CircleID

You all remember cybersquatting, a popular sport in the late 90s, right? McDonalds.com, JenniferLopez.com, Hertz.com and Avon.com thankfully all point to the right web sites today, but thaiairline.com, mcdonald.com, luftansa.com, gugle.com, barnesandnobles.com and other misspellings are fake web sites intended to trap the casual surfer with a hand that's a bit too much quicker than the eye.

These web site traps are successful because web sites are so easy to remember, people don't bother bookmarking them. It used to be that if you wanted to know the weather in Minnesota you had to go to http://www.geocities.com/Athens/rubytuesday71/weatherinminnesota281007.html . Today you go to weather.com (or type "weather for Minnesota" in google) and get an immediate response.

If you want to go to the McDonalds web site, you don't even spend the 10 seconds to look it up — you will type McDonalds.com and expect to see the latest dollar meal menu.

But the same is true for the other popular form of communication — email. If I know the person's name and company (or free email system) I will generally just type it up rather than look it up on my address book.

Of course, back in the Hotmail days when John was john_sm1th253@hotmail.com I couldn't rely on my memory alone. But today, if your name isn't John Smith, it's probably not too difficult to get a decent first name/last name combination on Gmail, Yahoo or some other free mail system, and certainly on your corporate email system.

So will we start seeing cyber-squatting on email addresses? Maybe we already do. There is no real way to know who's behind a certain email address and while it's merely funny if a guy names Roo Taylor gets the email root@aol.com, it could actually be dangerous if some bad guy owns 'john@gmail.com', 'johnsmith@gmail.com', 'johns@gmail.com', etc. Imagine how much legitimate mail is accidentally sent to those accounts by people who send the latest budget figures to their boss at work and also CC his personal address so he can watch it from his home machine too.

I have first-hand experience of this 'attack'. Luckily for me I've got the login to aviram@gmail.com (piece of cake. All you need is to have a "google-in-law". For me it was as simple as my office neighbor's wife having a cousin that works for Google. Then they sign you up for a new experimental beta Google product called "google mail" and you get not only to pick your first name as login, but send invites to a bunch of envying friends). As Gmail becomes more popular I'm receiving invitation to birthday parties of people I don't know, detailed minutes of brainstorming meetings I've never been to and last week a bunch of emails with the list of hospital equipment and inventory, all sent to some other 'aviram'. I can't imagine what would have happened if my first name was more common. I'm also pretty sure it's still possible to register Gmail accounts with common misspellings and dig out some of the emails that come out.

At the very least, this would give the bad guys get a fresh harvest of active email addresses. But if they're lucky, they may receive an email that carries a personal story that can be exploited further. Think about a young guy sending his parents pictures from an Internet cafe about his Africa safari trip. A simple typo sends the email to our bad guy who then forges a follow-up email to the parents telling them his wallet was stolen and that they need to wire money to help their stranded son.

Cybersquatting is easy to identify and is usually settled in court. With "email-squatting" I don't see a clear and obvious solution; in the meanwhile, be sure to only use your address book…

By Aviram Jenik, Chief Executive Officer. Visit the blog maintained by Aviram Jenik here.

Related topics: Cybercrime, Cybersquatting, DNS, Email, Security