1

When you visit faecbook.com you'll be redirected to a page that has no benefits for the user visiting it. The page will either try to:

  • Get your personal information.
  • Have you download their malware.
  • Have you call their technicians to "repair" your computer.
  • etc.

There are thousands of domains like faecbook.com that redirect visitors to malicious pages. How can you detect such malicious redirections?

Here are my thoughts:

  • Check the domain for typosquatting.
  • Check the length of the redirection url. They are mostly very long because they pass info about the visitor.
  • Count number of redirects.
  • Match domain against blacklist.

A combination of these features could be used to build a classifier. My goal is to detect that you are getting redirected to a malicious page before even arriving there. I'm not a professional in this field so I was wondering if someone else could come up with interesting features to detect malicious redirections. Any input is appreciated.

1

You've compiled a neat list of possible indicators for a classifier. Some feedback:

First: Who would run this classifier? Are you talking about a browser or a browser plugin that will check every URL, or are you designing a redirector service of some kind? Are you building a search engine? Obviously, your classifier only works in cases like these; it doesn't help if you're just the owner of the real "facebook.com" and want to protect your users from entering "faecbook.com", because you'll never get to see the wrong "faecbook.com".

Playing devil's advocate to your suggestions:

  • Check the domain for typosquatting: This only works if you have an inkling what the "actual" domain name should be. You could probably automate this using result counts of various search engines (or, if you were a search engine yourself, look at your index to identify close matches) or try to access domain registry databases. Or, as a browser plugin developer, you could create a central database of domains your users visit, and then determine which domains are typosquatters using some simple statistics. However, if you did this, you'd have to deal with serious privacy issues.

  • Check the length of the redirection url: This is dangerous: There are various protocols which require redirection and which can pass a lot of information through the URL (oauth, for example). You'd have to exclude these protocols to avoid false positives. Also, some frameworks send things like session identifiers as parameters in the URL as a fallback when cookies are disabled. That's hard to distinguish from your typosquatter.

  • Count the number of redirects: I don't understand this. If you're refering to the number of redirects the browser does when it hits a typosquatter url, I don't think this will work very well as an indicator. Again, there are valid reasons for redirects, and a higher number doesn't necessarily imply malicious intent. Also, there's no technical reason for typosquatters to do more than one redirect (in fact, they don't even need to do a single one; redirects are just the simplest (and cheapest!) way to forward the user to a third-party site, but they could take the traffic and cpu hit and act as a proxy instead of doing http redirection, which would be invisible to you - it would just make it more expensive for the bad guys); so if you built a hugely successful classifier based on the number of redirects, the typosquatters could simply adapt.

  • Blacklist: It will never be even close to complete or up to date. How would you compile it? If you were a browser plugin developer, one way would be to record which domains your users visit, as I already said. If you were a search engine, you might be able to do something with your index, although most typosquatter domains probably wouldn't be indexed at all, so there'd be no way to build an even remotely useful blacklist from it.

An additional avenue you might think about is to try to classify the target page based on its content. You say that the target pages try to get you to provide personal information, offer fake tech support etc. It might be possible to build a classifier on that, kind of like the classifiers to determine whether we're dealing with ham or spam in our mailboxes. You could also run a limited spider on the target site to see how big it was; if it only offered a handful of pages, that would be an additional indicator. But again, if you were successful, this would be easily overcome by your opponents automatically building a large number of fake additional pages.

  • First of all, thank you for playing the devil's advocate, that's what I needed. My goal is to build a browser plugin (not sure yet for which browser). To check for typosquatting I'd use this code: github.com/VSSRS/Domain-Parking-Sensors/blob/master/includes/…. Looks very promising. The length and count features would indeed be prone to false positive. But could be an extra indicator when typosquatting is true. The blacklist would indeed work like you said. It would be based on existing lists and on user submissions. – Stanko Feb 4 '17 at 11:24
  • Your idea about looking at the target page is interesting. Maybe a naive bayes classifier based on populair words like "repair", "call", "download", etc. Or a classifier based on screenshots. – Stanko Feb 4 '17 at 11:27
  • Thinking about it a bit more, just compiling a list of the 500 most visited web sites and try to fuzzy-match a domain against that list when a user enters it will take care of a large percentage of all squatters right there. If you automated the generation of this list and made your plugin download the new list once every two or three months, that would take care of rising and falling stars on the internet sky. That's basically your suggestion one, much reduced in scope. – Pascal Feb 4 '17 at 11:37
  • That's a great idea, that could definitely be an addition to the plugin. – Stanko Feb 4 '17 at 13:30
  • Hi Stanko, @Pascal, I like the idea of having a list of most visited domains, and near-matches (by certain edit distance metrics, and ccTLD heuristics) will trigger warnings. Wonder if a plugin like WOT already does this well enough, though. – gus May 5 '17 at 8:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.