Sivran
February 8th, 2005, 01:14 AM
Ironically IE is NOT affected by this vulnerability.
...but then unless it has the plugin for it, it doesn't support this anyway!
Thread at DSLReports Security: The state of homograph attacks (http://www.dslreports.com/forum/remark,12603456~mode=flat)
Brief Summary: browsers supporting Punycode/IDN are vulnerable to a URL spoofing attack that can easily fool less sophisticated and complacent users. The address bar will contain the expected url (in text, not an image even!) and even the https: protocol and lock icon can be spoofed.
The most disturbing part of the story is this: (emphasis mine)
VI. Vendor Responses
Opera: They believe they have correctly implemented IDN, and will not be making any changes.
http://forum.shrapnelgames.com/images/smilies/eek.gif
Proof of concept link:
http://www.shmoo.com/idn/
There is a workaround for Mozilla browsers but it only partially works. In the meantime I suggest you type in/use a bookmark and never click links in emails. http://forum.shrapnelgames.com/images/smilies/wink.gif As for Opera users, show your displeasure by pirating...oh wait, I mean, by switching to Mozilla. http://forum.shrapnelgames.com/images/smilies/tongue.gif
...but then unless it has the plugin for it, it doesn't support this anyway!
Thread at DSLReports Security: The state of homograph attacks (http://www.dslreports.com/forum/remark,12603456~mode=flat)
Brief Summary: browsers supporting Punycode/IDN are vulnerable to a URL spoofing attack that can easily fool less sophisticated and complacent users. The address bar will contain the expected url (in text, not an image even!) and even the https: protocol and lock icon can be spoofed.
The most disturbing part of the story is this: (emphasis mine)
VI. Vendor Responses
Opera: They believe they have correctly implemented IDN, and will not be making any changes.
http://forum.shrapnelgames.com/images/smilies/eek.gif
Proof of concept link:
http://www.shmoo.com/idn/
There is a workaround for Mozilla browsers but it only partially works. In the meantime I suggest you type in/use a bookmark and never click links in emails. http://forum.shrapnelgames.com/images/smilies/wink.gif As for Opera users, show your displeasure by pirating...oh wait, I mean, by switching to Mozilla. http://forum.shrapnelgames.com/images/smilies/tongue.gif