AI-based Sound-Squatting Attack Made Possible
Rodolfo Valentim, Idílio Drago, Federico Cerutti, Marco Mellia · 2022
Domain squatting is an efficient attacking technique that relies on the similarity between domain names to trick users. Sound-squatting is a type of domain squatting that explores the similarity in the pronunciation of domains. Sound-squatting requires better approaches to protect users, and indeed it demands more research attention due to popularization of intelligent speakers and the increase of voice-based navigation. In this work we propose an AI-based methodology to automatically build sound-squatting candidates. We leverage recent results of AI, namely the ability to translate text, to automatically generate possible sound-squatting candidates. We evaluate our methodology by verifying the generated candidates and classifying them according to their threat class. We generate over twenty thousand candidates from popular domains, out of which, 7% are found active at the time of the analysis. Active domains include “Parked/Ads/For-Sale” domains. We thus show that automatic sound-squatting generation is useful to proactively check and limit the abuse of such offences.