I still can't quite put my finger on the security risk for others, can you help explain what makes it one?
Here's the only scenario I can think of:
Say you are a web developer and you use mybusiness.local.computer for developing your client's website. You use it every day, you are used to loading up the URL and seeing your website.
One day I, owner of local.computer turn the dark side. I decide that I want to attack you, this one person who I know uses mybusiness.local.computer, and change mybusiness.local.computer to redirect to my nefarious server.
When I do that, when you come to work, you load up mybusiness.local.computer and expect to see the site you've been working on.
Because I know my victim, I know exactly what website to spoof, so I have my spoof up and running on my nefarious server.
Then, when the victim goes to visit mybusiness.local.computer, thinking they are visiting a copy of their website, it's actually being served from my server.
Hopefully, you then input some information, like their username and password, which I then capture in my spoof website.
This is the only way I can imagine using this domain against someone.
It involves quite a few assumptions:
- The one in control of DNS is the attacker.
- The attacker has one specific victim in mind, because they can only spoof one website.
- The attacker already knows what site the victim is expecting to load at a .local.computer domain. This requires personal knowledge of the victim's site because the DNS for .local.computer goes straight to 127.0.0.1. Requests are not proxied or logged. (Ok, after writing this, I realize I could change the local.computer to go through my servers then redirect the user to 127.0.0.1 enabling me to at least learn what subdomains are being requested. Still, I have no idea what that site is supposed to be.)
- The attacker is able to spoof that website well enough that the victim (a developer of the website) is able to be fooled into giving up information.
Is there another way this could be abused? I seriously would like to know.
Thanks!
Here's the only scenario I can think of:
Say you are a web developer and you use mybusiness.local.computer for developing your client's website. You use it every day, you are used to loading up the URL and seeing your website.
One day I, owner of local.computer turn the dark side. I decide that I want to attack you, this one person who I know uses mybusiness.local.computer, and change mybusiness.local.computer to redirect to my nefarious server.
When I do that, when you come to work, you load up mybusiness.local.computer and expect to see the site you've been working on.
Because I know my victim, I know exactly what website to spoof, so I have my spoof up and running on my nefarious server.
Then, when the victim goes to visit mybusiness.local.computer, thinking they are visiting a copy of their website, it's actually being served from my server.
Hopefully, you then input some information, like their username and password, which I then capture in my spoof website.
This is the only way I can imagine using this domain against someone.
It involves quite a few assumptions:
- The one in control of DNS is the attacker. - The attacker has one specific victim in mind, because they can only spoof one website. - The attacker already knows what site the victim is expecting to load at a .local.computer domain. This requires personal knowledge of the victim's site because the DNS for .local.computer goes straight to 127.0.0.1. Requests are not proxied or logged. (Ok, after writing this, I realize I could change the local.computer to go through my servers then redirect the user to 127.0.0.1 enabling me to at least learn what subdomains are being requested. Still, I have no idea what that site is supposed to be.) - The attacker is able to spoof that website well enough that the victim (a developer of the website) is able to be fooled into giving up information.
Is there another way this could be abused? I seriously would like to know.
Thanks!