5 ms·

I assume the attack case case was sending a mail that says "I have attached product.zip to this email" but product.zip becomes a link to the web because the ema

I assume the attack case case was sending a mail that says "I have attached product.zip to this email" but product.zip becomes a link to the web because the email client is too smart. What you think is an attachment from a trusted source is actually a link to the web.

eganist 3y ago
Wow, I love/hate this attack case far more.
eli 3y ago
But can't you already hyperlink product.zip to any URL?
- eganist 3y ago
  there's a certain plausibility to the idea that some folks were trained to hover over a link and see where it goes as part of anti-phishing training, but that a fraction of them may hover over the link, see product.zip anyway, and just click it because they don't have the context to understand why that would be a terrible link.
  - reqrbHVPetKGE57 3y ago
    They can't understand that product.zip is a terrible link, but they can understand that perfectlysafewebsite.com/product.zip is a terrible link???
- deleted 3y ago
  [deleted]
- yonatan8070 3y ago
  This is my primary gripe with this whole thread, in most cases where abc.zip would become a link, you could just as well hyperlink it to anything, like in an email, a web page, or a markdown document
  - deleted 3y ago
    [deleted]
  - kpw94 3y ago
    The difference is the malicious actor and the email sender don't have to be the same person. A malicious user can craft an email "this is [abc.zip](http://very-bad-website http://very-bad-website)". Ok nothing new here. But a non-malicious, who's emailing their mom: "I've attached abc.zip" (and put a abc.zip as attachment). Here the problem here is a malicious other user has registered abc.zip to download a virus, and the mom's email client highlight abc.zip, and she clicks on it instead of the abc.zip attachment.
    - reqrbHVPetKGE57 3y ago
      Yes, auto-vivification of links is bad.
- meindnoch 3y ago
  You're misunderstanding GP. Your boss sends you this plaintext email: Hi! Please upload the photos as photos.zip to the company GDrive! Thanks, Boss Your email client "helpfully" recognizes that "photos.zip" can be a TLD, so turns it automatically into a hyperlink. You click it because you think it's a link your boss intended to share with you, but you actually land on a site that pwns your browser with an exploit.
  - deleted 3y ago
    [deleted]
  - benatkin 3y ago
    That isn't GP's example. That's a separate one. There are 3 - yours, GP's, and GGP's. None of the three seem like serious attack vectors to me. I'm still having trouble coming up with a legitimate attack vector so I think there must not be one. I am ready to change my mind when I see one though.
    - eganist 3y ago
      > None of the three seem like serious attack vectors to me. Why not?
zerocrates 3y ago
I recognize that if the TLD doesn't exist in the first place then we aren't even asking the question, but if your email client auto-creates a confusing link isn't it the email client's fault?

eganist 3y ago

Wow, I love/hate this attack case far more.

eli 3y ago

But can't you already hyperlink product.zip to any URL?

eganist 3y ago
there's a certain plausibility to the idea that some folks were trained to hover over a link and see where it goes as part of anti-phishing training, but that a fraction of them may hover over the link, see product.zip anyway, and just click it because they don't have the context to understand why that would be a terrible link.
- reqrbHVPetKGE57 3y ago
  They can't understand that product.zip is a terrible link, but they can understand that perfectlysafewebsite.com/product.zip is a terrible link???
deleted 3y ago
[deleted]
yonatan8070 3y ago
This is my primary gripe with this whole thread, in most cases where abc.zip would become a link, you could just as well hyperlink it to anything, like in an email, a web page, or a markdown document
- deleted 3y ago
  [deleted]
- kpw94 3y ago
  The difference is the malicious actor and the email sender don't have to be the same person. A malicious user can craft an email "this is [abc.zip](http://very-bad-website http://very-bad-website)". Ok nothing new here. But a non-malicious, who's emailing their mom: "I've attached abc.zip" (and put a abc.zip as attachment). Here the problem here is a malicious other user has registered abc.zip to download a virus, and the mom's email client highlight abc.zip, and she clicks on it instead of the abc.zip attachment.
  - reqrbHVPetKGE57 3y ago
    Yes, auto-vivification of links is bad.
meindnoch 3y ago
You're misunderstanding GP. Your boss sends you this plaintext email: Hi! Please upload the photos as photos.zip to the company GDrive! Thanks, Boss Your email client "helpfully" recognizes that "photos.zip" can be a TLD, so turns it automatically into a hyperlink. You click it because you think it's a link your boss intended to share with you, but you actually land on a site that pwns your browser with an exploit.
- deleted 3y ago
  [deleted]
- benatkin 3y ago
  That isn't GP's example. That's a separate one. There are 3 - yours, GP's, and GGP's. None of the three seem like serious attack vectors to me. I'm still having trouble coming up with a legitimate attack vector so I think there must not be one. I am ready to change my mind when I see one though.
  - eganist 3y ago
    > None of the three seem like serious attack vectors to me. Why not?

zerocrates 3y ago

I recognize that if the TLD doesn't exist in the first place then we aren't even asking the question, but if your email client auto-creates a confusing link isn't it the email client's fault?