3 ms·
During a phishing test at an old company, I was able to: 1. buy a cheap VPS ($5) 2. Buy a domain name with homoglyph unicode similar to the company's
by pierat 3y ago
During a phishing test at an old company, I was able to:
1. buy a cheap VPS ($5)
2. Buy a domain name with homoglyph unicode similar to the company's name
3. get a full stack of ssl from letsencrypt for the attack domain
4. set up postfix to use this domain with SPF/DKIM/DMARC
I then sent emails as the "CEO" and got by every spam and anti-impersonation filter. Outlook showed my emails as 100% legit in all ways. The ONLY way to tell was to go to email->properties->headers and KNOW and check the IP addresses of the servers.
Homoglyphs in Outlook desktop app are not shown as punycode. However the users who used OWA saw the punycode expansion of the domain and rightly reported them.
- Symbiote 3y agoI thought that had been fixed, by ordering the registrars not to allow problem domains (e.g. domain must be entirely in Cyrillic+Numbers or not at all), though Wikipedia says this isn't yet the case for .com. I'm not sure if that's up-to-date though. Pretending I work for asdf.com, I could register аsdf.com (Cyrillic а) and maybe αsdf.com (Greek α) as a precaution. But "xn--sdf-5cd.com" and "xn--sdf-nxc.com" both show as unavailable for registration. Something like asclf.com (all ASCII) could be mistaken in some circumstances.