10 ms·

I have a story on using weird/fishy/phishy TLDs: Recently my colleagues and I started collecting information on all the available compression methods for 3D Gau

by w-m 2y ago

I have a story on using weird/fishy/phishy TLDs: Recently my colleagues and I started collecting information on all the available compression methods for 3D Gaussian Splatting (3DGS, a popular method for 3d scene representation). There were quite a few works in the area with naming conflicts already, so I thought to give it a unique short name to refer to - and came up with “3dgs.zip”. A few days later we started putting together a web page, and I noticed that .zip actually is available as a TLD. Impulsively I bought the domain, https://3dgs.zip/ https://3dgs.zip/, launched it and printed it on a few shirts before heading off to a conference. Felt a bit weird that there is a .zip TLD, but I was in a rush and I didn’t ponder its existence any further. But strange things started happening: setting up the domain for a GitHub page worked, but in the process downloaded a 0 Byte file called “3dgs.zip”, when submitting content one of the GitHub.com forms. And a few days later colleagues told me they had trouble accessing the site. After some DNS sleuthing and then some back-and-forth with our IT dept, it turned out that our organization has blocked the whole TLD - for every Windows user, out of phishing concerns of people being confused. I’m no security person, so the reasoning felt a bit weird to me, as I guess the .zip TLD can’t hurt anybody; downloading a .zip might, which you can attach to any link name? But in any case I wasn’t able to find any .zip URL with a purpose, but lots of Reddit posts of angry sysadmins who bemoaned the influx of terrible TLDs with mostly phishing use and vowed to block them all. So they probably have a point in downright blocking the whole TLD. Now I’m sitting here with my .zip url. Had to revert the page to use github.io, so people in my organization (and similarly thinking ones) would be able to access it. Guess I’m cured for a while, won’t be using any novelty TLDs anytime soon…

walls 2y ago
I grabbed two .zip domain names that I knew were used frequently as filenames and set them up to return a zip with an html inside. The html tries to load a specific resource from the server to let it know the html was opened. There are dozens of unique opens per week. I'm very curious how an executable would do, but I'm not trying to cause any problems.
- codetrotter 2y ago
  http://iloveu.exe http://iloveu.exe would be a neat website tho
  - _blk 2y ago
    Looks more like everyone is try to exit the EU ;)
    - codetrotter 2y ago
      > ILOVEYOU, sometimes referred to as the Love Bug or Loveletter, was a computer worm that infected over ten million Windows personal computers on and after 5 May 2000. It started spreading as an email message with the subject line "ILOVEYOU" and the attachment "LOVE-LETTER-FOR-YOU.TXT.vbs". https://en.wikipedia.org/wiki/ILOVEYOU https://en.wikipedia.org/wiki/ILOVEYOU :D
- w-m 2y ago
  Ah that makes a lot more sense as an attack vector. Thanks for explaining! Indeed, checking a list of common .zip file names, most of them are registered domains. Uhhh.
heraldgeezer 2y ago
So these type of filters work on massive lists that IT or Sec admin configure. Its not that they specifially blocked .zip but software like Umbrella, Zorus DNS etc have a filter for "phising domains" and that TLD is probably part of it. Blocks at the DNS level, its actually useful. Demo for ZorusTech DNS blocker: https://www.youtube.com/watch?v=MeubLoEHW9E https://www.youtube.com/watch?v=MeubLoEHW9E
TonyTrapp 2y ago
> I’m no security person, so the reasoning felt a bit weird to me, as I guess the .zip TLD can’t hurt anybody; downloading a .zip might, which you can attach to any link name? But in any case I wasn’t able to find any .zip URL with a purpose, but lots of Reddit posts of angry sysadmins who bemoaned the influx of terrible TLDs with mostly phishing use and vowed to block them all. So they probably have a point in downright blocking the whole TLD. The problem is auto-linkification. It is extremely common in forum posts or emails to refer to attached filenames. Most forum softwares or email clients are helpful it automatically turning obvious URLs (doesn't start with a protocol:// but ends in a .tld) into clickable links. Anybody's reference to a zip filename is now a clickable link, only waiting to be registered for phishing attempts.
- n_plus_1_acc 2y ago
  That's not a new problem tho. .TS and .CS are TLDs and Heck even .COM is also a file extension, should we block that too? What changed suddendly?
  - deleted 2y ago
    [deleted]
  - wlesieutre 2y ago
    The type of user who has email conversations about .COM files is the same type of user who will realize that the link was automatically created by someone's email client and have a laugh about it. I don't know if you can say the same about zip files, an average user they might encounter someone mentioning a zip filename a handful of times in a year and they might click on the link expecting to get that zip file.
  - chrisfosterelli 2y ago
    COM files are a good point I hadn't considered.
  - paranoidrobot 2y ago
    The thing is '.com' is relatively unknown. When was the last time you had a genuine .com file you needed to use? And you're someone who's tech-savvy. Most people are going to see ".com" and think "Website" not "Program". So if suddenly a .com file is downloaded there's at least a chance they might stop and wonder what's going on. I run into this issue all the time - We get Bug bounty reports constantly because $SecurityResearcher put "example.com" into the "Company Name" field, and we sent them an email saying "Thanks for signing up. We hope you find $OurProduct useful at $CompanyName. " When the email turns up in their Gmail inbox, Gmail "helpfully" turns the plain text "example.com" into a link to https://example.com https://example.com - so $SecurityResearcher reports it to us as a vulnerability in our platform because "we" are linking to example.com - except we never did, and we have no way to tell Gmail, or Outlook, or any other platform to stop doing that. Services we pay for, directly, also do this - Notion and Slack are two I can think of immediately. I have to fight them to stop turning my mention of some file into a link to a random domain. (e: Maybe Slack has stopped doing this, perhaps - in testing it didn't do automatic linkifying for messages to myself) This was bad enough with .cs, .ts, .js., .json and so forth - but having a .zip link appear in the middle of documentation on how to do something with a zip file is a recipe for disaster. I've had a document saying "please download package.zip from the build artifacts site" - which was then auto linked to https://package.zip https://package.zip - and anyone not paying attention might expect that it was a link to the build artifacts site.
tetha 2y ago
> I’m no security person, so the reasoning felt a bit weird to me, as I guess the .zip TLD can’t hurt anybody; downloading a .zip might, which you can attach to any link name? Turn of all of your developer knowledge for a minute. You click on a link "very-trustworthy-ceo-information.zip" in a mail, since you want to download this very important information from your CEO. Sure, your browser pops up, but it does that all the time so who cares, and then there is a file "very-trustworthy-ceo-information.zip" in your downloads folder. Native Outlook might usually open it in a different way usually, but who cares? OWA - you won't notice a difference in the UI at all. But anyway, important CEO information. Open the zip, open the PDF, oops your workstation is compromised. If we turn our technical knowledge back on, it's rather simple. A user was phished to open a link to "https://very-trustworthy-ceo-information.zip https://very-trustworthy-ceo-information.zip". This returned with a file download, obviously called "very-trustworthy-ceo-information.zip", containing whatever I want to contain based off of IPs and whatever I can stuff into the link in a hidden fashion the average user won't note. A lot of people would not be able to distinguish between https://foo.zip https://foo.zip answering with a binary content type and naming the file foo.zip through content disposition headers and foo.zip coming from a trusted source. And honestly, I would personally have to double-check what's going on there if it happened to me.
- w-m 2y ago
  My point was that the person fooled by https://foo.zip/ https://foo.zip/ would have been also fooled by https://foo.com/bar.zip https://foo.com/bar.zip, so the existence .zip wouldn’t change much. But now I’ve understood that the auto-linkification of a simple non-link mention like update.zip can be indeed dangerous.
- godzillabrennus 2y ago
  Imagine a URL like http://www.chase.com.auth.statement.zip http://www.chase.com.auth.statement.zip Average users would never suspect a thing.
  - eli 2y ago
    I genuinely do not see how that is different than http://www.chase.com.auth.statement.com http://www.chase.com.auth.statement.com
floam 2y ago
Some firewalls just block newly-registered domains. Are you totally sure it wasn’t that category?
- w-m 2y ago
  Yep, I checked other, established .zip domains. Finding one was quite a hard task, which gave me pause. I found a link shortener site on some Google promotional page for .zip (.zip is a Google-TLD). Accessing any .zip url was denied on the tested machines. So this matches what IT told me and what the sister comments state here: some tool blocks the whole .zip TLD on the DNS level.
  - nneonneo 2y ago
    Tip: “nic.TLD” should always exist and will often be the first domain registered. It is operated by the domain’s registry. For example, see https://nic.zip https://nic.zip.
    - floam 2y ago
      Counterexample: https://nic.gy https://nic.gy https://registry.gy https://registry.gy
      - CydeWeys 2y ago
        Those are ccTLDs, which don't have any rules to abide by.
    - deleted 2y ago
      [deleted]
- qingcharles 2y ago
  Email servers also put a high spam score on new domains, from what I've witnessed.
annoyingnoob 2y ago
I block .top and several other of the newer TLDs in SMTP. We get tons of spam from these TLDs, and we don't otherwise interact with those TLDs in our business.
cxr 2y ago
Is how you find out that your company's IT department is just a bunch of bozos in a trenchcoat. Sucks, but it's the norm for any company who's payroll isn't >50% programmers.
kokx 2y ago
With a little trickery with URL's you could construct something like: https://github.com/example/project/releases/@example-project-v1.zip https://github.com/example/project/releases/@example-project... Due to everything in a URL before the @ being interpreted as a username for basic authentication, this would result in the user navigating to https://example-project-v1.zip https://example-project-v1.zip instead of to github. Edit: Fortunately it seems like browsers have caught on to this trick
IncRnd 2y ago
> I’m no security person, so the reasoning felt a bit weird to me, as I guess the .zip TLD can’t hurt anybody I really apologize that our docs don't cover what to do in your situation. We move really fast with software to bring you the best experience possible and sometimes miss these things. I'm the founder, John Smith, and I'll provide direct support here for you. Just go in your browser and open the .zip archive to extract the file you need. You can use chrome, Internet Explorer, Firefox, or any other browser. In your browser, open the zip file that you downloaded earlier from our website. Open it this way: https://3DGScode.zip/cross-platform-imaging https://3DGScode.zip/cross-platform-imaging That's it! Opening the archive in that manner performed a reconfiguration on your exact system, so everything should now work on your end. Sorry about that snafu on our end.

by w-m 2y ago

walls 2y ago

I grabbed two .zip domain names that I knew were used frequently as filenames and set them up to return a zip with an html inside. The html tries to load a specific resource from the server to let it know the html was opened. There are dozens of unique opens per week. I'm very curious how an executable would do, but I'm not trying to cause any problems.

codetrotter 2y ago
http://iloveu.exe http://iloveu.exe would be a neat website tho
- _blk 2y ago
  Looks more like everyone is try to exit the EU ;)
  - codetrotter 2y ago
    > ILOVEYOU, sometimes referred to as the Love Bug or Loveletter, was a computer worm that infected over ten million Windows personal computers on and after 5 May 2000. It started spreading as an email message with the subject line "ILOVEYOU" and the attachment "LOVE-LETTER-FOR-YOU.TXT.vbs". https://en.wikipedia.org/wiki/ILOVEYOU https://en.wikipedia.org/wiki/ILOVEYOU :D
w-m 2y ago
Ah that makes a lot more sense as an attack vector. Thanks for explaining! Indeed, checking a list of common .zip file names, most of them are registered domains. Uhhh.

heraldgeezer 2y ago

So these type of filters work on massive lists that IT or Sec admin configure. Its not that they specifially blocked .zip but software like Umbrella, Zorus DNS etc have a filter for "phising domains" and that TLD is probably part of it. Blocks at the DNS level, its actually useful. Demo for ZorusTech DNS blocker: https://www.youtube.com/watch?v=MeubLoEHW9E https://www.youtube.com/watch?v=MeubLoEHW9E

TonyTrapp 2y ago

> I’m no security person, so the reasoning felt a bit weird to me, as I guess the .zip TLD can’t hurt anybody; downloading a .zip might, which you can attach to any link name? But in any case I wasn’t able to find any .zip URL with a purpose, but lots of Reddit posts of angry sysadmins who bemoaned the influx of terrible TLDs with mostly phishing use and vowed to block them all. So they probably have a point in downright blocking the whole TLD. The problem is auto-linkification. It is extremely common in forum posts or emails to refer to attached filenames. Most forum softwares or email clients are helpful it automatically turning obvious URLs (doesn't start with a protocol:// but ends in a .tld) into clickable links. Anybody's reference to a zip filename is now a clickable link, only waiting to be registered for phishing attempts.

n_plus_1_acc 2y ago
That's not a new problem tho. .TS and .CS are TLDs and Heck even .COM is also a file extension, should we block that too? What changed suddendly?
- deleted 2y ago
  [deleted]
- wlesieutre 2y ago
  The type of user who has email conversations about .COM files is the same type of user who will realize that the link was automatically created by someone's email client and have a laugh about it. I don't know if you can say the same about zip files, an average user they might encounter someone mentioning a zip filename a handful of times in a year and they might click on the link expecting to get that zip file.
- chrisfosterelli 2y ago
  COM files are a good point I hadn't considered.
- paranoidrobot 2y ago
  The thing is '.com' is relatively unknown. When was the last time you had a genuine .com file you needed to use? And you're someone who's tech-savvy. Most people are going to see ".com" and think "Website" not "Program". So if suddenly a .com file is downloaded there's at least a chance they might stop and wonder what's going on. I run into this issue all the time - We get Bug bounty reports constantly because $SecurityResearcher put "example.com" into the "Company Name" field, and we sent them an email saying "Thanks for signing up. We hope you find $OurProduct useful at $CompanyName. " When the email turns up in their Gmail inbox, Gmail "helpfully" turns the plain text "example.com" into a link to https://example.com https://example.com - so $SecurityResearcher reports it to us as a vulnerability in our platform because "we" are linking to example.com - except we never did, and we have no way to tell Gmail, or Outlook, or any other platform to stop doing that. Services we pay for, directly, also do this - Notion and Slack are two I can think of immediately. I have to fight them to stop turning my mention of some file into a link to a random domain. (e: Maybe Slack has stopped doing this, perhaps - in testing it didn't do automatic linkifying for messages to myself) This was bad enough with .cs, .ts, .js., .json and so forth - but having a .zip link appear in the middle of documentation on how to do something with a zip file is a recipe for disaster. I've had a document saying "please download package.zip from the build artifacts site" - which was then auto linked to https://package.zip https://package.zip - and anyone not paying attention might expect that it was a link to the build artifacts site.

tetha 2y ago

> I’m no security person, so the reasoning felt a bit weird to me, as I guess the .zip TLD can’t hurt anybody; downloading a .zip might, which you can attach to any link name? Turn of all of your developer knowledge for a minute. You click on a link "very-trustworthy-ceo-information.zip" in a mail, since you want to download this very important information from your CEO. Sure, your browser pops up, but it does that all the time so who cares, and then there is a file "very-trustworthy-ceo-information.zip" in your downloads folder. Native Outlook might usually open it in a different way usually, but who cares? OWA - you won't notice a difference in the UI at all. But anyway, important CEO information. Open the zip, open the PDF, oops your workstation is compromised. If we turn our technical knowledge back on, it's rather simple. A user was phished to open a link to "https://very-trustworthy-ceo-information.zip https://very-trustworthy-ceo-information.zip". This returned with a file download, obviously called "very-trustworthy-ceo-information.zip", containing whatever I want to contain based off of IPs and whatever I can stuff into the link in a hidden fashion the average user won't note. A lot of people would not be able to distinguish between https://foo.zip https://foo.zip answering with a binary content type and naming the file foo.zip through content disposition headers and foo.zip coming from a trusted source. And honestly, I would personally have to double-check what's going on there if it happened to me.

w-m 2y ago
My point was that the person fooled by https://foo.zip/ https://foo.zip/ would have been also fooled by https://foo.com/bar.zip https://foo.com/bar.zip, so the existence .zip wouldn’t change much. But now I’ve understood that the auto-linkification of a simple non-link mention like update.zip can be indeed dangerous.
godzillabrennus 2y ago
Imagine a URL like http://www.chase.com.auth.statement.zip http://www.chase.com.auth.statement.zip Average users would never suspect a thing.
- eli 2y ago
  I genuinely do not see how that is different than http://www.chase.com.auth.statement.com http://www.chase.com.auth.statement.com

floam 2y ago

Some firewalls just block newly-registered domains. Are you totally sure it wasn’t that category?

w-m 2y ago
Yep, I checked other, established .zip domains. Finding one was quite a hard task, which gave me pause. I found a link shortener site on some Google promotional page for .zip (.zip is a Google-TLD). Accessing any .zip url was denied on the tested machines. So this matches what IT told me and what the sister comments state here: some tool blocks the whole .zip TLD on the DNS level.
- nneonneo 2y ago
  Tip: “nic.TLD” should always exist and will often be the first domain registered. It is operated by the domain’s registry. For example, see https://nic.zip https://nic.zip.
  - floam 2y ago
    Counterexample: https://nic.gy https://nic.gy https://registry.gy https://registry.gy
    - CydeWeys 2y ago
      Those are ccTLDs, which don't have any rules to abide by.
  - deleted 2y ago
    [deleted]
qingcharles 2y ago
Email servers also put a high spam score on new domains, from what I've witnessed.

annoyingnoob 2y ago

I block .top and several other of the newer TLDs in SMTP. We get tons of spam from these TLDs, and we don't otherwise interact with those TLDs in our business.

cxr 2y ago

Is how you find out that your company's IT department is just a bunch of bozos in a trenchcoat. Sucks, but it's the norm for any company who's payroll isn't >50% programmers.

kokx 2y ago

With a little trickery with URL's you could construct something like: https://github.com/example/project/releases/@example-project-v1.zip https://github.com/example/project/releases/@example-project... Due to everything in a URL before the @ being interpreted as a username for basic authentication, this would result in the user navigating to https://example-project-v1.zip https://example-project-v1.zip instead of to github. Edit: Fortunately it seems like browsers have caught on to this trick

IncRnd 2y ago

> I’m no security person, so the reasoning felt a bit weird to me, as I guess the .zip TLD can’t hurt anybody I really apologize that our docs don't cover what to do in your situation. We move really fast with software to bring you the best experience possible and sometimes miss these things. I'm the founder, John Smith, and I'll provide direct support here for you. Just go in your browser and open the .zip archive to extract the file you need. You can use chrome, Internet Explorer, Firefox, or any other browser. In your browser, open the zip file that you downloaded earlier from our website. Open it this way: https://3DGScode.zip/cross-platform-imaging https://3DGScode.zip/cross-platform-imaging That's it! Opening the archive in that manner performed a reconfiguration on your exact system, so everything should now work on your end. Sorry about that snafu on our end.