When the IETF decided to allow Unicode characters in domain names, many techies saw the move as commendable, but also fraught with danger, as hundreds of unique characters can look similar or identical across multiple alphabets. This can be used for typosquatting attacks, wherein bad actors create functioning websites with deliberately misspelled web addresses that look identical to the real URL, thus launching attacks against unsuspecting visitors who land on the site due to search results generated when the user mistypes an address. The Chromium browser has the most advanced ruleset for finding and preventing mischievous domains masquerading as legitimate ones, but even the best code has odd edge cases, as a blog post from Have I Been Squatted (HIBS) explains in great detail.

Using "аррӏө.com" as an example — which is in fact not identical to the real "apple.com" — the researchers show how specific combinations of characters can still evade multiple layers of protection, thanks to the particular circumstances surrounding the use of specific Cyrillic characters. This alphabet has lookalikes for many Latin letters. For example, а → a, е → e, о → o, р → p, and с → c. We forgive you if you can't spot the differences.

Trying to sneak the one homoglyph into the middle of standard Latin ones triggers Chromium's safeguards and makes the browser display the domain name in its Punycode format. com". com only pass the check if they're all from the same alphabet.

Source link