Top-level domain expansion is a security risk for business computers

Automatic proxy configuration requests frequently leak on the public Internet from corporate computers

The explosion of new generic top-level domains (gTLDs) in recent years can put enterprise computers at risk due to name conflicts between internal domain names used inside corporate networks and those that can now be registered on the public Internet.

Many companies have configured their networks to use domain names, in many cases with made-up TLDs that a few years ago didn't use to exist on the Internet, such as .office, .global, .network, .group, .school and many others. Having an internal domain-based namespace makes it easier to locate, manage and access systems.

The problem is that over the past two years, the Internet Corporation for Assigned Names and Numbers (ICANN) has approved over 900 gTLDs for public use as part of an expansion effort. This can have unexpected security implications for applications and protocols used on domain-based corporate networks.

Such is the case for the Web Proxy Auto-Discovery (WPAD) protocol, which is used by computers on local networks to automatically discover the Web proxy settings they should use.

WPAD is enabled in Internet Explorer and Windows, the most common OS-browser combination on corporate networks. It is also supported in Mozilla Firefox, Google Chrome and Apple Safari, including on Linux and OS X, but is not used by default.

Computers can use the WPAD protocol and a local DNS server to find the location of a wpad.dat proxy configuration file that they should download and use. In the case of a domain-based network, this file can be located on a Web server that is reachable via the host name wpad.internal_domain.tld.

The problem is that when a computer, such as a laptop, is taken outside of a company's network and is connected to a different network, the WPAD DNS query can reach a public DNS server, since the company's internal DNS server is not available.

Because of the gTLD expansion, attackers can register domain names used by companies internally and then host rogue proxy configuration files that will then be downloaded by roaming laptops. This means that those computers' Web traffic will be passed through a proxy server controlled by attackers, allowing for unauthorized traffic inspection or modification. This is known as a man-in-the-middle attack.

To understand the scope of the problem, researchers from Verisign and the University of Michigan have analyzed the WPAD queries that reached 2 of the 13 global root DNS servers from September 2013 to July 2015. Verisign operates those two servers.

The data showed that there are over 20 million leaked WPAD queries hitting the servers every day, accounting for at least 6.6 million potential user victims. The researchers found leaked WPAD queries for 485 of the 738 new gTLDs that have been delegated by ICANN until Aug. 25, 2015, when the data was analyzed.

The problem is likely even more widespread than that, because ICANN has delegated an additional 201 new gTLDs since August and because the analyzed data was only from two of the 13 global root DNS servers.

The gTLDs for which the largest number of leaked WPAD queries were observed are: .global, .ads, .group, .network, .dev, .office, .prod, .hsbc, .win, .world, .wan, .sap and .site. Over 65 percent of the WPAD query leaks originated from computers in the U.S.

The issue has prompted the United States Computer Emergency Readiness Team (US-CERT) to publish a security alert Monday. The team has several recommendations for network administrators including disabling the automatic proxy discovery in browsers and operating systems during device setup if the feature is not needed and a using a fully qualified domain name from the global DNS that the company has registered and owns as the root for enterprise and other internal namespace.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?