Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google-hosted malvertising leads to fake Keepass site that looks genuine

arstechnica.com

Post reply on HN
Print view View original

41–50 of 197 posts

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#41

Post by eviks »

Stem0037 wrote: post #34

While there's no foolproof way to detect scams like these, there are some proactive steps we can take: 1. Always type in URLs manually when downloading critical software to bypass the potential risks from ads. 2. Make use of browser plugins that identify malicious websites or unverified SSL/TLS certificates. 3. Before making any downloads, inspect the TLS certificate of the website by clicking on the padlock icon nex…

Isn't ignoring ads easier (so 0. Use an adblocker)? How often would a scam rank higher than the legitimate domain?

Maybe also 4. use a package manager?

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#42

Post by vbezhenar »

TeMPOraL wrote: post #23

That's a neat trick. I can imagine getting caught by this if I saw the link in non-ad context. The attackers made a smart choice here. Usual Unicode substitutions are something I've learned to spot, because the substituted letters look off , even if a tiny bit. But here? I didn't notice the dot under "k" even with an arrow pointing at it, because to me, it looked like a tiny speck of dust or dirt on the monitor . $de…

Тhеrе'rе рlеntу оf lеttеrs whiсh аre vеrу hаrd tо distinguish. Brоwsеrs аrе suрроsеd to саtсh thаt, but thеy dоn't аlwауs dо.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#43

Post by noirscape »

usr1106 wrote: post #33
noirscape wrote: post #28

Punycode is of questionable use anyway. Granted I'm mostly looking into this from a primary latin alphabet perspective, but for the various non-latin alphabet sites I've browsed over the past decade all of them just stuck to regular ASCII domains. (Heck you see this even with usernames on websites that allowed Unicode to be used; most non-latin alphabet users will still stick to the Latin alphabet for usernames.) The…

I fully support national languages, ASCII is not suitable for a huge part of mankind. But it's obvious that Unicode as it is is not suitable for security critical applications. Myself, speaking several European languages, I need less than 10 Unicode characters (each of them actually still 8 bit ISO 8859-15 codes). Well, need and need, most of the sites don't even register a punycode domain, but some uglified ASCII ve…

Agreed on ASCII not being suitable for a huge chunk of mankind for messaging. That said, in lieu of a better defined set of characters, it is a reliable set of characters that largely don't overlap when it comes to homograph attacks on human readable identifiers.

The only single character ones in ASCII with noticable issues are 0/O and I/l/1 (this is also why on latin alphabet gift cards, you'll often see these characters omitted entirely). The other homograph attacks on ASCII are mostly font kerning dependent (and even the two I mentioned can still be made distinct from each other in fonts).

I'm not dunking on Unicode here to be clear, Unicode is awesome. That said, bolting Unicode into unique identifiers humans are meant to read is a bad idea because of the homographs. Again; just look at how non-latin alphabet countries generally (don't) work with Unicode in things like usernames.

> As a practical step browsers should ask the user whether they want to allow URLs in a certain language the first time a non-ASCII character is entered.

This would probably help on top of the usual algorithmic blocklists that Firefox and Chrome already use (which largely rely on trying to match what sets of Unicode are used in a domain name to pick between Unicode and punycode rendering).

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#44

Post by WhyNotHugo »

noirscape wrote: post #28

Punycode is of questionable use anyway. Granted I'm mostly looking into this from a primary latin alphabet perspective, but for the various non-latin alphabet sites I've browsed over the past decade all of them just stuck to regular ASCII domains. (Heck you see this even with usernames on websites that allowed Unicode to be used; most non-latin alphabet users will still stick to the Latin alphabet for usernames.) The…

> Punycode is of questionable use anyway

Lots of people might want to register their name, or the name of their city, etc. These all sound like valid use cases. You could say that anything beyond ascii is of questionable use, but non-English natives will always digress.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#45

Post by bell-cot »

usr1106 wrote: post #33
noirscape wrote: post #28

Punycode is of questionable use anyway. Granted I'm mostly looking into this from a primary latin alphabet perspective, but for the various non-latin alphabet sites I've browsed over the past decade all of them just stuck to regular ASCII domains. (Heck you see this even with usernames on websites that allowed Unicode to be used; most non-latin alphabet users will still stick to the Latin alphabet for usernames.) The…

I fully support national languages, ASCII is not suitable for a huge part of mankind. But it's obvious that Unicode as it is is not suitable for security critical applications. Myself, speaking several European languages, I need less than 10 Unicode characters (each of them actually still 8 bit ISO 8859-15 codes). Well, need and need, most of the sites don't even register a punycode domain, but some uglified ASCII ve…

> As a practical step browsers should ask the user whether...

No, humans are far too well-trained in "just say yes and forget it". The browser should loudly flag any non-ASCII name (maybe there's a buried-deep option somewhere, to less-loudly flag it), or else it should do a bit of OCR and pop up a "DANGER - Look-Alike Domain Name..." warning.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#46

Post by fuzzy2 »

baal80spam wrote: post #5

I consider myself a security-conscious person and I'm not sure I would've spotted this. Another reason to use uBo with zero regrets.

uBlock Origin is cool and all, but what does it have to do with IDN lookalike attacks? It certainly did not block this one for me.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#47

Post by rob74 »

jasode wrote: post #30

>A closer link at the link, however, shows that the site is not the genuine one. In fact, ķeepass[.]info —at least when it appears in the address bar—is just an encoded way of denoting xn--eepass-vbb[.]info, which it turns out, is pushing a malware family tracked as FakeBat. Combining the ad on Google with a website with an almost identical URL creates a near perfect storm of deception. “Users are first deceived via…

The first "punycode attacks" were using letters that were completely indistinguishable from the "real" ones (e.g. by using Cyrillic letters). I guess the assumption is that the user would be able to identify any letters with diacritics (even if they're indistinguishable from specks of dust on your screen) and avoid them - after all, you wouldn't go to "göogle.com" either?

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#48

Post by 369548684892826 »

Semaphor wrote: post #12

Interesting, chrome indeed shows it in the url bar as ķeepass[.]info, but with FF I get xn--eepass-vbb[.]info, is this something I changed or a different default? edit: As someone mentioned further down, it’s an about:config setting for network.IDN_show_punycode

Firefox about:config check your setting for the network.IDN_show_punycode flag. I've just set this to true myself to prevent this kind of spoofing.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#49

Post by makeitdouble »

noirscape wrote: post #28

Punycode is of questionable use anyway. Granted I'm mostly looking into this from a primary latin alphabet perspective, but for the various non-latin alphabet sites I've browsed over the past decade all of them just stuck to regular ASCII domains. (Heck you see this even with usernames on websites that allowed Unicode to be used; most non-latin alphabet users will still stick to the Latin alphabet for usernames.) The…

One of the issue with ascii domains is the phonetic mapping for CJK languages.

For instance right not asahi.com is taken by 朝日 (Asahi shibun, the newspaper), thus the Asahi town (旭) cannot use it. Mind you, the town could take asahi-town.co.jp or something like that, but there is other Asahi towns and places with different writings (including 旭日, 朝陽、浅緋 etc.)

Wanting all of them to have some random ascii diversification is madness, and we're only talking about Japanese places, when the Chinese character space overlaps. (The question of whether these domains are actually registered is I think a chicken and egg problem, and I have a hard time imagining the above conflict space will get a nice resolution inside the ascii alphabet)

Western ascii domains being ripe for scam is an issue, throwing the baby with the bath water would still be problematic.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#50

Post by infinityio »

fuzzy2 wrote: post #46
baal80spam wrote: post #5

I consider myself a security-conscious person and I'm not sure I would've spotted this. Another reason to use uBo with zero regrets.

uBlock Origin is cool and all, but what does it have to do with IDN lookalike attacks? It certainly did not block this one for me.

the distribution method for this particular attack was a Google search ad
Post reply on HN