Menu
Top-level domain expansion is a security risk for business computers

Top-level domain expansion is a security risk for business computers

Automatic proxy configuration requests frequently leak on the public Internet from corporate computers

The explosion of new generic top-level domains (gTLDs) in recent years can put enterprise computers at risk due to name conflicts between internal domain names used inside corporate networks and those that can now be registered on the public Internet.

Many companies have configured their networks to use domain names, in many cases with made-up TLDs that a few years ago didn't use to exist on the Internet, such as .office, .global, .network, .group, .school and many others. Having an internal domain-based namespace makes it easier to locate, manage and access systems.

The problem is that over the past two years, the Internet Corporation for Assigned Names and Numbers (ICANN) has approved over 900 gTLDs for public use as part of an expansion effort. This can have unexpected security implications for applications and protocols used on domain-based corporate networks.

Such is the case for the Web Proxy Auto-Discovery (WPAD) protocol, which is used by computers on local networks to automatically discover the Web proxy settings they should use.

WPAD is enabled in Internet Explorer and Windows, the most common OS-browser combination on corporate networks. It is also supported in Mozilla Firefox, Google Chrome and Apple Safari, including on Linux and OS X, but is not used by default.

Computers can use the WPAD protocol and a local DNS server to find the location of a wpad.dat proxy configuration file that they should download and use. In the case of a domain-based network, this file can be located on a Web server that is reachable via the host name wpad.internal_domain.tld.

The problem is that when a computer, such as a laptop, is taken outside of a company's network and is connected to a different network, the WPAD DNS query can reach a public DNS server, since the company's internal DNS server is not available.

Because of the gTLD expansion, attackers can register domain names used by companies internally and then host rogue proxy configuration files that will then be downloaded by roaming laptops. This means that those computers' Web traffic will be passed through a proxy server controlled by attackers, allowing for unauthorized traffic inspection or modification. This is known as a man-in-the-middle attack.

To understand the scope of the problem, researchers from Verisign and the University of Michigan have analyzed the WPAD queries that reached 2 of the 13 global root DNS servers from September 2013 to July 2015. Verisign operates those two servers.

The data showed that there are over 20 million leaked WPAD queries hitting the servers every day, accounting for at least 6.6 million potential user victims. The researchers found leaked WPAD queries for 485 of the 738 new gTLDs that have been delegated by ICANN until Aug. 25, 2015, when the data was analyzed.

The problem is likely even more widespread than that, because ICANN has delegated an additional 201 new gTLDs since August and because the analyzed data was only from two of the 13 global root DNS servers.

The gTLDs for which the largest number of leaked WPAD queries were observed are: .global, .ads, .group, .network, .dev, .office, .prod, .hsbc, .win, .world, .wan, .sap and .site. Over 65 percent of the WPAD query leaks originated from computers in the U.S.

The issue has prompted the United States Computer Emergency Readiness Team (US-CERT) to publish a security alert Monday. The team has several recommendations for network administrators including disabling the automatic proxy discovery in browsers and operating systems during device setup if the feature is not needed and a using a fully qualified domain name from the global DNS that the company has registered and owns as the root for enterprise and other internal namespace.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Educating from the epicentre - Why distributors are the pulse checkers of the channel

Educating from the epicentre - Why distributors are the pulse checkers of the channel

​As the channel changes and industry voices deepen, the need for clarity and insight heightens. Market misconceptions talk of an “under pressure” distribution space, with competitors in that fateful “race for relevance” across New Zealand. Amidst the cliched assumptions however, distribution is once again showing its strength, as a force to be listened to, rather than questioned. Traditionally, the role was born out of a need for vendors and resellers to find one another, acting as a bridge between the testing lab and the marketplace. Yet despite new technologies and business approaches shaking the channel to its very core, distributors remain tied to the epicentre - providing the voice of reason amidst a seismic industry shift. In looking across both sides of the vendor and partner fences, the middle concept of the three-tier chain remains centrally placed to understand the metrics of two differing worlds, as the continual pulse checkers of the local channel. This exclusive Reseller News Roundtable, in association with Dicker Data and rhipe, examined the pivotal role of distribution in understanding the health of the channel, educating from the epicentre as the market transforms at a rapid rate.

Educating from the epicentre - Why distributors are the pulse checkers of the channel
Kiwi channel reunites as After Hours kicks off 2017

Kiwi channel reunites as After Hours kicks off 2017

After Hours made a welcome return to the channel social calendar last night, with a bumper crowd of distributors, vendors and resellers descending on The Jefferson in Auckland to kickstart 2017. Photos by Maria Stefina.

Kiwi channel reunites as After Hours kicks off 2017
Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow Electronics introduced Tenable Network Security to local resellers in Sydney last week, officially launching the distributor's latest security partnership across Australia and New Zealand. Representing the first direct distribution agreement locally for Tenable specifically, the deal sees Arrow deliver security solutions directly to mid-market and enterprise channel partners on both sides of the Tasman.

Arrow exclusively introduces Tenable Network Security to A/NZ channel
Show Comments