NLB Blog

“Domain names are far from the only vector of attack, but they're one of the most visible,” says CyberScout founder and chairman Adam Levin.

Although hackers can deploy a wide array of methods to hijack domain names, there are fortunately several ways businesses and organizations can protect against them

The COVID-19 pandemic has significantly interrupted many aspects of daily life. It seems like every month we are faced with a new challenge to overcome, not only in our personal lives but also as a community. Recently, signs have been appearing at business around the country requesting electronic payment or the use of exact change for purchases. This has sparked several questions about what is happening regarding the coin supply.

Typosquatting is perhaps the least sophisticated form of domain name hacking. It relies on user error, specifically the odds of a user mis-typing a URL address into their web browser. Hacker register a misspelled version of a well-known domain name, such as “gooogle.com” or “gooogl.com” rather than google.com. (Important: do not visit either “gooogle.com” or “gooogl.com”. They are dangerous).

Domain names are a foundational service of the Internet, and are controlled by a protocol called Domain Name System, or DNS. While the details are complicated, DNS ultimately serves a straightforward purpose: it helps route traffic on the internet using human-friendly names.

Everything connected to the internet, from smartphones and fitness trackers to enterprise-level email servers, has a unique identifying address called an IP address. Every activity on the internet, from checking email to web browsing to posting to Instagram is a means of connecting a request from one IP address to its destination IP address. 

Your company’s online presence relies on a domain name. That domain name is registered, and you would think as a result that it would be hard for a criminal to steal, but that’s not the case. Domain name compromise makes possible a wide array of attacks--including the introduction of ransomware and other extinction-level exploits.

While no business can make themselves a hundred percent cybersecure, understanding not only the way domain names work, but also how they can be leveraged by hackers is mission critical when it comes to avoiding common security pitfalls.