Facepalm: In Google's own words, new generic top-level domains (gTLDs) can help self-expression, creativity and business. The previously approved list of "hundreds" of gTLDs entries now provides some troublesome additions such as "zip" and "mov," which can (and will) be abused to target users with sophisticated phishing attacks.
Google Registry has recently introduced 8 new top-level domains for "dads, grads, and techies," adding .dad, .phd, .prof, .esq, .foo, .nexus, .zip, and .mov to its growing list of some of the "most popular" gTLDs which also include .app and .dev. The .zip and .mov domains, however, have sparked a debate among experts about their potential consequences on internet and web overall security.
The zip and mov gTLDs were available in IANA's DNS records since 2014, but they have now become generally available thanks to Google's involvement. Now, anyone can purchase a ".zip" or ".mov" domain like "techspot.zip," even though the two suffixes have long been used to identify compressed file archives in Zip format and video clip files.
The overlap between two, extremely popular file formats – the Zip standard was created by Pkware in 1989, 34 years ago – and the recently registered web domains will bring new security threats to the internet ecosystem, some researchers said. Users could be deceived by malicious URLs shared on social networks or by mail, giving cyber-criminals new, "creative" tools to push malware installations, phishing campaigns or other nefarious activities.
As zip and mov are now two generally approved TLDs, internet services and mobile apps will be essentially forced to treat text snippets such as "test.zip" or "test.mov" like proper URLs to open in a web browser. Cyber-criminals have already started to exploit the new gTLDs, with a now-defunct phishing page at "microsoft-office.zip" designed to try and steal Microsoft Account credentials.
New exploit tactics conceived by security researchers include the ability to use Unicode characters and the "@" symbol for user identification as a creative way to share malicious URLs that looks like legitimate internet addresses. The "creative" internet conceived by Google as a new form of expression and business is more insecure than ever, it seems.
The debate among security experts is still ongoing, though, as some developers don't share the same "doom and gloom" sentiment about the new gTLDs. Microsoft Edge programmer Eric Lawrence said on Twitter that the level of fear-mongering about .zip and .mov domains is "just comical." Google highlighted how the risk of confusion between domains and file names is not a new one, and that Google Registry provides the tools needed to suspend or remove malicious domains across all of the TLDs the company controls.