Re: [dmarc-ietf] cousin domain definition (was Re: Fwd: Eliot's review of the DMARC spec)

[Steve Jones <[e-mail]>]

Do we have other definitions to cover deceptive names not similar to an
existing domain? If phishers are using CraftsmanOnline.com, and Sears using
other domains, is that a cousin domain or do we need a different term?

If it is considered a cousin domain because it plays on a known entity name
or brand identity...

<t hangText="Cousin Domain:"> A domain name that is
     deceptively similar to a registered domain name or other name
     associated with a known entity.  The target name may be familiar to
     many users, thereby imparting a degree of trust. The deceptive
similarity can
     trick the user by embedding the essential parts of the target name
     in a new string (such as, "companysecurity.example" to attack
     "company.example"); it can use some variant of the target name,
     such as replacing 'i' with '1', which is known as a "homograph
     attack;" or it may invent a plausible domain name based on the
     common name of a known entity or brand, such as "BrandAOnline.example,"
     where the entity actually uses other domain names such as
     "xyzcorp.example."
</t>


On Mon, Jul 8, 2013 at 5:54 AM, MH Michael Hammer (5304) <[e-mail]>wrote:

> I don't think it is just that the target domain is familiar to the users
> under attack. It is the "brand identity". That is, the users under attack
> may be familiar with the brand but not necessarily familiar with the exact
> domain that the brand/organization uses.
>
> Mike
>
> > -----Original Message-----
> > From: [e-mail] [mailto:[e-mail]] On Behalf
> > Of Elizabeth Zwicky
> > Sent: Saturday, July 06, 2013 2:52 PM
> > To: Dave Crocker; Matt Simerson
> > Cc: SM; [e-mail]; Murray S. Kucherawy; Eliot Lear
> > Subject: Re: [dmarc-ietf] cousin domain definition (was Re: Fwd: Eliot's
> > review of the DMARC spec)
> >
> >
> > I would say that the target domain is familiar to the users under attack.
> >
> >       Elizabeth
> >
> > On 7/6/13 11:41 AM, "Dave Crocker" <[e-mail]> wrote:
> >
> > >Thanks for the quick feedback.
> > >
> > >some additional thoughts...
> > >
> > >
> > >On 7/6/2013 11:18 AM, Matt Simerson wrote:
> > >>>     A cousin domain is a registered domain name that is deceptively
> > >>> similar to a target domain name.  The target domain is *usually
> > >>> *familiar to many end-users, and therefore imparts a degree of trust.
> > >>>  The deceptive similarity can trick the user by embedding the
> > >>> essential parts of the target name, in a new string, or it can use
> > >>> some variant of the target name, such as replacing 'i' with '1'.
> > >>
> > >> I inserted the word 'usually'.
> > >
> > >That's a kind of careful phrasing that makes sense for precise
> > >specification, but I think is actually distracting for the usage here.
> > >
> > >That is, I think that extra qualifiers in definitions are, ummmm...
> > >usually distracting...
> > >
> > >It's not that it's wrong; it's that I doubt it's as helpful as we'd
> like.
> > >
> > >
> > >> In addition to providing basic examples, perhaps include the well
> > >> defined and recognized terms: typosquatting, and IDN homographs?
> > >>
> > >> https://en.wikipedia.org/wiki/Typosquatting
> > >> https://en.wikipedia.org/wiki/IDN_homograph_attack
> > >
> > >yeah, and probably cite the dhs.gov text, to show some history to the
> > >key phrase.
> > >
> > >d/
> > >
> > >
> > >--
> > >Dave Crocker
> > >Brandenburg InternetWorking
> > >bbiw.net
> > >_______________________________________________
> > >dmarc mailing list
> > >[e-mail]
> > >https://www.ietf.org/mailman/listinfo/dmarc
> >
> > _______________________________________________
> > dmarc mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/dmarc
> _______________________________________________
> dmarc mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dmarc
>