{"id":8919,"date":"2018-10-10T12:43:51","date_gmt":"2018-10-10T12:43:51","guid":{"rendered":"http:\/\/ebrandservices.com\/?p=8919"},"modified":"2024-07-16T09:11:15","modified_gmt":"2024-07-16T09:11:15","slug":"homograph-attacks-increase-need-for-brand-protection","status":"publish","type":"post","link":"https:\/\/ebrand.com\/it\/blog\/homograph-attacks-increase-need-for-brand-protection\/","title":{"rendered":"Homograph attacks increase need for brand protection"},"content":{"rendered":"

Internationalised domain names (IDNs) allow users to register domain names in almost any written language, enabling today\u2019s global internet to become more multilingual. However, non-Latin script Unicode characters are making it easier for cybercriminals to register domain names for phishing websites. This website phishing technique, known as a homograph attack or IDN spoofing, is nothing new but reports indicate it\u2019s a growing problem. If your domain isn\u2019t being monitored, your brand is unprotected and may be at risk.<\/p>\n

Unicode confusables key to homograph attacks<\/h2>\n

Farsight Security, the world\u2019s largest provider of DNS data, has reported<\/a> that between May 2017 and April 2018, nearly 36,000 domains were used to imitate 466 top brands with lookalike domains which used confusable characters. These brands came from diverse industries, ranging from banking to retail to technology. 91 percent of these IDNs were considered \u201cconfusable\u201d.<\/p>\n

IDNs represent characters in scripts other than Latin. Like other domains, IDNs rely on Unicode, which is the standard for digital representation of all the world\u2019s languages. However, the key to a homograph attack is a specific Unicode formula known as Punycode. Punycode converts non-Latin script characters into code that is readable by DNS. For example, espa\u00f1a.com converted by Punycode creates the domain xn-espaa-rta.com. DNS will have no trouble recognizing xn-espaa-rta.com as it does not contain any non-Latin characters.<\/p>\n

The problem, though, is that letters from different alphabets can look the same in different languages. These are called \u201cconfusables<\/a>\u201d. Confusables are nearly undetectable to users, email clients, or web browsers.<\/p>\n

To an untrained eye, there is no problem. But look closely at the \u201co\u201d above \u201ctower\u201d and you\u2019ll see a small diacritic mark – \u201c\u022f\u201d – which is used in some languages so, therefore, supported by Unicode.<\/p>\n

This is the kind of small language script change that fraudsters rely on. They trick you into thinking you\u2019re seeing one thing but, in reality, they\u2019re redirecting you to a lookalike phishing site.<\/p>\n

Combatting homograph attacks is everyone\u2019s responsibility<\/h2>\n

ICANN (Internet Corporation for Assigned Names and Numbers) has taken steps to fight homograph attacks. Its Guidelines for the Implementation of Internationalized Domain Names provides registries and registrars with rules<\/a> designed to help restrict the prevalence of homograph attacks and keep brands protected. Unfortunately, Farsight\u2019s research indicates not everyone is adhering to the rules.<\/p>\n

Many browsers have also responded to the growing threat of homograph attacks by providing warnings to users about potential Punycode lookalikes.<\/p>\n

Notice how in both examples the website address is converted to Punycode, \u201cxn--80a7a.com\u201d so visitors better understand this is a lookalike site. It is not the actual \u201c.ca.com\u201d site they are searching for. It is, instead, one using the Cyrillic \u201ca\u201d to trick users.<\/p>\n

But what about outside browsers where such warning don\u2019t exist? Users have a number of options:<\/p>\n