CAPEC-630: TypoSquatting
Description
An adversary registers a domain name with at least one character different than a trusted domain. A TypoSquatting attack takes advantage of instances where a user mistypes a URL (e.g. www.goggle.com) or not does visually verify a URL before clicking on it (e.g. phishing attack). As a result, the user is directed to an adversary-controlled destination. TypoSquatting does not require an attack against the trusted domain or complicated reverse engineering.
- Likelihood of attack
- Low
- Typical severity
- Medium
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- An adversary requires knowledge of popular or high traffic domains, that could be used to deceive potential targets.
Skills required
- LowAdversaries must be able to register DNS hostnames/URL’s.
Consequences
- Other
Other
Depending on the intention of the adversary, a successful TypoSquatting attack can be leveraged to execute more complex attacks such as cross-site scripting or stealing account credentials.
Mitigations
- Authenticate all servers and perform redundant checks when using DNS hostnames.
- Purchase potential TypoSquatted domains and forward to legitimate domain.
Related weaknesses (CWE)
CAPEC 3.9 links no CWE weakness to this pattern.