5 ms·
Can someone describe a concrete vulnerability that this creates?
by dom96 3y ago
Can someone describe a concrete vulnerability that this creates?
- deleted 3y ago[deleted]
- hgs3 3y agoMessage someone and mention a file with a .zip extension, like "Go to Trusted Bank and download financials.zip". Since .zip is now a TLD, software could auto-link it to https://financials.zip https://financials.zip. The receiver will think the sender legibility linked to financials.zip for their convivence, but in fact they'll be redirected to a URL with a malicious zip file.
- gcoakes 3y agoAt least with HTML email, I can already link text to an arbitrary link. This whole thing doesn't seem that important to me.
- hgs3 3y ago> At least with HTML email, I can already link text to an arbitrary link. The sender doesn't have to link to anything. Merely writing some non-whitespace characters, followed by a dot, followed by a TLD can trigger client software to automatically create a link, e.g. mentioning "attachments.zip" could cause client software - that is trying to be clever - to create a link to https://attachments.zip https://attachments.zip which might serve a malicious zip file. The receiver will think the sender created the link, but in actuality it was their own software that created it trying to be clever. > This whole thing doesn't seem that important to me. This affects any client software that creates auto-links for TLD's. The "solution" is software must never create an auto-link in the absence of a protocol, e.g. never auto-link "example.com" but "https://example.com https://example.com" is ok.
- neurostimulant 3y agoChat clients like whatsapp don't allow you to link text to an arbitrary link, but instead will automatically turns text "attachment.zip" into a link to http://attachment.zip http://attachment.zip