Typo-squatting attacks on major domains still work
The Unicode Trick: How Typo-Squatting Sneaks Past the Protections of the Web
When the Internet decided to embrace the vast array of Unicode characters, many tech enthusiasts celebrated the move. However, this seemingly brilliant expansion of character sets introduced a hidden vulnerability: the possibility of malicious actors leveraging characters that look identical to legitimate ones across different alphabets. This subtle visual trick opens the door to a sophisticated form of digital mischief known as typo-squatting.
Typo-squatting involves creating websites with deliberately misspelled domain names that look exactly like legitimate ones. The goal is to lure unsuspecting visitors into clicking malicious links, making it a potent tool for phishing and attack.
The danger lies in the visual similarity of certain characters. Take, for example, Cyrillic letters, which possess visual homoglyphs for many Latin characters. A classic example is how the Cyrillic letter “а” can perfectly mimic the Latin “a,” or “p” can mimic “р.” This visual overlap allows bad actors to craft domains that are virtually indistinguishable from the real ones at a glance.
To illustrate this, a malicious entity might register a domain like “арр<0xD3><0x8F>ө.com.” While this domain is not identical to “apple.com,” it uses a carefully constructed combination of lookalike characters to evade simple checks. This scenario highlights the complexity of policing the ever-growing world of Unicode characters, which boasts nearly 173,000 entries.
Fortunately, technology is fighting back. Browsers like Chromium have become sophisticated gatekeepers, employing advanced rulesets to detect and mitigate these mischievous domains. When a domain name contains homoglyphs, the browser automatically converts it into the technical Punycode format, making the deception visible to the user. For instance, a domain using a homoglyph is transformed into a string like “xn--pple-43d.com,” immediately flagging it as non-standard.
Even when sophisticated attempts are made, like combining multiple lookalike characters, the system still faces edge cases. Researchers have found that while Chromium is remarkably effective—catching over 64 percent of typo-squatting attempts in one study—the challenge remains multifaceted. The issue stems from the fact that no single, universal solution exists for detecting every possible character combination.
Domain registries also play a role by establishing some rules about which characters can be used within specific Top-Level Domains. However, these registry efforts are not a complete solution on their own. The ongoing battle against visual deception requires constant vigilance, as the character sets continually evolve. Ultimately, while automated systems offer powerful protection, the most effective defense involves a combination of technical safeguards and user awareness. Companies dealing with impersonation should look to measures like using passkeys, which bind authentication securely to a specific domain, offering an extra layer of defense against sneaky impersonations.
Credit
