Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deceptive example for malicious usage of .zip domain

fosstodon.org

Post reply on HN
Print view View original

21–30 of 44 posts

Re: Deceptive example for malicious usage of .zip domain

#21

Post by GloomyBoots »

yathern wrote: post #5

Cool trick - they're using HTTP auth URLs[1] so that the @ sign is doing a lot of the heavy lifting (plus some clever unicode slashes). It's an old school phishing trick, with the additional layer of looking like a genuine zip file. Not sure if this trick would be too effective in real life, Firefox and likely others will give you warnings when logging into a site like this, as this form of HTTP auth is way deprecate…

I haven’t seen this combination of Unicode forward slashes and http auth before. I would have fallen for it. Does anyone maintain a kind of “phishing URL menagerie” of interesting cases like this?

Re: Deceptive example for malicious usage of .zip domain

#22

Post by SAI_Peregrinus »

0x0000000 wrote: post #9
tedunangst wrote: post #8

How is this different from paypal.com@notpaypal.com?

What you have in your comment is an email address, where anti-phishing training has hopefully helped users to identify non-authentic or at least suspicious domains. We (should) know to look at the part after the "@" in an email. This trick is a URL, not an email address. It looks like a valid URL, because we are accustomed to checking the hostname for authenticity. But the URL in the post is crafted to look like the…

Doesn't every browser "grey out" everything other than the hostname & TLD these days?

Re: Deceptive example for malicious usage of .zip domain

#24

Post by Arnt »

GloomyBoots wrote: post #21
yathern wrote: post #5

Cool trick - they're using HTTP auth URLs[1] so that the @ sign is doing a lot of the heavy lifting (plus some clever unicode slashes). It's an old school phishing trick, with the additional layer of looking like a genuine zip file. Not sure if this trick would be too effective in real life, Firefox and likely others will give you warnings when logging into a site like this, as this form of HTTP auth is way deprecate…

I haven’t seen this combination of Unicode forward slashes and http auth before. I would have fallen for it. Does anyone maintain a kind of “phishing URL menagerie” of interesting cases like this?

Sort of. The browser vendors work hard to keep deceptive links and sites from fooling users.

In this case, the browsers I use don't fall for it. Hovering over the link shows the real domain. The browser I use on my work iphone also does something sensible, but I can't remember what. Obviously I can't hover on that device.

Re: Deceptive example for malicious usage of .zip domain

#26

Post by fragmede »

Arnt wrote: post #24
GloomyBoots wrote: post #21

Earlier quoted context omitted.

I haven’t seen this combination of Unicode forward slashes and http auth before. I would have fallen for it. Does anyone maintain a kind of “phishing URL menagerie” of interesting cases like this?

Sort of. The browser vendors work hard to keep deceptive links and sites from fooling users. In this case, the browsers I use don't fall for it. Hovering over the link shows the real domain. The browser I use on my work iphone also does something sensible, but I can't remember what. Obviously I can't hover on that device.

click and hold brings up a user-initiated popup that shows the full url, though it may not sufficiently deobfuscate it.

Re: Deceptive example for malicious usage of .zip domain

#27

Post by fragmede »

yathern wrote: post #5

Cool trick - they're using HTTP auth URLs[1] so that the @ sign is doing a lot of the heavy lifting (plus some clever unicode slashes). It's an old school phishing trick, with the additional layer of looking like a genuine zip file. Not sure if this trick would be too effective in real life, Firefox and likely others will give you warnings when logging into a site like this, as this form of HTTP auth is way deprecate…

Side note: someone's using http://yourmom.zip for hilariously nerdy purpose

Re: Deceptive example for malicious usage of .zip domain

#28

Post by mid-kid »

donmcronald wrote: post #14
watashiato wrote: post #3

Here's the original source by the author: https://scribe.rip/@bobbyrsec/the-dangers-of-googles-zip-tld... While I think that we really don't need a .zip domain, this trick falls apart when not shown as an image. Hovering over either URL should tip you off. Firefox shows the actual link in the bottom left.

> Hovering over either URL should tip you off. Firefox shows the actual link in the bottom left. Most people don't even know what a URL is, let alone how to discover this kind of deception by looking at the hover info.

at that point you can just use a regular hyperlink without showing the url on the page at all.

Re: Deceptive example for malicious usage of .zip domain

#29

Post by cxr »

From Google's domain delegation application (https://gtldresult.icann.org/applicationstatus/applicationde...>):

> 28. Abuse Prevention and Mitigation [...] all registered domain names will be subject to a Domain Name Anti-Abuse Policy (“Abuse Policy”). The Abuse Policy will provide CRR with broad power to suspend, cancel, or transfer domain names that violate the Abuse Policy. We plan to post the Abuse Policy on a publicly facing website at nic.zip⁄abuse

The policy document in question cannot, in fact, be found at that* address (because they're using a wildcard URL-rewriting redirect for nic.zip that ends up pointing to a bogus URL on registry.google).

* Actually, anyone familiar with IANA applications will be aware that the applications posted publicly end up, coincidentally enough, mangling all references to URLs because slashes get transformed into U+2044 FRACTION SLASH, so if you actually tried to dereference that, you'll end up on a path dealing in punycode TLDs—specifically "xn--zipabuse-g03d" in this case, which has not (yet) been delegated to anyone.

Re: Deceptive example for malicious usage of .zip domain

#30

Post by CydeWeys »

sebzim4500 wrote: post #10
lostmsu wrote: post #7

I am not sure what this does that cant be made with a href tag with text and a tooltip.

There are lots of contexts where you can't use an href tag. Twitter maybe?

This supposed attack doesn't work on Twitter either (or Gmail, or anywhere else I can think of). The full URL doesn't get linkified because of the very contrived use of Unicode slashes in the username portion of the URL.
Post reply on HN