6 ms·

Yeah wow this is actually pretty bad. Right now I can go buy: - wellsfargo.zip - bankinfo.zip - irs.zip - email.zip - taxreturns.zip Which — in one sense

Yeah wow this is actually pretty bad. Right now I can go buy: - wellsfargo.zip - bankinfo.zip - irs.zip - email.zip - taxreturns.zip Which — in one sense it's great that there's some new domain names. On the other hand these 5 alone would be a total phishing nightmare for some unsuspecting people.

Cthulhu_ 3y ago
winrar.zip
indeyets 3y ago
win.zip
evan_ 3y ago
What's the specific attack vector you're thinking of for something like wellsfargo.zip?
- woodruffw 3y ago
  Some of these are more tortured, but I can personally imagine a scenario in which a less-technical friend or family member is told to open a ZIP archive locally by some (trusted!) website and types that into the omnibar instead, bringing them to a random website.
- growthwtf 3y ago
  There's probably better ones, literally the first one I tried, but I'm imaging someone messaging me that telling me to download a recovery package for my Wells Fargo account and that it should open in the browser. Then have UI mimicking some kind of OS prompt and asking for your social security as a password to confirm identity, or something.
  - evan_ 3y ago
    Is that substantially different from simply messaging someone and saying "download this file:" and linking to a malicious site with a .net TLD? Is the thought that the .zip tld conveys some kind of trustworthiness that a different TLD would not? Really trying to understand this, I hope I don't come across as snarky or naïve.
    - growthwtf 3y ago
      Appreciate the clarification, no snark detected. And yeah, that is what I'm thinking people would or could expect. Obviously they're quite different but if someone is multitasking, not thinking clearly, or just not great with computers it seems like something that could (and probably will) happen. I imagine the "conversion rate" of a .net TLD will be much lower for spammers than that of a .zip
- 1023bytes 3y ago
  WELLSFARGO ALERT: Suspicious activity detected in your account! Please see the attachment for more information [https://wellsfargo.zip https://wellsfargo.zip]
  - eli 3y ago
    So this is bad because .zip sounds vaguely like something related to attachments? I dunno that doesn't sound much worse than wellsfargo.info to me.
    - SpaghettiCthulu 3y ago
      Because technologically illiterate users will think it's a filename
      - eli 3y ago
        I'm having a hard time imagining users who would be fooled by https://wellsfargo.zip https://wellsfargo.zip but not fooled by https://wellsfargo.inc https://wellsfargo.inc
  - organsnyder 3y ago
    Isn't that true of every generic-looking TLD?
    - grumbel 3y ago
      With Chrome hiding the 'https:// https://' a bankinfo.zip URL ends up looking a lot like a file or a attachment. So it could be used to trick people into assuming the file comes from a trusted domain instead of a third party one, as the user just see a filename without a domain part, not realizing what looks like a filename is the domain and they are no longer on their previous trusted site. This is especially problematic as the 'https:// https://' hiding also happens in the URL preview when you hover over a link (Edit: seems to happen only for longer URLs).
  - jrockway 3y ago
- smolder 3y ago
  Maybe have them click a .zip link that takes them to a web page which asks for an account password to open the "archive"? I could see that getting under a few people's radars, but it's not much more menacing than existing fishing tricks with lookalike urls.
- bentcorner 3y ago
  The problem is that we assume that it will forever be impossible for a browser to mimic the look and feel of opening a zip file attachment. I'm unsure if it's possible today but most definitely I don't think it's wise to assume it will never be possible in the future. We are slowly chipping away at defense in depth all in the name of convenience.
et-al 3y ago
Unfortunately, .cm and .co are also rife for phishing scams. (Apologies to the good folk of Cameroon.)
version_five 3y ago
When I played around earlier I found e.g. document.zip, atachment.zip (proper spelling wasn't there), image.zip, and a few others like that, without looking very hard. Many were being sold on the registration site I looked at as "premium" presumably for common words or short domains. Such names appear to be much more plausible attack vectors because they will trap people trying to open files. If I found a cheap common one I was going to buy it just to see what kind of traffic it got, but everything interesting was a few hundred dollars and up.
- caam 3y ago
  I was looking around for companies such as AWS and Contabo who sell domains without a markup fee. However i havent found any that support the .zip TLD. that makes sense and is pretty good because otherwise people could very easily have bought out every decent domain. For example, i have nabbed modpack.zip, ultimately however i dont see many scenarios where someone would make money from someone's technical inexperience being manipulated with this simple domain. But i feel slightly driven to keep it from the wrong hands. Plus that domain is really easy to remember which is great.
rsync 3y ago
I’m not so sure … If you expect a host name and you end up clicking a file instead, that seems dangerous. But in this case, you expect to open a file and you visit a website instead? That sounds simply annoying… Maybe this is for browsers to deal with - if there is a collision between TLD and (file extension on this system) throw up a warning?
- CydeWeys 3y ago
  You'd be throwing a warning on nearly every domain name, including this very site we're on right now. What would be the point? Domain names are different from file system paths, full stop.
  - growthwtf 3y ago
    I was interested in that, and apparently that has actually been used as an attack vector in the past! https://en.wikipedia.org/wiki/COM_file#Malicious_usage_of_the_.com_extension https://en.wikipedia.org/wiki/COM_file#Malicious_usage_of_th... TIL. Do you think computer users always think that's the case? I tend to come down on the side of "no, probably not" but open to other arguments.
- growthwtf 3y ago
  Exactly — and I think the danger is in website mimicking a file being opened. Which, browsers have already trained us to expect in many cases. Maybe some browser teams will implement a warning like this, that would make sense to me?
- jareklupinski 3y ago
  it could be worse, if the 'website' server automatically returned / downloaded something called YourTaxReturns.zip
  - danem 3y ago
    Just to make sure I'm following, the scenario you're worrying about is someone sends an email containing a url to "YourTaxReturns.zip". Upon visiting the site, it automatically downloads a zip file named "YourTaxReturns.zip". And then what? How is this any worse than the user downloading the zip directly? They clearly wanted to download it, given they clicked on it after all.
yafbum 3y ago
How is this different from any other TLD?
- growthwtf 3y ago
  Most TLDs are not the names of commonly used file transfer protocols, right? I think that's the primary difference that is concerning to the author of the post we are commenting on, and I it find convincing.
  - c-hendricks 3y ago
    So surely there's some evidence from past TLDs like .app
    - menus 3y ago
      When was the last time you used any file with .app? .zip on the other hand is used more frequently across multiple operating systems.
      - chungy 3y ago
        Anyone that uses/used NeXTSTEP, OPENSTEP, Mac OS X, or GNUSTEP is very familiar with program names that end with .app
      - FinnKuhn 3y ago
        .app is the equivalent to .exe on MacOS, so for most MacOS users the answer is probably daily.
        menus 3y ago
        Not a Mac guy so this was a blank spot in my brain. thank you.
  - yafbum 3y ago
    Zip isn't a file transfer protocol, it's a file compression format and popular file extension. Still, I don't understand a scenario in which this is going to be abused for exploitation.
bluescrn 3y ago
Also available: photoshop.zip and office.zip
case 3y ago
For the Wells Fargo example at least, presumably Wells is registered with the TMCH (https://www.trademark-clearinghouse.com/ https://www.trademark-clearinghouse.com/) and this will raise a flag at the registrar level if someone tries to purchase it. At the very least the would-be registrant should see a warning about it. https://newgtlds.icann.org/en/about/trademark-clearinghouse/faqs https://newgtlds.icann.org/en/about/trademark-clearinghouse/...
- nubinetwork 3y ago
  This is google we're talking about... they'll run ads for people pretending to be the largest YouTuber and not even think twice.
jonny_eh 3y ago
I bought dkong.zip and galaga.zip, not sure what I should do with them though.

Cthulhu_ 3y ago

winrar.zip

indeyets 3y ago

win.zip

evan_ 3y ago

What's the specific attack vector you're thinking of for something like wellsfargo.zip?

woodruffw 3y ago
Some of these are more tortured, but I can personally imagine a scenario in which a less-technical friend or family member is told to open a ZIP archive locally by some (trusted!) website and types that into the omnibar instead, bringing them to a random website.
growthwtf 3y ago
There's probably better ones, literally the first one I tried, but I'm imaging someone messaging me that telling me to download a recovery package for my Wells Fargo account and that it should open in the browser. Then have UI mimicking some kind of OS prompt and asking for your social security as a password to confirm identity, or something.
- evan_ 3y ago
  Is that substantially different from simply messaging someone and saying "download this file:" and linking to a malicious site with a .net TLD? Is the thought that the .zip tld conveys some kind of trustworthiness that a different TLD would not? Really trying to understand this, I hope I don't come across as snarky or naïve.
  - growthwtf 3y ago
    Appreciate the clarification, no snark detected. And yeah, that is what I'm thinking people would or could expect. Obviously they're quite different but if someone is multitasking, not thinking clearly, or just not great with computers it seems like something that could (and probably will) happen. I imagine the "conversion rate" of a .net TLD will be much lower for spammers than that of a .zip
1023bytes 3y ago
WELLSFARGO ALERT: Suspicious activity detected in your account! Please see the attachment for more information [https://wellsfargo.zip https://wellsfargo.zip]
- eli 3y ago
  So this is bad because .zip sounds vaguely like something related to attachments? I dunno that doesn't sound much worse than wellsfargo.info to me.
  - SpaghettiCthulu 3y ago
    Because technologically illiterate users will think it's a filename
    - eli 3y ago
      I'm having a hard time imagining users who would be fooled by https://wellsfargo.zip https://wellsfargo.zip but not fooled by https://wellsfargo.inc https://wellsfargo.inc
- organsnyder 3y ago
  Isn't that true of every generic-looking TLD?
  - grumbel 3y ago
    With Chrome hiding the 'https:// https://' a bankinfo.zip URL ends up looking a lot like a file or a attachment. So it could be used to trick people into assuming the file comes from a trusted domain instead of a third party one, as the user just see a filename without a domain part, not realizing what looks like a filename is the domain and they are no longer on their previous trusted site. This is especially problematic as the 'https:// https://' hiding also happens in the URL preview when you hover over a link (Edit: seems to happen only for longer URLs).
- jrockway 3y ago
smolder 3y ago
Maybe have them click a .zip link that takes them to a web page which asks for an account password to open the "archive"? I could see that getting under a few people's radars, but it's not much more menacing than existing fishing tricks with lookalike urls.
bentcorner 3y ago
The problem is that we assume that it will forever be impossible for a browser to mimic the look and feel of opening a zip file attachment. I'm unsure if it's possible today but most definitely I don't think it's wise to assume it will never be possible in the future. We are slowly chipping away at defense in depth all in the name of convenience.

et-al 3y ago

Unfortunately, .cm and .co are also rife for phishing scams. (Apologies to the good folk of Cameroon.)

version_five 3y ago

When I played around earlier I found e.g. document.zip, atachment.zip (proper spelling wasn't there), image.zip, and a few others like that, without looking very hard. Many were being sold on the registration site I looked at as "premium" presumably for common words or short domains. Such names appear to be much more plausible attack vectors because they will trap people trying to open files. If I found a cheap common one I was going to buy it just to see what kind of traffic it got, but everything interesting was a few hundred dollars and up.

caam 3y ago
I was looking around for companies such as AWS and Contabo who sell domains without a markup fee. However i havent found any that support the .zip TLD. that makes sense and is pretty good because otherwise people could very easily have bought out every decent domain. For example, i have nabbed modpack.zip, ultimately however i dont see many scenarios where someone would make money from someone's technical inexperience being manipulated with this simple domain. But i feel slightly driven to keep it from the wrong hands. Plus that domain is really easy to remember which is great.

rsync 3y ago

I’m not so sure … If you expect a host name and you end up clicking a file instead, that seems dangerous. But in this case, you expect to open a file and you visit a website instead? That sounds simply annoying… Maybe this is for browsers to deal with - if there is a collision between TLD and (file extension on this system) throw up a warning?

CydeWeys 3y ago
You'd be throwing a warning on nearly every domain name, including this very site we're on right now. What would be the point? Domain names are different from file system paths, full stop.
- growthwtf 3y ago
  I was interested in that, and apparently that has actually been used as an attack vector in the past! https://en.wikipedia.org/wiki/COM_file#Malicious_usage_of_the_.com_extension https://en.wikipedia.org/wiki/COM_file#Malicious_usage_of_th... TIL. Do you think computer users always think that's the case? I tend to come down on the side of "no, probably not" but open to other arguments.
growthwtf 3y ago
Exactly — and I think the danger is in website mimicking a file being opened. Which, browsers have already trained us to expect in many cases. Maybe some browser teams will implement a warning like this, that would make sense to me?
jareklupinski 3y ago
it could be worse, if the 'website' server automatically returned / downloaded something called YourTaxReturns.zip
- danem 3y ago
  Just to make sure I'm following, the scenario you're worrying about is someone sends an email containing a url to "YourTaxReturns.zip". Upon visiting the site, it automatically downloads a zip file named "YourTaxReturns.zip". And then what? How is this any worse than the user downloading the zip directly? They clearly wanted to download it, given they clicked on it after all.

yafbum 3y ago

How is this different from any other TLD?

growthwtf 3y ago
Most TLDs are not the names of commonly used file transfer protocols, right? I think that's the primary difference that is concerning to the author of the post we are commenting on, and I it find convincing.
- c-hendricks 3y ago
  So surely there's some evidence from past TLDs like .app
  - menus 3y ago
    When was the last time you used any file with .app? .zip on the other hand is used more frequently across multiple operating systems.
    - chungy 3y ago
      Anyone that uses/used NeXTSTEP, OPENSTEP, Mac OS X, or GNUSTEP is very familiar with program names that end with .app
    - FinnKuhn 3y ago
      .app is the equivalent to .exe on MacOS, so for most MacOS users the answer is probably daily.
      - menus 3y ago
        Not a Mac guy so this was a blank spot in my brain. thank you.
- yafbum 3y ago
  Zip isn't a file transfer protocol, it's a file compression format and popular file extension. Still, I don't understand a scenario in which this is going to be abused for exploitation.

bluescrn 3y ago

Also available: photoshop.zip and office.zip

case 3y ago

For the Wells Fargo example at least, presumably Wells is registered with the TMCH (https://www.trademark-clearinghouse.com/ https://www.trademark-clearinghouse.com/) and this will raise a flag at the registrar level if someone tries to purchase it. At the very least the would-be registrant should see a warning about it. https://newgtlds.icann.org/en/about/trademark-clearinghouse/faqs https://newgtlds.icann.org/en/about/trademark-clearinghouse/...

nubinetwork 3y ago
This is google we're talking about... they'll run ads for people pretending to be the largest YouTuber and not even think twice.

jonny_eh 3y ago

I bought dkong.zip and galaga.zip, not sure what I should do with them though.