ICANN's list of abandoned vanity TLDs, which now has about 134 entries

Re:ICANN's list of abandoned vanity TLDs, which now has abou... by avidiax on Monday July 08, 2024 @03:36AM (#40903352)

If the search domain list is empty or contains "." or "", or the search algorithm is flawed (maybe an IoT device), trying to connect might lead to a bare TLD lookup.

CMD.exe is either a program accepts either a filename or URL in the same context (VLC does this), or the user is confused about the URL/file distinction. The .ZIP TLD was concerning for this reason.

[ Parent | on HN ]

Re:ICANN's list of abandoned vanity TLDs, which now has abou... by DidYaWipe on Monday July 08, 2024 @02:21PM (#40907864)

Thanks for the reply. Maybe I just don't know enough about all the scenarios. I don't know what "the domain search list" is or what user action would involve it.

I was looking more for specific dangerous use cases; for example, "The user types such-and-such in the address bar, and instead of getting this he gets that." In other words, how is this a problem in actual practice.

[ Parent | on HN ]

Re:ICANN's list of abandoned vanity TLDs, which now has abou... by avidiax on Monday July 08, 2024 @02:33PM (#40908011)

https://en.wikipedia.org/wiki/Search_domain

An example:

The attacker posts a message to a forum, chatroom, etc. like:

Download: 2024YourCompanySalaryData.zip

When the user clicks "2024YourCompanySalaryData.zip", it is actually a domain name, and loads that website. This website then asks you to enter your corp credentials, or executes a 0-day on the victim's browser, etc.

The forum doesn't need to allow file downloads (i.e. a real .zip might not even work), and even if it does, client or server side virus scanning doesn't have a .zip to inspect.

The user is less wary of phishing, having never seen the .zip TLD. They assume they are downloading a file.

https://blog.talosintelligence.com/zip-tld-information-leak/

[ Parent | on HN ]

Re:ICANN's list of abandoned vanity TLDs, which now has abou... by DidYaWipe on Monday July 08, 2024 @04:05PM (#40909039)

Thanks. I don't really see how that's worse than today, where a bad actor can do exactly the same thing in a forum post. Typically the post shows the text you enter, but can go to any URL.

In terms of the user going to a site instead of a zip file: If a user is willing to unpack and run a random file he downloaded and give it credentials to something... what's the difference? Not being argumentative, but this seems like a stretch.

[ Parent | on HN ]

Re:ICANN's list of abandoned vanity TLDs, which now has abou... by avidiax on Monday July 08, 2024 @06:02PM (#40910225)

The difference is that many forums or chat programs will automatically linkify valid hostnames/URLs.

Now "foo.zip" is a valid URL.

You could have a forum or chat program that you think is quite safe, since it doesn't allow file uploads, and doesn't allow arbitrary link text, and this would upend that.

[ Parent | on HN ]