CAPEC-630: TypoSquatting
An adversary registers a domain name with at least one character different than a trusted domain. A TypoSquatting attack takes advantage of instances where a user mistypes a URL (e.g. www.goggle.com) or not does visually verify a URL before clicking on it (e.g. phishing attack). As a result, the user is directed to an adversary-controlled destination. TypoSquatting does not require an attack against the trusted domain or complicated reverse engineering.
Last updated
Overview
CAPEC-630 (TypoSquatting) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
How the attack works
The phases an attacker typically follows to carry out this attack.
- Step 1Explore
[Determine target website] The adversary first determines which website to impersonate, generally one that is trusted and receives a consistent amount of traffic.
- Research popular or high traffic websites.
- Step 2Experiment
[Impersonate trusted domain] In order to impersonate the trusted domain, the adversary needs to register the TypoSquatted URL.
- Register the TypoSquatted domain.
- Step 3Exploit
[Deceive user into visiting domain] Finally, the adversary needs to deceive a user into visiting the TypoSquatted domain.
- Execute a phishing attack and send a user an e-mail convincing the user to click on a link leading the user to the TypoSquatted domain.