Google has recently introduced a set of new top-level domains: .dad, .esq, .prof, .phd, .nexus, .foo, .zip and .mov. They’re now available for purchase, and it’s the last two that are attracting attention due to the risk of abuse in phishing attacks.
WIRED describes why .zip and .mov have raised concerns. “The two stand out because they are also common file extension names. The former, .zip, is ubiquitous for data compression, while .mov is a video format developed by Apple. The concern, which is already starting to play out, is that URLs that look like file names will open up even more possibilities for digital scams like phishing that trick web users into clicking on malicious links that are masquerading as something legitimate.”
There’s another potential problem, the obverse of the first. “And the two domains could also expand the problem of programs mistakenly recognizing file names as URLs and automatically adding links to the file names. With this in mind, scammers could strategically buy .zip and .mov URLs that are also common file names—think, springbreak23.mov—so online references to a file with that name could automatically link to a malicious website.”
Experts are divided as to whether the new domains represent a real increase in the risk of phishing. On the one hand, criminals have been observed purchasing and experimenting with domains that use the new extensions, so the risk isn’t a purely theoretical one. On the other hand, as experienced (and jaded) observers note, users tend to be so careless with respect to URLs, and so easily gulled by malicious domains, that any increase in phishing activity associated with the news domains is likely to be lost in the noise.
Whatever proves to be the case, this is the sort of risk that new school security awareness training can help your people learn to recognize and avoid.
WIRED has the story.
