Skip to Content.
Sympa Menu

internetworkers - [internetworkers] on URL spoofing

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: Sil Greene <Sil_greene AT unc.edu>
  • To: internetworkers AT lists.ibiblio.org
  • Subject: [internetworkers] on URL spoofing
  • Date: Fri, 30 Jan 2004 09:19:36 -0500 (EST)



Another interesting attack; probably not a big issue now, but as DNS moves
to utilize Unicode more and more, this will be a thornier issue to handle.
The comment below was posted to Slashdot under the MS KB article mentioned
earlier.

As a side question, has anyone run across Unicode in domain names? I
haven't yet, and I'm not sure my Windows machines would have a
Unicode-enabled DNS resolver.
--Sil


===============================
links:
The Homograph Attack
http://www.cs.technion.ac.il/~gabr/papers/homograph.html
=================================
Homograph attacks might bite us all (Score:5, Interesting)
by ControlFreal (661231) * <niekNO AT SPAMbergboer.net> on Friday January 30,
@05:13AM (#8133115)

Although this article on the insecurities of IE (or in a more general
sense, Windows' URL handling) is fitting for ./, the advice to type URL
into the address bar may be one that we should all take to heart in the
future.

As pointed out here [technion.ac.il], the advent of multilingual (Unicode)
domain names gives rise to a new possibility for attacks: the Homograph
attack.

Example: one could replace the o's in http://www.microsoft.com
[microsoft.com] with Greek omicrons, Cyrillic o's or characters from other
charsets, as long as they are rendered by our browser as something
resembling an "o". The users won't notice the difference, but they might
be redirected to another site, even though they visually inspected the
URL.

A more serious example: my bank, the Dutch Rabobank [rabobank.nl],
features internet banking. It specifically displays a warning before
logging in: Make sure that the address in the address bar starts with
https://www.rabobank.nl/, then you are sure you're communicating with us.
Now, with a homograph attack, even that might not be certain again: it
looks the same, and users are reassured even though reassurance is not
due! And it's not limited to using IE or Windows either.

A comment is in order here: we're not that far yet, as most clients
require special (non-default) DNS clients to access Unicode domain names.
But it might become a big problem in the future.

Are there any people from countries using non-latin domain names that
might want to comment on this?



--
"If you put your supper dish to your ears you can hear the sounds
of a restaurant." --Snoopy (Charles Schultz 02-12-2000 RIP)
Sil_Greene AT unc.edu




  • [internetworkers] on URL spoofing, Sil Greene, 01/30/2004

Archive powered by MHonArc 2.6.24.

Top of Page