Facebook announced that it is extending the capabilities of its Certificate Transparency Monitoring tool to make it easier for developers to catch phishing scams using their domains.
Phishing scams are an annoying part of life on the Internet, and they are getting more and more sophisticated, leading to more people falling for them every day. As they are shut down, scammers are constantly finding new ways to deceive. Here are a few examples, using the Facebook.com domain.
- Scammers could use different characters to make a “construct a malicious domain that looks similar to a legitimate domain.” This is what’s called a “homograph attack.” For example,
- faceb00k[.]com: the letter “o”s in “facebook” are replaced by the number “zero”
- facebook[.]com: the letter “о” is actually the Cyrillic small letter “o” (0x43E), not the Latin “o” (0x6F)
- They could “combine recognisable brand names with other keywords to create fake domains.” This is what’s called “combo squatting.” For example,
- They could “take advantage of small screens on mobile devices which cannot display the full domain.” For example,
- They could use common misspellings or typos, aka “typo-squatting”
To make the domains look more legit, scammers will even get valid security certificates, to trick browsers into showing the “secure” indicator padlock. Thus, it’s not enough to check whether a site has https nowadays, before entering personal details like address, credit card numbers etc.
In a post this week, Facebook engineers David Huang, Bartosz Niemczura and Amy Xu announced that the company is extending the capabilities of its Certificate Transparency Monitoring tool so that website owners can be notified when domains are “maliciously created to implement phishing attacks” at their expense.
The tool will monitor when certificates are issued for a domain and notify owners or the rightful domain of a potential scam, so that they can take action fast, and protect their users.
As the engineers explain, “every time a new certificate appears in any public Certificate Transparency Log, our tool analyzes the domains specified by the certificate for phishing attempts by taking into consideration the most common spoofing techniques.” The tool can notify subscribers by “email, push, or on-site notifications, depending on their preference.” All you have to do to enable your free phishing domain monitoring service visit: developers.facebook.com/tools/ct/subscriptions
Finally, Facebook is also extending its Webhook API to allow developers integrate the phishing detection feature into their own systems. Simply follow the steps described in the documentation to set it up.
You might also like
More from Facebook
Following the recent events in Washington DC, Facebook CEO Mark Zuckerberg has announced an indefinite ban on Donald Trump from …
Facebook was expecting a traffic spike on its apps over New Year's Eve, but this year broke all previous records …
Facebook is running newspaper ads newspapers criticizing Apple for its policy giving iOS users the choice of whether they want …
Facebook Collab is a new experimental music-making app available in the US, that lets you create music with friends.
Facebook is rolling out it s Brand Collabs Manager to public groups this week, giving them a new opportunity for …
Forty-eight attorneys general and the Federal Trade Commission say Facebook Needs To Sell Instagram And WhatsApp.
Facebook is rolling out several updates to US-based dealership Pages to make it easier for auto dealers to showcase and …