Menu
Top-level domain expansion is a security risk for business computers

Top-level domain expansion is a security risk for business computers

Automatic proxy configuration requests frequently leak on the public Internet from corporate computers

The explosion of new generic top-level domains (gTLDs) in recent years can put enterprise computers at risk due to name conflicts between internal domain names used inside corporate networks and those that can now be registered on the public Internet.

Many companies have configured their networks to use domain names, in many cases with made-up TLDs that a few years ago didn't use to exist on the Internet, such as .office, .global, .network, .group, .school and many others. Having an internal domain-based namespace makes it easier to locate, manage and access systems.

The problem is that over the past two years, the Internet Corporation for Assigned Names and Numbers (ICANN) has approved over 900 gTLDs for public use as part of an expansion effort. This can have unexpected security implications for applications and protocols used on domain-based corporate networks.

Such is the case for the Web Proxy Auto-Discovery (WPAD) protocol, which is used by computers on local networks to automatically discover the Web proxy settings they should use.

WPAD is enabled in Internet Explorer and Windows, the most common OS-browser combination on corporate networks. It is also supported in Mozilla Firefox, Google Chrome and Apple Safari, including on Linux and OS X, but is not used by default.

Computers can use the WPAD protocol and a local DNS server to find the location of a wpad.dat proxy configuration file that they should download and use. In the case of a domain-based network, this file can be located on a Web server that is reachable via the host name wpad.internal_domain.tld.

The problem is that when a computer, such as a laptop, is taken outside of a company's network and is connected to a different network, the WPAD DNS query can reach a public DNS server, since the company's internal DNS server is not available.

Because of the gTLD expansion, attackers can register domain names used by companies internally and then host rogue proxy configuration files that will then be downloaded by roaming laptops. This means that those computers' Web traffic will be passed through a proxy server controlled by attackers, allowing for unauthorized traffic inspection or modification. This is known as a man-in-the-middle attack.

To understand the scope of the problem, researchers from Verisign and the University of Michigan have analyzed the WPAD queries that reached 2 of the 13 global root DNS servers from September 2013 to July 2015. Verisign operates those two servers.

The data showed that there are over 20 million leaked WPAD queries hitting the servers every day, accounting for at least 6.6 million potential user victims. The researchers found leaked WPAD queries for 485 of the 738 new gTLDs that have been delegated by ICANN until Aug. 25, 2015, when the data was analyzed.

The problem is likely even more widespread than that, because ICANN has delegated an additional 201 new gTLDs since August and because the analyzed data was only from two of the 13 global root DNS servers.

The gTLDs for which the largest number of leaked WPAD queries were observed are: .global, .ads, .group, .network, .dev, .office, .prod, .hsbc, .win, .world, .wan, .sap and .site. Over 65 percent of the WPAD query leaks originated from computers in the U.S.

The issue has prompted the United States Computer Emergency Readiness Team (US-CERT) to publish a security alert Monday. The team has several recommendations for network administrators including disabling the automatic proxy discovery in browsers and operating systems during device setup if the feature is not needed and a using a fully qualified domain name from the global DNS that the company has registered and owns as the root for enterprise and other internal namespace.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

The making of an MSSP: a blueprint for growth in NZ

The making of an MSSP: a blueprint for growth in NZ

Partners are actively building out security practices and services to match, yet remain challenged by a lack of guidance in the market. This exclusive Reseller News Roundtable - in association with Sophos - assessed the making of an MSSP, outlining the blueprint for growth and how partners can differentiate in New Zealand.

The making of an MSSP: a blueprint for growth in NZ
Reseller News Platinum Club celebrates leading partners in 2018

Reseller News Platinum Club celebrates leading partners in 2018

The leading players of the New Zealand channel came together to celebrate a year of achievement at the inaugural Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months, with more than ​​50 organisations in the spotlight.​​​

Reseller News Platinum Club celebrates leading partners in 2018
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP has honoured its leading partners in New Zealand during 2018, following 12 months of growth through the local channel. Unveiled during the fourth running of the ceremony in Auckland, the awards recognise and celebrate excellence, growth, consistency and engagement of standout Kiwi partners.

Meet the top performing HP partners in NZ
Show Comments