billions in profit can’t connect the dots here.
- Spivak 7y agoThose giant companies already have connected the dots and have super aggressive spam filters for links. It’s a testament to the volume of spam that’s out there that so much still gets through. SMS has the problem that since you don’t have a spam folder filters have to be lenient because it’s more of a problem when they get a false positive.
- ttul 7y agoI’m not seeing the SMS filtering market being super lively these days. There was a burst back a decade ago when Cloudmark and AdaptiveMobile were selling solutions that bolted onto the SMSC infrastructure. But that investment petered out. I am not aware of any device side filtering, which IMHO is where it should live.
- jrockway 7y agoMore interesting than these obvious scams are when your phone company sends you legitimate texts that look like scams. I got what I thought was something super scammy from Verizon and did a lot of investigation and eventually found out that it was them. The TLDR is that apparently they send all their marketing texts from "+90 (007) 000 38 64". You can opt out on their website and now I don't get these anymore. It's nice. But sad that my $120 a month isn't enough money for them, and they have to text me at 3AM to get me to buy a new phone. (And sell my browsing data.)
- meehow 7y agoQuick fix for SMS app creators: when you highlight a link, accent the domain part of it, just like Firefox is doing in URL bar.
- LyalinDotCom 7y agoOn the topic of trusting domains, big companies are not helping themselves. Lets use a big financial company as an example. I recently got an email from them to check on a transaction that settled, the domain was: https://click.SOMECOMPANYNAMEHEREinvestments.com/ https://click.SOMECOMPANYNAMEHEREinvestments.com/? ... Their real domain is SOMECOMPANYNAMEHERE.COM but as you see they made a special domain just for email clicks. I thought at first this was a scam email, but then tried clicking and sorted out that it redirects to the real site and login. But man you can't even easily trust real emails if you're paying attention, i dont know how regular people will defend against stuff like this.
- z3t4 7y agoOne problem is that if a subdomain gets hacked it can be used for XSS as subdomains are trusted by the TLD, which might be a reason why they don't want every division to use a domain under the TLD.
- enonevets 7y agoThis likely happens to prevent the primary domain from being blacklisted. Many companies including key ESPs will register multiple domains to combat potential spam listings and blacklists. It's possible they rotate through a number of similar domains to ensure if any are blocked they have backups available for use until those get unblocked.
- scarmig 7y agoI think the most practical solution here is to train users not to use domain names and de-emphasize them in the UI (and URLs more generally). Which I hate as much as anyone here, but if I'm going to give my parents advice on how not to fall for a scam, telling them "Google the name of the bank [or whatever] and click on that link" seems like the most secure path. Once security keys become ubiquitous, they should also provide some protection. But right now setting up 2FA for every site they use is impractical.
- ryandrake 7y agoA lot of replies here are pointing at DNS being not trust-able, but let's back up a bit. This is only a problem because people are still clicking on unsolicited links they get in their E-mail. When you get an unsolicited phone call and the guy on the other end claims to be from your bank, do you give him your personal information and conduct whatever business he wants to conduct? Of course not! So why would you click through some random link you get in E-mail or text, regardless of how official it looks? Users need to stop clicking on links they get out of the blue over E-mail, and legitimate companies need to stop sending links they expect customers to click, which encourages this risky behavior. Easy to say, but behavior is hard to change.
- capableweb 7y ago> Users need to stop clicking on links they get out of the blue over E-mail, and legitimate companies need to stop sending links they expect customers to click I agree with the first part, but how is the second part supposed to work? We're using links to easier guide people in the "right" direction (depending on who "you" are, changes what "right" means), what could an alternative be? So, a X just finished, and the user can now use it. In my notification to the user, how to guide them to that specific X?
- ryandrake 7y agoI think the key is whether the E-mail is unsolicited. Request a password reset? The E-mail is solicited and expected. Just bought something from an online store? The receipt E-mail is solicited and expected. In these cases, users should not feel it's particularly risky to click the links, because they are currently interacting with the site. On the other hand, "Hi! We noticed there is a scary-sounding problem with your account, please click here to fix it!" No legitimate company should be sending users something like this out of the blue, and users should be trained to immediately think fraud/scam when they receive this.
- capableweb 7y agoSo you bring up a good example. Imagine something scary happened to the account, and the user needs to provide some additional details or fix something. How can I as a company inform the user about this and get them to fix this? The incentive from the senders side is to get the person receiving it to do something. If that's good or bad, it's harder to say than draw a line in the middle. Currently, bunch of companies and other entities are finding the whole clickbait super useful, and it's only natural that bad actors take advantage of this. But who is the bad actor? Turns out a lot of them, but on different levels.
- deleted 7y ago[deleted]
- RcouF1uZ4gsC 7y agoThis is a situation where EV certificates would be helpful. The cost and the fact that it generates somewhat of a paper trail would discourage scammers from getting them.
- unexaminedlife 7y ago"By the time I'd fired up a VM to inspect it, major browsers were already blocking the site as suspicious." The system sounds pretty safe to me, even with its warts.