3 ms·

If the search domain list is empty or contains "." or "", or the search algorithm is flawed (maybe an IoT device), trying to connect might lead to a bare TLD lo

If the search domain list is empty or contains "." or "", or the search algorithm is flawed (maybe an IoT device), trying to connect might lead to a bare TLD lookup. CMD.exe is either a program accepts either a filename or URL in the same context (VLC does this), or the user is confused about the URL/file distinction. The .ZIP TLD was concerning for this reason.

DidYaWipe 2y ago
Thanks for the reply. Maybe I just don't know enough about all the scenarios. I don't know what "the domain search list" is or what user action would involve it. I was looking more for specific dangerous use cases; for example, "The user types such-and-such in the address bar, and instead of getting this he gets that." In other words, how is this a problem in actual practice.
- avidiax 2y ago
  https://en.wikipedia.org/wiki/Search_domain https://en.wikipedia.org/wiki/Search_domain An example: The attacker posts a message to a forum, chatroom, etc. like: Download: 2024YourCompanySalaryData.zip When the user clicks "2024YourCompanySalaryData.zip", it is actually a domain name, and loads that website. This website then asks you to enter your corp credentials, or executes a 0-day on the victim's browser, etc. The forum doesn't need to allow file downloads (i.e. a real .zip might not even work), and even if it does, client or server side virus scanning doesn't have a .zip to inspect. The user is less wary of phishing, having never seen the .zip TLD. They assume they are downloading a file. https://blog.talosintelligence.com/zip-tld-information-leak/ https://blog.talosintelligence.com/zip-tld-information-leak/
  - DidYaWipe 2y ago
    Thanks. I don't really see how that's worse than today, where a bad actor can do exactly the same thing in a forum post. Typically the post shows the text you enter, but can go to any URL. In terms of the user going to a site instead of a zip file: If a user is willing to unpack and run a random file he downloaded and give it credentials to something... what's the difference? Not being argumentative, but this seems like a stretch.
    - avidiax 2y ago
      The difference is that many forums or chat programs will automatically linkify valid hostnames/URLs. Now "foo.zip" is a valid URL. You could have a forum or chat program that you think is quite safe, since it doesn't allow file uploads, and doesn't allow arbitrary link text, and this would upend that.

DidYaWipe 2y ago

Thanks for the reply. Maybe I just don't know enough about all the scenarios. I don't know what "the domain search list" is or what user action would involve it. I was looking more for specific dangerous use cases; for example, "The user types such-and-such in the address bar, and instead of getting this he gets that." In other words, how is this a problem in actual practice.

avidiax 2y ago
https://en.wikipedia.org/wiki/Search_domain https://en.wikipedia.org/wiki/Search_domain An example: The attacker posts a message to a forum, chatroom, etc. like: Download: 2024YourCompanySalaryData.zip When the user clicks "2024YourCompanySalaryData.zip", it is actually a domain name, and loads that website. This website then asks you to enter your corp credentials, or executes a 0-day on the victim's browser, etc. The forum doesn't need to allow file downloads (i.e. a real .zip might not even work), and even if it does, client or server side virus scanning doesn't have a .zip to inspect. The user is less wary of phishing, having never seen the .zip TLD. They assume they are downloading a file. https://blog.talosintelligence.com/zip-tld-information-leak/ https://blog.talosintelligence.com/zip-tld-information-leak/
- DidYaWipe 2y ago
  Thanks. I don't really see how that's worse than today, where a bad actor can do exactly the same thing in a forum post. Typically the post shows the text you enter, but can go to any URL. In terms of the user going to a site instead of a zip file: If a user is willing to unpack and run a random file he downloaded and give it credentials to something... what's the difference? Not being argumentative, but this seems like a stretch.
  - avidiax 2y ago
    The difference is that many forums or chat programs will automatically linkify valid hostnames/URLs. Now "foo.zip" is a valid URL. You could have a forum or chat program that you think is quite safe, since it doesn't allow file uploads, and doesn't allow arbitrary link text, and this would upend that.