Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Top-level domain expansion is a security risk for business computers

Lucian Constantin | May 26, 2016
Automatic proxy configuration requests frequently leak on the public Internet from corporate computers.

The explosion of new generic top-level domains (gTLDs) in recent years can put enterprise computers at risk due to name conflicts between internal domain names used inside corporate networks and those that can now be registered on the public Internet.

Many companies have configured their networks to use domain names, in many cases with made-up TLDs that a few years ago didn't use to exist on the Internet, such as .office, .global, .network, .group, .school and many others. Having an internal domain-based namespace makes it easier to locate, manage and access systems.

The problem is that over the past two years, the Internet Corporation for Assigned Names and Numbers (ICANN) has approved over 900 gTLDs for public use as part of an expansion effort. This can have unexpected security implications for applications and protocols used on domain-based corporate networks.

Such is the case for the Web Proxy Auto-Discovery (WPAD) protocol, which is used by computers on local networks to automatically discover the Web proxy settings they should use.

WPAD is enabled in Internet Explorer and Windows, the most common OS-browser combination on corporate networks. It is also supported in Mozilla Firefox, Google Chrome and Apple Safari, including on Linux and OS X, but is not used by default.

Computers can use the WPAD protocol and a local DNS server to find the location of a wpad.dat proxy configuration file that they should download and use. In the case of a domain-based network, this file can be located on a Web server that is reachable via the host name wpad.internal_domain.tld.

The problem is that when a computer, such as a laptop, is taken outside of a company's network and is connected to a different network, the WPAD DNS query can reach a public DNS server, since the company's internal DNS server is not available.

Because of the gTLD expansion, attackers can register domain names used by companies internally and then host rogue proxy configuration files that will then be downloaded by roaming laptops. This means that those computers' Web traffic will be passed through a proxy server controlled by attackers, allowing for unauthorized traffic inspection or modification. This is known as a man-in-the-middle attack.

To understand the scope of the problem, researchers from Verisign and the University of Michigan have analyzed the WPAD queries that reached 2 of the 13 global root DNS servers from September 2013 to July 2015. Verisign operates those two servers.

The data showed that there are over 20 million leaked WPAD queries hitting the servers every day, accounting for at least 6.6 million potential user victims. The researchers found leaked WPAD queries for 485 of the 738 new gTLDs that have been delegated by ICANN until Aug. 25, 2015, when the data was analyzed.

 

1  2  Next Page 

Sign up for CIO Asia eNewsletters.