Menu
Top-level domain expansion is a security risk for business computers

Top-level domain expansion is a security risk for business computers

Automatic proxy configuration requests frequently leak on the public Internet from corporate computers

The explosion of new generic top-level domains (gTLDs) in recent years can put enterprise computers at risk due to name conflicts between internal domain names used inside corporate networks and those that can now be registered on the public Internet.

Many companies have configured their networks to use domain names, in many cases with made-up TLDs that a few years ago didn't use to exist on the Internet, such as .office, .global, .network, .group, .school and many others. Having an internal domain-based namespace makes it easier to locate, manage and access systems.

The problem is that over the past two years, the Internet Corporation for Assigned Names and Numbers (ICANN) has approved over 900 gTLDs for public use as part of an expansion effort. This can have unexpected security implications for applications and protocols used on domain-based corporate networks.

Such is the case for the Web Proxy Auto-Discovery (WPAD) protocol, which is used by computers on local networks to automatically discover the Web proxy settings they should use.

WPAD is enabled in Internet Explorer and Windows, the most common OS-browser combination on corporate networks. It is also supported in Mozilla Firefox, Google Chrome and Apple Safari, including on Linux and OS X, but is not used by default.

Computers can use the WPAD protocol and a local DNS server to find the location of a wpad.dat proxy configuration file that they should download and use. In the case of a domain-based network, this file can be located on a Web server that is reachable via the host name wpad.internal_domain.tld.

The problem is that when a computer, such as a laptop, is taken outside of a company's network and is connected to a different network, the WPAD DNS query can reach a public DNS server, since the company's internal DNS server is not available.

Because of the gTLD expansion, attackers can register domain names used by companies internally and then host rogue proxy configuration files that will then be downloaded by roaming laptops. This means that those computers' Web traffic will be passed through a proxy server controlled by attackers, allowing for unauthorized traffic inspection or modification. This is known as a man-in-the-middle attack.

To understand the scope of the problem, researchers from Verisign and the University of Michigan have analyzed the WPAD queries that reached 2 of the 13 global root DNS servers from September 2013 to July 2015. Verisign operates those two servers.

The data showed that there are over 20 million leaked WPAD queries hitting the servers every day, accounting for at least 6.6 million potential user victims. The researchers found leaked WPAD queries for 485 of the 738 new gTLDs that have been delegated by ICANN until Aug. 25, 2015, when the data was analyzed.

The problem is likely even more widespread than that, because ICANN has delegated an additional 201 new gTLDs since August and because the analyzed data was only from two of the 13 global root DNS servers.

The gTLDs for which the largest number of leaked WPAD queries were observed are: .global, .ads, .group, .network, .dev, .office, .prod, .hsbc, .win, .world, .wan, .sap and .site. Over 65 percent of the WPAD query leaks originated from computers in the U.S.

The issue has prompted the United States Computer Emergency Readiness Team (US-CERT) to publish a security alert Monday. The team has several recommendations for network administrators including disabling the automatic proxy discovery in browsers and operating systems during device setup if the feature is not needed and a using a fully qualified domain name from the global DNS that the company has registered and owns as the root for enterprise and other internal namespace.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments