Jump to content

.zip domains: Disaster or not?


sp123

Recommended Posts

Link to post
Share on other sites

From Malwarebytes - https://www.malwarebytes.com/blog/news/2023/05/zip-domains

I think it is a BAD idea to create a TLD based upon what is known to be a historically used File Extension.  I think it is just as a bad an idea as Microsoft's hubris in "Hide extensions for known file types"  as we know this resulted in double extension exploitation.

I truly believe a TLD based upon what is known to be a historically used File Extension will be exploited and is avoidable.  What's next - an expletive TLD ?

 

 

 

{ I wanted to see WHO replied first  winky1.gif.df971474a27b57af8bb03bb6f695f4b0.gif}

  • Like 1
  • Haha 1
Link to post
Share on other sites

Here 'ya go.  Already exploited.

Clever ‘File Archiver In The Browser’ phishing trick uses ZIP domains

Quote

A new 'File Archivers in the Browser' phishing kit abuses ZIP domains by displaying fake WinRAR or Windows File Explorer windows in the browser to convince users to launch malicious files.

Earlier this month, Google began offering the ability to register ZIP TLD domains, such as bleepingcomputer.zip, for hosting websites or email addresses.

Since the TLD's release, there has been quite a bit of debate over whether they are a mistake and could pose a cybersecurity risk to users.

While some experts believe the fears are overblown, the main concern is that some sites will automatically turn a string that ends with '.zip,' like setup.zip, into a clickable link that could be used for malware delivery or phishing attacks.

For example, if you send someone instructions on downloading a file called setup.zip, Twitter will automatically turn setup.zip into a link, making people think they should click on it to download the file.

Twitter DM automatically turns setup.zip into a linkTwitter DM automatically turns setup.zip into a link
Source: BleepingComputer

When you click on that link, your browser will attempt to open the https://setup.zip site, which could redirect you to another site, show an HTML page,  or prompt you to download a file.

However, like all malware delivery or phishing campaigns, you must first convince a user to open a file, which can be challenging.

A file archiver in the browser

Security researcher mr.d0x has developed a clever phishing toolkit that lets you create fake in-browser WinRar instances and File Explorer Windows that are displayed on ZIP domains to trick users into thinking they are opened .zip file.

"With this phishing attack, you simulate a file archiver software (e.g. WinRAR) in the browser and use a .zip domain to make it appear more legitimate," explains a new blog post by the researcher.

In a demonstration shared with BleepingComputer, the toolkit can be used to embed a fake WinRar window directly in the browser when a .zip domain is opened, making it look like the user opened a ZIP archive and is now seeing the files within it.

While it looks nice when displayed in the browser, it shines as a popup window, as you can remove the address bar and scrollbar, leaving what appears to be a WinRar window displayed on the screen, as shown below.

Fake in-browser WinRar screen pretending to open a ZIP archiveFake in-browser WinRar screen pretending to open a ZIP archive
Source: BleepingComputer

To make the fake WinRar window even more convincing, the researchers implemented a fake security Scan button that, when clicked, says that the files were scanned and no threats were detected.

Fake file scannerFake file scanner
Source: BleepingComputer

While the toolkit still displays the browser address bar, it is still likely to trick some users into thinking this is a legitimate WinRar archive. Furthermore, creative CSS and HTML could likely be used to refine the toolkit further.

mr.d0x also created another variant that displays a fake in-browser Windows File Explorer pretending to open a ZIP file. This template is more of a work-in-progress, so has some items missing.

file-explorer-in-the-browser.jpgFake Windows File Explorer shown in the browser
Source: BleepingComputer

Abusing the phishing toolkit

mr.d0x explains that this phishing toolkit can be used for both credential theft and malware delivery.

For example, if a user double-clicks on a PDF in the fake WinRar window, it could redirect the visitor to another page asking for their login credentials to properly view the file.

The toolkit can also be used to deliver malware by displaying a PDF file that downloads a similarly named .exe instead when clicked. For example, the fake archive window could show a document.pdf file, but when clicked, the browser downloads document.pdf.exe.

As Windows does not show file extensions by default, the user will just see a PDF file in their downloads folder and potentially double-click on it, not realizing it's an executable.

Of particular interest is how Windows searches for files and, when not found, attempts to open the searched-for string in a browser. If that string is a legitimate domain, then the website will be opened; otherwise, it will show search results from Bing.

If someone registers a zip domain that is the same as a common file name and someone performs a search in Windows, the operating system will automatically open the site in the browser.

If that site hosted the 'File Archivers in the Browser' phishing kit, it could trick a user into thinking WinRar displayed an actual ZIP archive.

This technique illustrates how ZIP domains can be abused to to create clever phishing attacks and malware delivery or credential theft.

mr.d0x is known for previous clever phishing toolkits, such as using VNC for phishing to bypass MFA and the Browser-in-the-Browser technique. Threat actors used the latter to steal Steam credentials.

 

  • Like 2
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.