“A security weakness in a standard for handling special character sets in domain names could let an attacker spoof Web sites on non-Microsoft browsers, a researcher has warned.
The problem arises because certain browsers support a standardized way of representing domain names in the letters or characters of any language, security expert Eric Johanson said at the ShmooCon hacker convention this weekend. Called Internationalized Domain Names, the standard allows companies to register domain names that appear to be the same in different languages.
That encoding scheme could enable an attacker to create a fake Web site for a phishing scam. A spoofed link would seem to be a legitimate URL in the address bar of affected browsers--Opera, Apple Computer's Safari, and the Mozilla and Firefox browsers from the Mozilla Foundation. But instead of taking the victim to the trusted site, the link would lead to a phony Web site with a domain rendered as the same address under the IDN process.
The Mozilla Foundation is looking for a long-term solution to the issue, Chris Hofmann, director of engineering at the company, said in a statement.
"With the increase in phishing attacks, there is a growing concern that exploits could take advantage of this feature to trick users into visiting rogue sites," Hofmann stated. "Mozilla is looking at options for fixing or disabling this feature and should have more information available very soon."
Phishing attacks, which try to fool consumers into handing over sensitive information by creating legitimate-looking Web sites and e-mail messages, have become a central security concern recently. While vulnerabilities in Microsoft's Internet Explorer have been the focus of much of the concern, other browsers also have had their fair share of flaws.
The security weakness in the IDN scheme comes as registrars push for support for expressing domain names in different languages and scripts.
"There are now many ways to display any domain name on a browser, as there are a huge number of (character sets) which look very similar to Latin (characters)," Johanson said in an advisory.
The advisory demonstrates the attack using the domain for PayPal, but using an alternate Unicode character for the first "a." That gives an address that looks like "http://www.pàypal.com," but with a smaller "a."
Details of the flaw were shown at ShmooCon, a hacking and computer security convention, in Washington D.C., last weekend.…”
http://www.shmoo.com/idn/homograph.txt| Browser Bugs Spare Internet Explorer for a Change
Larry Seltzer The advisory announcing the vulnerability, which could facilitate phishing and other spoofing attacks, is related to IDN (International Domain Name) support in these browsers. IDN allows for non-English lettering in domain names. It also allows for English lettering using non-English (unicode) character sets. Thus, in the proof-of-concept provided, when linked to "http://www.pаypal.com/" the browsers display "http://www.paypal.com/". But the browsers' handle it as "http://www.xn—pypal-4ve.com." The advisory lists as vulnerable the following browsers:
|
http://news.zdnet.com/2100-1009_22-5566517.html?tag=nl.e539
Posts
No comments:
Post a Comment