21–28 of 28 posts
Earlier quoted context omitted.
High level recap: Chrome - fixed in 59 (current stable is 57) Firefox - no plans to change; you can adjust network.IDN_show_punycode in about:config IE - immune Safari - immune
Could you explain what fixed/immune means? Is it only the confusable characters, ie characters that are visually identical or near-identical to latin characters, that is getting the punycode treatment?
This is the scariest one: http://www.xn--80a6aa.com/ & http://www.app.com/
However apple.com with a CC reset form could be a mighty easy way to scam a lot of people into giving up the personal details which could easily lead to full blown identify theft.
Thankfully FF/Chrome are patching this
Earlier quoted context omitted.
Won't it be even easier to just check if the domain contains something outside the currently used character set (perhaps always allowing ascii)? I think that, plus a "you have never visited this site before" kind of warning could go a long way towards combating these kinds of attacks. I think the real devil is going to be in the UI. You don't want to make it overly scary (otherwise you penalize domains which use some…
For a multi-lingual (really multi-char-set, "multi-graphic"?) user who often visits sites in several different char-sets, and might have a 60/30/5/5 percentage distribution, getting an "are you sure?" check before visiting a site with mixed char sets or a new-to-that-profile unmixed set seems like an useful confirmation that would not be invoked often, but would be likely to avoid a trip to the phishy sites. The same…
Someone else's example that looks like "app.com" ( http://www.xn--80a6aa.com/) translates to the Cyrillic text, even in Pale Moon. I wonder if Apple's site is on a hard-coded blacklist in the browser, or if every update includes the top-1000 list, or something?
I remember reading about issues with Unicode domains years ago, though. It surprises me that something hasn't been figured out by this point. One mitigation that I remember being discussed was coloring characters from different scripts in different colors, to make variant characters more obvious.
Earlier quoted context omitted.
High level recap: Chrome - fixed in 59 (current stable is 57) Firefox - no plans to change; you can adjust network.IDN_show_punycode in about:config IE - immune Safari - immune
Could you explain what fixed/immune means? Is it only the confusable characters, ie characters that are visually identical or near-identical to latin characters, that is getting the punycode treatment?
Interesting. The apple.com one ( https://www.xn--80ak6aa92e.com/ ) shows literally that text in Pale Moon (27.2), but shows "аррӏе.com" (Cyrillic text) in Chrome 57 and Firefox 51. Someone else's example that looks like "app.com" ( http://www.xn--80a6aa.com/ ) translates to the Cyrillic text, even in Pale Moon. I wonder if Apple's site is on a hard-coded blacklist in the browser, or if every update includes the top-1…
Earlier quoted context omitted.
Considering how easy email is to spoof, why bother using a unicode domain which is only similar to the target domain? Why not just use the real domain instead?
Spoofing isnt so easy for gmail and yahoo inboxes. Some web-clients warn of a return path too. For sophisticated spoofing and phishing unicode domains are helpful. Plus, spoofing emails is just a small attack vector.
mike@blob:~$ telnet gmail-smtp-in.l.google.com 25
Trying 66.102.1.26...
Connected to gmail-smtp-in.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP 19si14686133wmr.1 - gsmtp
EHLO whatever
250-mx.google.com at your service, [164.132.228.175]
250-SIZE 157286400
250-8BITMIME
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-CHUNKING
250 SMTPUTF8
MAIL FROM:
250 2.1.0 OK 19si14686133wmr.1 - gsmtp
RCPT TO:
250 2.1.5 OK 19si14686133wmr.1 - gsmtp
DATA
354 Go ahead 19si14686133wmr.1 - gsmtp
From: "Fake Address"
To: *****@gmail.com
Subject: This is a spoofed email
Spoof spoof spoof
--
Spoofy McSpoof
.
250 2.0.0 OK 1492497764 19si14686133wmr.1 - gsmtp
The only clue is, in the web interface Google displays a grey octagon with a red question mark inside it next to the sender address. And when you hover over that a tooltip says:
"Gmail couldn't verify that ycombinator.com actually sent this message (and not a spammer)"
So yeah. I would dispute "Spoofing isnt so easy for gmail and yahoo inboxes" - They're as shit as everyone else.
Interesting. The apple.com one ( https://www.xn--80ak6aa92e.com/ ) shows literally that text in Pale Moon (27.2), but shows "аррӏе.com" (Cyrillic text) in Chrome 57 and Firefox 51. Someone else's example that looks like "app.com" ( http://www.xn--80a6aa.com/ ) translates to the Cyrillic text, even in Pale Moon. I wonder if Apple's site is on a hard-coded blacklist in the browser, or if every update includes the top-1…
Even if you could train that, it doesn't help color-blind people...