Jacksonville, Florida - A new Google Chrome extension, released by Phish.ai, detects non-standard Unicode characters in domain names and warns users about the potential for a homograph attack. A homograph attack, sometimes known as Unicode Domain Phishing, uses non-standard characters to mimic the spelling and appearance of legitimate domains. Users think they’re logging into a trusted website when they’re actually having their credentials stolen or possibly even being infected with malware.
How does a Homograph Attack Work?
A homograph attack essentially creates a look-alike URL by using international characters that are different, but look similar to English characters. I wrote an article about homograph attacks and Unicode domain phishing last month if you’d like to go in-depth, but here are the basics.
The internet was designed around the English language. So as more and more non-English speakers have come online, considerable effort has been made to provide support for other languages. One of those efforts is Internationalized Domain Names (IDNs), which allow for domains and TLDs to be registered in other languages. Unfortunately, one of the unintended side effects of this was the advent of homograph attacks.
Here’s how it works, from the standpoint of your computer the American Standard Code for Information Interchange (ASCII) “a” (U+0061) and the Cryillic “a” (U+0430) are entirely different characters, but they are displayed in exactly the same way. That means to the human eye, it’s impossible to tell the difference.
You can probably see where this is going. By registering a Unicode domain, you can use non-ASCII characters and criminals have figured out that you can create some extremely convincing spoofs using this method.
Shouldn’t the Browsers Detect This?
Yes, but so far, the results have varied. Some people believe and have even proposed that browsers should not display IDNs at all, but that has been criticized as “unfairly prejudicial” against non-English users. Engineers at Google have argued that this issue is best handled at the domain registrar level.
Still, the browsers have made efforts to deal with this problem. Some browsers have begun replacing Unicode characters with Punycode, which is an ASCII-based rendering of Unicode characters. Microsoft Edge does this as a default. Last year, researcher Xudong Zheng published a Proof of Concept that fooled both Firefox and Chrome into showing a spoofed apple.com URL.
Both browsers quickly worked on a fix. Mozilla Firefox users can go to about:config and enable “IDN_show_punycode” to add a layer of protection against homograph attacks.
Google, meanwhile, improved its browser mechanism for displaying Unicode domains in version 58. That same apple.com URL now displays like this:
That being said, it’s still not perfect. Chrome displays the Punycode version of the URL in the Title bar, but not the address bar itself.
Phish.ai designed its extension to help fix that. In what would best be described as a love letter to subtlety, a big red window will warn users every time they attempt to access a domain that’s using Unicode characters.
Much like Google’s Safe Browsing alert, the warning message will block access to the website and will require a response from the user to continue. If you would like to start using Phish.ai’s extension, it’s in the Chrome Web Store, or you can find the source code on GitHub.
