3 ms·

> “This was an email address that looked like the real thing,” says Exempt, explaining the mechanics of how he tricked Charter Communications. “The real domain

> “This was an email address that looked like the real thing,” says Exempt, explaining the mechanics of how he tricked Charter Communications. “The real domain of the Jacksonville Sheriff’s Office in Florida is jaxsheriff.org. We purchased jaxsheriff.us and then spoofed our number as the department’s, so that when we called them to verify receipt of the legal process, when they searched the number, it would come back to the sheriff’s office, giving them no reason to doubt it. We use real badge numbers and officer names as well.” I'm honestly impressed. It's an interesting situation where the companies can only verify the same information that the hackers have access to

ghssds 11mo ago
> The real domain of the Jacksonville Sheriff’s Office in Florida is jaxsheriff.org. We purchased jaxsheriff.us This would not be an issue if RFC 1480 had been taken seriously.
- thih9 11mo ago
  Too many edge cases, some would still be exploitable. Eg if the real address was: Sheriff.CI.Jacksonville.FL.US Malicious actors could register: Sheriff.Jacksonville.FL.US Unless your solution is to add some verification step as part of .us registrations.
  - Etheryte 11mo ago
    Many top-level TLDs have requirements you need to fulfill, .edu is a good example. Similarly you need to prove you're a local entity for many country-specific TLDs. At the end of the day though, this attack vector will always be there, no matter how diligent you are about it. Phishing is all about numbers and one in is often all you need.
  - marcianx 11mo ago
    Can people register a subdomain of fl.us willy-nilly though? Isn't the root domain owned by the state?
    - valleyer 11mo ago
      From the RFC (note the "or businesses"): Name Space Within States: ------------------------ "locality" - cities, counties, parishes, and townships. Subdomains under the "locality" would be like CI.<city>.<state>.US, CO.<county>.<state>.US, or businesses. For example: Petville.Marvista.CA.US. "CI" - This branch is used for city government agencies and is a subdomain under the "locality" name (like Los Angeles). For example: Fire-Dept.CI.Los-Angeles.CA.US. So you'd be counting on the sub-registrar of jacksonville.fl.us not to allow a registration for the fraudulent "business" of Sheriff, Inc. -- multiplied by every municipality across the country.
- monerozcash 11mo ago
  Wouldn't make any difference, you'd just hack one email at any random sheriff department in the country. Or pay $5 for one, anyway.
mh- 11mo ago
"No problem, Deputy Smith. I'll call you back at your listed number now to complete your request." What am I missing? Not doing this is negligent. Same advice we'd give to phishing targets.
- Maxious 11mo ago
  Their listed number on jaxsheriff.us? What if they bought Google ads to get the first result for Jacksonville Office?

ghssds 11mo ago

> The real domain of the Jacksonville Sheriff’s Office in Florida is jaxsheriff.org. We purchased jaxsheriff.us This would not be an issue if RFC 1480 had been taken seriously.

thih9 11mo ago
Too many edge cases, some would still be exploitable. Eg if the real address was: Sheriff.CI.Jacksonville.FL.US Malicious actors could register: Sheriff.Jacksonville.FL.US Unless your solution is to add some verification step as part of .us registrations.
- Etheryte 11mo ago
  Many top-level TLDs have requirements you need to fulfill, .edu is a good example. Similarly you need to prove you're a local entity for many country-specific TLDs. At the end of the day though, this attack vector will always be there, no matter how diligent you are about it. Phishing is all about numbers and one in is often all you need.
- marcianx 11mo ago
  Can people register a subdomain of fl.us willy-nilly though? Isn't the root domain owned by the state?
  - valleyer 11mo ago
    From the RFC (note the "or businesses"): Name Space Within States: ------------------------ "locality" - cities, counties, parishes, and townships. Subdomains under the "locality" would be like CI.<city>.<state>.US, CO.<county>.<state>.US, or businesses. For example: Petville.Marvista.CA.US. "CI" - This branch is used for city government agencies and is a subdomain under the "locality" name (like Los Angeles). For example: Fire-Dept.CI.Los-Angeles.CA.US. So you'd be counting on the sub-registrar of jacksonville.fl.us not to allow a registration for the fraudulent "business" of Sheriff, Inc. -- multiplied by every municipality across the country.
monerozcash 11mo ago
Wouldn't make any difference, you'd just hack one email at any random sheriff department in the country. Or pay $5 for one, anyway.

mh- 11mo ago

"No problem, Deputy Smith. I'll call you back at your listed number now to complete your request." What am I missing? Not doing this is negligent. Same advice we'd give to phishing targets.

Maxious 11mo ago
Their listed number on jaxsheriff.us? What if they bought Google ads to get the first result for Jacksonville Office?