Typo-squatting Attacks Using Homoglyphs Remain Viable Against Major Domains

Unicode Domains and Typo-squatting Risks

The introduction of Unicode characters in domain names, while commendable for internationalization, introduced risks like typo-squatting. This involves creating malicious websites with URLs that visually mimic legitimate ones through the use of homoglyphs—characters from different alphabets that appear identical or very similar. Users can inadvertently land on these fake sites through mistyped addresses or search results.

Chromium's Protection Mechanisms

Chromium browsers incorporate advanced rules to identify and prevent users from accessing deceptive domains. These rules often involve displaying domain names in Punycode format if non-Latin characters are mixed with Latin ones, or if domains are composed entirely of known problematic homoglyphs from a specific list. For instance, using a Cyrillic 'а' within 'apple.com' would result in 'xn--pple-43d.com' being displayed.

Evasion Through Edge Cases

A blog post from Have I Been Squatted (HIBS) demonstrated an evasion technique using 'аррӏө.com'. While 'аррӏе.com' (using all Cyrillic lookalikes for 'apple') would be flagged by Chromium's list of 29 problematic Cyrillic characters, the domain 'аррӏө.com' bypasses these checks. The key is the Cyrillic character 'ө', which visually resembles a Latin 'e' but was not included in Chromium's specific list of 29 Cyrillic characters flagged for homoglyph attacks.

Implications for Domain Security

This example highlights the ongoing challenge of comprehensively detecting typo-squatting. Even with sophisticated rule sets, the vast number of Unicode characters and their visual similarities mean that new edge cases can emerge. This requires continuous vigilance and updates to browser security mechanisms to counter evolving evasion tactics by malicious actors.