Hacker News Reader

Comment by evan_ | Hacker News Reader

What's the specific attack vector you're thinking of for something like wellsfargo.zip?

WELLSFARGO ALERT: Suspicious activity detected in your account! Please see the attachment for more information [https://wellsfargo.zip]

So this is bad because .zip sounds vaguely like something related to attachments?

I dunno that doesn't sound much worse than wellsfargo.info to me.

Because technologically illiterate users will think it's a filename

I'm having a hard time imagining users who would be fooled by https://wellsfargo.zip but not fooled by https://wellsfargo.inc

Isn't that true of every generic-looking TLD?

With Chrome hiding the 'https://' a bankinfo.zip URL ends up looking a lot like a file or a attachment. So it could be used to trick people into assuming the file comes from a trusted domain instead of a third party one, as the user just see a filename without a domain part, not realizing what looks like a filename is the domain and they are no longer on their previous trusted site.

This is especially problematic as the 'https://' hiding also happens in the URL preview when you hover over a link (Edit: seems to happen only for longer URLs).

I'm guessing your hitrate is just as high if the URL is http://youareabouttogethacked.geocitiesorsomething.com/?shad....

As many other people have said, does anyone confuse C:\command.com and http://command.com? I doubt it.

How is this any different than 'There's an urgent update to your tax information. Download your documents from here: <a href="https://welsfargo.tax">https://wellsfargo.zip</a>'

Looks like it will take you to a zip file, but won't. hovering over the link looks legit enough. I just don't think it buys you that much. /shrug

> hovering over the link looks legit enough

You get a pretty different result if it's just "http" and not "https" though: The zip domain looks like just the file name instead of a URL.

There's probably better ones, literally the first one I tried, but I'm imaging someone messaging me that telling me to download a recovery package for my Wells Fargo account and that it should open in the browser. Then have UI mimicking some kind of OS prompt and asking for your social security as a password to confirm identity, or something.

Is that substantially different from simply messaging someone and saying "download this file:" and linking to a malicious site with a .net TLD? Is the thought that the .zip tld conveys some kind of trustworthiness that a different TLD would not?

Really trying to understand this, I hope I don't come across as snarky or naïve.

Appreciate the clarification, no snark detected. And yeah, that is what I'm thinking people would or could expect. Obviously they're quite different but if someone is multitasking, not thinking clearly, or just not great with computers it seems like something that could (and probably will) happen.

I imagine the "conversion rate" of a .net TLD will be much lower for spammers than that of a .zip

The problem is that we assume that it will forever be impossible for a browser to mimic the look and feel of opening a zip file attachment. I'm unsure if it's possible today but most definitely I don't think it's wise to assume it will never be possible in the future.

We are slowly chipping away at defense in depth all in the name of convenience.

Some of these are more tortured, but I can personally imagine a scenario in which a less-technical friend or family member is told to open a ZIP archive locally by some (trusted!) website and types that into the omnibar instead, bringing them to a random website.

Maybe have them click a .zip link that takes them to a web page which asks for an account password to open the "archive"?

I could see that getting under a few people's radars, but it's not much more menacing than existing fishing tricks with lookalike urls.

Reply on news.ycombinator.com