Sometimes, changes believed to be for the best can have unintentional negative consequences. For example, the changes in the generic Top Level Domain (TLD) system seem to have enabled possible man-in-the-middle (MitM) attacks, according to a recent US-CERT alert.

Unintended Consequences

Web Proxy Auto-Discovery (WPAD) is a protocol used to ensure all systems in an organization have the same proxy configuration. But instead of individually modifying configurations on each device connected to a network, WPAD locates a proxy configuration file and applies it automatically.

Unfortunately, WPAD is known to be vulnerable. Researchers at Verisign Labs and the University of Michigan recently identified a new attack vector involving the protocol that may be a serious risk to enterprises.

The problem begins when an enterprise creates an internal namespace with domains such as .corp, .dev and .network for their corporate active directory and lightweight directory access protocol (LDAP). Usually, this would not be an issue because these internal TLDs are meant to be served only from an internal domain name system (DNS). However, it’s possible that these internal domains can exist on the open Internet.

Other issues could stem from a work laptop connecting to public Wi-Fi at a local coffee shop, for example. WPAD queries may be made in error to public DNS servers.

Another problem? The use of WPAD is enabled by default on all Microsoft Windows operating systems and Internet Explorer. It is also supported on most other modern browsers and OSs — so anyone could become a victim.

Actors Eyeing MitM Attacks

Here’s the barb: Attackers may exploit such leaked WPAD queries by registering the leaked domain and setting up MitM proxy configuration files on the Internet. They can launch a MitM attack on the entire enterprise. They don’t have to wait for a specific session, rather they just hang around and wait for it to happen.

US-CERT advised disabling WPAD on any computer that will be using public access. The agency also recommended that firewalls and proxies be configured to log and block outbound requests for files.

Enterprises will have to monitor the public namespace and register domains defensively to avoid future name collisions. That’s the only way to totally lock this problem down.