TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Phishing with Unicode Domains

129 pointsby 01walidabout 8 years ago

8 comments

wimaggucabout 8 years ago
HN Discussion about the same topic from 2 days ago (126 comments to date): <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=14119713" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=14119713</a>
评论 #14133454 未加载
dmckeonabout 8 years ago
Can a browser could track how many language&#x2F;character sets are typically used by a browser profile, and warn the user when they are about to use a new, previously unused set, rather than waving the duty off as the &quot;responsibility of domain owners&quot;?<p>With now over 1000 top-level domains, and however many homographic matches among character sets, expecting people to register dozens of matching domains seems unrealistic.
评论 #14132654 未加载
shifabout 8 years ago
I wonder how the domain displays on email clients like gmail and outlook, this is the scariest part, most people will just look at the domain and think it&#x27;s a valid mail and follow the instructions of that mail, it could be catastrophic for companies, the ubiquity $40 million fiasco comes to mind.
评论 #14132066 未加载
nemo1618about 8 years ago
What an odd coincidence: I just published a Go package yesterday to detect such attacks in source code. Is there a homography bug going around?<p><a href="https:&#x2F;&#x2F;github.com&#x2F;NebulousLabs&#x2F;glyphcheck" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;NebulousLabs&#x2F;glyphcheck</a><p>(btw, Wikipedia notes that &quot;The term homograph is sometimes used synonymously with homoglyph, but in the usual linguistic sense, homographs are words that are spelled the same but have different meanings, a property of words, not characters.&quot;)
评论 #14134352 未加载
html5webabout 8 years ago
This is the scariest one: <a href="http:&#x2F;&#x2F;www.арр.com&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.xn--80a6aa.com&#x2F;</a> &amp; <a href="http:&#x2F;&#x2F;www.app.com&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.app.com&#x2F;</a>
评论 #14134809 未加载
E6300about 8 years ago
<a href="http:&#x2F;&#x2F;blog.unicode.org&#x2F;2014&#x2F;09&#x2F;updated-unicode-security-specifications.html" rel="nofollow">http:&#x2F;&#x2F;blog.unicode.org&#x2F;2014&#x2F;09&#x2F;updated-unicode-security-spe...</a>
khedoros1about 8 years ago
Interesting. The apple.com one (<a href="https:&#x2F;&#x2F;www.xn--80ak6aa92e.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.xn--80ak6aa92e.com&#x2F;</a>) shows literally that text in Pale Moon (27.2), but shows &quot;аррӏе.com&quot; (Cyrillic text) in Chrome 57 and Firefox 51.<p>Someone else&#x27;s example that looks like &quot;app.com&quot; ( <a href="http:&#x2F;&#x2F;www.xn--80a6aa.com&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.xn--80a6aa.com&#x2F;</a>) translates to the Cyrillic text, even in Pale Moon. I wonder if Apple&#x27;s site is on a hard-coded blacklist in the browser, or if every update includes the top-1000 list, or something?<p>I remember reading about issues with Unicode domains <i>years</i> ago, though. It surprises me that something hasn&#x27;t been figured out by this point. One mitigation that I remember being discussed was coloring characters from different scripts in different colors, to make variant characters more obvious.
评论 #14135450 未加载
bchociejabout 8 years ago
Thankfully I got this: <a href="https:&#x2F;&#x2F;imgur.com&#x2F;a&#x2F;3XyIe" rel="nofollow">https:&#x2F;&#x2F;imgur.com&#x2F;a&#x2F;3XyIe</a>