An overview of threats exploring the confusion between top-level domains and file type extensions

Abstract

Cyberattacks exploit deceptions involving the Domain Name Service (DNS) to direct users to fake websites, such as typosquatting attacks, which exploit natural typographical errors, and homograph attacks, where different Unicode characters resemble the legitimate ones. The deception attacks may also exploit the confusion between DNS domain names, specifically Top-Level Domains (TLDs), and file extensions. Recently, two new TLDs were added, “zip” and “mov”, sharing names with certain file types. This overlapping can be explored by malicious actors in a range of threat scenarios to compromise user security. This paper provides an overview of threats originating from the confusion between specific TLDs and file extensions, such as the recent “zip” and “mov”. The threats are grouped into 6 threat scenarios that are described and discussed. This research can be part of a more comprehensive strategy that includes addressing the risks associated with these threats and designing future strategies to address the threats associated with exploiting this ambiguity.