Latest news of the domain name industry

Recent Posts

Verisign says new gTLDs put millions at risk

Kevin Murphy, May 26, 2016, 13:04:31 (UTC), Domain Tech

Verisign has revived its old name collisions security scare story, publishing this week a weighty research paper claiming millions are at risk of man-in-the-middle attacks.

It’s actually a study into how a well-known type of attack, first documented in the 1990s, might become easier due to the expansion of the DNS at the top level.

According to the paper there might be as many as 238,000 instances per day of query traffic intended for private networks leaking to the public DNS, where attackers could potentially exploit it to all manner of genuinely nasty things.

But Verisign has seen no evidence of the vulnerability being used by bad guys yet and it might not be as scary as it first appears.

You can read the paper here (pdf), but I’ll attempt to summarize.

The problem concerns a virtually ubiquitous protocol called WPAD, for Web Proxy Auto-Discovery.

It’s used by mostly by Windows clients to automatically download a web proxy configuration file that tells their browser how to connect to the web.

Organizations host these files on their local networks. The WPAD protocol tries to find the file using DHCP first, but fails over to DNS.

So, your browser might look for a wpad.dat file on wpad.example.com, depending on what domain your computer belongs to, using DNS.

The vulnerability arises because companies often use previously undelegated TLDs — such as .prod or .global — on their internal networks. Their PCs could belong to domains ending in .corp, even though .corp isn’t real TLD in the DNS root.

When these devices are roaming outside of their local network, they will still attempt to use the DNS to find their WPAD file. And if the TLD their company uses internally has actually been delegated by ICANN, their WPAD requests “leak” to registry or registrant.

A malicious attacker could register a domain name in a TLD that matches the domain the target company uses internally, allowing him to intercept and respond to the WPAD request and setting himself up as the roaming laptop’s web proxy.

That would basically allow the attacker to do pretty much whatever he wanted to the victim’s browsing experience.

Verisign says it saw 20 million WPAD leaks hit its two root servers every single day when it collected its data, and estimates that 6.6 million users are affected.

The paper says that of the 738 new gTLDs it looked at, 65.7% of them saw some degree of WPAD query leakage.

The ones with the most leaks, in order, were .global, .ads, .group, .network, .dev, .office, .prod, .hsbc, .win, .world, .one, .sap and .site.

It’s potentially quite scary, but there are some mitigating factors.

First, the problem is not limited to new gTLDs.

Yesterday I talked to Matt Larson, ICANN’s new vice president of research (who held the same post at Verisign’s until a few years ago).

He said ICANN has seen the same problem with .int, which was delegated in 1988. ICANN runs one of .int’s authoritative name servers.

“We did a really quick look at 24 hours of traffic and saw a million and a half queries for domain names of the form wpad.something.int, and that’s just one name server out of several in a 24-hour period,” he said.

“This is not a new problem, and it’s not a problem that’s specific to new gTLDs,” he said.

According to Verisign’s paper, only 2.3% of the WPAD query leaks hitting its root servers were related to new gTLDs. That’s about 238,000 queries every day.

With such a small percentage, you might wonder why new gTLDs are being highlighted as a problem.

I think it’s because organizations typically won’t own the new gTLD domain name that matches their internal domain, something that would eliminate the risk of an attacker exploiting a leak.

Verisign’s report also has limited visibility into the actual degree of risk organizations are experiencing today.

Its research methodology by necessity was limited to observing leaked WPAD queries hitting its two root servers before the new gTLDs in question were delegated.

The company only collected relevant NXDOMAIN traffic to its two root servers — DNS queries with answers typically get resolved closer to the user in the DNS hierarchy — so it has no visibility to whether the same level of leaks happen post-delegation.

Well aware of the name collisions problem, largely due to Verisign’s 11th-hour epiphany on the subject, ICANN forces all new gTLD registries to wildcard their zones for 90 days after they go live.

All collision names are pointed to 127.0.53.53, a reserved IP address picked in order to catch the attention of network administrators (DNS uses TCP/IP port 53).

Potentially, at-risk organizations could have fixed their collision problems shortly after the colliding gTLD was delegated, reducing the global impact of the vulnerability.

There’s no good data showing how many networks were reconfigured due to name collisions in the new gTLD program, but some anecdotal evidence of admins telling Google to go fuck itself when .prod got delegated.

A December 2015 report from JAS Advisors, which came up with the 127.0.53.53 idea, said the effects of name collisions have been rather limited.

ICANN’s Larson echoed the advice put out by security watchdog US-CERT this week, which among other things urges admins to use proper domain names that they actually control on their internal networks.

Tagged: , , , , ,

Comments (15)

  1. So, this never happens with drop caught domains under large existing TLDs, say those with 120M or more names in them where it would be more likely?

    Seems like the F.U.D. axe has sharp edges on both sides.

  2. Ed Pascoe says:

    To say this is not a new problem is putting it mildly. I registered wpad.co.za back in 2001 when I first saw the autoconfig setting in Internet Explorer. Back then the documentation on Mozilla’s website explicitly stated that searches for wpad were limited to the 3rd level and greater (so wpad.co.za but not wpad.gtld) that must have been forgotten about at some stage, and I know the owner of wpad.com said he was seeing lots requests for the proxy script many years ago.

    ICANN probably should have wpad on its list of reserved names for the gTLDs but I would imagine that if it was ever abused any responsible registry would permanently suspend the domain anyway.

  3. 1 – Kevin, I believe you do your readers a great disservice by downplaying the very serious risks to users. Before I get into the details you should look at this link, where Russian hackers have been specifically exploiting WPAD attacks in new gTLDs (and ccTLDs) and name collisions to compromise users. Here is a public reference that has surfaced (yet is a year old, and until now only in Russian) as a direct result of the US-CERT Technical Alert and IEEE S&P paper: https://translate.google.com/translate?sl=ru&tl=en&js=y&prev=_t&hl=ru&ie=UTF-8&u=https%3A%2F%2Fhabrahabr.ru%2Fcompany%2Fmailru%2Fblog%2F259521%2F&edit-text=

    2 – Not only does CI not solve this problem, it in fact blocked visibility into the impact of WPAD name collisions. By trapping and containing name collisions CI prevented anyone from knowing what would happen with WPAD name collisions. Furthermore, CI doesn’t notify users vulnerable to this attack vector (and the same issue exists for other DNS “service discovery” protocols as well, to include ISATAP and DNS-SD). Verisign and SSAC told JAS and ICANN about this yet no action was taken as a result. Regrettably, and again despite SSAC advice to ICANN and JAS, there were ZERO reporting obligations on CI effects by new gTLD registries.

    3 – Today there are 50x the number of gTLDs in the root than there were when we first highlighted these issues. Vulnerable WPAD domains in new gTLDs are being registered, as you can see from the Russian blog above and as the IEEE S&P paper illustrates. That’s what’s changed since we initially warned of this 3+ years ago. This should create some urgency for relying parties to be notified of their vulnerability.

    4 – In your story you say “but Verisign has seen no evidence of the vulnerability being used by bad guys yet and it may not be as scary as it first appears”. In this field, given the presence of the exploit blueprint and kit, that best practice is to assume that anyone leaking WPAD queries would have been compromised. Therefore, since the discovery of the Russian website, this is in fact “far scarier” than it first appears. You also say in your story that the exploit “… would basically allow the attacker to do pretty much whatever he wanted to the victim’s browsing experience.” It’s important to understand what this means: “pretty much whatever” includes theft of credentials, malware injection, surreptitious penetration and advanced persistent presence, malvertising, techniques to MiTM secure SSL/TLS transactions, and any broader array of bad scenarios you could imagine. Even more so because of this statement as provided in our white paper “As previously mentioned, what makes this vector so dangerous is that attackers need not be on path, or waiting to spoof responses to DNS queries at just the right time. Attackers can remain off-path and always on, and just wait for willing victims to query them. This effectively enables a large-scale high success probability Watering Hole attack, where an attacker knows with high confidence that victims will visit persistently and be vulnerable and easily exploited.” This fact alone dramatically increases the risk.

    5 – Name collisions can occur in any TLD and of course we understand this, triggered by a number of factors to include search list processing, as Google, Verisign, SSAC and others have pointed out. There are an array of reasons why the problem space is very different, to include the newness of new gTLDs and leaked internal namespaces combining with the ease of registering these strings in new gTLDs (as the Russian blog illustrates). Some additional information on the distinction is available here ( Difference Between Apples and Oranges (Regarding name collisions in new gTLDs versus in .com and other existent top level domains). Understanding what this link conveys, I find it confusing when you say “it’s potentially quite scary but there are some mitigating factors. First, the problem is not limited to new gTLDs”. As you can see from this link, the problems are quite different and the risk is considerably greater in new gTLDs.

    6 – You may or may not be aware, .INT is a special use restricted TLD and even then, allowing those networks to remain badly configured without notifying those relying parties that they need to fix their configurations isn’t responsible. This is the crux of what we’ve outlined with US-CERT in the Technical Alert, and in our white paper on the topic here: http://www.verisign.com/assets/Enterprise_Remediation_for_WPAD_Name_Collision_Vulnerability.pdf

    7 – Proponents of new gTLDs have understandably reacted defensively with regards to security concerns in new gTLDs since 2013. Verisign continues to believe it’s important to notify potentially impacted relying parties and communicating the urgency of fixing network and system configurations. While rather complex, the simple facts of our work point out that the registration of SLDs in new gTLDs provide empirical evidence that this is no longer a theoretical attack, an that controlled interruption likely contributed to a false sense of security.

    • Kevin Murphy says:

      Thanks for the link to the Russian site. I was not aware of it. I would agree that exploit code in the wild, if that’s what this is, certainly does up the risk factor.

    • Kevin Murphy says:

      I think this is probably the document you wanted to link to in bullet 5 https://forum.icann.org/lists/comments-name-collision-05aug13/pdfgGgQZ2Oxuv.pdf

    • The link for “On the Differences Between Apples and Oranges (Regarding name collisions in new gTLDs versus in .com and other existent top level domains)” is https://forum.icann.org/lists/comments-name-collision-05aug13/pdfgGgQZ2Oxuv.pdf

    • Rubens Kuhl says:

      On point 1, reservation of WPAD.TLD was one of the NTAG suggestions to mitigate name collisions, and that still holds as a best practice (except for Brand TLDs which might take advantage of it). I will save Eric from repeating yet again that WPAD..TLD could also cause issues, but such a real in the wild example has not yet been seen.

      • Rubens Kuhl says:

        That was supposed to be WPAD.Leaked SLD.TLD

      • Just to clarify, point 1 _also_ has a link showing a year-old weaponization technique from Russia that uses `WPAD’.registered-SLD.TLD (i.e. in the wild).

        • Rubens Kuhl says:

          One domain they mentioned, office.work, is registered to the registry, so it’s unlikely that the registry is doing WPAD exploits… it sounded more like a proof of concept than a real in the wild example, and it was contained in the local exploitation part of the article.

          OTOH, wpad.work is said in the article to have been registered (different from office.work) and it’s currently registered to a privacy proxy provider, which is consistent with other abusive behaviour.

          So, your point is not taken.

    • The whole new GTLD movement PUSH by regs. is fraught with we could care less about the legal pitfalls that come with new GTLDs Attitude. A well known new GTLD proponent that says things like there are more Chinese Millionaires than there are people in the United states, gives you a clue about how much Due Dilligence these new GTLD Regs Pushers are doing or mostly not doing.
      Also any Marketing Strategist who knows their profession, knows that .COM Subdomains are a clear better and safer bet for real professionals. On top of all this damning true information, we sadly report that 90% plus of all New GTLDs will never be sold on the active secondary market.
      Who needs New GTLDs? We can assure you professional Marketing Strategists know the real answer not New gTLD carpetbaggers.
      Gratefully, Jeff Schneider (Contact Group) (Metal Tiger) Former (Marketing Analyst/Strategist Rockefeller I.B.E.C.) (Licensed C.B.O.E. Commodity Hedge Strategist) (Domain Master)

  4. Avri Doria says:

    One thing I get from all of this is that if it is so dangerous for businesses to use names they are not entitled to use because they have not been delegated for their use, they should be educated in the risks and the ways and reasons to stop doing so. Where is the campaign to educate people in the danger to businesses of using domain names improperly?

      • Ed Pascoe says:

        Only Internet Explorer has proxy auto detection(WPAD) turned on by default and many of the badly named networks are a direct result of bad advice in Microsoft documentation.

        I wonder when this is going to turn into a lawsuit? The publicity from that would have far more impact than any outreach program from ICANN.

    • Yes Avri, you would think that there should be some consumer warnings labels on these New GTLD Spam Spawns. Sadly this whole new GTLD experiment will strip millions of investors of their hard earned money. Our experience in the Financial services Industry warn us of the coming carnage of the spec bubble in new GTLDs.
      Our advice buy good .COM subdomains in place of new GTLDs you will have a good future value .COM asset,without the coming financial fallout headed towards the bloated Spec. Bubble new GTLD Industry.Buyer Beware!
      Gratefully, Jeff Schneider (Contact Group) (Metal Tiger) Former (Marketing Analyst/Strategist Rockefeller I.B.E.C.) (Licensed C.B.O.E. Commodity Hedge Strategist)(Domain Master)

Add Your Comment