By Robert Lemos, 8 February 2005 09:05
NEWS
A security weakness in a standard for handling special character sets in domain names could let an attacker spoof websites on non-Microsoft browsers, a researcher has warned.
Security expert Eric Johanson said at the ShmooCon hacker convention last weekend that the problem arises because certain browsers support a standardised way of representing domain names in the letters or characters of any language. Called Internationalised Domain Names, the standard allows companies to register domain names that appear to be the same in different languages.
That encoding scheme could enable an attacker to create a fake website for a phishing scam. A spoofed link would seem to be a legitimate URL in the address bar of affected browsers - Opera, Apple's Safari, and the Mozilla and Firefox browsers from the Mozilla Foundation. But instead of taking the victim to the trusted site, the link would lead to a phoney website with a domain rendered as the same address under the IDN process.
Chris Hofmann, director of engineering at Mozilla, said in a statement the Mozilla Foundation is looking for a long-term solution to the issue.
"With the increase in phishing attacks, there is a growing concern that exploits could take advantage of this feature to trick users into visiting rogue sites," Hofmann stated. "Mozilla is looking at options for fixing or disabling this feature and should have more information available very soon."
Phishing attacks, which try to fool consumers into handing over sensitive information by creating legitimate-looking websites and email messages, have become a central security concern recently. While vulnerabilities in Microsoft's Internet Explorer have been the focus of much of the concern, other browsers also have had their fair share of flaws.
The security weakness in the IDN scheme comes as registrars push for support for expressing domain names in different languages and scripts.
"There are now many ways to display any domain name on a browser, as there are a huge number of [character sets] which look very similar to Latin (characters)," Johanson said in an advisory.
The advisory demonstrates the attack using the domain for PayPal, but using an alternate Unicode character for the first "a". That gives an address that looks like "http://www.pàypal.com," but with a smaller "a".
Details of the flaw were shown at ShmooCon, a hacking and computer security convention, in Washington D.C., last weekend. The Shmoo Group, a loose association of security professionals that runs the convention, notified the affected browser makers in mid-January. Johanson is a member of the Shmoo Group.
Apple, VeriSign and Opera could not immediately be reached for comment.
Microsoft has not implemented support for IDN yet, so its IE browser is not vulnerable to the flaw.
Browser security is gaining attention among software makers. In December, internet security company Netcraft released an IE plug-in that it said could help people avoid becoming victims of online fraud. In addition, Netscape announced last month that it is getting ready to release a browser designed to resist phishing attacks.
Robert Lemos writes for CNET News.com.
Comments
There is 1 comment. Join the discussion
1. David Wrixon
One of the biggest arguments out there against IDN is the Phishing argument. This has now largely been negated by ICANN banning registeration of mixed character scripts that are likely to cause confusion.
However, another side of the story has been put. It is clear that many words in local characters have multiple representations when transliterated, often with more than one system, into Latin Characters. Each of these ambiguities offers an opportunity for a Phisher to conduct his Scam. Unlike the problem of eliminating the use of rogue cyrillics in Latin scripts, I see no easy solution to this problem, as each of the transliterations are in a single script and therefore legitimate. Indeed, each could have legitimate usuage, but surely often won't.
IDN / Phishing Argument turned on its head.
The argument therefore develops into the imperative of introducing IDN to prevent Phishing Scams in Asia. Without IDN, it is likely that the confusion over how to transliterate will result in a Pandemic of Scamming, the scale of which will be unprecidented! I feel that we should no longer be silent on the issue of Phishing as IDN undoubtedly will hold the moral high ground on this issue.
Best Regards
Dave Wrixon