Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 02/21/08 web stories

Candidates not tuned in to cyberthreats to campaigns

By William Jackson

Using the Internet in an election campaign is not a new idea, but would-be presidential candidates have embraced the concept in this election cycle like never before.

“Every campaign is online today,” said Oliver Friedrichs, director of emerging technology at Symantec Security Response. “Everyone uses e-mail, they have Web sites and they blog.”

And they have been successful. During his entire 2004 campaign, John Kerry raised $82 million through online contributions. This January alone, Barack Obama raised $28 million online—80 percent of his contributions that month.

But along with the newfound power of the Internet comes equally significant threats, Friedrichs said at the Black Hat Federal Briefings yesterday in Washington.

Hundreds of Internet domains have been registered based on variations of legitimate campaign Web site domain names, creating the possibility of confusion, misinformation, illicit profit or hacking. They also could be used to intercept misdirected e-mail, Friedrichs said. “This is really scary.”

But candidates appear to be paying little attention to the possibilities of online shenanigans being carried out in their names.

“The campaigns haven’t taken steps to protect themselves from the problem,” said Friedrichs, who has contributed a chapter on cybercrime and the electoral system to the upcoming book Crimeware, to be published by Symantec Press and Addison-Wesley Professional.

As an experiment, Friedrichs registered 124 phony campaign domains himself. “Anyone can do this,” he said. “It cost me $800.” Although U.S. law and international rules on intellectual property allow legitimate parties to recover their name domains from squatters, no one has contacted him about the domains, Friedrichs said.

Friedrichs did research on two types of common fraudulent URLs: Typos of legitimate sites, and cousins, which are variations of a site name. Using a program to generate common typographical errors, he searched for registered domains based on misspellings and variations last year. He found 242 registered typo domains and 2,287 registered cousin domains. Not surprisingly, the front-running candidates were the most frequently targeted. There were 58 Hillary Clinton typo sites registered, and 52 for Obama. There were 566 Clinton cousin domains registered, and 337 Obama cousins. Ron Paul came in third on the cousin list with 276 phony domains registered.

More news on related topics: Communications / Networks, IT Security, IT Management, Web Strategies



GCN Popup