Hello, World!
Today in hacking news…
Google has a gift for cyber criminals.
A brand new ‘top level domain’ called .zip.
Just like .com, .net or .pizza - yes that’s a thing, you can register a .zip domain today
for just a few dollars a year.
One obvious use case for .zip is a link shortener, and someone’s already done it.
This comes with a bit of irony of course, thanks to the file type with exactly the same
extension.
You have zip files which expand and now you have zip links which also expand.
However there is a price to pay for this minor amusement, and that’s because cyber criminals
are going to love .zip domains.
For example, and this is wild - lets say you receive a perfectly innocent email from a
family member containing some photos, but importantly with the file name in the email.
Because .zip domains are now a thing, that file name becomes a link.
A bad actor could register a bunch of common filenames, so that if you mistakenly click
the link thinking you’re just downloading the attachment, you’re sent to the website
‘familyphotos.zip’ which auto downloads a file of the same name.
Within which there are no family photos, just malware.
By Google introducing this new TLD, a vast number of instances of people simply stating
a file name have potentially been weaponised overnight.
And…
it won’t surprise you to learn that bad actors are already jumping on the bandwagon.
There’s a github repo which has been tracking newly created .zip domains, this includes,
“backup.zip”, “archive.zip”, “homework.zip”, and thousands of others.
However some of these will have been registered by white hats, in order to take them off the
market so to speak, denying cyber criminals access to them.
Some have been turned into landing pages lambasting Google for introducing the .zip TLD.
But there are malicious .zip domains already in use, such as this one microsoft-office.zip
which hosts a lovely phishing page.
However, there are other malicious uses of .zip domains that are a little more sophisticated
than just waiting for passive traffic to roll by.
I found an incredibly sneaky method in a medium article which I’ll link below.
There’s a bit of an explanation to this one, but stick with me because you absolutely
have to know about this and I doubt you’ve seen it before.
Take a look at this URL, it links to github, and downloads a kubernetes repository, in
the form of a zip file, right?
Well, no.
Click the link and you’ll be taken to v1271.zip - which could be configured by a bad actor
to do anything…
like serve you an infected copy of the zip you were expecting.
But what’s going on here?
Clearly the domain in the URL is github.com.
Let’s dissect this, you’ll see an “@” in the URL just before the zip domain, this is
a big red flag and is a sign that the link is taking advantage a little known feature
of URLs called ‘UserInfo’, this parameter can be used to specify login credentials for
a web application, so you’re automatically authenticated when you’re sent to whatever
comes after the “@”. However, this feature of including login credentials in URLs is
more of a legacy feature and isn’t really used much nowadays because people quickly
realised that including plaintext credentials within a URL is pretty bad for security.
Nevertheless, the feature lingers in modern browsers.
So in our malicious URL, everything before the “@” is treated as a “UserInfo”
parameter, and you’re really sent to v1271.zip instead.
However, something still doesn’t add up.
I mean the link to this very medium article includes an “@” to specify the author
of this article, so why doesn’t this invalidate the “medium.com” part of the URL.
This is because when the browser sees a ‘slash’ character in a URL it treats whatever comes
after it as a path, so you can’t really just take any URL and tack on “@arbitrarydomain.zip”
and expect to be sent there.
Our malicious link however, accomplishes this through the use of a certain unicode character
that looks very similar to a slash, but isn’t.
Compare the slashes in our malicious URL to the slashes in an innocent URL, they’re
at slightly more of an angle, but it’s not enough of a difference to set off alarm bells.
This all makes possible hyper convincing phishing links, the only giveaway that something just
isn’t right here is the true domain appearing in the bottom left when you hover over the
link, and the fact that some fonts do make the fake slashes look slightly odd.
But other than that there isn’t even an opportunity to realise you’re being sent
to a malicious domain, because as per normal download link behaviour, the tab only opens
for a fraction of a second until the download starts.
Oh and if you’re holding on to hope that this will be fixed by browsers, don’t.
A chromium bug report 7 years ago raised the issue of Unicode slash lookalikes, and it
was decided nothing that would be done.
As such this phishing method isn’t new per se, but it’s made a whole lot more useful
thanks to bad actors now being able to serve the exact filetype the victim expects.
Google has published a statement defending their new Zip domains, in which they said
“The risk of confusion between domain names and file names is not a new one”.
They give the example of the .com TLD which actually used to be a file extension in the
early days of windows, it was similar in function to .exe.
However that’s a bit of an absurd comparison, because you’d have to go back to the first
half of the 90s to find .com files being used regularly, to imply that just because it didn’t
pose a problem then, that it won’t now - is ridiculous.
The number of people connected to the internet back then, was tiny - it barely registers
on a graph, and cyber crime wasn’t the multi trillion dollar industry that it is today.
The rest of Google’s statement is just waffle really.
.zip isn’t though only newly created TLD, there’s also .mov which has also proved
controversial, again, thanks to the filetype sharing the same extension.
I want to hear your guys’ thoughts on all this, is the existence of .zip a dumb idea,
I mean - there’s already 1500 TLDs!
Do we really need any more, in particular confusing ones?
Or is the drama just hype, and so long as developers implement some basic changes like
not auto hyperlinking .zip domains we’ll all just be fine.
Let me know your thoughts down in those comments.
This video is sponsored by PCBWay, the complete solution for all your PCB Fabrication and
on demand 3D printing needs.
From standard PCBs to the more advanced varieties, PCBWay provides granular control over every
element of your PCB.
With superfast turnaround times you’ll be spending more time creating and less time
waiting on packages.
PCBWay also offers on demand machining, from CNCing and sheet metal cutting to 3d printing
and injection molding, there’s an array of materials to choose from, and of course,
superfast turnaround times.
Sign up now using the link in the description to get a $5 coupon, which can be used site
wide.
As always thanks for watching and I’ll see you in the next video, have a good one.