Following insights from The Register, researchers have identified new characters that can be used by malicious actors to create domain names that appear legitimate in web browsers, potentially leading to phishing and credential theft.
Researchers Ian Muscat and Leanne Briffa from Have I Been Squatted discovered that characters such as the Cyrillic 'ө' and the Latin 'ƙ' can bypass security checks in Chromium-based browsers. These characters visually resemble standard Latin letters 'e', 'o', and 'k', allowing attackers to register domain names that look identical to legitimate ones when displayed in Unicode, despite appearing as different Punycode when rendered correctly. For example, 'аррӏө.com' appears as 'apple.com' to unsuspecting users. These bypasses exploit weaknesses in Chromium's SafeToDisplayAsUnicode and GetSimilarTopDomain functions. The former has a hardcoded list of known Cyrillic characters, and if a character is not on this list, the check can be bypassed. The latter compares domain skeletons against a list of popular websites, but characters like 'ƙ' do not have accents and are not properly processed, allowing them to slip through. While browsers have additional defenses like Safety Tips, these can also be circumvented by domains with multiple character changes or fewer than five characters. Email clients are even less secure, with Gmail and Outlook Web showing varying degrees of vulnerability to these spoofed domains. The scale of the issue is significant, with an estimated 162,000 pairs of internationalized domain names (IDNs) resembling plain ASCII domains, posing a considerable risk to users.
Source: The Register
