is this thing on
hello there good morning afternoon or
evening uh wherever you're at
and uh welcome to the the virtual recon
village at defcon 29.
thanks very much for listening i'm glad
you're here i'm going to start off with
a disclaimer first off
that's most important my opinions
are not my employers what you're going
to hear are personal opinions
i'm not going to lie to you all i ask is
that you please help me
not get fired or sued because i happen
to love my job i also love not getting
sued
thank you for that i want to start off
with a quick shout out
first to defcon 402 that's the local
omaha metropolitan area defcon group
they heard the beta version of this talk
they didn't throw a lot of stuff at me
very supportive thank you for that
i want to say thanks again to the apsec
village and skytalks
both of whom took a chance on me as a
first time village speaker at dc27
and of course biggest thank you to recon
village
uh for accepting this talk and for
letting me take part and uh
you know i really appreciate being part
of your tradition
traditions are important uh traditional
traditions and internet traditions
like wednesdays they're important and
it's going to be a recurring topic
that we talk about here but first i want
to go back to winter
the winter of 2020 and 2021. it's a
bleak
harsh winter especially harsh if you
live in iowa like i do
it's located conveniently in the middle
smack dab of
the contiguous united states and it gets
very cold
nobody wants to go outside and do
anything
for some reason the red army acquires
things but anyway
setting that aside i'm at work and i'm
uh
down in my office in storage b and
i am taking the pandemic seriously and
doing my duties so i am wearing a mask
and i was probably listening uh to my
favorite kind of music at the same time
too
but anyway i'm at my computer and i'm
doing some of the
mission critical work that my employer
requires of me
so as i'm reading emails i notice that i
get one email
that is uh it's addressed to me and it's
copying a number of other people
one of the addresses that copies doesn't
have the right domain name so
uh my domain name our our official one
enzyme.gov
i work at a county government but in
this case the email was also addressed
to somebody at the same exact name
except editon.org easy mistake to make
the question is though where does that
email go i was curious you know
who got that.org email it's easy enough
to check
i went and looked up mx records turns
out nobody owned
that dot org domain and
for about eight dollars i or anyone else
on the internet could buy that domain
name
and you know suddenly once you own the
domain
and you set up the dns and you can
decide where the email goes and where
web traffic goes and that sort of thing
you're a hacker now uh you can start
receiving emails you weren't supposed to
be privy to
and uh that's something we're going to
talk about so
how does somebody type a dot org instead
of a gov i mean we're a county
government or a government entity you'd
expect gov is what people think but
that's not always the case and again the
answer is because of tradition
because because across the united states
uh local governments cities and counties
for years and years
have have used dot orgs and dot coms and
dot u s
domains uh instead of govs
and uh it's only recently that local
governments have started to move more
into the the
gub domain space i remember a time
before the web was invented
when uh dot us was actually a pretty big
deal for public institutions and a lot
of people were using it
uh you know americans are stubborn they
didn't standardize it on it
like they did in the uk or in germany
and places like that
anyway that means that local government
entities are using all sorts of
different domains.coms.net.org.us
domains
and that makes it tough to know which is
the the real deal but then there's
the.gov top level domain it's a special
top-level domain
available only to government entities in
the united states
how do you get one of these and why
would somebody not use one well
getting one you have to apply to the
federal government to get to get your
gov domain and a couple years ago i
guess it was a little bit too easy to do
because uh
brian krebs ran an article there was a
fellow who
was able to get a gov domain and all he
had to do
was download the logos from a town in
rhode island
put them on letterhead and say i'm the
mayor give me a gov and it
worked out so that wasn't good
i don't recommend that by the way i just
want to be clear that uh forging
documents and you know
getting.gov domain you're not supposed
to that's fraud or forgery that's
illegal stuff
don't do crimes stay in school kids uh
but
back then the gov registry was run by
gsa if you've ever if you've ever worked
for
with or in the us federal government you
probably had dealings with gsa and they
had a whole bunch of different rules
and they did do work to try to verify
those domains but obviously some
slipped through nowadays the.gov
registry is run
under cisa it was moved over it was kind
of part of the fallout from the
2016-2020 elections
um and now it's free to get a
gov domain it's free for local
governments to register those it used to
be a 400
a year fee that doesn't seem like very
much and it's not if you're in the
federal government
but if you are a uh you know town with
500 or a thousand people or something a
400
expenditure is actually a pretty big
expenditure it's free now they
they want you to go to it in part for
election security but also just to make
it clear that you are a government
entity
and so local governments are moving in
droves
to gov domains and there are good
reasons for doing that
the gov domain carries a certain cachet
when you see it you know it's got to be
a government entity because no one else
should be able to get one
it's trusted more whether that's the
right way to do it or not employees and
citizens trust it
and yet there are still a lot of
governments out there that use
dotcoms.net
and us domains and
why do they do that again it's tradition
it's as old as star wars
themed weddings the tradition i mean
look at multnomah county in oregon
they've been using a.u.s domain for
20 years so their citizens and employees
know to go there
that's the place they go to syracuse in
in new york
that city has a net domain a little bit
unusual but
they've been using it for a number of
years as well
we're going to talk about using
look-alike domains and specifically
using impersonations of.gov domains
and.us.org whatever local governments
are using because it's it's dangerous
and also because uh you know it works
and so
those of you who are red teamers for a
living you you probably are hearing this
and you think
this isn't super advanced and you are
right it's not
but it is effective um and it's a form
of typo squatting
so i'm sure everyone knows what type of
squatting is you type facebook wrong or
gmail wrong you end up at the wrong site
i hope you don't get you know loaded
down malware when that happens
there's a term cyber squatting that's
used now to cover typo squatting and
other types of
lookalike domains and things like that
it sounds cooler because it has the word
cyber in it plus when you put it in your
title it doubles your pay
so that's good we're going to talk a
little bit about doppelganger domains
and so their look-alike domains imposter
domains
that are missing a dot pretty easy to do
an easy mistake for
somebody to make but we can also you
know
that's doppelganger's a german term we
can also go back to
greek because there are some lovely
things you can do to set up
look-alike domains uh using techniques
like homophones those are words that are
spelled differently but sound the same
you can trick users that way um everyone
loves unicode i'm sure you do
and dealing with uh yeah dealing with
that unicode offers a whole bunch of
different alphabets
and there are alphabets like cyrillic
that have letters that look similar to
the latin ones
but aren't the same and they make lovely
lovely imposter domains
bit squatting this one you may have read
there's a paper out recently on this and
some amazing stuff and basically every
now and
again a computer accidentally changes a
one to a zero
apparently it's done by space rays and
possibly aliens are behind it whatever
it is it's really really cool
we don't need any of that we have very
simple
very simple attacks to do just by
substituting dot org or dot com for
gov and once you can get someone to go
to your lookalike domain
you control what their experience is you
control what website they go to for real
and
you control where email goes so
that's all we need all we need to do is
rely on
human nature and human nature says that
somebody is going to
who's been used to typing.org for 20
years is going to keep typing.org even
when
governmentswitches.gov why do i care
about this why am i
talking to you about this today well
i've worked
in county government for about 20 years
and you know when i started i actually
had a lot more hair and probably a
little bit more sanity
and uh i i'm still going strong but i
care about the security
of our local governments and i started
out in our county's i.t
department i spent 15 years there during
the last
eight years i dur by day i was a
mild-mannered
i.t professional and by night i fought
crime
as a reserve deputy in our sheriff's
office and i started doing digital
forensics that way
and and i i guess i don't really have a
cv slide but
my favorite accomplishment is that i
think i am federally
considered a porn expert because i was
at a federal trial once
testifying and uh the defense attorney
came up and
i was ready uh to uh it was ready to
examine me and
uh in his line of questioning he started
off deputy cava
you're an expert in pornography and
there was this pause and it was empty
and so i just said
thank you and uh stenographer typed it
down it went into the transcript and now
i think federally i am recognized as a
porn expert so there's that
um i i've been on the i've been on our
state's
internet crimes against children task
force since 2009 and so when i explain
it to students i tell them that you know
we go after bad guys on the internet who
go after kids so
you know we're the good guys marty for
those of you of a certain age
i am a hacker and i carry a badge and i
don't think those things are mutually
exclusive in fact i think we need more
of that i think we need more people
who subscribe to the hacker ethos who
who believe in transparency uh who
believe in privacy
who believe in you know judging people
by who they are not by you know who
their parents were where they came from
what they look like
i think we need more of that in law
enforcement um and i
i want to just so you've got something
hopeful hopeful message to come out of
this
i want to let you know there are
literally dozens of us out there
and we are infiltrating law enforcement
all over the united states and elsewhere
so uh
i'm hoping that we can affect some sort
of change but
my job and i work in a sheriff's office
is uh
investigating cyber crime and and that
can mean you know looking into facebook
accounts that means uh
doing forensic examination so i also uh
you know will dump cell phones i look at
computers that sort of thing
i do all those and then i also have a
cyber security role and i've had
that kind of role ever since my days in
it
we have at the local government level
the same kind of challenges that you
have at any organization we have a
domain to protect
and we want to do that and
that also means looking out for our you
know actual domain names
so i work for a place called potawatomi
county
there'll be a spelling test later on so
don't worry about it for now but
nobody our citizens can hardly spell it
and so we don't use that name spelled
out we uh
for years and years about almost 20
years uh used potcounty.com with two t's
as our
as our domain name when i was in i.t i
registered the 1t variant just to make
sure that nobody could grab that away
from us
before it was cool and before it was
free we switched over to a
gov domain and back then i didn't think
i didn't think to register the dot com
or dot org they go along with that
so i missed out on an opportunity there
which brings me back to this email this
email that's going
nowhere it's going to a dot org that
doesn't exist i started looking into it
and then i thought well i wonder where
else in the state of iowa this could be
happening because i
you know work with other counties and so
on there are 98 other counties in the
state of iowa
and it turns out a lot of them had
this potential vulnerability they had
domains available that were very similar
to their real domain
and as i looked at those you know i got
to thinking
state of iowa is not very big it's not
not a very populous place
there got to be bigger fish in the sea
there's got to be you know bigger
targets out there and
where do you find them well thankfully
the sum
total of human knowledge is now out on
the internet under wikipedia.org so
you can find them there there's a list
of cities and counties listed by
their populations and so if you want to
find the most populous ones the best
biggest targets to look at that's one
way to do it
and that led to an experiment that led
to
some research i decided i want to find
out what other counties are out there
what other cities are out there
that could fall victim to this sort of
thing and what can we do about it
like all of life's hardest problems this
one was solved with pearl
and i wrote some pearl code to go out to
wikipedia
scrape that list of most populous
counties and cities and then go
a level deeper and find the websites for
them out of the individual articles
there's probably an api for it but i was
too lazy to learn it so i just did it
with regex's
i put that into a database did some dns
queries did some who is queries
figured out which of those domains were
available made a nice list of targets
and i didn't do anything super fancy
there's no uh
you know raise from space involved here
if they had a dot gov i looked at the
dot com and
org that were similar if they had a dot
us same thing and
as i was doing this i thought why limit
ourselves to uh to the united states i
mean
and every other country has governments
too and what about the uk we've got our
special relationship with them they
should like us they haven't invaded us
in 207 years that things were going
really well i thought it was about time
to shake things up
so i looked at gov.uk to see what else
was available for them
that's their equivalent to our.gov
domain yada yada yada
i ended up with 42 look-alike domains
that looked like
local governments from here and abroad
and basically if they had a.gov i looked
for the
similar coms or orgs if they had a dot
u.s i looked for doppelganger
opportunities
we in my county and this is that's how
you spell it
i have one of these official
co.countyname.state.us domains
and those are rife for um for
doppelganger attacks too
drop that dot out of there so look to
some of those
and gov.uk as i mentioned it's their
equivalent to our.gov
and people will miss that last stop
before the gov and so
i registered a couple of those and this
isn't something limited just to
you know the uk and the u.s there are
domains that are
parked or domains that are available for
countries all over the world
and uh one interesting thing that came
out of this was i found out that the uk
actually has a safety net in place to
protect
to prevent this sort of thing from
happening something we don't have in the
u.s
um they have read they have a registrar
with regulations that say that you
cannot register a domain
if you're going to use it for phishing
or illegal stuff i mean it's it's a good
idea
and they didn't actually let me register
the domain at first they said this looks
hinky
and they uh sent me a an instagram by
email
and asked what that guy was up to i told
him doing some research i promise i'm
not doing anything bad if he can't give
me the domain
no big deal um the appeal went up i
assumed at the highest levels of
government
and it went through i was able to
actually register the domains i wanted
so
somehow i got away with it just barely
and so
no international incident there good
thing
let's get back to the experiment so the
goals of the experiment we're going to
do something good we're going to try to
take some of these domains out of
circulation so that an attacker can't
use them
we're also going to try to increase
awareness that's actually part of what
this talk is about
i've got these 42 look-alike domains
ready to go so i set them up
to redirect their web traffic to the
real site that they're that they're
that they look like to the actual
government sites just as a 302 it
doesn't say that
you know our lookalike is the actual
site we just redirected the real one
um also started bouncing emails
so set up mx record and anybody who
emails one of these lookalike domains
they immediately get a bounce message
back so we're looking at the email
for research purposes to figure out you
know how bad this problem could be
but we're also telling them this is not
the right address and
usually after the second or third try
they figured that out
they're at no point did we do anything
to try to entice people
to use these lookalike domains so at no
point was i taking a domain and putting
it out there on google or whatever and
saying this is the official one
anything that came in was unsolicited
and i decided to take
you know i used the prime directive and
decided not to interfere with anything
that happened here obviously if i saw an
email that said you know somebody was in
immediate danger i would have taken
action
right away but that never came up
thankfully so no problem
this sounds kind of sleazy people you
know registering domains that look like
someone else's domain there ought to be
a law
right and it turns out there is since
1999 there's the anti-cyber squatting
consumer
protection act and it's uh it's not
criminal so you're not going to go to
jail for it
but it gives companies a way to sue if
somebody tries to water down their
trademark by registering something or
just you know squats on one of their
names
we're not going to run a follow that
because we are not going after first off
anything in private private sector or
you know private industry
but second our motivations are good
we're not doing anything wrong
here's the intent we want to deny the
best real estate
to the baddies we want to bounce emails
to make it obvious to anyone who sends
an email that they got the wrong address
so that they fix their stuff
um and then we want to at the end of
this and this is actually in progress
now
give these domains away to the the
potential victims that could use them
so if you know if there was a county
somewhere and and one of their domains
was one of these 42
or where there's a look-alike i wanted
to give them the domain and i've done
that
now with seven or eight counties so far
the beauty
of this kind of attack of this these
look-alike domains
there's a lot going for it first off
it's difficult to detect
there are companies you can pay to go
look for these things or you can buy
feeds
you know newly registered domains but
it's it's kind of tricky and you got to
remember
that there are 3 000 counties in the
united states you know give or take
and some of them don't even have it
departments they've got an auditor's
clerk or whatever that's doing their
stuff and so
they aren't going to be able to keep an
eye out for this it can be very silent
if you're just passively accepting email
and accepting web traffic
nobody may even you know see that this
is happening
you can also do uh meddling with the
traffic you can do man in the middle
attack if somebody is visiting
the wrong website you can proxy them to
the right one inject some javascript or
whatever you want to do there's
dangerous stuff that can happen
there's a ton of intel you can get on
this if you're a red teamer or an actual
attacker
if you are watching the email traffic if
you end up in one of these email chains
where you're cc'd
you can you can jump right into it you
could reply and it's going to have the
right thread id it's going to look right
or you can sit back and just collect the
data you can build a beautiful dossier
on somebody that you are after a target
because you're going to you're going to
see their actual email signature you can
get phone numbers you're going to know
who they're talking to what business
they're doing i mean there's tons of
intel there and you cannot use all that
for phishing
and you'll even know you know what the
best topics are and you may know what a
banner is going to look like if you're
going to hit one of those external email
banners
the lifespan on this thing could be
indefinite because if you're not
outright breaking the law or it can't be
proven that you are then
you can just sit there silently with
that domain for years and years and
there may not be anything somebody can
do
so 42 domains they're set up
first few days already there were
results and i want to share those with
you
um instant results the one of the very
first emails that i saw come across
was from a lawyer and had a disclaimer
at the end that said
email is not secure a little bit of an
understatement
and then there were the secure emails so
you've seen the
zix emails in office 365 and virtru
those were coming in and how do you
authenticate yourself you click the link
and say
i own this email they send you a code
and you're in the email so
not very secure in that case then there
were the zoom invites
zoom invite after zoom in fight there
were just so many of them you probably i
know everybody zoomed out after 2020
2021 here but
anyway there were a ton of those if you
wanted to bomb a meeting wouldn't be too
hard to do
invoices financial information sometimes
there's financial information on the
documents that we're coming across
sometimes it's just a useful invoice
again if you wanted to send a false
invoice to someone you know exactly what
it should look like and who it should go
to
people citizens are sending in their
paperwork they're sending in their
vehicle registration stuff like that
trying to get to the department of motor
vehicles and
some there were just weird uh off the
you know off the wall stuff you wouldn't
have expected
like um notifications about new
toxicology reports from autopsies that
just started pouring in because they
were automated
oh and and a coupon for subway so
there's that
is anybody doing this it was a question
that comes up if you're looking at the
stuff you're thinking wow an attacker
could actually do this who
who's actually doing this well i've got
an example and i don't have to go very
far because it's actually our county
seat
council bluffs iowa is the seat of
pottawattamie county it's where i live
it's where i work
and they have a website it's a gov
they've been on a
dot gov for a number of years but
somebody else has the dot-com
who has the com and why do they have it
what are they doing with it
well if you look it up i looked up the
name servers and you can see the real
one uses a company called civic plus
that makes sense
uh the fake one the dot com uses
keystonepack.com
and the servers are bernie and hillary
which is interesting interesting pairing
too but
what does that mean well if you look up
keystonepack.com you'll find out
that it resolves the same ip address
they both have
they both have mx records so they can
receive mail uh they
must be the same company if you look up
that ip you'll find that it's hosted out
of new york
and if you go to the websites you just
get this placeholder park domain kind of
thing it just says this is whatever the
domain name is
keystonepack.com however is very similar
to keystonepac.org which is a real
political website so it sounds like
their parking domains lookalike domains
for
political or government agencies
dig a little deeper make an smtp
connection and you can get
another domain now bigfission.com you
dig into that and it turns out to be
a remailer in the netherlands it's been
operating since the 90s so a little bit
of a rabbit hole there that's as far as
we'll go down it but somebody is
using that.com and they could be
receiving email because they've got mx
records going
i noticed at the time when i was looking
into that that nobody had the dot org so
i did register that and did hand it over
to the city of council bluffs so that
they can hang onto it for safekeeping
they may never get that dot com back
without they've got the dot org
what about states our state state of
iowa
iowa.gov is their official domain they
have lots of subdomains in there
including for counties
who has iowa.com it's parked somebody
wants fifty thousand dollars for it
at any point they could register or they
could put up mx records and start
receiving emails from peopletype.com.gov
who has the dot org this guy named yan
he's had it since the 90s in fact his
website doesn't seem to have changed too
much since the 90s which is
cool but anyway if he wanted to he could
start publishing mx records and stealing
emails
the same way anyone else could scary
stuff
so we're getting emails we're we're
getting uh hits
to uh these look-alike websites uh what
are the results or anything useful
well i told you a little bit about
things seen in the first three days but
there were
even weirder more cringe-worthy things
coming after that
after a while i started seeing it looked
like a driver's license every day or two
people are sending their pictures their
driver's license in
there were all those invoices again and
bills and quotes and all sorts of
lovely financial information good for
fraud use
over over 200 pdf documents attached to
emails that came in
there were over 170 photos that were
sent including those drivers licenses
just here's a quick chart on dns but
basically there are over 4
000 queries against these 42 domains
every day
web traffic over 1300 hits every day a
lot of those are automated but some of
them
are people that hit the wrong domain and
you can control where they go i
ended up over almost four month period
getting 2 500 emails
that's over 23 a day to these 42 domains
you've got
mail and and what if i told you there
was some really scary stuff in there
you know you'd believe it i mean i
assume from what you've seen so far
there was one email that came in that
had
the trifecta not just the driver's
license but also social security card
and a certificate of birth all in one
email
so that was good there's a largest uh
large-ish
city in california that has a credit
card form
they use for permitting and they said go
ahead and email it to us with your cvv2
and everything so that was cool
ended up getting automated notifications
like this one
whenever there's a city that was buying
water from a neighbor
and every time that they did that their
ics system or whatever would trigger
this and you would get a receipt
so that was kind of interesting to read
or this wire transfer notice
coming from a pretty big city in the
midwest every time they did a wire
transfer
i was getting information about it
thankfully not everything was so scary
in fact i think the majority of the
emails were people trying to get out of
jury service which makes some sense
there was a little bit of police
intelligence involved because
a cop at some time had gotten signed up
on a list serve
with the wrong address and now for years
even though the email
wasn't going anywhere until the domain
was registered they were getting
bulletins with all the latest you know
criminal information in there so
passwords people signing up their
colleagues or their workers
for different websites they put the
wrong address in and you get their
initial password
also some two-factor action i'm seeing
codes coming in when people are trying
to log into their you know google
accounts or apple accounts
too long didn't read summary here this
attack is cheap
it's simple it's hard to stop once it
starts and
it works it works and it doesn't require
a lot in terms of uh
you know capabilities uh how do we help
with this
well like i said registering the domains
is good getting the word out there and
getting awareness up is good too and so
i gave a talk to
iowa counties and told them about this i
put some other things out to
national counties groups and i set up a
website i made this website called
imposter.domains
and if you go there you can do a search
for any domain name you want
and you can go do this now and it will
give you just a couple of hints as to
what some similar domain names might
look like
and tell you whether they're taken or
not and there's a frequently asked
questions that explains how all this
stuff works so if somebody's not
familiar with domains that works there's
all
there's even a nerd mode you can turn on
and you can see a little bit of dns
information
for these domains too if you want to so
feel free to check it out
imposter.domains
if you spell it with an er by mistake
that also works because it's a look like
domain right
anyway the results of this are the
concepts confirmed this attack works
everybody knew you could do it it's not
a surprise it's nothing new
but i'm just telling you that uh from a
proof of concept
it's it's f it's uh feasible it works uh
the awareness is expanded we
between talks and that site trying to
get the word out so that all these local
governments that are uh
now moving to govs make sure that they
protect themselves
and we're transferring domains getting
them out to the individuals who could
use them so we make sure they never go
back into circulation
and that is it that's all the
information i had to share with you now
you know it's half the battle
thanks so much for listening if you've
got questions there's going to be q
a on defcon's discord the links down
there if you
need to get in there you're probably
already logged in thank you for that
and that is it if you want to reach out
my website with my contact info is
forensic.coffee
and i really appreciate you listening
and thanks so much recon village for
giving me a chance to take part
[Music]
you