Shady LinkedIn group targeting infosec professionals
September 04, 2015
A blog post from Finland-based cybersecurity firm F-Secure shows how some unidentified group is sending out LinkedIn invitations to infosec professionals.
They are if you forget the "www."
According to research done by Benjamin Balter, updated on October 4, 200 of the 1,334 .gov domains queried do not support non-www. resolution, which means in order to access those sites, you must include "www." prefix.
When the Web was in its infancy, subdomains such as ftp.domain.gov or email.domain.gov were used for non-web services, while www.domain.gov was reserved specifically for the website. Over time, as the Internet has become more web-based, the assumption became that domain.gov was equivalent to www.domain.gov, but some agencies have failed to update their systems to address the non-www. convention.
Mozilla Firefox and Apple Safari have created a workaround by enabling domain guessing, where they automatically assume the "www." and resolve to the intended URL. However, if the server isn't correctly configured to redirect the non-www. URL, the browser will indicate the site cannot be found, the server is taking too long to respond or the connection has timed out.
"Domain Guessing intercepts the DNS "hostname not found" error, and resends the request to a guessed hostname that might use the correct domain. Domain guessing will attempt to add "www." to the front and/or ".com" to the end of your request, and try again."
Here are a few major agency websites that currently do not pass the "non-www." test: