Jump to content

.zip now available as a TLD

jthompson
 Share

Recommended Posts

jthompson

jthompson

Posted
Posted (edited)

Seeing quite a few articles this morning reacting to the news that Google is now offering .zip as a TLD.

 

https://domains.google/tld/zip/

 

My first reaction is to imagine new phishy ways to trick people into clicking on "pictures.zip" to download malicious files without having to get a malicious file attachment delivered to their mailbox.

 

Perhaps blocking .zip URLs in filters and browser policies to head off any such tactic?

 

EDIT: but that could prevent legitimate zip file downloads.

Edited by jthompson
  • Thanks 1
Dos_Box

Dos_Box

Posted
Posted

I'm just wondering what segment of the market that TLD is aimed at?

Still you could have a lot of fun with some domain names there. I'd get zipadeedoodah.zip.

  • Thanks 1
jthompson

jthompson

Posted
  • Author
Posted
I'm tempted to ban the entire TLD here - I can't see anyone with good intentions using the domain

 

I agree, but it would need to be done in such a way that only .zip domains are blocked, not example.com/file.zip.

jthompson

jthompson

Posted
  • Author
Posted
This all blown out of proportion by websites looking to get clicks, there's 1500 TLDs now

 

I appreciate that there are tonnes of TLDs out there, but it's the .zip one in particular that has a huge scope for misleading end users.

mcolbourn

mcolbourn

Posted
Posted
This all blown out of proportion by websites looking to get clicks, there's 1500 TLDs now

 

I agree with this too, I also agree with a great thread Troy Hunt posted on twitter "humans are bad at URLs and TLDs don't matter"

 

mavhc

mavhc

Posted
Posted
I appreciate that there are tonnes of TLDs out there, but it's the .zip one in particular that has a huge scope for misleading end users.

 

Is it though? Why is:

goodfile.zip

needed to trick people when

goodfile.zip

has been working for decades?

 

Show me the real world studies where it's shown to confuse people and there's nothing the browser makers can do about it

jthompson

jthompson

Posted
  • Author
Posted

Annoyingly, the Chrome/Edge URL blocklist policy option can't be used to block a particlar tld. The wildcard isn't flexible enough to match *.zip and will not accept it as a valid pattern.

 

Could block it at the network level but that won't do anything when devices are being used off site. We don't have cloud filtering.

Garacesh

Garacesh

Posted
Posted
Is it though? Why is:

goodfile.zip

needed to trick people when

goodfile.zip

has been working for decades?

 

Show me the real world studies where it's shown to confuse people and there's nothing the browser makers can do about it

 

Because one of the bits of advice we give people during security training is to hover over a link to see where it goes.

Sure, it's not like every PC in the world is suddenly compromised, but let's face it - why make a system less secure for no good reason?

 

I appreciate anybody can make any file extension they like. There's no reason I couldn't write a piece of software that used .co.uk as its file type, or .org, but if it's a common filetype that every computer has the ability to open (except maybe unix-based systems because they use tarballs, I think?) we really shouldn't be making it easier to exploit with no good cause.

 

Who is .zip even aimed at? What company needs a .zip domain?

mcolbourn

mcolbourn

Posted
Posted
Who is .zip even aimed at? What company needs a .zip domain?

 

Its not who its really aimed at it more of what can be sold as a domain and they must think that that TLD will be used. It might sound strange but take a listen to the Waveform podcast (MKBHD)

it goes into the reason TLD exist and why plus a great story about pizza.pizza.
mavhc

mavhc

Posted
Posted
Because one of the bits of advice we give people during security training is to hover over a link to see where it goes.

Sure, it's not like every PC in the world is suddenly compromised, but let's face it - why make a system less secure for no good reason?

 

I appreciate anybody can make any file extension they like. There's no reason I couldn't write a piece of software that used .co.uk as its file type, or .org, but if it's a common filetype that every computer has the ability to open (except maybe unix-based systems because they use tarballs, I think?) we really shouldn't be making it easier to exploit with no good cause.

 

Who is .zip even aimed at? What company needs a .zip domain?

 

 

That advice is for pre javascript

 

Also the url and the downloaded file don't have to have the same name https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition lets you set the name of the file you're downloading

jthompson

jthompson

Posted
  • Author
Posted (edited)
Is it though? Why is:

goodfile.zip

needed to trick people when

goodfile.zip

has been working for decades?

 

Show me the real world studies where it's shown to confuse people and there's nothing the browser makers can do about it

 

I imagine that the former example would be more effective as a means to trick people, since it's also attempting to undermine users' hover checks.

 

RE: real world. No, probably not actually worth my time working on blocking stuff, but I guess I'd like to know that I can get in ahead of any black swans (i.e. be able to allowist domains of particular TLDs).

Edited by jthompson
mavhc

mavhc

Posted
Posted

Focus on having AV that will scan whatever is downloaded, and security settings that mean they can't run anything they downloaded anyway, and patching everything as fast as possible.

 

Also given everything is online, working MFA that can't be bypassed or just requested so many times the user just clicks ok to shut it up

 

And passwords that aren't a) reused, b) in a leaked password list, c) typed into any other websites except your MS or Google login page

  • 2 weeks later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing


×
×
  • Create New...