Venafi, a company that offers a range of solutions to help financial services companies secure their cryptographic keys and digital certificates, has uncovered over 100,000 URL hijacks with valid TLS ( Transport Layer Security) certificates targeting major retailers.
Venafi conducted an analysis of lookalike domains targeting 20 major retailers, as the festive season is around the corner. The analysis resulted in the discovery of 109,045 typosquatted domains of retailers from the United States, the United Kingdom, Australia, Germany, and France. These use TLS certificates to appear more genuine.
This is more than double from last year and of these only 20,000 certificates were issued for retail.
These URL hijackers targeted 20 dominant retailers from countries like the United States, the United Kingdom, Australia, Germany, and France. Of the 109,045, nearly 84,000 hijacked US domains with 50,000 copying countries major players. In the UK, Venafi could trace 14,000 fake retail certificates. The typosquatted domains were not limited to the UK and US, but Venafi also discovered 7,000 certificates for fake domains targeting retailers in Germany, 3,500 Australian retailers, and 1,500 targeting French retailers.
Jing Xie, a senior threat intelligence researcher at Venafi said," Some of these URLs probably serve a legitimate purpose, but many may be used by attackers for fraudulent purposes. We think the sheer volume of these sites is a strong indication that a large number of them are being used for malicious purposes, especially since we are so close to the holiday shopping season. " (Sc. SecurityWeek)
He also added, “Although our research did not analyze the specific threats connected with these domains, we know that lookalike domains are frequently used in phishing attacks and to distribute malware. For example, back in 2017, security researchers found that many certificates that contained the word ‘Paypal’ were used in phishing websites. It’s logical to assume that attackers are using similar tactics with other retail domains.”
60% of the total fake domains and 85% of lookalike domains targeting German retailers got their TLS certificates from Let’s Encrypt. Let's Encrypt Certificate Authority, is an online forum which gives free certificates to website owners that they can use to encrypt traffic, however, it seems miscreants are also taking advantage of its services.
