4 ms·

What's the specific attack vector you're thinking of for something like wellsfargo.zip?

by evan_ 3y ago

woodruffw 3y ago
Some of these are more tortured, but I can personally imagine a scenario in which a less-technical friend or family member is told to open a ZIP archive locally by some (trusted!) website and types that into the omnibar instead, bringing them to a random website.
growthwtf 3y ago
There's probably better ones, literally the first one I tried, but I'm imaging someone messaging me that telling me to download a recovery package for my Wells Fargo account and that it should open in the browser. Then have UI mimicking some kind of OS prompt and asking for your social security as a password to confirm identity, or something.
- evan_ 3y ago
  Is that substantially different from simply messaging someone and saying "download this file:" and linking to a malicious site with a .net TLD? Is the thought that the .zip tld conveys some kind of trustworthiness that a different TLD would not? Really trying to understand this, I hope I don't come across as snarky or naïve.
  - growthwtf 3y ago
    Appreciate the clarification, no snark detected. And yeah, that is what I'm thinking people would or could expect. Obviously they're quite different but if someone is multitasking, not thinking clearly, or just not great with computers it seems like something that could (and probably will) happen. I imagine the "conversion rate" of a .net TLD will be much lower for spammers than that of a .zip
1023bytes 3y ago
WELLSFARGO ALERT: Suspicious activity detected in your account! Please see the attachment for more information [https://wellsfargo.zip https://wellsfargo.zip]
- eli 3y ago
  So this is bad because .zip sounds vaguely like something related to attachments? I dunno that doesn't sound much worse than wellsfargo.info to me.
  - SpaghettiCthulu 3y ago
    Because technologically illiterate users will think it's a filename
    - eli 3y ago
      I'm having a hard time imagining users who would be fooled by https://wellsfargo.zip https://wellsfargo.zip but not fooled by https://wellsfargo.inc https://wellsfargo.inc
- organsnyder 3y ago
  Isn't that true of every generic-looking TLD?
  - grumbel 3y ago
    With Chrome hiding the 'https:// https://' a bankinfo.zip URL ends up looking a lot like a file or a attachment. So it could be used to trick people into assuming the file comes from a trusted domain instead of a third party one, as the user just see a filename without a domain part, not realizing what looks like a filename is the domain and they are no longer on their previous trusted site. This is especially problematic as the 'https:// https://' hiding also happens in the URL preview when you hover over a link (Edit: seems to happen only for longer URLs).
- jrockway 3y ago
smolder 3y ago
Maybe have them click a .zip link that takes them to a web page which asks for an account password to open the "archive"? I could see that getting under a few people's radars, but it's not much more menacing than existing fishing tricks with lookalike urls.
bentcorner 3y ago
The problem is that we assume that it will forever be impossible for a browser to mimic the look and feel of opening a zip file attachment. I'm unsure if it's possible today but most definitely I don't think it's wise to assume it will never be possible in the future. We are slowly chipping away at defense in depth all in the name of convenience.

What's the specific attack vector you're thinking of for something like wellsfargo.zip?

by evan_ 3y ago

What's the specific attack vector you're thinking of for something like wellsfargo.zip?

Some of these are more tortured, but I can personally imagine a scenario in which a less-technical friend or family member is told to open a ZIP archive locally by some (trusted!) website and types that into the omnibar instead, bringing them to a random website.

growthwtf 3y ago

There's probably better ones, literally the first one I tried, but I'm imaging someone messaging me that telling me to download a recovery package for my Wells Fargo account and that it should open in the browser. Then have UI mimicking some kind of OS prompt and asking for your social security as a password to confirm identity, or something.

evan_ 3y ago
Is that substantially different from simply messaging someone and saying "download this file:" and linking to a malicious site with a .net TLD? Is the thought that the .zip tld conveys some kind of trustworthiness that a different TLD would not? Really trying to understand this, I hope I don't come across as snarky or naïve.
- growthwtf 3y ago
  Appreciate the clarification, no snark detected. And yeah, that is what I'm thinking people would or could expect. Obviously they're quite different but if someone is multitasking, not thinking clearly, or just not great with computers it seems like something that could (and probably will) happen. I imagine the "conversion rate" of a .net TLD will be much lower for spammers than that of a .zip

1023bytes 3y ago

WELLSFARGO ALERT: Suspicious activity detected in your account! Please see the attachment for more information [https://wellsfargo.zip https://wellsfargo.zip]

eli 3y ago
So this is bad because .zip sounds vaguely like something related to attachments? I dunno that doesn't sound much worse than wellsfargo.info to me.
- SpaghettiCthulu 3y ago
  Because technologically illiterate users will think it's a filename
  - eli 3y ago
    I'm having a hard time imagining users who would be fooled by https://wellsfargo.zip https://wellsfargo.zip but not fooled by https://wellsfargo.inc https://wellsfargo.inc
organsnyder 3y ago
Isn't that true of every generic-looking TLD?
- grumbel 3y ago
  With Chrome hiding the 'https:// https://' a bankinfo.zip URL ends up looking a lot like a file or a attachment. So it could be used to trick people into assuming the file comes from a trusted domain instead of a third party one, as the user just see a filename without a domain part, not realizing what looks like a filename is the domain and they are no longer on their previous trusted site. This is especially problematic as the 'https:// https://' hiding also happens in the URL preview when you hover over a link (Edit: seems to happen only for longer URLs).
jrockway 3y ago

smolder 3y ago

Maybe have them click a .zip link that takes them to a web page which asks for an account password to open the "archive"? I could see that getting under a few people's radars, but it's not much more menacing than existing fishing tricks with lookalike urls.

bentcorner 3y ago

The problem is that we assume that it will forever be impossible for a browser to mimic the look and feel of opening a zip file attachment. I'm unsure if it's possible today but most definitely I don't think it's wise to assume it will never be possible in the future. We are slowly chipping away at defense in depth all in the name of convenience.