5 ms·

>A closer link at the link, however, shows that the site is not the genuine one. In fact, ķeepass[.]info —at least when it appears in the address bar—is just an

by jasode 3y ago

>A closer link at the link, however, shows that the site is not the genuine one. In fact, ķeepass[.]info —at least when it appears in the address bar—is just an encoded way of denoting xn--eepass-vbb[.]info, which it turns out, is pushing a malware family tracked as FakeBat. Combining the ad on Google with a website with an almost identical URL creates a near perfect storm of deception. “Users are first deceived via the Google ad that looks entirely legitimate and then again via a lookalike domain,” Jérôme Segura, head of threat intelligence at security provider Malwarebytes, Back in 2017, Google Chrome 59 supposedly fixed the Punycode phishing attack. E.g. story: https://www.engadget.com/2017-04-17-google-chrome-phishing-unicode-flaw.html https://www.engadget.com/2017-04-17-google-chrome-phishing-u... Maybe a dedicated criminal studied the Chromium source code that checks Punycode and noticed a flaw where it would allow 'ķ' in place of 'k' ??? https://www.xn--80ak6aa92e.com/ https://www.xn--80ak6aa92e.com/ --> fake "аррӏе.com" triggers phishing warning https://xn--eepass-vbb.info/ https://xn--eepass-vbb.info/ --> fake "ķeepass.info" does not trigger warning

rob74 3y ago
The first "punycode attacks" were using letters that were completely indistinguishable from the "real" ones (e.g. by using Cyrillic letters). I guess the assumption is that the user would be able to identify any letters with diacritics (even if they're indistinguishable from specks of dust on your screen) and avoid them - after all, you wouldn't go to "göogle.com" either?
- rapind 3y ago
  ķ does look a lot like screen dirt though. ö not so much.
  - high_5 3y ago
    Yeah it's really frustrating for me to look at it because of such appearance.
  - dspillett 3y ago
    Also the , may be somewhat obscured by link underlining, which additions atop a letter would not be.
    - WorldMaker 3y ago
      Modern typography in Firefox and Edge (I can't speak to Chrome as I don't have it installed) has actually done a great job of skipping underlines across descenders of all sorts (as proper underlining is supposed to do).
      - klyrs 3y ago
        http://test.ķ.test http://test.xn--ifa.test Ah, funny. HN renders the ķ as punycode in urls. In the interest of sharing negative results, I leave this here.
  - burnished 3y ago
    I tried to brush the dust off my screen before reading reading your comment. Can confirm, does look like dust
- Quikinterp 3y ago
  weird because the keepass example, on chrome + android, looks exactly like a regular k in the address bar.
  - jasode 3y ago
    >looks exactly like a regular k in the address bar. Because there's a quick 302 redirect from "ķeepass.info" to "keepass.info" : Chrome F12 Dev Tools network trace: https://imgur.com/a/vrxjsUV https://imgur.com/a/vrxjsUV Whether that redirect was there at the time of the Arstechnica article, I don't know. EDIT ADD: around 12:57 UTC, the 302 redirect was changed to a Youtube video: https://imgur.com/a/TtLxafP https://imgur.com/a/TtLxafP (Somebody is apparently having fun trolling the internet.) ICANN lookup trivia says "ķeepass.info" domain was created 3 days ago: Domain Information Name: xn--eepass-vbb.info Internationalized Domain Name: ķeepass.info Registry Domain ID: a375f89abb384328a10460509f9f99f8-DONUTS Domain Status: clientTransferProhibited addPeriod Nameservers: leia.ns.cloudflare.com sevki.ns.cloudflare.com Dates Registry Expiration: 2024-10-16 10:21:45 UTC Updated: 2023-10-19 11:40:19 UTC Created: 2023-10-16 10:21:45 UTC
    - Quikinterp 3y ago
      Well that's good news, I was a little worried that it would be impossible to tell on mobile
- matrss 3y ago
  As a german I wouldn't go to göogle.com. If my native language didn't include ö? Then that might be a speck of dust to me as well. A safer approach would be to only ever show a user the characters they expect to see (and are familiar with), e.g. based on their language setting. Assuming that every language has a finite list of characters used in its written form such a whitelist approach should be possible and much better than playing whack-a-mole with a blacklist for "potentially confusable" characters.
  - addandsubtract 3y ago
    I don't think it's that easy. Most people A) use english as their system language, because troubleshooting menus / error messages in foreign languages is a nightmare, and B) my mom would not notice the difference between google and göogle.
  - hnfong 3y ago
    > Assuming that every language Oof. Take for example, both 糉 and 糭 are valid characters in Chinese. One is a variant of the other. Which one is "canonical" depends on who (i.e. which authority, of which there are many) you ask. And FWIW the language and regional settings don't necessarily give an answer to the canonical representation. Those characters mean the same thing with or without the specks of dust. So, what's your solution here? To be fair, Unicode domains are inherently a huge mess. The thing is that we don't need more armchair experts dreaming up Euro-centric solutions.
    - necovek 3y ago
      It still sounds like an improvement: while they might still fall for malicious URLs in their own language, they would not for other scripts. But as someone said, tiny, valid differences are easy to miss anyway, and original URL attacks were replacing similar-looking ASCII graphemes (eg. l for 1), so this will all continue.
      - hnfong 3y ago
        > while they might still fall for malicious URLs in their own language, they would not for other scripts. That's totally backwards. If the assumption is that users of language X will legitimately visit sites of language Y with sufficient frequency, then all that language-specific filtering makes no sense.
gnfargbl 3y ago
The relevant sections of the Chrome IDN rules [1] seem to be detection of "mixed script confusables" and "whole script confusables". The character ķ (U+0137) is part of the Latin script [2], so I presume the string "ķeepass.info" won't trigger the mixed-script confusable test. I don't see ķ listed in the "whole script confusable" glyphs [3]. Should ķ be included there? There's a comment in the Greek section of that file to the effect that "variants such as ά, έ, ή, ί" are ignored, so perhaps there is a general rule that accented characters are not considered to be confusables? If so, that makes some sense to me; French users would presumably be a bit disappointed if a domain name containing an é were rendered in the Punycode form, for instance. [1] https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md https://chromium.googlesource.com/chromium/src/+/main/docs/i... [2] https://www.compart.com/en/unicode/U+0137 https://www.compart.com/en/unicode/U+0137 [3] https://source.chromium.org/chromium/chromium/src/+/main:components/url_formatter/spoof_checks/idn_spoof_checker.cc?q=kWholeScriptConfusables&ss=chromium https://source.chromium.org/chromium/chromium/src/+/main:com...

by jasode 3y ago

rob74 3y ago

The first "punycode attacks" were using letters that were completely indistinguishable from the "real" ones (e.g. by using Cyrillic letters). I guess the assumption is that the user would be able to identify any letters with diacritics (even if they're indistinguishable from specks of dust on your screen) and avoid them - after all, you wouldn't go to "göogle.com" either?

rapind 3y ago
ķ does look a lot like screen dirt though. ö not so much.
- high_5 3y ago
  Yeah it's really frustrating for me to look at it because of such appearance.
- dspillett 3y ago
  Also the , may be somewhat obscured by link underlining, which additions atop a letter would not be.
  - WorldMaker 3y ago
    Modern typography in Firefox and Edge (I can't speak to Chrome as I don't have it installed) has actually done a great job of skipping underlines across descenders of all sorts (as proper underlining is supposed to do).
    - klyrs 3y ago
      http://test.ķ.test http://test.xn--ifa.test Ah, funny. HN renders the ķ as punycode in urls. In the interest of sharing negative results, I leave this here.
- burnished 3y ago
  I tried to brush the dust off my screen before reading reading your comment. Can confirm, does look like dust
Quikinterp 3y ago
weird because the keepass example, on chrome + android, looks exactly like a regular k in the address bar.
- jasode 3y ago
  >looks exactly like a regular k in the address bar. Because there's a quick 302 redirect from "ķeepass.info" to "keepass.info" : Chrome F12 Dev Tools network trace: https://imgur.com/a/vrxjsUV https://imgur.com/a/vrxjsUV Whether that redirect was there at the time of the Arstechnica article, I don't know. EDIT ADD: around 12:57 UTC, the 302 redirect was changed to a Youtube video: https://imgur.com/a/TtLxafP https://imgur.com/a/TtLxafP (Somebody is apparently having fun trolling the internet.) ICANN lookup trivia says "ķeepass.info" domain was created 3 days ago: Domain Information Name: xn--eepass-vbb.info Internationalized Domain Name: ķeepass.info Registry Domain ID: a375f89abb384328a10460509f9f99f8-DONUTS Domain Status: clientTransferProhibited addPeriod Nameservers: leia.ns.cloudflare.com sevki.ns.cloudflare.com Dates Registry Expiration: 2024-10-16 10:21:45 UTC Updated: 2023-10-19 11:40:19 UTC Created: 2023-10-16 10:21:45 UTC
  - Quikinterp 3y ago
    Well that's good news, I was a little worried that it would be impossible to tell on mobile
matrss 3y ago
As a german I wouldn't go to göogle.com. If my native language didn't include ö? Then that might be a speck of dust to me as well. A safer approach would be to only ever show a user the characters they expect to see (and are familiar with), e.g. based on their language setting. Assuming that every language has a finite list of characters used in its written form such a whitelist approach should be possible and much better than playing whack-a-mole with a blacklist for "potentially confusable" characters.
- addandsubtract 3y ago
  I don't think it's that easy. Most people A) use english as their system language, because troubleshooting menus / error messages in foreign languages is a nightmare, and B) my mom would not notice the difference between google and göogle.
- hnfong 3y ago
  > Assuming that every language Oof. Take for example, both 糉 and 糭 are valid characters in Chinese. One is a variant of the other. Which one is "canonical" depends on who (i.e. which authority, of which there are many) you ask. And FWIW the language and regional settings don't necessarily give an answer to the canonical representation. Those characters mean the same thing with or without the specks of dust. So, what's your solution here? To be fair, Unicode domains are inherently a huge mess. The thing is that we don't need more armchair experts dreaming up Euro-centric solutions.
  - necovek 3y ago
    It still sounds like an improvement: while they might still fall for malicious URLs in their own language, they would not for other scripts. But as someone said, tiny, valid differences are easy to miss anyway, and original URL attacks were replacing similar-looking ASCII graphemes (eg. l for 1), so this will all continue.
    - hnfong 3y ago
      > while they might still fall for malicious URLs in their own language, they would not for other scripts. That's totally backwards. If the assumption is that users of language X will legitimately visit sites of language Y with sufficient frequency, then all that language-specific filtering makes no sense.

gnfargbl 3y ago

The relevant sections of the Chrome IDN rules [1] seem to be detection of "mixed script confusables" and "whole script confusables". The character ķ (U+0137) is part of the Latin script [2], so I presume the string "ķeepass.info" won't trigger the mixed-script confusable test. I don't see ķ listed in the "whole script confusable" glyphs [3]. Should ķ be included there? There's a comment in the Greek section of that file to the effect that "variants such as ά, έ, ή, ί" are ignored, so perhaps there is a general rule that accented characters are not considered to be confusables? If so, that makes some sense to me; French users would presumably be a bit disappointed if a domain name containing an é were rendered in the Punycode form, for instance. [1] https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md https://chromium.googlesource.com/chromium/src/+/main/docs/i... [2] https://www.compart.com/en/unicode/U+0137 https://www.compart.com/en/unicode/U+0137 [3] https://source.chromium.org/chromium/chromium/src/+/main:components/url_formatter/spoof_checks/idn_spoof_checker.cc?q=kWholeScriptConfusables&ss=chromium https://source.chromium.org/chromium/chromium/src/+/main:com...