How to stop ‘conversation hijacking’ from hijacking your firm

Man-in-the-middle attacks, as the name suggests, involve techniques where attackers in some way insert themselves in the middle of a transaction or communication for advantage.

One of the most recent publicly-reported examples was the diversion last year by criminals of $1 million that was supposed to be sent from a Chinese venture capital firm to an Israeli startup.

A blog posted today from Barracuda Networks included a stern reminder about what it calls “conversation hijacking” aided by creating fake domains for impersonating email addresses. It’s a threat that has to be faced by CISOs.

While the volume of domain impersonation attacks is extremely low compared to phishing attacks, the report notes that it has been increasing in recent months. Looking at customer data of 500,000 monthly email attacks, Barracuda saw more than 2,000 domain impersonation attacks in November. By comparison, there were only 500 in July.

Domain impersonation involves setting up lookalike web and email domains that fool the unsuspected. So, for example, an attacker trying to impersonate creates or — techniques called typo-squatting.


Providers, domain registrars not doing enough to prevent DNS compromise: Vendor

Scams often start with researching and taking over email accounts of senior staff. However, the report notes, cybercriminals rarely use the compromised accounts for conversation hijacking. Instead, they turn to email-domain impersonation.

“They leverage information from the compromised accounts, including internal and external conversations between employees, partners, and customers, to craft convincing messages, send them from impersonated domains, and trick victims into wiring money or updating payment information.”

The victimizing of the Chinese venture capital company is a perfect example. The criminals created fake domains of both the venture capital company and the startup to intercept and send fake messages to both sides.

Barracuda says infosec leaders can use a number of tactics to protect their organizations against this kind of attack, including security awareness training, using multi-factor authentication for account authorization, deploying technology that recognizes when accounts have been compromised, monitoring new similar domain registrations, watching for logins from unusual locations and IP addresses, and watching for unusual inbox rules like forwarding mail.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times. I can be reached at hsolomon [@]

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now