Facebook Helps Website Owners Detect Phishing Scams

42shares

Facebook announced that it is extending the capabilities of its Certificate Transparency Monitoring tool to make it easier for developers to catch phishing scams using their domains.

Phishing scams are an annoying part of life on the Internet, and they are getting more and more sophisticated, leading to more people falling for them every day. As they are shut down, scammers are constantly finding new ways to deceive. Here are a few examples, using the Facebook.com domain.

Scammers could use different characters to make a “construct a malicious domain that looks similar to a legitimate domain.” This is what’s called a “homograph attack.” For example,
- faceb00k[.]com: the letter “o”s in “facebook” are replaced by the number “zero”
- facebook[.]com: the letter “о” is actually the Cyrillic small letter “o” (0x43E), not the Latin “o” (0x6F)
They could “combine recognisable brand names with other keywords to create fake domains.” This is what’s called “combo squatting.” For example,
- helpdesk-facebook[.]com
- facebook[.]com-legit.com
They could “take advantage of small screens on mobile devices which cannot display the full domain.” For example,
- facebook[.]com.long.subdomain.that.will.not.be.fully.shown.on.mobile.devices.com
They could use common misspellings or typos, aka “typo-squatting”
- faecbook[.]com
- faceboook[.]com

Phishing scams use four main methods to spoof legitimate domains. Do you know them?

Click To Tweet

To make the domains look more legit, scammers will even get valid security certificates, to trick browsers into showing the “secure” indicator padlock. Thus, it’s not enough to check whether a site has https nowadays, before entering personal details like address, credit card numbers etc.

In a post this week, Facebook engineers David Huang, Bartosz Niemczura and Amy Xu announced that the company is extending the capabilities of its Certificate Transparency Monitoring tool so that website owners can be notified when domains are “maliciously created to implement phishing attacks” at their expense.

The tool will monitor when certificates are issued for a domain and notify owners or the rightful domain of a potential scam, so that they can take action fast, and protect their users.

With phishing attacks getting more and more sophisticated every day, website owners need to get smart.

Click To Tweet

As the engineers explain, “every time a new certificate appears in any public Certificate Transparency Log, our tool analyzes the domains specified by the certificate for phishing attempts by taking into consideration the most common spoofing techniques.” The tool can notify subscribers by “email, push, or on-site notifications, depending on their preference.” All you have to do to enable your free phishing domain monitoring service visit: developers.facebook.com/tools/ct/subscriptions

Finally, Facebook is also extending its Webhook API to allow developers integrate the phishing detection feature into their own systems. Simply follow the steps described in the documentation to set it up.