CBWY Blog

“Domain names are far from the only vector of attack, but they're one of the most visible,” says CyberScout founder and chairman Adam Levin.

Although hackers can deploy a wide array of methods to hijack domain names, there are fortunately several ways businesses and organizations can protect against them.

Typosquatting is perhaps the least sophisticated form of domain name hacking. It relies on user error, specifically the odds of a user mistyping a URL address into their web browser. Hacker register a misspelled version of a well-known domain name, such as “gooogle.com” or “gooogl.com” rather than google.com. (Important: do not visit either “gooogle.com” or “gooogl.com”. They are dangerous).

Domain names are a foundational service of the Internet, and are controlled by a protocol called Domain Name System, or DNS. While the details are complicated, DNS ultimately serves a straightforward purpose: it helps route traffic on the internet using human-friendly names. Everything connected to the internet, from smartphones and fitness trackers to enterprise-level email servers, has a unique identifying address called an IP address. Every activity on the internet, from checking email to web browsing to posting to Instagram is a means of connecting a request from one IP address to its destination IP address. 

Your company’s online presence relies on a domain name. That domain name is registered, and you would think as a result that it would be hard for a criminal to steal, but that’s not the case. Domain name compromise makes possible a wide array of attacks--including the introduction of ransomware and other extinction-level exploits.

While no business can make themselves a hundred percent cybersecure, understanding not only the way domain names work, but also how they can be leveraged by hackers is mission critical when it comes to avoiding common security pitfalls.

We’re not even halfway through 2020, and already it’s been a record-breaking year for ransomware attacks. Barely a week goes by without reports of a new strain or variant of malware wreaking havoc among companies. No industry, category, size, or group is safe from this cyber scourge.

Not all summer scams target unwary travelers. There are legion crimes waiting to happen that target their victims at home or in the workplace.

Vacation season presents a golden opportunity for scammers. Their targets are typically looking for bargains and are more likely to let their guard down, especially now with demand for rentals and hotel space at an all time high. For those hoping to get some rest and relaxation away from work and other responsibilities, the competition for that perfect vacation spot can present a perilous lure--and scammers know it.

Covid-19 quickly revealed shortages (and organizational) shortcomings that worried consumers, whether it was the availability of PPE supplies, medical treatments, or diagnostic tests. Each of these deficits provided criminals with hard to resist lures that continue to be used in phishing and malware campaigns.

The response from federal, state, and local government agencies and organizations to support the economy during the pandemic created fertile ground for scammers. With tens of millions of newly jobless or furloughed Americans filing for unemployment benefits and the federal government paying individual stimulus checks to avert further economic crisis, criminals have been making a fortune.

Several state governments have been targeted by a sophisticated fraud campaign that has likely siphoned millions of dollars in unemployment payments earmarked for the record number of Americans seeking benefits as a result of the pandemic, a new Secret Service memo warns.