Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6....
Transcript of Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6....
![Page 1: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/1.jpg)
Hacking law firms
with abandoned
domain names
“You had better keep your expiring domain names alive”
![Page 2: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/2.jpg)
gabor:~$ whoami
Gabor Szathmari@gszathmari
Cyber security expert @ Iron Bastion
Privacy advocate @ CryptoAUSTRALIA
![Page 3: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/3.jpg)
Which one is real?
OptusGames.com.au
TheWestPacCentre.com.au
wmWoolworthsMoneyCreditCard.com.au
![Page 4: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/4.jpg)
@gszathmari
![Page 5: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/5.jpg)
Overview
•How domain names die?
•How to find good domain names?
•Hacking law firms – The examples
•Tips for individuals & red/blue teams
![Page 6: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/6.jpg)
Let’s go!
![Page 7: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/7.jpg)
How domain names die?
.au domain lapsing:
1. Active
2. ‘Expired Hold’ (30 days)
3. ‘Expired Pending Purge’ (1 day)
4. Purged at 1.00pm (AEST)
5. Available for new registration
![Page 8: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/8.jpg)
![Page 9: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/9.jpg)
How to find
good domain names?
![Page 10: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/10.jpg)
The manual method 1.
$ cat RO_expired-domain-names_au_daily_2018-09-08.csv | grep law
2018-09-04,04:13:42,joshlawelectrical.com.au
2018-09-04,04:30:04,comslaw.org.au
2018-09-04,05:37:05,lawyersforbusiness.net.au
[…]
![Page 11: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/11.jpg)
KeywordsBacklinks Dmoz rating
The manual method 2.
![Page 12: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/12.jpg)
Workflow
1. Iden.fy good sounding names
2. How the website looked like? à web.archive.org
3. Look up domain reputa.on(for proxy and spam filter bypass)
4. Backlinks (DMoz / Ahrefs)
5. Register domain
6. Profit!
![Page 13: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/13.jpg)
Hacking law firms
with abandoned
domains
![Page 14: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/14.jpg)
Reasons to target law firms
•Merge and get acquired frequently
•Low-security businesses
•Manage sensitive data and high-value
payments
![Page 15: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/15.jpg)
Reasons to NOT target law firms
#1: Tendency to sue people
![Page 16: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/16.jpg)
What we did
1. Identified valuable expired
domain names
2. Registered domain name
3. Added our MX hosts – ‘catch all’
4. Started receiving emails
![Page 17: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/17.jpg)
Ques%on 1.
What are the auDA
requirements to register
a .com.au domain?
![Page 18: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/18.jpg)
Question 1.
1. Must be one of these:•Registered business •Sole trader• Incorporated association•Trade mark owner
2. Must provide ABN/ACN/ARBN/TM#
3. Be able to tick a box
![Page 19: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/19.jpg)
![Page 20: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/20.jpg)
Loot #1:
Statements and
no/fica/ons
![Page 21: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/21.jpg)
![Page 22: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/22.jpg)
![Page 23: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/23.jpg)
![Page 24: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/24.jpg)
![Page 25: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/25.jpg)
![Page 26: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/26.jpg)
Text-to-email
service
![Page 27: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/27.jpg)
Loot #2:
Legal documents
![Page 28: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/28.jpg)
Family legal matter
![Page 29: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/29.jpg)
Family legal ma*er
![Page 30: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/30.jpg)
Tax invoice
![Page 31: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/31.jpg)
Client enquiry
![Page 32: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/32.jpg)
Negotiation strategy
![Page 33: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/33.jpg)
Nego%a%on strategy
![Page 34: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/34.jpg)
Bank statements
![Page 35: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/35.jpg)
Par-tay! !
![Page 36: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/36.jpg)
Loot #3:
Password
recovery
![Page 37: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/37.jpg)
![Page 38: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/38.jpg)
Ques%on 2.
What are the domain
verification methods on
‘Havibeenpwned’?
![Page 39: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/39.jpg)
Question 2.
•Email – e.g. postmaster@
•Website – Meta tag and file upload
•DNS – TXT record
![Page 40: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/40.jpg)
![Page 41: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/41.jpg)
![Page 42: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/42.jpg)
SpyCloud.com
![Page 43: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/43.jpg)
![Page 44: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/44.jpg)
Casual observation
Lawyers are:
•guilty of using crappy passwords
•tend to reuse them across mul7ple
websites
![Page 45: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/45.jpg)
Loot #4:
Password
resets
![Page 46: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/46.jpg)
![Page 47: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/47.jpg)
![Page 48: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/48.jpg)
![Page 49: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/49.jpg)
![Page 50: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/50.jpg)
![Page 51: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/51.jpg)
![Page 52: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/52.jpg)
![Page 53: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/53.jpg)
![Page 54: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/54.jpg)
![Page 55: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/55.jpg)
![Page 56: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/56.jpg)
![Page 57: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/57.jpg)
![Page 58: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/58.jpg)
![Page 59: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/59.jpg)
![Page 60: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/60.jpg)
![Page 61: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/61.jpg)
![Page 62: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/62.jpg)
![Page 63: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/63.jpg)
![Page 64: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/64.jpg)
![Page 65: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/65.jpg)
Loot #5:
Professional-
specific portals
![Page 66: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/66.jpg)
![Page 67: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/67.jpg)
![Page 68: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/68.jpg)
![Page 69: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/69.jpg)
![Page 70: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/70.jpg)
![Page 71: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/71.jpg)
![Page 72: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/72.jpg)
![Page 73: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/73.jpg)
What else we could’ve accessed?
•NSW Online Registry
•PayPal ([email protected])
•Google AdWords
•G Suite admin panel
•Office 365 admin portal
![Page 74: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/74.jpg)
Recap
•Sensi&ve data in emails
•List of email accounts at
haveibeenpwned
•Passwords from SpyCloud
•Password reset emails
![Page 75: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/75.jpg)
How to prevent pwnage? (1/2)
•Keep renewing the domain name indefinitely;
•Close user accounts that were registered with the
business email address
(e.g. Dropbox, Commonwealth Courts Portal, PayPal);
•Change or remove the business email address from
online user accounts (e.g. LinkedIn, Facebook);
![Page 76: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/76.jpg)
How to prevent pwnage? (2/2)
•Unsubscribe from email no0fica0ons that usually features sensi0ve data (Text-to-email services, mobile phone billing no0fica0ons);
•Advise your clients to update their address book;
• Enable two-factor authen0ca0on where the feature is supported for online services; and
•Use unique and complex passwords.
![Page 77: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/77.jpg)
Red Teams
Blue Teams
![Page 78: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/78.jpg)
Abandoned versus new domains
Better reputation:
•Backlinks/SEO on Google
•Proxy category
•Spam – Not flagged as a newly
registered domain
Ideal for phishing
![Page 79: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/79.jpg)
Blue Teams – Protect my organisation
•Phishing against my organisa.on
• Informa.on leakage (via ‘catch all’ email service)
•Shadow IT takeover (e.g. rogue Dropbox accounts)
•www. or *. à Web traffic / API traffic / iframe/
embedded content hijacking
•Haveibeenpwned, SpyCloud
![Page 80: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/80.jpg)
Red Teams – Security assessments
•Ideal for phishing campaigns
•Gather leaked creden5als
•Provides access to 3rd party
online services
![Page 81: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/81.jpg)
Question 3.
Can you name three domain reputation services?** Used by proxy servers
![Page 82: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/82.jpg)
Question 3.
• For$net - h+p://url.for$net.net/rate/submit.php
•McAfee - h+ps://www.trustedsource.org/en/feedback/url
• Trend Micro - h+ps://global.sitesafety.trendmicro.com/index.php
• Symantec WebPulse Site Review -
h+ps://sitereview.bluecoat.com/
• Barracuda Central -
h+p://www.barracudacentral.org/report/website-category
![Page 83: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/83.jpg)
Tooling
•Ubuntu + Pos+ix + Dovecot
•Domain registra6on:
•Manual
•API – Above.com
•Domain backorders
• ‘Drop catch’ services
(e.g. www.dropcatch.com, www.drop.com.au)
![Page 84: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/84.jpg)
Summary
•Expired domains are .ed to your
personal/professional online presence in
unexpected ways
•Overlooked a:ack vector (Red Teams)
•Achilles’s Heel of your organisa.on (Blue Teams)
•ProTip™: Keep your domain names registered
![Page 85: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/85.jpg)
Fun facts
In this research, we:
•Registered six abandoned domain names
•Received approximately 25,000 emails in total
•Won $250,000 from Mark Zuckerberg himself (we are yet to claim the prize)
![Page 86: Hacking law firms with abandoned - Iron Bastion...Backlinks(DMoz/ Ahrefs) 5. Register domain 6. Profit! Hacking law firms with abandoned domains Reasons to target law firms •Merge](https://reader033.fdocuments.in/reader033/viewer/2022050223/5f68bca9260a7e07f22e7ef4/html5/thumbnails/86.jpg)
Questions?
h"ps://blog.gaborszathmari.me/2018/08/22/hacking-law-firms-abandoned-domain-name-a"ack/
@gszathmari