Phishing with Unicode Domains
xudongz.com
Phishing with Unicode Domains
1–10 of 28 posts
Re: Phishing with Unicode Domains
#2I wonder how the domain displays on email clients like gmail and outlook, this is the scariest part, most people will just look at the domain and think it's a valid mail and follow the instructions of that mail, it could be catastrophic for companies, the ubiquity $40 million fiasco comes to mind.
Re: Phishing with Unicode Domains
#3[deleted]
Re: Phishing with Unicode Domains
#4I wonder how the domain displays on email clients like gmail and outlook, this is the scariest part, most people will just look at the domain and think it's a valid mail and follow the instructions of that mail, it could be catastrophic for companies, the ubiquity $40 million fiasco comes to mind.
Considering how easy email is to spoof, why bother using a unicode domain which is only similar to the target domain? Why not just use the real domain instead?
Re: Phishing with Unicode Domains
#5Can a browser could track how many language/character sets are
typically used by a browser profile, and warn the user when they are
about to use a new, previously unused set, rather than waving the
duty off as the "responsibility of domain owners"?
With now over 1000 top-level domains, and however many homographic matches among character sets, expecting people to register dozens of matching domains seems unrealistic.
Re: Phishing with Unicode Domains
#6I wonder how the domain displays on email clients like gmail and outlook, this is the scariest part, most people will just look at the domain and think it's a valid mail and follow the instructions of that mail, it could be catastrophic for companies, the ubiquity $40 million fiasco comes to mind.
Considering how easy email is to spoof, why bother using a unicode domain which is only similar to the target domain? Why not just use the real domain instead?
Spoofing isnt so easy for gmail and yahoo inboxes. Some web-clients warn of a return path too. For sophisticated spoofing and phishing unicode domains are helpful. Plus, spoofing emails is just a small attack vector.
Re: Phishing with Unicode Domains
#7Thankfully I got this: https://imgur.com/a/3XyIe
Re: Phishing with Unicode Domains
#8Can a browser could track how many language/character sets are typically used by a browser profile, and warn the user when they are about to use a new, previously unused set, rather than waving the duty off as the "responsibility of domain owners"? With now over 1000 top-level domains, and however many homographic matches among character sets, expecting people to register dozens of matching domains seems unrealistic.
Won't it be even easier to just check if the domain contains something outside the currently used character set (perhaps always allowing ascii)?
I think that, plus a "you have never visited this site before" kind of warning could go a long way towards combating these kinds of attacks.
I think the real devil is going to be in the UI. You don't want to make it overly scary (otherwise you penalize domains which use some unicode characters correctly), but it can't be so unnoticable that you won't be able to tell when it matters.
Re: Phishing with Unicode Domains
#9Can a browser could track how many language/character sets are typically used by a browser profile, and warn the user when they are about to use a new, previously unused set, rather than waving the duty off as the "responsibility of domain owners"? With now over 1000 top-level domains, and however many homographic matches among character sets, expecting people to register dozens of matching domains seems unrealistic.
Won't it be even easier to just check if the domain contains something outside the currently used character set (perhaps always allowing ascii)? I think that, plus a "you have never visited this site before" kind of warning could go a long way towards combating these kinds of attacks. I think the real devil is going to be in the UI. You don't want to make it overly scary (otherwise you penalize domains which use some…
For a multi-lingual (really multi-char-set, "multi-graphic"?) user
who often visits sites in several different char-sets, and might
have a 60/30/5/5 percentage distribution, getting an "are you
sure?" check before visiting a site with mixed char sets or a
new-to-that-profile unmixed set seems like an useful confirmation
that would not be invoked often, but would be likely to avoid a trip
to the phishy sites. The same approach would work for the 99/1
or 100/0 distribution. The UI should be more of:
"You have never visited a site in this language/character set before"
More_Info. Cancel? Proceed?Re: Phishing with Unicode Domains
#10[deleted]