Fast Facts
- Malicious actors can register visually identical domain names using characters like Cyrillic ‘ө’ and Latin ‘ƙ’, tricking users into phishing sites.
- Browser security checks can be bypassed due to weaknesses in Unicode rendering functions, allowing spoofed domains to appear legitimate.
- Over 162,000 IDN pairs resemble legitimate domains, significantly increasing the risk of credential theft and user deception.
Threat, Attack Techniques, and Targets
Researchers from Have I Been Squatted have found new ways for malicious actors to create lookalike domains. They use special characters like Cyrillic ‘ө’ and Latin ‘ƙ’ that look like normal Latin letters such as ‘e’, ‘o’, and ‘k’. These characters can pass through security checks in Chromium-based browsers. Attackers register these fake domains to trick users and steal credentials. The fake domains look very similar to real ones, like ‘apple.com’. This trick can fool many browsers and email clients. The main targets are internet users who might visit these spoofed sites or receive emails from these fake domains. The attack exploits weaknesses in browser functions like SafeToDisplayAsUnicode and GetSimilarTopDomain, which do not recognize certain characters as suspicious. Overall, this creates a large risk, with about 162,000 similar IDN pairs that look like legitimate sites.
Impact, Security Implications, and Remediation Guidance
These fake domains pose a serious security threat. Users can be deceived into thinking they are visiting real websites, which could lead to phishing or credential theft. Browsers and email clients have some defenses, but these can be bypassed, especially when domains use multiple character changes or fewer than five characters. The vulnerabilities mean that some security checks are not enough to prevent spoofing. Organizations should stay updated on the latest security patches from their browsers and email providers. They should also educate users about the risks of lookalike domains. If you want detailed instructions for protection, consult your browser or email service vendor. The guidance should come directly from the relevant security provider or authority to ensure effective mitigation.
Continue Your Tech Journey
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
