Avoid Falling Victim to a Registrar Phishing Attack

Comment | Print | RSS

• Login to Rate

Phishers also use emails from domain name registrars in phishing scams to gain control over legitimate domain names. Often, the attacker's objective is to change the IP addresses of your name servers in order to control name resolution for your domain. An attacker who can gain control over your name servers can inflict reputation harm -- directly, through Web defacement or email interception, or indirectly, by using your domain as a source for spam or other criminal activities.

Basic phishing avoidance and awareness are a big part of the vigilance your organization needs to maintain to avoid falling victim to registrar attacks. Beyond these -- especially if your organization cannot afford the embarrassment of a defacement or a disruption of online presence of any length or kind -- you may want to consider measures recommended by ICANN’s Security and Stability Advisory Committee (SSAC), described below.

• Use registrar emails to your advantage. Registrars often send notification emails when changes are made to your domain account. Use these to confirm that the changes were authorized and correct. As an extra precaution, use an email address from a domain other than those registered under your registration account. This protects against an attacker who compromises your registration account and quickly alters your mail exchange (MX) record to block your organization from receiving emails.

• Use multiple point of contact information to distribute risk and response. Each domain name registration contains a registrant (domain holder), along with administrative and technical points of contact. Use three distinct points of contact (including email addresses) to increase the likelihood that at least one responsible party in your organization will notice unauthorized changes.

• Monitor your domain’s Whois and DNS information. A simple monitoring activity that routinely compares responses from Whois and DNS queries against what you believe to be the complete and correct domain registration, DNS configuration, and domain zone information for your registered domains can save your organization’s assets. For larger organizations, look for a registrar or independent business that includes such monitoring as part of an online brand protection package.

• Have complete account, abuse contact, and configuration information ready and available for event response and recovery. Be certain you have urgent point of contact information for your domain registrar(s). Be prepared to present copies of your registration information, proof of registration, name server hosting information, and zone data in situations where you may have to recover from a domain registration account compromise.

You may ask why your organization, and not your registrar, should have to put this kind of effort into protecting domain name assets. You could very easily ask the same of the online banking and e-merchant services your organization uses. Though these are different assets, the issue is the same. Phishers thrive on deception and social engineering. They study the security measures that banks, e-merchants, and registrars implement, so they can subvert them. You can’t rely on these security measures exclusively. Ultimately, the responsibility to avoid falling victim to scams of any kind is yours.