5 ms·

Hey mom, here's the photos from our last family get-together: familyphotos.zip (go ahead, click it) Depending on platform, this is even more fun with command

by mholt 3y ago

Hey mom, here's the photos from our last family get-together: familyphotos.zip (go ahead, click it) Depending on platform, this is even more fun with command lines with commands like: `open familyphotos.zip` But the point is, unless you are technically skilled, you probably can't tell whether you're about to go to a trusted file or download something random. Depending on the context you would probably expect to be taken to a local file on the disk, you would never think this would download something new unless you were already in a context to do so. Note that Google is also doing this for .mov. Both are file formats which can execute code (zip and mov both have exploits). These TLDs should at least be removed from the PSL. Edit: Here's a PoC screenshot: https://twitter.com/mholt6/status/1657133439546695680 https://twitter.com/mholt6/status/1657133439546695680

reqrbHVPetKGE57 3y ago
Please name a platform where `open` will treat a non-link as a link? I just tested the ones I have access to and none did.
deleted 3y ago
[deleted]
SCUSKU 3y ago
Wow this is scary. This really drives the point home, I wasn't sure with OP's article but this convinced me.
- hoppla 3y ago
  Opening a zip webpage url is probably harmless compared to opening a file archive…
  - oplav 3y ago
    I think the problem is that zip webpage URL http://familyphotos.zip http://familyphotos.zip is a download to a file archive that people will open.
    - reqrbHVPetKGE57 3y ago
      And <a href="http: //perfectlynormalwebsite.com/familyphotos.zip">familyphotos.zip</a> isn't? Am I missing something? What does the TLD add that wasn't possible before? Auto-vivified links in the 0.001% of users who only read text/plain? C'mon.
alphabet9000 3y ago
i love this example, having the domain automatically download a zip file that's the same name as the domain feels powerful.. (even though it could be used for malicious purposes). this could be a cool way for a musical artist to release an album, telling people to go to a zip domain and then it just downloads the album as a zip file.
- donmcronald 3y ago
  > i love this example, having the domain automatically download a zip file that's the same name as the domain feels powerful Did you and the GP just invent a new kind of phishing? Lmao. Go grab bitcoin-wallet.zip and start emailing people. Hi. Here's the cold wallet with the $5 million you requested. The password is 'password'. Then 5 minutes later send a panicked looking email. Do NOT open the previous email. It was sent to you by accident. You are NOT authorized to view it. DELETE IT NOW! Haha.
  - 8organicbits 3y ago
    It's worse than that. I'll send a legitimate email with an attachment named wallet.zip, and in the body say "download wallet.zip". Now the email client changes wallet.zip to a link. The email is not phishing. The <wallet.zip> site can be maliciously registered, knowing people will inadvertently mention "wallet.zip" in emails and may click the link.
    - Corrado 3y ago
      Holy Carp! I didn't think about someone just registering all kinds of "normal" looking domain names: archive.zip, photos.zip, budget.zip, music.zip, etc. Just register those domains and sit back and wait for people to come knocking on your door. It's a phishing dream!
    - xigoi 3y ago
      This is why it's a stupid idea to automatically turn anything that doesn't start with a protocol specifier into a link.
donmcronald 3y ago
> you probably can't tell whether you're about to go to a trusted file or download something random Don't worry. Google will offer enhanced protection to keep your account from being phished and hijacked. How convenient.
sebzim4500 3y ago
I wonder how much more effective in practice that is than registering familyphotos.info for example.
latexr 3y ago
> Depending on platform, this is even more fun with command lines with commands like: `open familyphotos.zip` The `open` command on macOS doesn’t open websites if no schema is specified. At best (worst?) it makes a suggestion: $ open google.com The file /private/tmp/google.com does not exist. Perhaps you meant 'http://google.com'? But it doesn’t even try it with the zip TLD: $ open familyphotos.zip The file /private/tmp/familyphotos.zip does not exist.
arp242 3y ago
This is already an issue with a number of common(-ish) extensions a non-tech person might realistically encounter: .ai (Illustrator), .ps (Photoshop), .md, (Markdown), .mobi (E-books) There's also some that are less commonly encountered by non-tech people, but still fairly common in the tech world (depending on the person of course): .sh, .rs, .cab, .java, .py, .org, .pl, .pm, .target, .pub That's just from a quick check from what I recognized from memory; I didn't feel like writing the code to also print out the MIME type and description and there may be more. Here's a full list of conflicts I generated from my /usr/share/mime/globs and the TLD list from ICANN, 74 conflicts in total: https://gist.github.com/arp242/ca24b58eaf37184b03e626c8e4093082 https://gist.github.com/arp242/ca24b58eaf37184b03e626c8e4093... Is .zip more common? No doubt, so it does become worse, but this confusion already exists, and will no doubt grow in the future with further proliferation of tlds and file extensions. Basically, we should probably do something about this regardless, although I'm not entirely sure what.
- donmcronald 3y ago
  IMO the correct solution is giving users adequate information. Instead of downloading files automatically, the browser should prompt. "You're about to download a file from the internet...". Of course we all know what will really happen is Google will continue to use Chrome to obfuscate the way the internet works and all of the big tech companies will sell "solutions" to the problems they're causing. Most people will end up completely dependent on Google's Advanced Protection Program, Microsoft's SmartScreen Filter, etc..
  - joseda-hg 3y ago
    Wasn't that default behaviour a while ago? I believe they changed it because most people saw the dialog twice and then got annoyed and deactivated it
  - zamadatix 3y ago
    For most people (i.e. those who use email via web) you're downloading a file from the internet either way. There isn't really a good way, in my opinion, to convince people to validate where the file downloaded from. Things like prompts are just as likely to become as ignored as the URL in the downloads status or the "this file is from the internet" warning. It's unrealistic to expect a person to check 999 times so on the 1,000th time they can catch the 1 time they were being tricked (or whatever numbers you want to use, point is it's just too rare compared to how often it does what they want and bugs them).
pfooti 3y ago
> But the point is, unless you are technically skilled, you probably can't tell whether you're about to go to a trusted file or download something random. Under what circumstances would a link you click on a website or an email _ever_ be a trusted file?
- mholt 3y ago
  You can be on a legitimate, trusted web site or be reading a legit, trusted email from a contact and still have a link slip in there. Other commenters like xsmasher have described a benign example, I'll rephrase: > I've attached familyphotos.zip -- here you go! The email client will presumably have a link below called familyphotos.zip, but the email client ALSO link-ified the text familyphotos.zip to download the content at https://familyphotos.zip https://familyphotos.zip, which is untrusted but you don't realize it doesn't go to the same familyphotos.zip file. Screenshot: https://twitter.com/mholt6/status/1657133439546695680 https://twitter.com/mholt6/status/1657133439546695680
  - reqrbHVPetKGE57 3y ago
    Or the attacker could've just sent you ... a link to familyphotos.zip. I'm not sure why you're bringing client-side auto-vivification (which yes, is a bad idea) into the picture when the attacker could equally send a link. I'm also not sure why you assume that clients will begin to auto-vivify .zip links just as a result of it existing, nor why you assume that's any worse than them auto-vivifying https://example.com/familyphotos.zip https://example.com/familyphotos.zip.
  - askiiart 3y ago
    hxxps:[//]]familyphotos.zip (broke the link on purpose) is already registered, and it downloads the zip file. 4 days later, and unsurprisingly, it's already happened. I'll open the zip in a VM and see what happens, it's 0.58 KB... Update: Turns out it just contains what_happened.txt, a copy of which is below. Thanks anonymous person! ``` "Hey, this isn't family pictures!" You're right -- and that link you clicked wasn't a file attached to the email or message you received. Thanks to Google[0][1], now it's impossible to discern the difference between a link to an attachment called "familyphotos.zip" and a link to this file... unless you are able to inspect the destination of a link before clicking it. Most software and apps don't allow that, and most people don't know how to tell the difference anyway. Have fun in the Wild Wild Web! [0]: https://www.blog.google/products/registry/8-new-top-level-domains-for-dads-grads-tech/ https://www.blog.google/products/registry/8-new-top-level-do... [1]: https://twitter.com/Google/status/1653866291692728320 https://twitter.com/Google/status/1653866291692728320 ```
jug 3y ago
> Hey mom, here's the photos from our last family get-together: familyphotos.zip And most applications (even some browsers) will even helpfully strip out the "ugly https" in front too, and make it clickable. :)
jbaber 3y ago
On the flipside, familyphotos.com could be a windows executable.

by mholt 3y ago

reqrbHVPetKGE57 3y ago

Please name a platform where `open` will treat a non-link as a link? I just tested the ones I have access to and none did.

deleted 3y ago

[deleted]

SCUSKU 3y ago

Wow this is scary. This really drives the point home, I wasn't sure with OP's article but this convinced me.

hoppla 3y ago
Opening a zip webpage url is probably harmless compared to opening a file archive…
- oplav 3y ago
  I think the problem is that zip webpage URL http://familyphotos.zip http://familyphotos.zip is a download to a file archive that people will open.
  - reqrbHVPetKGE57 3y ago
    And <a href="http: //perfectlynormalwebsite.com/familyphotos.zip">familyphotos.zip</a> isn't? Am I missing something? What does the TLD add that wasn't possible before? Auto-vivified links in the 0.001% of users who only read text/plain? C'mon.

alphabet9000 3y ago

i love this example, having the domain automatically download a zip file that's the same name as the domain feels powerful.. (even though it could be used for malicious purposes). this could be a cool way for a musical artist to release an album, telling people to go to a zip domain and then it just downloads the album as a zip file.

donmcronald 3y ago
> i love this example, having the domain automatically download a zip file that's the same name as the domain feels powerful Did you and the GP just invent a new kind of phishing? Lmao. Go grab bitcoin-wallet.zip and start emailing people. Hi. Here's the cold wallet with the $5 million you requested. The password is 'password'. Then 5 minutes later send a panicked looking email. Do NOT open the previous email. It was sent to you by accident. You are NOT authorized to view it. DELETE IT NOW! Haha.
- 8organicbits 3y ago
  It's worse than that. I'll send a legitimate email with an attachment named wallet.zip, and in the body say "download wallet.zip". Now the email client changes wallet.zip to a link. The email is not phishing. The <wallet.zip> site can be maliciously registered, knowing people will inadvertently mention "wallet.zip" in emails and may click the link.
  - Corrado 3y ago
    Holy Carp! I didn't think about someone just registering all kinds of "normal" looking domain names: archive.zip, photos.zip, budget.zip, music.zip, etc. Just register those domains and sit back and wait for people to come knocking on your door. It's a phishing dream!
  - xigoi 3y ago
    This is why it's a stupid idea to automatically turn anything that doesn't start with a protocol specifier into a link.

donmcronald 3y ago

> you probably can't tell whether you're about to go to a trusted file or download something random Don't worry. Google will offer enhanced protection to keep your account from being phished and hijacked. How convenient.

sebzim4500 3y ago

I wonder how much more effective in practice that is than registering familyphotos.info for example.

latexr 3y ago

> Depending on platform, this is even more fun with command lines with commands like: `open familyphotos.zip` The `open` command on macOS doesn’t open websites if no schema is specified. At best (worst?) it makes a suggestion: $ open google.com The file /private/tmp/google.com does not exist. Perhaps you meant 'http://google.com'? But it doesn’t even try it with the zip TLD: $ open familyphotos.zip The file /private/tmp/familyphotos.zip does not exist.

arp242 3y ago

This is already an issue with a number of common(-ish) extensions a non-tech person might realistically encounter: .ai (Illustrator), .ps (Photoshop), .md, (Markdown), .mobi (E-books) There's also some that are less commonly encountered by non-tech people, but still fairly common in the tech world (depending on the person of course): .sh, .rs, .cab, .java, .py, .org, .pl, .pm, .target, .pub That's just from a quick check from what I recognized from memory; I didn't feel like writing the code to also print out the MIME type and description and there may be more. Here's a full list of conflicts I generated from my /usr/share/mime/globs and the TLD list from ICANN, 74 conflicts in total: https://gist.github.com/arp242/ca24b58eaf37184b03e626c8e4093082 https://gist.github.com/arp242/ca24b58eaf37184b03e626c8e4093... Is .zip more common? No doubt, so it does become worse, but this confusion already exists, and will no doubt grow in the future with further proliferation of tlds and file extensions. Basically, we should probably do something about this regardless, although I'm not entirely sure what.

donmcronald 3y ago
IMO the correct solution is giving users adequate information. Instead of downloading files automatically, the browser should prompt. "You're about to download a file from the internet...". Of course we all know what will really happen is Google will continue to use Chrome to obfuscate the way the internet works and all of the big tech companies will sell "solutions" to the problems they're causing. Most people will end up completely dependent on Google's Advanced Protection Program, Microsoft's SmartScreen Filter, etc..
- joseda-hg 3y ago
  Wasn't that default behaviour a while ago? I believe they changed it because most people saw the dialog twice and then got annoyed and deactivated it
- zamadatix 3y ago
  For most people (i.e. those who use email via web) you're downloading a file from the internet either way. There isn't really a good way, in my opinion, to convince people to validate where the file downloaded from. Things like prompts are just as likely to become as ignored as the URL in the downloads status or the "this file is from the internet" warning. It's unrealistic to expect a person to check 999 times so on the 1,000th time they can catch the 1 time they were being tricked (or whatever numbers you want to use, point is it's just too rare compared to how often it does what they want and bugs them).

pfooti 3y ago

> But the point is, unless you are technically skilled, you probably can't tell whether you're about to go to a trusted file or download something random. Under what circumstances would a link you click on a website or an email _ever_ be a trusted file?

mholt 3y ago
You can be on a legitimate, trusted web site or be reading a legit, trusted email from a contact and still have a link slip in there. Other commenters like xsmasher have described a benign example, I'll rephrase: > I've attached familyphotos.zip -- here you go! The email client will presumably have a link below called familyphotos.zip, but the email client ALSO link-ified the text familyphotos.zip to download the content at https://familyphotos.zip https://familyphotos.zip, which is untrusted but you don't realize it doesn't go to the same familyphotos.zip file. Screenshot: https://twitter.com/mholt6/status/1657133439546695680 https://twitter.com/mholt6/status/1657133439546695680
- reqrbHVPetKGE57 3y ago
  Or the attacker could've just sent you ... a link to familyphotos.zip. I'm not sure why you're bringing client-side auto-vivification (which yes, is a bad idea) into the picture when the attacker could equally send a link. I'm also not sure why you assume that clients will begin to auto-vivify .zip links just as a result of it existing, nor why you assume that's any worse than them auto-vivifying https://example.com/familyphotos.zip https://example.com/familyphotos.zip.
- askiiart 3y ago
  hxxps:[//]]familyphotos.zip (broke the link on purpose) is already registered, and it downloads the zip file. 4 days later, and unsurprisingly, it's already happened. I'll open the zip in a VM and see what happens, it's 0.58 KB... Update: Turns out it just contains what_happened.txt, a copy of which is below. Thanks anonymous person! ``` "Hey, this isn't family pictures!" You're right -- and that link you clicked wasn't a file attached to the email or message you received. Thanks to Google[0][1], now it's impossible to discern the difference between a link to an attachment called "familyphotos.zip" and a link to this file... unless you are able to inspect the destination of a link before clicking it. Most software and apps don't allow that, and most people don't know how to tell the difference anyway. Have fun in the Wild Wild Web! [0]: https://www.blog.google/products/registry/8-new-top-level-domains-for-dads-grads-tech/ https://www.blog.google/products/registry/8-new-top-level-do... [1]: https://twitter.com/Google/status/1653866291692728320 https://twitter.com/Google/status/1653866291692728320 ```

jug 3y ago

> Hey mom, here's the photos from our last family get-together: familyphotos.zip And most applications (even some browsers) will even helpfully strip out the "ugly https" in front too, and make it clickable. :)

jbaber 3y ago

On the flipside, familyphotos.com could be a windows executable.