4 ms·
For those having a hard time fathoming it, here's a rather simple attack case: someone types "product.zip" into the address bar thinking the browser will autom
by eganist 3y ago
For those having a hard time fathoming it, here's a rather simple attack case:
someone types "product.zip" into the address bar thinking the browser will automatically google it because of course it's not a valid domain name
but it turns out product.zip is a valid domain name, and it masquerades either as the product's webpage or as a delivery vector for other payloads.
---
I've mistyped search terms with periods in them and seen the browser try to route me to an invalid domain, so this isn't beyond the realm of reason.
---
edit: xsmasher below came up with a much more obvious attack case that deserves a read.
- whalesalad 3y agook, giving you props on coming up with a valid scenario here but in what world is someone trying to search for product.zip? Maybe my tech-illiterate boomer mom who would ask google to find a file on her desktop called product.zip but is that a case we want to optimize our TLDs for?
- bryant 3y ago> Maybe my tech-illiterate boomer mom who would ask google to find a file on her desktop called product.zip but is that a case we want to optimize our TLDs for? What percentage of the population is tech-illiterate? maybe a single-digit percentage of HN, but the vast majority of the world even today can't find the control panel on Windows. And anecdata from school systems suggests that consumption-focused devices are regressing the next generation of users such that millenials and early gen-z are probably the peak of tech-literacy.
- xboxnolifes 3y agoI don't search for zips, but searching like this is pretty good for finding pdfs. If you were looking for a zip and knew with good chance it's on the internet, why not?
- pphysch 3y agoPDF is special for a dozen reasons. Googling for "product.zip" makes no sense. Unless it's an actual website.
- recursive 3y agozip is special for a dozen other reasons. It makes sense to me if you're looking for a portable deployment without an installer.
- pphysch 3y agoCan you give an example of where you would want to ask the internet for opaque zip files to execute instead of using official downloads? E.g. why would you prefer "zoom.zip" over "install zoom" query?
- recursive 3y agoOfficial downloads are generally opaque files. These aren't different things. > why would you prefer "zoom.zip" over "install zoom" query? Why shouldn't I? This isn't a question about figuring out the optimal search terms. But anyway. The mainline installer probably... installs it. In this scenario, I want a portable deployment, maybe because I lack permissions on this machine.
- Taywee 3y agoI get it, but I don't agree that the defense is having a smaller number of tldns. I think the problem is with an omnibar in the first place, because it has to heuristically guess what you want. I preferred having a separate search bar from address bar. For a technical professional, I fight with the behavior of my web browser's address bar far more often than I really think I should. Maybe the average person would be far better served if the browser only assumed you meant a URL if you explicitly included a scheme, and otherwise just did a search.
- lupire 3y agoComputers should serve humans, not vice versa.
- dkarl 3y agoThe omnibar is a mixed bag from a usability standpoint. It favors the bold and confuses the meek. For some non-expert users, they eagerly mash in whatever they want, without understanding that the browser treats "hot women near me" differently from "amazon.com". For other non-expert users, they see domain names and big scary URLs in the omnibar and are scared to type anything into it that isn't an "official" web site address.
- munk-a 3y agoI'm pretty certain that's why my slightly dyslexic grandfather accidentally ordered two dozen hot grills from amazon.
- 8organicbits 3y agoOr similarly, the domain doesn't exist and the user sees an error page. They may assume their search engine is down.
- xsmasher 3y agoI assume the attack case case was sending a mail that says "I have attached product.zip to this email" but product.zip becomes a link to the web because the email client is too smart. What you think is an attachment from a trusted source is actually a link to the web.
- eganist 3y agoWow, I love/hate this attack case far more.
- eli 3y agoBut can't you already hyperlink product.zip to any URL?
- eganist 3y agothere's a certain plausibility to the idea that some folks were trained to hover over a link and see where it goes as part of anti-phishing training, but that a fraction of them may hover over the link, see product.zip anyway, and just click it because they don't have the context to understand why that would be a terrible link.
- reqrbHVPetKGE57 3y agoThey can't understand that product.zip is a terrible link, but they can understand that perfectlysafewebsite.com/product.zip is a terrible link???
- deleted 3y ago[deleted]
- yonatan8070 3y agoThis is my primary gripe with this whole thread, in most cases where abc.zip would become a link, you could just as well hyperlink it to anything, like in an email, a web page, or a markdown document
- deleted 3y ago