{"id":338918,"date":"2017-04-21T03:43:22","date_gmt":"2017-04-20T19:43:22","guid":{"rendered":"http:\/\/techcrunch.com\/?p=1479479"},"modified":"2017-04-21T03:43:22","modified_gmt":"2017-04-20T19:43:22","slug":"this-phishing-technique-is-more-interesting-than-dangerous","status":"publish","type":"post","link":"https:\/\/people.utm.my\/asmawisham\/this-phishing-technique-is-more-interesting-than-dangerous\/","title":{"rendered":"This phishing technique is more interesting than dangerous"},"content":{"rendered":"

<\/p>\n

There\u2019s no shortage of ways adversaries will employ to get you to click through to a malicious website, some technical, some psychological. This one<\/a> is interesting because it leverages a useful feature of browsers that you might have never thought about.<\/p>\n

Not all websites have names that can be written in the alphabet we that primarily English-speaking countries are familiar with. Why shouldn\u2019t Russian websites use Cyrillic characters, or Japanese ones use kanji? After all, Unicode, the standard for displaying text worldwide, supports all these languages.<\/p>\n

Unfortunately, it\u2019s not standard to allow all those characters in URIs, and some systems only allow standard ASCII ones.\u00a0 The workaround arrived at by web authorities was a system called \u201cPunycode\u201d that encodes international characters using ASCII notation<\/a>. Browsers will know a URI is using the system because it\u2019s always preceded by the characters \u201cxn--\u201c.<\/p>\n

The whole process is done without informing the user; so So \u201cJP\u7d0d\u8c46.\u4f8b.jp\u201d becomes \u201cxn--jp-cd2fp15c.xn--fsq.jp\u201d in transit, but you never see the unintelligible latter one, only the former, rendered in its intended language.<\/p>\n

That transparency, the fact that punycode doesn\u2019t announce it\u2019s being used, is the basis for the phishing attack. An attacker can use punycode to create URIs that look normal to the user but are actually totally different. Pedro Umbolino over at Hack a day<\/a> showed how this is possible in a post that certainly had me fooled.<\/p>\n

Several browsers, including Firefox and Chrome, rendered the link in the first paragraph as what appeared to be apple.com, both inline and in the link preview. But when you click, it goes somewhere totally different.<\/p>\n

In fact, as you find out later in the paragraph or if you change the settings in your browser, the letters in apple.com are actually created by the punycode xn--80ak6aa92e.<\/p>\n

\"\"<\/a>That forms something that looks like apple.com the way browsers render the text, but if you look at the URI in certain monotype fonts, it\u2019s clear there\u2019s a classic capital-\u201cI\u201d\/lowercase-\u201cL\u201d switcheroo, with a Cyrillic twist:<\/p>\n

\"\"<\/a>Clever, right? A hacker could use this in an email or another link to lure even a normally attentive user who inspects suspicious links. As Umbolino shows (and this is a separate issue) the site you\u2019re tricked into visiting may even imitate the real site\u2019s HTTPS status, giving you that reassuring green lock next to the URI.<\/p>\n

Yes Devin, but how do I fix it<\/h2>\n

Firefox and Chrome were the only browsers affected, really \u2014 it just had to to with the defaults they had for displaying punycode stuff. But Chrome 58 (just out) makes those addresses show the full punycode URI in the link preview, and Firefox has a setting that changes it. Just go to about:config, put \u201cpunycode\u201d in the search there, and toggle the setting that comes up to \u201ctrue.\u201d You\u2019ll see the xn-- punycode links from now on \u2014 but remember, most are legit! Just be aware of when you should expect one and when it could be shady.<\/p>\n

You learn something new every day! Well, sometimes.<\/p>\n","protected":false},"excerpt":{"rendered":"

\"\" There’s no shortage of ways adversaries will employ to get you to click through to a malicious website, some technical, some psychological. This one is interesting because it leverages a useful feature of browsers that you might have never thought about. Read More<\/a><\/p>\n

\n<\/img><\/a> <\/img><\/a> <\/img><\/a> <\/img><\/a> <\/img><\/a> <\/img><\/a>\n<\/div>\n

\"\"\/ <\/p>\n","protected":false},"author":5817,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[25],"tags":[59,66,26],"class_list":["post-338918","post","type-post","status-publish","format-standard","hentry","category-technology","tag-media","tag-techcrunch","tag-technology"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/338918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/users\/5817"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/comments?post=338918"}],"version-history":[{"count":0,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/338918\/revisions"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/media?parent=338918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/categories?post=338918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/tags?post=338918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}