US-CERT, Verisign: new gTLDs pose increasing Security risk for business computers

May 27, 2016

The expansion of new generic top-level domains (gTLDs) by ICANN in recent years can put enterprise computers at risk due to name conflicts between internal domain names used inside corporate networks and those that can now be registered on the public Internet.

To explore the scope of the problem, researchers from Verisign and the University of Michigan have analyzed the WPAD queries that reached 2 of the 13 global root DNS servers from September 2013 to July 2015. Verisign operates those two servers.

The data showed that there are over 20 million leaked WPAD queries hitting the servers every day, accounting for at least 6.6 million potential user victims. The researchers found leaked WPAD queries for 485 of the 738 new gTLDs that have been delegated by ICANN until Aug. 25, 2015, when the data was analyzed.

The problem is likely even more widespread than that, because ICANN has delegated an additional 201 new gTLDs since August and because the analyzed data was only from two of the 13 global root DNS servers.

The gTLDs for which the largest number of leaked WPAD queries were observed are: .global, .ads, .group, .network, .dev, .office, .prod, .hsbc, .win, .world, .wan, .sap and .site. Over 65 percent of the WPAD query leaks originated from computers in the U.S.

The issue has prompted the United States Computer Emergency Readiness Team (US-CERT) to publish a security alert Monday. The team has several recommendations for network administrators including disabling the automatic proxy discovery in browsers and operating systems during device setup if the feature is not needed and a using a fully qualified domain name from the global DNS that the company has registered and owns as the root for enterprise and other internal namespace.