4

Is it not possible for Chrome and Firefox to protect against this > https://www.аррӏе.com/

Navigating to that above (fake) apple website using Firefox 59.0.2 doesn't actually take me to the apple website, but it still says apple[dot]com in my web browser...

References:

https://www.xudongz.com/blog/2017/idn-phishing/

https://thehackernews.com/2017/04/unicode-Punycode-phishing-attack.html

https://en.wikipedia.org/wiki/IDN_homograph_attack

  • 1
    It's simply a trade-off between security and usability. We have already discussed how browsers try to prevent these attacks and possible defense measures here: security.stackexchange.com/questions/182680/… – Arminius Apr 14 '18 at 0:22
  • If I recall, Chrome/Chromium has some resistance, and Firefox is still vulnerable. – forest Apr 14 '18 at 0:31
  • 1
    In Chrome, that URL appears as https://www.xn--80ak6aa92e.com/ both when I mouse over it and in the URL bar when I go to it. – Neil Smithline Apr 14 '18 at 0:45
  • In Firefox, it only does that if you set network.IDN_show_punycode to true. – forest Apr 14 '18 at 1:03
  • 1
    @AndrolGenhald If I recall, a web page can spoof the bottom left mouseover bar, as Google for example does. It cannot be relied upon. See for example this answer. – forest Apr 14 '18 at 2:31
1

No, Humans are vulnerable to the homograph attack, browsers are unaffected.

Chrome has a partial work-around that offers a false sense of security to those who buy the hype.

In the general case of the attack both domain names are IDN and the user can't be expected to differentiate between two different random-looking strings of ASCII characters.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.