{"id":72851,"date":"2020-03-05T02:41:57","date_gmt":"2020-03-04T23:41:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vozmozhnost-registraczii-fishingovyh-domenov-s-pohozhimi-unicode-simvolami-v-imeni"},"modified":"2020-03-05T02:41:57","modified_gmt":"2020-03-04T23:41:57","slug":"vozmozhnost-registraczii-fishingovyh-domenov-s-pohozhimi-unicode-simvolami-v-imeni","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vozmozhnost-registraczii-fishingovyh-domenov-s-pohozhimi-unicode-simvolami-v-imeni","title":{"rendered":"The ability to register phishing domains with similar unicode characters in the name","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Researchers from Soluble identified<\/a><\/noindex> a new way to register domains with homoglyphs<\/a><\/noindex>, which externally resemble other domains but actually differ due to the presence of characters with different meanings. Such internationalized domains (IDN<\/a><\/noindex>) may initially appear indistinguishable from domains of well-known companies and services, allowing them to be used for phishing, even obtaining valid TLS certificates for them.<\/p>\n

Classic spoofing through visually similar IDN domains has long been blocked in browsers and registrars, due to the prohibition of mixing characters from different alphabets. For example, a spoof domain a p p l e . c o m («xn--pple-43d.com») cannot be created by replacing the Latin «a» (U+0061) with the Cyrillic «\u0430» (U+0430), as mixing letters from different alphabets in a domain is not allowed. In 2017, it was found<\/a><\/noindex> a way to bypass such protection through the use of only Unicode characters in the domain, without the use of Latin letters (for instance, using characters from languages with symbols similar to Latin).<\/p>\n

Now another method of bypassing protection has been found, based on the fact that registrars block mixing Latin characters and Unicode, but if the specified Unicode characters in the domain belong to the group of Latin characters, such mixing is permitted, as the characters belong to one alphabet. The problem is that in the Unicode Latin IPA<\/a><\/noindex> extension there are homoglyphs that look similar to other characters of the Latin alphabet:
\nthe symbol «ɑ<\/a><\/noindex>» resembles «a», «ɡ<\/a><\/noindex>» \u2014 «g», «ɩ<\/a><\/noindex>» \u2014 «l». <\/p>\n

\"The<\/a><\/noindex><\/center><\/p>\n

The ability to register domains that mix Latin characters with the specified Unicode characters has been identified in the registrar Verisign (other registrars were not checked), and subdomains were created in services like Amazon, Google, Wasabi, and DigitalOcean. The issue was discovered last November and, despite notifications sent, was only resolved at the last moment in Amazon and Verisign three months later.<\/p>\n

During the experiment, researchers spent $400 to register the following domains in Verisign:<\/p>\n