New Domains: A Wide-Open Playing Field for Cybercrime

As bad actors increasingly exploit new domains for financial gain and other nefarious purposes, security teams need to employ policies and practices to neutralize the threat in real time. Here’s why and how.

Thousands of new domain names are created every day as part of the Domain Name System. According to Farsight Security research, there are two to three new domain names observed, per second, on the Internet. While domain names containing a brand’s trademark and other brand-related names are the crown jewel of an organization, not all domains are created for good.

Bad actors looking to execute various criminal activities (such as spreading spam, malware distribution, and the operation of botnets) register hundreds to thousands of domains, capitalizing almost instantly on the profits and value that these domains enable. And while many of these domains are abandoned within minutes to avoid detection, the damage to victim organizations is already done.  

One approach to neutralizing the threat of new domains is to detect them in real time. This visibility enables security teams to assess their risk, update security defenses, effectively block them, and fully understand the potential threats to their organization such as to data compromise and irreparable harm to brand and reputation.

Why Age Matters
A domain’s age is a valuable factor in determining the threat it poses to an organization. New domains are cheap, “disposable” assets often used by bad actors to quickly deploy an attack. But defining a domain’s age can vary. For example, one way to pinpoint a domain’s inception is its registration date. Yet many bad actors will register a new domain but not use it right away, so it poses no immediate threat. A more useful way to determine the age of a domain is when it is first seen on the Internet. Once the domain is actually put into service, the race is on for the threat actors to leverage the domain for maximum value before reputation engines can detect and blacklist it. 

New Domains Open the Door for Old Threats
The proliferation of new domains can present a formidable threat to enterprises. For one, these domains are new, unchartered territory that have yet to be labeled as malicious or harmful. Thus, for a limited time, they represent a wide-open playing field on which criminals can easily launch old but successful threats (including phishing attacks and brand impersonation) at their discretion without fear of detection.

New top-level domains (TLDs) present another challenge. A company with an established brand has the potential to create thousands of new domain names. An adversary could register a new “look-alike” domain of an existing brand domain using many of the new TLDs. And while some protections exist for legitimate brand owners, enforcement is slow and erratic at best. In short, finding and blocking adversaries exploiting domains is all too often tantamount to a game of whack-a-mole.

Despite this threat, the good news is that most new malicious domains have a short shelf life — once they’re detected and appropriately categorized, they are often shut down or become disabled due to outside sources either via blacklists or registrar takedowns. The bad news is that even in a short window of time, the damage to an organization via malicious domains can be extensive. Domain names are critical to an organization’s brand — and the vast majority of domains that users interact with on a daily basis include some reference to the brand in use. As such, any damage to the domain will likely indirectly or directly harm the related brand.

What to Do: Four Broad Strokes
Currently, organizations looking to protect themselves against risks posed by new domains have to rely mostly on blacklists created by reputation services, which can’t block new domains in real time. To close this time gap, organizations can turn to response policy zone (RPZ) technology to filter out new domains until the reputation services have had a chance to detect and block the domain.

But as criminals increasingly exploit new domains for financial gain and other nefarious purposes, security teams also will need to employ policies and practices to reduce the threat of new domains. Because every organization varies with regard to security posture, risk exposure and the security controls they have in place, some broad recommendations include:

1. Consider blocking or alerting on domains that have no reputation or appear in a new domain data source.
2. Think about what policy to apply to incoming email from “new” domains, as well as policies to apply to outgoing web requests to “new” domains.
3. Evaluate what policy to apply to DNS resolutions to new domains by way of a DNS firewall or RPZ capability.
4. Keep in mind that novelty is fleeting; blocking a new domain for the first 24 hours is likely to have minimal impact to your business operations but can significantly reduce risk to your organization.

Looking ahead, security teams need to increasingly find ways to glean insights that only new domains can provide, including early warnings about brand infringement, unauthorized changes, and other malicious activity. For organizations, that critical insight could mean difference between business as usual and falling victim to a devastating attack.

Related Content: 

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Ben April is the chief technology officer at Farsight Security, Inc.  Prior to joining Farsight, Mr. April spent eight years at Trend Micro, where he became the Americas regional manager of the forward-looking threat research team. He has presented to security … View Full Bio

More Insights

Read More HERE