Recent Posts
- The Swiss can register .swiss domains from next week
- .ai up to 425,000 domains
- A million “free” .music domains up for grabs
- D3 to get $5 million in crypto to apply for .ape gTLD
- Alibaba hit with ICANN breach notice
- New Vegas conference “Davos for Web3 interoperability”
- ICANN content policing power grab may be dead
- Cable company unplugs its dot-brand after acquisition
- Germany crosses 10,000 dot-brand domains milestone
- Founders out as Com Laude gets equity injection
- PIR’s Diaz to leave domain industry
- Some registrars have already quit ICANN’s Whois experiment
- ICANN opens $217 million Grant Program
- Internet could get one-letter gTLDs (but there’s a catch)
- .ai registry fights deadbeats with tweaked auction rules
- Amazon and Google among .internal TLD ban backers
- .ai registry advises buyers not to use GoDaddy
- .post liberalizes with new sunrise period
- Team Internet spends $41 million on content farm
- Epik backtracks on Kiwi Farms claim after legal threat
- .austin names launch on blockchain
- Freenom shuts down 12.6 million domains — report
- GoDaddy’s next .xxx contract may not be a done deal
- GlobalBlock blocking 2.5 million domains
- Microsoft moving its cloud apps from .com to .microsoft
- ICANN 79: anonymous trolls and undercover lawyers
- ICANN scores win in single-letter .com lawsuit
- Cosmetics brand terminates its gTLD
- Up to 70 jobs on the line at Nominet as .uk regs dwindle
- Governments back down on new gTLD next round delay
- Private auctions could be banned in new gTLD next round
- ICANN meeting venue “insensitive and hurtful”
- GoDaddy to start selling graphic.design domains
- GAC spinning up new gTLD curveball at ICANN 79?
- GoDaddy’s GlobalBlock supports blockchain names
- Police .uk domain takedowns dive in 2023
- GoDaddy wants to cut the bullshit from .xxx
- Dueling domain blocking services to launch at ICANN 79
- Freename tries to bridge DNS and blockchain
- Olive retires from ICANN
- Whois policy published without life-saving disclosure rule
- UK gov takes its lead from ICANN on DNS abuse
- Tucows reports 2023 results
- Twitter “completely unresponsive” on clickable domains
- ICANN spends $5 million more than planned in first fiscal half
- .art takes a million domains off its premium list
- KeyTrap ‘the most devastating vulnerability ever found in DNSSEC’
- Freenom settles $500 million Meta lawsuit and will exit domain business
- New gTLD lottery to return in 2026
- First GlobalBlock prices revealed — they ain’t cheap
- Domain universe grows on new gTLDs despite .com shrinkage
- D3 signs up crypto gTLD client number five
- GoDaddy reports strong domains growth
- How to qualify for a $40,000 gTLD
- Registry service provider evaluation handbook published
- WebUnited inks deal to “mirror” country’s TLD in the blockchain
- GoDaddy project unveils brand-blocking calculator
- Report: Monster “misappropriated” millions from Epik
- .com is shrinking but Verisign raises prices again anyway
- D3 announces fourth crypto new gTLD client
- Donald Trump loses second UDRP case
- UK cybersquatting complaints hit record low
- No excuses! PIR to pay for ALL registries to tackle child abuse
- ICANN insists it is working on linkification
- Namecheap sues ICANN over .org price caps
- GoDaddy offers free Ethereum blockchain integration
- Epik reveals who is running the company
- Epik gets acquired again! The plot thickens…
- Airline gTLD crashes and burns
- First chunks of new gTLD Applicant Guidebook drop
- Epik to reveal its owners soon
- Another crypto firm to apply for a new gTLD
- Monster and Royce are NOT involved in Epik?!
- Nominet to overhaul .uk registry, turn off some services
- Russia blames DNSSEC, not Ukraine, for internet downtime
- Team Internet says revenue beat estimates
- Sold for over $20k, insure.ai and dog.ai back in .ai’s expired names auction
- .ai helps UDRP cases rise in 2023, WIPO says
- Freenom’s domains land at Gandi after termination
- .ru domains fly off the shelf as Western sanctions bite
- ICANN picks its first ever Supreme Court
- Lebanon’s ccTLD going back to Lebanon after ICANN takeover
- ICANN picks the domain it will never, ever release
- ICANN approves domain takedown rules
- Has Epik gone “woke”?
- First bits of new gTLD Applicant Guidebook expected next week
- ICANN bans closed generics for the foreseeable
- You can’t use money to buy .box domains
- After 14 years, ICANN practices what it preaches on IDNs
- Weak demand for private Whois data, ICANN data shows
- .ing doing way better than .meme
- DNS Women barred from ICANN funding?
- Dev releases free open-source TLD registry platform
- INCO flips a gTLD to Identity Digital
- Anguilla fears the .ai junk drop
- Five more gTLDs get launch dates
- $10 million of ICANN cash up for grabs
- Almost 50,000 .ai domains sold in a quarter
- ICANN threatens to regulate your speech [RANT]
- Life insurance company kills dot-brand
- ICANN finds new home for Lebanon’s TLD after founder’s death
- ICANN begs people to use its new Whois service
- Shiba Inu outs itself as crypto new gTLD applicant
- Over 50,000 .ai domains sold in three months
- Amazon planning new push into registrar market?
- Registries and registrars vote ‘Yes’ to new DNS abuse rules
- ICANN predicts flattish 2025 for domain industry
- Fast-growing Gname buys another 150 registrars
- GoDaddy service to let you block domains in over 650 TLDs
- Did I find a murder weapon in a zone file?
- ICANN drops the “man” from Ombudsman
- Have your say on police domain takedown powers
- Most registrars are shunning ICANN’s new Whois system
- Nominet to take over .gov.uk
- ICANN picks Istanbul for 2024 meeting
- ICANN’s private Whois data request service goes live
- .au regs slide on 2LD anniversary
- ICANN accused of power grab over $271 million auction fund
- A registrar is getting blamed for an Israeli war propaganda site
- Two more dot-brands bite the dust
- Google sells five-figure AI domain and six-figure .ing hack
- .blackfriday is still a bit rubbish
- Internet Naming Co acquires five more gTLDs
- Domain universe grows despite .com drag
- Did somebody spend a million bucks on a Google domain hack?
Verisign says new gTLDs put millions at risk
Verisign has revived its old name collisions security scare story, publishing this week a weighty research paper claiming millions are at risk of man-in-the-middle attacks.
It’s actually a study into how a well-known type of attack, first documented in the 1990s, might become easier due to the expansion of the DNS at the top level.
According to the paper there might be as many as 238,000 instances per day of query traffic intended for private networks leaking to the public DNS, where attackers could potentially exploit it to all manner of genuinely nasty things.
But Verisign has seen no evidence of the vulnerability being used by bad guys yet and it might not be as scary as it first appears.
You can read the paper here (pdf), but I’ll attempt to summarize.
The problem concerns a virtually ubiquitous protocol called WPAD, for Web Proxy Auto-Discovery.
It’s used by mostly by Windows clients to automatically download a web proxy configuration file that tells their browser how to connect to the web.
Organizations host these files on their local networks. The WPAD protocol tries to find the file using DHCP first, but fails over to DNS.
So, your browser might look for a wpad.dat file on wpad.example.com, depending on what domain your computer belongs to, using DNS.
The vulnerability arises because companies often use previously undelegated TLDs — such as .prod or .global — on their internal networks. Their PCs could belong to domains ending in .corp, even though .corp isn’t real TLD in the DNS root.
When these devices are roaming outside of their local network, they will still attempt to use the DNS to find their WPAD file. And if the TLD their company uses internally has actually been delegated by ICANN, their WPAD requests “leak” to registry or registrant.
A malicious attacker could register a domain name in a TLD that matches the domain the target company uses internally, allowing him to intercept and respond to the WPAD request and setting himself up as the roaming laptop’s web proxy.
That would basically allow the attacker to do pretty much whatever he wanted to the victim’s browsing experience.
Verisign says it saw 20 million WPAD leaks hit its two root servers every single day when it collected its data, and estimates that 6.6 million users are affected.
The paper says that of the 738 new gTLDs it looked at, 65.7% of them saw some degree of WPAD query leakage.
The ones with the most leaks, in order, were .global, .ads, .group, .network, .dev, .office, .prod, .hsbc, .win, .world, .one, .sap and .site.
It’s potentially quite scary, but there are some mitigating factors.
First, the problem is not limited to new gTLDs.
Yesterday I talked to Matt Larson, ICANN’s new vice president of research (who held the same post at Verisign’s until a few years ago).
He said ICANN has seen the same problem with .int, which was delegated in 1988. ICANN runs one of .int’s authoritative name servers.
“We did a really quick look at 24 hours of traffic and saw a million and a half queries for domain names of the form wpad.something.int, and that’s just one name server out of several in a 24-hour period,” he said.
“This is not a new problem, and it’s not a problem that’s specific to new gTLDs,” he said.
According to Verisign’s paper, only 2.3% of the WPAD query leaks hitting its root servers were related to new gTLDs. That’s about 238,000 queries every day.
With such a small percentage, you might wonder why new gTLDs are being highlighted as a problem.
I think it’s because organizations typically won’t own the new gTLD domain name that matches their internal domain, something that would eliminate the risk of an attacker exploiting a leak.
Verisign’s report also has limited visibility into the actual degree of risk organizations are experiencing today.
Its research methodology by necessity was limited to observing leaked WPAD queries hitting its two root servers before the new gTLDs in question were delegated.
The company only collected relevant NXDOMAIN traffic to its two root servers — DNS queries with answers typically get resolved closer to the user in the DNS hierarchy — so it has no visibility to whether the same level of leaks happen post-delegation.
Well aware of the name collisions problem, largely due to Verisign’s 11th-hour epiphany on the subject, ICANN forces all new gTLD registries to wildcard their zones for 90 days after they go live.
All collision names are pointed to 127.0.53.53, a reserved IP address picked in order to catch the attention of network administrators (DNS uses TCP/IP port 53).
Potentially, at-risk organizations could have fixed their collision problems shortly after the colliding gTLD was delegated, reducing the global impact of the vulnerability.
There’s no good data showing how many networks were reconfigured due to name collisions in the new gTLD program, but some anecdotal evidence of admins telling Google to go fuck itself when .prod got delegated.
A December 2015 report from JAS Advisors, which came up with the 127.0.53.53 idea, said the effects of name collisions have been rather limited.
ICANN’s Larson echoed the advice put out by security watchdog US-CERT this week, which among other things urges admins to use proper domain names that they actually control on their internal networks.
So, this never happens with drop caught domains under large existing TLDs, say those with 120M or more names in them where it would be more likely?
Seems like the F.U.D. axe has sharp edges on both sides.
To say this is not a new problem is putting it mildly. I registered wpad.co.za back in 2001 when I first saw the autoconfig setting in Internet Explorer. Back then the documentation on Mozilla’s website explicitly stated that searches for wpad were limited to the 3rd level and greater (so wpad.co.za but not wpad.gtld) that must have been forgotten about at some stage, and I know the owner of wpad.com said he was seeing lots requests for the proxy script many years ago.
ICANN probably should have wpad on its list of reserved names for the gTLDs but I would imagine that if it was ever abused any responsible registry would permanently suspend the domain anyway.
1 – Kevin, I believe you do your readers a great disservice by downplaying the very serious risks to users. Before I get into the details you should look at this link, where Russian hackers have been specifically exploiting WPAD attacks in new gTLDs (and ccTLDs) and name collisions to compromise users. Here is a public reference that has surfaced (yet is a year old, and until now only in Russian) as a direct result of the US-CERT Technical Alert and IEEE S&P paper: https://translate.google.com/translate?sl=ru&tl=en&js=y&prev=_t&hl=ru&ie=UTF-8&u=https%3A%2F%2Fhabrahabr.ru%2Fcompany%2Fmailru%2Fblog%2F259521%2F&edit-text=
2 – Not only does CI not solve this problem, it in fact blocked visibility into the impact of WPAD name collisions. By trapping and containing name collisions CI prevented anyone from knowing what would happen with WPAD name collisions. Furthermore, CI doesn’t notify users vulnerable to this attack vector (and the same issue exists for other DNS “service discovery” protocols as well, to include ISATAP and DNS-SD). Verisign and SSAC told JAS and ICANN about this yet no action was taken as a result. Regrettably, and again despite SSAC advice to ICANN and JAS, there were ZERO reporting obligations on CI effects by new gTLD registries.
3 – Today there are 50x the number of gTLDs in the root than there were when we first highlighted these issues. Vulnerable WPAD domains in new gTLDs are being registered, as you can see from the Russian blog above and as the IEEE S&P paper illustrates. That’s what’s changed since we initially warned of this 3+ years ago. This should create some urgency for relying parties to be notified of their vulnerability.
4 – In your story you say “but Verisign has seen no evidence of the vulnerability being used by bad guys yet and it may not be as scary as it first appears”. In this field, given the presence of the exploit blueprint and kit, that best practice is to assume that anyone leaking WPAD queries would have been compromised. Therefore, since the discovery of the Russian website, this is in fact “far scarier” than it first appears. You also say in your story that the exploit “… would basically allow the attacker to do pretty much whatever he wanted to the victim’s browsing experience.” It’s important to understand what this means: “pretty much whatever” includes theft of credentials, malware injection, surreptitious penetration and advanced persistent presence, malvertising, techniques to MiTM secure SSL/TLS transactions, and any broader array of bad scenarios you could imagine. Even more so because of this statement as provided in our white paper “As previously mentioned, what makes this vector so dangerous is that attackers need not be on path, or waiting to spoof responses to DNS queries at just the right time. Attackers can remain off-path and always on, and just wait for willing victims to query them. This effectively enables a large-scale high success probability Watering Hole attack, where an attacker knows with high confidence that victims will visit persistently and be vulnerable and easily exploited.” This fact alone dramatically increases the risk.
5 – Name collisions can occur in any TLD and of course we understand this, triggered by a number of factors to include search list processing, as Google, Verisign, SSAC and others have pointed out. There are an array of reasons why the problem space is very different, to include the newness of new gTLDs and leaked internal namespaces combining with the ease of registering these strings in new gTLDs (as the Russian blog illustrates). Some additional information on the distinction is available here ( Difference Between Apples and Oranges (Regarding name collisions in new gTLDs versus in .com and other existent top level domains). Understanding what this link conveys, I find it confusing when you say “it’s potentially quite scary but there are some mitigating factors. First, the problem is not limited to new gTLDs”. As you can see from this link, the problems are quite different and the risk is considerably greater in new gTLDs.
6 – You may or may not be aware, .INT is a special use restricted TLD and even then, allowing those networks to remain badly configured without notifying those relying parties that they need to fix their configurations isn’t responsible. This is the crux of what we’ve outlined with US-CERT in the Technical Alert, and in our white paper on the topic here: http://www.verisign.com/assets/Enterprise_Remediation_for_WPAD_Name_Collision_Vulnerability.pdf
7 – Proponents of new gTLDs have understandably reacted defensively with regards to security concerns in new gTLDs since 2013. Verisign continues to believe it’s important to notify potentially impacted relying parties and communicating the urgency of fixing network and system configurations. While rather complex, the simple facts of our work point out that the registration of SLDs in new gTLDs provide empirical evidence that this is no longer a theoretical attack, an that controlled interruption likely contributed to a false sense of security.
Thanks for the link to the Russian site. I was not aware of it. I would agree that exploit code in the wild, if that’s what this is, certainly does up the risk factor.
I think this is probably the document you wanted to link to in bullet 5 https://forum.icann.org/lists/comments-name-collision-05aug13/pdfgGgQZ2Oxuv.pdf
The link for “On the Differences Between Apples and Oranges (Regarding name collisions in new gTLDs versus in .com and other existent top level domains)” is https://forum.icann.org/lists/comments-name-collision-05aug13/pdfgGgQZ2Oxuv.pdf
On point 1, reservation of WPAD.TLD was one of the NTAG suggestions to mitigate name collisions, and that still holds as a best practice (except for Brand TLDs which might take advantage of it). I will save Eric from repeating yet again that WPAD..TLD could also cause issues, but such a real in the wild example has not yet been seen.
That was supposed to be WPAD.Leaked SLD.TLD
Just to clarify, point 1 _also_ has a link showing a year-old weaponization technique from Russia that uses `WPAD’.registered-SLD.TLD (i.e. in the wild).
One domain they mentioned, office.work, is registered to the registry, so it’s unlikely that the registry is doing WPAD exploits… it sounded more like a proof of concept than a real in the wild example, and it was contained in the local exploitation part of the article.
OTOH, wpad.work is said in the article to have been registered (different from office.work) and it’s currently registered to a privacy proxy provider, which is consistent with other abusive behaviour.
So, your point is not taken.
The whole new GTLD movement PUSH by regs. is fraught with we could care less about the legal pitfalls that come with new GTLDs Attitude. A well known new GTLD proponent that says things like there are more Chinese Millionaires than there are people in the United states, gives you a clue about how much Due Dilligence these new GTLD Regs Pushers are doing or mostly not doing.
Also any Marketing Strategist who knows their profession, knows that .COM Subdomains are a clear better and safer bet for real professionals. On top of all this damning true information, we sadly report that 90% plus of all New GTLDs will never be sold on the active secondary market.
Who needs New GTLDs? We can assure you professional Marketing Strategists know the real answer not New gTLD carpetbaggers.
Gratefully, Jeff Schneider (Contact Group) (Metal Tiger) Former (Marketing Analyst/Strategist Rockefeller I.B.E.C.) (Licensed C.B.O.E. Commodity Hedge Strategist) (Domain Master)
One thing I get from all of this is that if it is so dangerous for businesses to use names they are not entitled to use because they have not been delegated for their use, they should be educated in the risks and the ways and reasons to stop doing so. Where is the campaign to educate people in the danger to businesses of using domain names improperly?
https://www.icann.org/resources/pages/name-collision-2013-12-06-en
Only Internet Explorer has proxy auto detection(WPAD) turned on by default and many of the badly named networks are a direct result of bad advice in Microsoft documentation.
I wonder when this is going to turn into a lawsuit? The publicity from that would have far more impact than any outreach program from ICANN.
Yes Avri, you would think that there should be some consumer warnings labels on these New GTLD Spam Spawns. Sadly this whole new GTLD experiment will strip millions of investors of their hard earned money. Our experience in the Financial services Industry warn us of the coming carnage of the spec bubble in new GTLDs.
Our advice buy good .COM subdomains in place of new GTLDs you will have a good future value .COM asset,without the coming financial fallout headed towards the bloated Spec. Bubble new GTLD Industry.Buyer Beware!
Gratefully, Jeff Schneider (Contact Group) (Metal Tiger) Former (Marketing Analyst/Strategist Rockefeller I.B.E.C.) (Licensed C.B.O.E. Commodity Hedge Strategist)(Domain Master)