1

I just got a very phishy looking email from Vodafone. It had encoding errors and nothing more than my name in it. It asked me to confirm my email address and in order to do that I had to enter some contract details after clicking a link. It turned out to be genuine and was indeed about a product I recently ordered from them.

Because it looked so phishy I had double checked that the domain was actually vodafone.de and that the certificate was issued by a trusted issuer. But it got me wondering - does that actually protect me from attacks like homograph attacks or overlong encoding attacks? Are certificate issuers bound to some standard about checking the domain name that they are signing?

Improve this question
1
  • 2
    Why should the certificate issuer check for this? Isn't this more in the responsibility of the domain registrar? The CA will only issue certificates for domain which actually exist. Also, it would not protect against simple HTTP requests if only the CA checks - because with plain HTTP no certificates are involved.
    – Steffen Ullrich
    Commented Sep 13, 2021 at 15:25

2 Answers 2

Reset to default
2

But it got me wondering - does that actually protect me from attacks like homograph attacks or overlong encoding attacks?

No. A homograph attack would show you vοdafone.de but the first ο isn't really ο. From your browser point of view, the domain is valid, the certificate is valid, and issued for that domain. You would read the information on the certificate and it would deceive you.

How you can protect yourself? By checking if the domain you are seeing is a homograph or not. There are tools and browser extensions for that.

Using a password manager helps immensely too. A password manager will not be fooled by the homograph. For it, vodafone.de and vοdafone.de are completely different domains, even if for you (and me) they look the same. If you try to login and your password manager complains that it does not recognize the domain, make sure to check if the domain is really what it looks.

Are certificate issuers bound to some standard about checking the domain name that they are signing?

They should, but that's not always the case. There were several instances of a fraudulent Google certificate caught in the wild. So even if the Certificate Authorities are bound to check if the entity requesting the certificate is entitled to that certificate, sometimes they get confused and issue a certificate when they should not. Other times they are compromised and attackers can use their infrastructure to issue fraudulent certificates.

Improve this answer
4
  • One thing that might be worth mentioning is Certificate Transparency logs as a method of combating this type of impersonation.
    – Polynomial
    Commented Sep 13, 2021 at 22:46
  • Well there are other rather arbitrary restrictions, like you have to have a certain email address, no certificates for IP addresses, etc. But ok, so the answer is "no". In my password manager (Keepass) I think I would have to copy the link to the search field and then manually remove everything but the domain name. Copying the link to an editor and searching for "vodafone" would probably be easier.
    – AndreKR
    Commented Sep 13, 2021 at 23:12
  • @Polynomial How would that work? I can see how someone could check the logs for homograph attacks but if they find one, what would they do with that information? They have no way to warn me.
    – AndreKR
    Commented Sep 13, 2021 at 23:14
  • @AndreKR It's more about security researchers and organisations monitoring CT logs and reporting homographs to the issuing authority. I helped a financial provider in the UK build a capability around this a few years ago, along with detection of malicious Google ads, to help get ahead of phishing attacks.
    – Polynomial
    Commented Sep 13, 2021 at 23:52
1

Unfortunately it's simply impossible to determine when a request for a domain or certificate would be used to phish/scam people.

For example nissan.com is a perfectly valid domain even though it does not refer to the brand you are thinking of, but the owners could decide to sell the domain to some scammers. How can CAs and registrar decide which requests should be allowed and which wont? They cannot without affecting some business or legitimate person.

There are companies that work with certificate transparency & registrars to detect suspect domains to investigate. But to do this you have to start from a know set of "good domains" you want to protect and you can then check all domain registrations to see if there is some suspect domain active. You can probably pay a subscription to have them check your domains and they will notify you when a suspect domain is registered.

Other than this:

  • avoid clicking on links, prefer typing at least the domain part of the URL (so if the email contains what looks like vodafone.com/something type vodafone.com/ on the URL bar and then copy/paste the rest
  • use a password manager that is integrated with the browser or that has a plugin with the browser (you mention Keepass... KeepassXC has a browser plugin)
  • When copy&pasting you may want to paste the text into some program which uses a font with only ASCII so that non-ASCII characters are easily detected (but check carefully for typos...)
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .