Attackers Used Look-Alike Domains to Steal $1M from a Chinese VC

Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi... by mmastrac on Saturday December 07, 2019 @11:20AM (#21731019)

I heard this story from a local startup as well - an investor ended up losing ~$100k because the investor's email account was compromised and a lookalike domain was used to impersonate the startup.

I've been calling people out-of-band for verification using phone numbers from past communications, even if I'm working on transactions that don't seem out of the ordinary. Not that SIM card fraud doesn't happen, but at least that adds another layer of security.

[ Parent | on HN ]

Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi... by westoque on Saturday December 07, 2019 @11:34AM (#21731097)

Isn’t it time to see more widespread use of encryption in emails? What I’m pertaining to is signing emails to make sure they are coming from correct source.

[ Parent | on HN ]

Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi... by thaumasiotes on Saturday December 07, 2019 @07:18PM (#21733571)

As bayarrhea points out, a signature doesn't help you if the attack model is "lookalike domain".

Email validation exists; gmail will let you know if email arrived over TLS or not. Validation that the source of an email matches the "From:" header is generally done by checking the domain's SPF record.

https://en.wikipedia.org/wiki/Sender_Policy_Framework

https://en.wikipedia.org/wiki/Email_spoofing#Countermeasures

[ Parent | on HN ]

Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi... by bayarrhea on Saturday December 07, 2019 @11:47AM (#21731170)

Encryption doesn’t help Unicode homoglyph attacks. I can send you encrypted messages all day long from google.com, even though they’re not coming from who you think they are.

[ Parent | on HN ]

Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi... by yabadabadoes on Saturday December 07, 2019 @12:47PM (#21731514)

If you are using web of trust in a gpg style then homoglyph attacks are not particularly effective..

If you are using CAs then homoglyph attacks are the simplest of many attacks based on a system of minimal technical compliance.

[ Parent | on HN ]

Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi... by DyslexicAtheist on Saturday December 07, 2019 @11:58AM (#21731230)

if you don't care about unicode domains then mitigation can be very simple using dnsmasq, e.g.:

in /etc/dnsmasq.conf add something like:

  # Add domains which you want to force to an IP address here.
  address=/:xn--*:/0.0.0.0

(in case your dnsmasq doesn't support this then there is a patch here: https://github.com/spacedingo/dnsmasq-regexp_2.76)

[ Parent | on HN ]

Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi... by zelly on Saturday December 07, 2019 @01:48PM (#21731849)

You wouldn't be able to sign the fake message with the fake domain unless you compromised the sender's PGP private key, which was not the vector of this attack.

[ Parent | on HN ]

Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi... by pbhjpbhj on Saturday December 07, 2019 @12:51PM (#21731534)

When I use the actual second party's public key, the decryption won't work though, so you'd be found out immediately, surely?

[ Parent | on HN ]

Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi... by mirimir on Sunday December 08, 2019 @12:51AM (#21734535)

Exactly so.

[ Parent | on HN ]