Internetworkers: http://www.ibiblio.org/internetworkers/

[Sil Greene <Sil_greene AT unc.edu>]

Another interesting attack; probably not a big issue now, but as DNS moves 
to utilize Unicode more and more, this will be a thornier issue to handle.  
The comment below was posted to Slashdot under the MS KB article mentioned 
earlier.

As a side question, has anyone run across Unicode in domain names?  I 
haven't yet, and I'm not sure my Windows machines would have a 
Unicode-enabled DNS resolver.
--Sil


===============================
links:
The Homograph Attack 
http://www.cs.technion.ac.il/~gabr/papers/homograph.html
=================================
Homograph attacks might bite us all (Score:5, Interesting)
by ControlFreal (661231) * <niekNO AT SPAMbergboer.net> on Friday January 30, 
@05:13AM (#8133115)

Although this article on the insecurities of IE (or in a more general 
sense, Windows' URL handling) is fitting for ./, the advice to type URL 
into the address bar may be one that we should all take to heart in the 
future.

As pointed out here [technion.ac.il], the advent of multilingual (Unicode) 
domain names gives rise to a new possibility for attacks: the Homograph 
attack.

Example: one could replace the o's in http://www.microsoft.com 
[microsoft.com] with Greek omicrons, Cyrillic o's or characters from other 
charsets, as long as they are rendered by our browser as something 
resembling an "o". The users won't notice the difference, but they might 
be redirected to another site, even though they visually inspected the 
URL.

A more serious example: my bank, the Dutch Rabobank [rabobank.nl], 
features internet banking. It specifically displays a warning before 
logging in: Make sure that the address in the address bar starts with 
https://www.rabobank.nl/, then you are sure you're communicating with us. 
Now, with a homograph attack, even that might not be certain again: it 
looks the same, and users are reassured even though reassurance is not 
due! And it's not limited to using IE or Windows either.

A comment is in order here: we're not that far yet, as most clients 
require special (non-default) DNS clients to access Unicode domain names. 
But it might become a big problem in the future.

Are there any people from countries using non-latin domain names that 
might want to comment on this? 



-- 
"If you put your supper dish to your ears you can hear the sounds
 of a restaurant."  --Snoopy    (Charles Schultz 02-12-2000 RIP)
Sil_Greene AT unc.edu