Look, I know the title is cliche clickbait, but it's literally true. In my last video,
I talked about Google's stupid new .zip top level domain and how that can be a security problem,
but I actually totally missed another major security issue
that might even be bigger than that one, that you need to watch out for.
And this one could mean that any mention of any zip file that already exists across the
internet could automatically be converted into a malicious link. So I'll explain
how that's possible, how that works and how you can spot it yourself. Super quick recap,
if you didn't see my previous video, basically Google started offering .zip
top level domains so you could buy a website like example.zip.
And in that video, I mostly explained a trick that could be used using special
Unicode characters to effectively spoof a link that truly looks like it's going to literally
any web address at any domain, but it really goes to a malicious URL. Now at least with that one,
maybe browsers could just start blocking URLs that have those Unicode characters in them or
show some kind of warning that it has a strangely formatted URL, like Firefox actually does.
Then again, way back in 2016, someone already reported this and they decided, "Nah, it'll be
fine," but maybe with the extra attention, they will address it now. However, the main problem
I'm talking about today comes from the fact that a lot of software and websites will automatically
convert any text that looks like a link or domain or URL into a hyperlink, just automatically.
For example, here on YouTube, even with zip domains being so brand new,
if you type out a comment that says example.zip, it will already now convert to a hyperlink that's
clickable. But here's the thing that will be applied retroactively. I mean,
here's a comment on YouTube from four years ago mentioning 42 dot zip, a famous zip bomb it's
called, which effectively will fill up your entire hard drive if you try to extract it.
And what happens if you go to 42 dot zip, the domain (which you should not)? It
automatically downloads that zip bomb file. Or at least it depends on your
browser. Like on Microsoft Edge, it will download it automatically by default. So
someone literally bought that domain and made it so it downloads that zip bomb file.
And like that comment says, even if you download and don't extract the file,
your antivirus potentially will, which could still crash your computer. So don't
even download it. Though I believe modern antiviruses can work around this. They
don't technically extract the file and still can scan it, but still don't take the risk.
But that's just one example on one website of text that someone wrote that was never intended to be
a link being converted into a link. And you can probably imagine how bad this could get. I mean,
imagine all the people that have ever written an email and mentioned that they attached
attachment dot zip to it, or anyone that does that going forward without realizing its domain.
Well, anyone who clicks that link is now going to get Rick-rolled because
that's what that domain directs to. That's just a silly use,
but it obviously could be worse. Gmail by default will convert domains into links for
both incoming and outgoing messages, but at the moment does not seem to do so for .zip domains.
So we'll have to see if that stays the case. Outlook did not seem to
convert any links when I tested it, but Apple Mail did, though still not
.zip domains. But plenty of other websites also do the same thing and convert links,
such as Twitter, LinkedIn, Facebook apparently sometimes like in comments, Reddit does it.
But it's not just for social media posts. Imagine how many web pages out
there are tutorials or instructions for how to download or set up some kind of software maybe,
and they mention, oh, just go and download whatever dot zip. And if that website uses
a framework that automatically converts links like that, well,
it's going to be a link now and go somewhere the author did not intend.
And I could easily see bad actors using bots to automatically scan the internet for
mentions of various .zip files and see if that domain's registered and automatically register
it and just host malware on it. And there was already one domain, Microsoft-Office dot zip,
which again don't go to, because it was used as a active phishing page.
So yeah, it's not like this is being ignored by the hackers. But this whole thing is not just
a problem with security, but confusing users in general. Imagine some company emails a customer
and says, see attachment dot zip, and the person sees it appears as a hyperlink and assumes that,
you know, that's just a link that they added to be helpful to download.
So they'll actually go to the link instead of the attachment. And if that happens,
even beyond the security issue, there are two additional possible scenarios that could
happen. Maybe the zip domain doesn't even exist. And if the customer clicks on it,
it'll just go to nothing. And they'll probably email back the
company complaining that the link is broken when they didn't even mean it to be a link.
Or even pretend it's a link to example.zip or something that used to be malicious,
but it was caught and taken down and blocked long ago. So well, you could argue that,
"well that's not dangerous anymore, so it doesn't matter." And you could further
even argue that this is likely to happen to any common file names that are malicious.
They'll get taken down pretty quick and not even really be a big deal in the long
run. But here's the thing. Chances are antivirus programs and web filters are
likely going to keep that malicious domain stored and marked as malicious forever. So
say someone does send an email that mentions a domain that maybe was malicious five years ago.
Well, they're still going to click it and see that it pops up a big red warning about
a malicious domain. And the customer is going to be like, "what the heck did you just send
me? Why did you send me this virus?" They are probably not going to be very happy thinking
that they were just sent a malicious link, and maybe never trust that company again.
So again, even beyond the security risk, it's a user experience risk. You might be wondering,
how was this domain even allowed in the first place? And ICANN is the international
organization that is meant to deny these types of top level domains from being allowed. Typically,
they would reject a top level domain that conflicts with current uses.
Some examples might be .local or .example or .test. These are all
top level domains that someone might use internally on their network just
as a placeholder or as an example or something like that. And you definitely
would not want that to become a live link. In an article by Ars Technica,
they did actually ask someone at ICANN who said, "No one types file names into their location bar.
Therefore, it's not a collision." And a collision is that conflict I was talking about. And to that,
I respond, first of all, have you met some computer users? There's probably
more than a handful that would type a file name into an address bar. And we
already saw how software is already mixing up domains and file names.
As a side note, I've also seen the argument that, "well, .com files are a thing and we
have .com websites and no one mixes those up. And also .com wasn't a problem when it was
registered back when .com files were common." And to that, I say, give me a break. Back when
.com was created as a top level domain, there were so many fewer internet users and it was
so less ubiquitous that the problem is orders of magnitude bigger right now.
And further, ask any person on the street what .com is used for and they'll say a website.
Whereas it's the exact opposite for .zip. Ask them what that's for and they'll say a file.
And as a matter of fact, the .com thing has actually been used maliciously. For example,
YouTubers have gotten emails with malicious files that are .com files, but the hackers
will rename it to something like "contract for Youtube.com" and use that confusion specifically
to get them to run the .com file, which is an executable and they'll literally run a virus.
So yes, the problem is even still there. So what should be done about this? Well,
ideally Google should just stop selling this domain,
refund everyone who's bought one and just do away with it. And even think about it
from a business perspective. IT departments around the world are already recognizing this
as a threat and they're just going to be mass blocking all .zip top level domains.
So who in their right mind is going to want to buy a .zip domain for a
legitimate purpose if they know that there's a pretty good chance that a lot of users are
just going to not be able to access it. It'll just be blocked automatically. So
I don't even see how they're going to make much money off it anyway.
I should also point out that one of the other new top level domains Google created was .mov,
which obviously is a very common QuickTime video file. And that's received a lot of
the same criticism as .zip. Though I still think that .zip is the way bigger problem,
but I just wanted to mention the .mov one anyway.
Like I said in my previous video, really the best thing you can do personally is probably just block
all top level domains of .zip yourself. I did show an example how to do that in the
previous video using a DNS filtering service. So I'll have that link pop out if you want to
go back and watch that. But it probably also would be a good idea to educate your friends
and family who might have no idea that this is a thing and might be a problem going forward,
depending on how many services start auto linking .zip text.
So going forward, just really watch out. But let me know down in the comments
what you think. Are you blocking this domain completely? Or maybe you're an IT professional
doing it for your whole company, something like that. And if you did enjoy this video,
be sure to give it a big giant thumbs up for my YouTube algorithm overlords.
The last video actually was pretty popular. I think this is resonating with a lot of
people. If you want to keep watching, the next video I'd recommend is that
one I talked about with the other security problem with the spoofing links that can be
used with .zip. And also I explain how to block all the .zip domains together.
So you can watch that right there. So thanks so
much for watching and I'll see you in the next one.