Unbeknownst to Reddit users, the site that likes to call itself the “front page of the internet” has acquired an unwanted evil twin they’d do well to avoid.
Registered in July 2010 as reddit.co (notice the missing ‘m’), it’s reportedly been used to host Flash games, a porn cam, and has spent a long time parked and for sale to anyone who might want to buy it.
Earlier this week, security engineer Alec Muffett noticed that Reddit.co had turned into something altogether more troubling – a clone of Reddit.com, most likely intended to phish user credentials.
Muffett found the site by accident, which is exactly how anyone would discover a site that is reached by mis-typing the correct domain by a single letter.
This made him wonder aloud:
How on earth the .co registry permitted it to be registered, is beyond me…
In fact, .co is the country code top-level domain (ccTLD) for Colombia – one might have assumed the registrar appointed to manage these would not have allowed it to be combined with such an obvious trademark as Reddit. Trademark holders are usually also careful to register similar-looking domains to protect themselves.
Muffett said he reported the page to Google’s Safe Browsing. Almost 24 hours later and the fake site was still reachable although by the morning of 7 February, Google had started blocking it.
What, if any, precautions can users of sites like Reddit take against this kind of typosquatting?
It sounds like a job for two-factor authentication (2FA) which, by coincidence, Reddit finally implemented late last month using the time-based one-time password (TOTP) protocol.
Anyone who had enabled this and found themselves trying to log in to the Reddit clone would have discovered two benefits. First, the phishing site had no prompt for the six-digit TOTP code, which would hopefully alert users that something is wrong.
Second, even if users had handed over their usernames and passwords to the phishing site their credentials would not be enough to give the crooks access to their 2FA-protected accounts on the real Reddit site.
But might TOTP codes not also be vulnerable to being phished?
TOTP works by combining a secret shared key held by the server with the current time, an operation which is repeated on the device before the output from the two is checked to see they match. Authenticator repeats this cycle every 30 seconds, which means that an attack has considerably less than this on average to conduct any phish of the code entered by the user.
Using a username, password and TOTP straight after they have been harvested is not impossible, but it’s a more complex task to get right than simply storing them for later use.
Attacks of this type seem to be rare, probably because so few people use 2FA in its various forms that attackers see no need to go to these lengths.
Password managers are another possible defence: Reddit users visiting the fake site would immediately have their attention drawn to the fact that the software had no password or username for the imposter domain.
It also pays to inspect the URL of the site you’re visiting, if something looks suspicious – misspelled words or missing letters – retreat!