Attackers Used Look-Alike Domains to Steal $1M from a Chinese VC
1–10 of 37 posts
Re: Attackers Used Look-Alike Domains to Steal $1M from a Chinese VC
#2I heard this story from a local startup as well - an investor ended up losing ~$100k because the investor's email account was compromised and a lookalike domain was used to impersonate the startup.
I've been calling people out-of-band for verification using phone numbers from past communications, even if I'm working on transactions that don't seem out of the ordinary. Not that SIM card fraud doesn't happen, but at least that adds another layer of security.
Re: Attackers Used Look-Alike Domains to Steal $1M from a Chinese VC
#3I heard this story from a local startup as well - an investor ended up losing ~$100k because the investor's email account was compromised and a lookalike domain was used to impersonate the startup. I've been calling people out-of-band for verification using phone numbers from past communications, even if I'm working on transactions that don't seem out of the ordinary. Not that SIM card fraud doesn't happen, but at le…
Isn’t it time to see more widespread use of encryption in emails? What I’m pertaining to is signing emails to make sure they are coming from correct source.
Re: Attackers Used Look-Alike Domains to Steal $1M from a Chinese VC
#4I heard this story from a local startup as well - an investor ended up losing ~$100k because the investor's email account was compromised and a lookalike domain was used to impersonate the startup. I've been calling people out-of-band for verification using phone numbers from past communications, even if I'm working on transactions that don't seem out of the ordinary. Not that SIM card fraud doesn't happen, but at le…
Isn’t it time to see more widespread use of encryption in emails? What I’m pertaining to is signing emails to make sure they are coming from correct source.
Encryption doesn’t help Unicode homoglyph attacks. I can send you encrypted messages all day long from google.com, even though they’re not coming from who you think they are.
Re: Attackers Used Look-Alike Domains to Steal $1M from a Chinese VC
#5Sounds like some brilliant social engineering went on. I'd love to read a more in-depth write-up
Re: Attackers Used Look-Alike Domains to Steal $1M from a Chinese VC
#6Earlier quoted context omitted.
Isn’t it time to see more widespread use of encryption in emails? What I’m pertaining to is signing emails to make sure they are coming from correct source.
Encryption doesn’t help Unicode homoglyph attacks. I can send you encrypted messages all day long from google.com, even though they’re not coming from who you think they are.
if you don't care about unicode domains then mitigation can be very simple using dnsmasq, e.g.:
in /etc/dnsmasq.conf add something like:
# Add domains which you want to force to an IP address here.
address=/:xn--*:/0.0.0.0
Re: Attackers Used Look-Alike Domains to Steal $1M from a Chinese VC
#7Earlier quoted context omitted.
Isn’t it time to see more widespread use of encryption in emails? What I’m pertaining to is signing emails to make sure they are coming from correct source.
Encryption doesn’t help Unicode homoglyph attacks. I can send you encrypted messages all day long from google.com, even though they’re not coming from who you think they are.
[deleted]
Re: Attackers Used Look-Alike Domains to Steal $1M from a Chinese VC
#8Well done!
Re: Attackers Used Look-Alike Domains to Steal $1M from a Chinese VC
#9Ask HN: How are other VCs dealing with this?
Re: Attackers Used Look-Alike Domains to Steal $1M from a Chinese VC
#10Earlier quoted context omitted.
Isn’t it time to see more widespread use of encryption in emails? What I’m pertaining to is signing emails to make sure they are coming from correct source.
Encryption doesn’t help Unicode homoglyph attacks. I can send you encrypted messages all day long from google.com, even though they’re not coming from who you think they are.
If you are using web of trust in a gpg style then homoglyph attacks are not particularly effective..
If you are using CAs then homoglyph attacks are the simplest of many attacks based on a system of minimal technical compliance.