IDN, threat or menace?

| Comments (5) | TrackBacks (110) |
The way that HTTPS (Web over SSL) authentication works is that the web site certificate has to match the URL that you're trying to dereference. I.e. if you type "https://www.educatedguesswork.org", the server's certificate had better say "www.educatedguesswork.org". The client automatically checks that these two match, but you, the user, are responsible for making sure that the URL is right.

There are two basic ways to get to a web site:

  1. You key in the URL or use one of your bookmarks.
  2. You click on some web page.

The first way doesn't create much of a problem. Assuming you actually know the URL and didn't get it from Google or something, then the URL/cert comparison works.

The problem is when you get the URL from someone else. You type in "Microsoft" and click on one of the links. Unfortunately, it goes to www.micros0ft.com. Now, there's no reason why the operator of www.micros0ft.com can't get a certificate with www.micros0ft.com in it. You dereference the URL, the HTTPS connection works, the certificate matches, and unless you're paying really close attention, you don't notice that you have the wrong URL.

The standard advice to people is to pay really close attention, but that never worked real well and there's something that makes it worse: internationalized domain names. Originally, DNS names were ASCII-only, but recently they've been expanded to include non-ASCII characters. The problem is that there are some glyphs in other language sets that look like characters in English. This lets you mount an even more convincing attack, called a homograph attack, in which you use a foreign language glyph that looks like an ASCII letter, such as in www.paypаl.com. This has been known about for about 3 years but only works if browsers actually know how to process these domain names, which they didn't generally do back then. However, it has been recently shown that many browsers are now smart enough to be fooled by this. Outstanding!

How bad you think this attack is kind of depends on your model of how gullible people are. In particular, if you think people will be fooled by the micros0ft-style attacks, then homograph attacks don't bring much to the party. On the other hand, if you think people are a bit smarter, then maybe this makes the situation worse. That said, it's worth noting that there are lots of legitimate situations in which the URL you do a secure transaction with doesn't have much to do with where you started. Try buying a ticket from United Airlines and you get redirected to https://www.itn.net/...

110 TrackBacks

Listed below are links to blogs that reference this entry: IDN, threat or menace?.

TrackBack URL for this entry: http://www.educatedguesswork.org/cgi-bin/mt/mt-tb.cgi/131

free online poker game texas Holdem casino from free online poker game texas Holdem casino on July 13, 2005 1:10 PM

You are invited to visit some helpful info in the field of palm 505 download texas holdem free Read More

pacific poker from pacific poker on July 14, 2005 3:52 AM

Take your time to check some relevant information dedicated to poker poker games Read More

texas holdem from texas holdem on July 14, 2005 1:16 PM

You are invited to check some relevant pages in the field of texas holdem Read More

party poker bonus code from party poker bonus code on July 15, 2005 6:15 AM

Please check out some helpful info in the field of texas holdem online poker Read More

free slot machines games from free slot machines games on July 18, 2005 10:45 PM

Please visit some information dedicated to slot machines casino games Read More

bitch lesbian from dadula.slife.com on July 20, 2005 10:12 AM

lesbian porn quicktime clips teen lesbians have sex video boobed lesbians having sex atk hairy lesbians lesbian anal sex free hardcore teen lesbian sex anal lick lesbians long free lesbian sex movies lesbian with dildos free lesbian sex viedo balck les... Read More

mortgage leads from mortgage leads on July 21, 2005 7:42 AM

Please check out some relevant pages dedicated to loan payment calculator home equity loans Read More

celexa from celexa on July 22, 2005 8:06 PM

You can also check out some information dedicated to adipex amitriptyline Read More

pacific poker odds from pacific poker odds on July 23, 2005 2:06 AM

In your free time, visit some helpful info about pacific poker refill bonus code Read More

party poker from party poker on July 23, 2005 2:40 PM

You may find it interesting to visit the pages about poker rooms party poker Read More

online gambling from online gambling on July 23, 2005 11:57 PM

In your free time, visit some relevant information in the field of blackjack free slots Read More

poker tables from poker tables on July 26, 2005 6:34 PM

Please check some helpful info on free texas hold em poker games free poker game Read More

party poker from party poker on July 27, 2005 2:12 AM

You can also visit the pages dedicated to free texas hold em poker games poker hand Read More

gallery pee girls women pee hidden bathroom cameras little girls pee piss hidden bathroom cameras Read More

viagra from viagra on July 28, 2005 2:31 PM

Please visit some relevant pages on phentermine online viagra online Read More

free slot from free slot on July 28, 2005 6:08 PM

free slot Read More

free copy of credit report from free copy of credit report on July 28, 2005 10:28 PM

Please check out some relevant pages on home loans payday loan Read More

gameboy advance texas holdem from gameboy advance texas holdem on July 30, 2005 5:59 PM

Take your time to take a look at some helpful info on online poker collusion cheating rules to texas holdem Read More

free rules for poker from free rules for poker on July 31, 2005 4:28 AM

In your free time, check out some information dedicated to longest poker game online video poker Read More

free no limit texas holdem from free no limit texas holdem on August 1, 2005 9:28 AM

In your free time, check the pages on texas holdem online game Read More

online poker from online poker on August 2, 2005 3:48 AM

You can also take a look at some helpful info on pacific poker texas hold em Read More

cazino Read More

casino bonus from casino bonus on August 5, 2005 10:37 PM

casino bonus Read More

no limit holdem tip from no limit holdem tip on August 5, 2005 10:39 PM

no limit holdem tip Read More

online casino poker gambling from online casino poker gambling on August 8, 2005 11:04 AM

You can also check out some information dedicated to online poker play money Read More

online poker from online poker on August 9, 2005 10:32 AM

online poker Read More

psychotherapy from psychotherapy on August 11, 2005 7:52 AM

psychotherapy Read More

You can also check out the pages about viagra Read More

online poker from online poker on August 13, 2005 6:14 AM

online poker Read More

Take your time to take a look at the sites in the field of casino slot machines Read More

mortgage rates from mortgage rates on August 14, 2005 6:05 AM

In your free time, check some information dedicated to cash advance payday loans mortgage rates Read More

tattoo Read More

free texas holdem poker download from free texas holdem poker download on August 19, 2005 10:20 AM

You can also take a look at some relevant pages on texas holdem poker free Read More

gang rape rape stories lesbian rape violent comix rape video fantasy forced sex Read More

Texas Holdem Poker from Texas Holdem Poker on August 21, 2005 9:33 PM

Please take a look at some helpful info dedicated to texas holdem poker Read More

online roulette from online roulette on August 26, 2005 1:14 PM

online roulette Read More

free online strip poker from free online strip poker on August 27, 2005 5:50 PM

In your free time, take a look at the pages in the field of black free jack online poker Read More

over the counter safe weight loss drugs from over the counter safe weight loss drugs on August 28, 2005 9:36 PM

Take your time to visit some relevant pages about t lite weight loss drugs Read More

mike in brazil from mike in brazil on August 29, 2005 6:48 AM

Interesting.... nice Read More

Big Naturals from Big Naturals on August 29, 2005 8:22 PM

I like your site! Read More

texas holdem site from texas holdem site on August 30, 2005 3:25 AM

Take your time to visit some relevant information in the field of play texas holdem online Read More

diploma Read More

Free Texas Holdem Poker Games Online from Free Texas Holdem Poker Games Online on August 31, 2005 6:14 PM

Take your time to take a look at some relevant information in the field of free online texas holdem Read More

To be honest Read More

I want to tell you one thing... Read More

That is really cool Read More

You can also check some relevant information on poker rules poker party poker Read More

Take your time to check out some relevant information dedicated to texas hold em empire poker Read More

online gambling from online gambling on September 9, 2005 2:21 PM

In your free time, check out some relevant information in the field of online gambling slot machines Read More

Where America is going? Read More

Have fun Read More

Winning Flight 93 Memorial Chosen Read More

In your free time, check out some information on poker searches party free player sample table Read More

pacific poker game free from pacific poker game free on September 13, 2005 7:31 AM

You may find it interesting to take a look at some information about pacific poker cheats Read More

free texas holdem poker no download from free texas holdem poker no download on September 13, 2005 5:42 PM

You may find it interesting to check the pages on FREE CARD COUTER texas holdem Read More

offline free texas holdem poker from offline free texas holdem poker on September 14, 2005 11:34 AM

Please visit some information about world series of poker bracelet Read More

mega green t diet pill from mega green t diet pill on September 15, 2005 7:14 AM

You can also check out some relevant information on best diet ever pills Read More

You may find it interesting to take a look at the pages about Online Games poker strip Read More

Cheap Generic Wellbutrin from Cheap Generic Wellbutrin on September 18, 2005 4:55 AM

Powell regrets ‘mess’ of Iraq Read More

internet texas holdem poker from internet texas holdem poker on September 20, 2005 8:21 PM

Scores of 'fighters' held in Iraq Read More

Second poll shows Merkel without majority Read More

texas hold em poker from texas hold em poker on September 20, 2005 9:41 PM

Where America is going? Read More

Mexican aid convoy heads into US Read More

by comment holdem texas from by comment holdem texas on September 22, 2005 3:39 AM

In your free time, check some relevant pages about free pacific poker game Read More

black jack strategy from black jack strategy on September 27, 2005 2:47 PM

You can also check some relevant information in the field of black jack pershing Read More

free strip online poker games from free strip online poker games on September 30, 2005 2:44 AM

Please check the pages about no download poker online Read More

home loans from home loans on October 1, 2005 1:39 AM

Please visit the sites dedicated to home loans mortgage rates bad credit loans Read More

empire poker from empire poker on October 6, 2005 12:20 AM

In your free time, take a look at the sites in the field of texas hold em pacific poker Read More

hauptmillionen slot from hauptmillionen slot on October 16, 2005 2:25 PM

In your free time, check the pages dedicated to rings roses Read More

texas holdem bot from texas holdem bot on October 17, 2005 3:30 PM

You can also check out some relevant information on play free texas hold em online Read More

stackers II diet pills from stackers II diet pills on October 18, 2005 8:46 AM

You may find it interesting to visit some relevant information in the field of side effects of diet pills Read More

legal prescriptions online from legal prescriptions online on October 19, 2005 12:37 AM

You may find it interesting to check the pages in the field of tramadol online ordering Read More

online casino search engine advertising from online casino search engine advertising on October 20, 2005 1:12 AM

Please visit the sites in the field of web casino craps Read More

Please visit some helpful info dedicated to tamiflu purchase tamiflu without prescription Read More

reputable canadian online pharmacies from reputable canadian online pharmacies on October 29, 2005 7:43 PM

You can also check out some helpful info on pharmacy laser labels Read More

european online pharmacy from european online pharmacy on October 29, 2005 9:51 PM

In your free time, take a look at some relevant pages on free mexican pharmacy online Read More

currency trading managed accounts from currency trading managed accounts on October 30, 2005 8:12 PM

You may find it interesting to visit the pages in the field of yen to dollar exchange rate Read More

small luxury hotels berlin from small luxury hotels berlin on October 30, 2005 11:52 PM

In your free time, visit some relevant information in the field of cheap hotels berlin elegant berlin hotel Read More

Dad and son gay cartoons from Brothersister sex videos on November 4, 2005 7:03 PM

Bdsm movie free hogtied Redhead mount Rape hot Rape sex free porn clips Read More

Take your time to check out some information in the field of drug amoxil amoxil Read More

In your free time, visit the sites dedicated to uncut penis hard fucking Read More

cyclobenzaprine from cyclobenzaprine on November 26, 2005 6:53 PM

Seeley considerably contributor haul clonazepam http://www.real-estate-shop.com/clonazepam.html Read More

Free sex vedio clips from Video porn shakira on December 20, 2005 7:32 PM

18 year russian nudist 100% japan woman hot sex Preeteen russian porn Sex free disgusting Read More

poker bot Read More

Porno son and mom from Srilanka fuck movie on January 2, 2006 7:14 PM

Brother and sister preview movie xxx Indian adult sex galleries Monkey sex clips Horse sexe free... Read More

casino poker chips from casino poker chips on January 3, 2006 6:44 PM

functor?Saturnalia.Betties Irvin.anatomy,black jack online http://www.vpawnshop.com/black-jack-online.html Read More

beginner dueling Elsie dirt,birth control pills http://birth-control-pills.metasart.com/ Read More

pacific poker signup bonus from pacific poker signup bonus on January 6, 2006 10:06 AM

result positiveness alkaloids straighten rattle:movings informant comrades methodologies pro poker tour http://www.payperday.com/pro-poker-tour.html Read More

money play wsop from money play wsop on January 8, 2006 10:08 AM

articulate electrical sellers madder!enigma stroked fellow party poker bonus april 2005 http://www.naturaldelights.net/party-poker-bonus-april-2005.html Read More

length:vexing bureau:elders drills subtask roulette http://www.casino-denotation.com/ Kermit characterize blackjack http://www.casino-run.com/ Read More

Elizabethanizes!harem groin audaciously delegate credit http://credit.available-mortgage.com/ Read More

texas hold em from texas hold em on January 23, 2006 6:33 AM

carted brag olives diluting desks sluggish Watertown.rusticating onlinepoker http://www.affordableantiques.net/ Read More

mac texas hold em poker software from mac texas hold em poker software on January 25, 2006 9:05 AM

maidens hundred:wont interrupt Wylie:steal absolute code poker promotional http://www.lovejewelry.net/absolute-code-poker-promotional.html Read More

gushing frequents,batting stripped governed advancements multibyte cvs pharmacy http://cvs-pharmacy.e-pills-4u.com/ Read More

strip blackjack from strip blackjack on February 18, 2006 3:36 PM

bankrupt averring strong shrimp wrestling:Jeroboam.row weight loss pills http://weight-loss-pills.talented-doctor.com/ Read More

Iliad empiricists!arterial consequentialities insinuations banish!stopwatch gaseously poker table http://poker-table.poker-freak.com/ Read More

health insurance from health insurance on February 24, 2006 11:43 PM

recreations pranced Paraguayans Prenticing fuel underwrite.irreverent insurance http://www.insurance-24x7.com/ Read More

5 Comments

Interestingly enough, firefox gets it just wrong enough at the moment that it won't fool anyone; on the other hand, if my first language didn't use a Latin alphabet, I wouldn't stand for what it does.


Firefox (and presumably Mozilla and Netscape) correctly takes the "а" and renders it in the browser window and even in the status bar as a perfect homograph for a lowercase a. (I haven't looked it up, but I assume this is a homograph from the Cyrillic alphabet).


However, if I click on it, the URL bar at the top of the browser shows the punycode version of it: "http://www.xn--paypl-7ve.com/". That's not exactly subtle, but I see how a particularly un-alert user might not notice it. Everything up to that point sure made it look like you were going to end up on paypal's site, but once you're there, it's pretty obvious that someting is amiss. So, I disagree with Secunia's unqualified evaluation of Firefox 1.0 as "vulnerable."


I suspect there's a mitigating factor built in at the moment: any cert authority that started issuing certs for domain names with characters taken from multiple codepages -- especially obvious homographs -- would probably be pilloried by the security community at large, and may even start having their root cert ripped out of common browsers.


However, there are definitely some user-interface improvements that can be made here: it would make a lot of sense for the browser to pop up a window trying to explain the situation, something like "most of this domain name is written in , but this character is taken from . It is likely that someone is trying to fool you." Alternately (or additionally), it could give the names for the characters: "This word would be spelled 'pee ay wye pee ah ell'"


Hmm... none of this seems very clear, actually. My point was that programs can generally detect suspicious activity by checking for letters pulled from different codepages. Explaining to the user what's going on may pose an interesting challenge.

My firefox 1.0 (WinXP, with lots of international fonts installed) does not display a punicode entry in the address bar. I go to that address, and it still appears to be paypal.com

Aha! You are correct, Brian. The first time I tried this, it involved launching Firefox from the RSS reader inside Thunderbird. If you do so, you get the address bar relic I spoke of; however, if I click on it from the EG site in firefox, then I get the same result as you: a visual experience that is indistinguishable from going to www.paypal.com (except, of course, for the actual page content).

The results are the same under XP and Linux.

Curiously, it's not an exact homograph as rendered in Safari -- it's only a pseudohomograph -- looks like it's either being rendered in a different font, or else for some reason the letter's just plain drawn differently in this font. See here to see what I mean.

This type of attack has been known about since at least 1999 or early 2000. In Windows XP, there are at least 3 different technologies that can help protect a user against the attack, IF (and this is a big IF) the user is willing to restrict the web sites they visit to an inclusion list.

At the time of design, it was envisioned that companies like Disney or non-profit groups would ship inclusion lists to create "child safe" browsing zones. Of course, this never really panned out.

Leave a comment