Many companies protect their brands by registering domain names that are slight variations on their own, but manufacturers of industrial control systems don't seem to have followed suit, potentially leaving customers open to attack.
Researchers from security consultancy Digital Bond have found 433 so-called "squat" domains whose names are similar to those of 11 industrial manufacturers, and which have been registered by unknown third parties. Some of the domains have been hosting scams, malicious redirects and malware.
Attackers engage in domain squatting for various reasons: to host phishing pages in order to steal credentials, direct accidental visitors to malware, profit from the brand's popularity by displaying ads, or sell the domain to the brand owner for a large fee.
By impersonating the domain names of industrial control systems vendors, attackers could trick factories, public utilities and oil and gas refineries into downloading malware or modified firmware, putting critical assets at risk. Supervisory control and data acquisition (SCADA) systems, which are a component of ICS, are an increasingly interesting target for hackers, particularly those looking to do physical damage.
Squat domain names include those that result from typos, such as "goople.com," or that rely on homoglyphs -- similar looking characters -- such as a zero instead of a capital "o."
Attackers also use a technique known as bitsquatting, which involves registering domain names that differ by a single bit from the original, and then relying on memory corruption errors in hardware to lead users to them.
During every DNS lookup or HTTP request, domain names are stored in a computer's RAM as binary code -- sequences of 0s and 1s. If the computer's memory is corrupted, for example due to a faulty memory module, one or more bits can accidentally be flipped.
For example, between google.com and googme.com there's a 1 bit difference -- the representation of the letter "l" in binary is 01101100, and that of "m" is 01101101. So a bit error on a computer where google.com is loaded in memory could lead a user's browser to googme.com instead.
From the viewpoint of a single computer, bit errors are rare. But there are many devices on the Internet, and there are typically multiple instances of a domain name in memory at any time. So the likelihood of a bitsquatting domain attracting accidental visitors is not negligible.
Attackers appear to be aware of this. According to Reid Wightman, the director of the Digital Bond Labs who performed the ICS domain survey, bitsquatting was the third most common technique used to generate the identified squat domains, accounting for 20 percent of the 433 domains.
Wightman presented his findings Thursday at the S4xEurope conference in Vienna.
Sign up for Computerworld eNewsletters.