Re: thoughts and a possible solution on homograph attacks

From: Mike Nice (niceman_at_att.net)
Date: 03/08/05

  • Next message: Conectiva Updates: "[CLA-2005:931] Conectiva Security Announcement - squid" 
    To: <bugtraq@securityfocus.com>
Date: Tue, 8 Mar 2005 07:33:14 -0500

    >It's rather trivial to determine programatically that www.paypal.com is
    >different from www.paypa1.com, but look similar. One might argue to rest
    >the burden with DNS registries (why would anyone legitimately want
    >paypa1.com?), but that's not likely to fly. Could it rest within the
    >browser? ("Hey buddy, you're going to paypa1.com--did you mean Pay Pal?"
    >or "Enable Unicode in URLs"). Perhaps with an addon ("Hey buddy, you're
    >going to a restricted domain-- are you sure?"). Finally, it could rest
    >with the operating system (via a variety of mechanisms).

     While not exactly a solution to homograph attacks, there is an entire class
    of man-in-the middle attacks (DNS poisoning, wireless Evil twin, etc) that
    make use of look alike domain names as well as just redirecting the IP data
    stream to a different server.

      Paypal - go to URL bar, type in 'www.paypal.com', put in your username and
    password and log in
      Bank - go to URL bar, type in 'www.mybank.com', put in your username and
    password and log in.
      Bank - go to URL bar, type in 'www.mybank.com', click on the SSL login
    page, put in your username and password and log in.

    BZZZT - wrong! You are vulnerable to a man in the middle attack (except if
    you examined the SSL certificate and/or URL prior to login in the 3rd case).
    This is particularly important on a laptop if you travel to multiple
    locations and wireless access points. A simple rule of thumb for less
    techie computer uses is to teach them how to examine SSL certificates for
    validity. Then find and bookmark the secure login page. Then if the SSL
    certificate name doesn't match the browser's bookmark name, they'll get a
    warning popup that the name doesn't match.

      The simple rule for everyone: bookmark the secure login page of sites
    where you enter your username and password. In the real world, we don't
    examine each SSL certificate at every login. ....How do you get to paypal
    or your online banking?

  • Next message: Conectiva Updates: "[CLA-2005:931] Conectiva Security Announcement - squid"

    Relevant Pages

    • Problem handling Login control Authenticate event
      ... login process. ... required for login… they have a username, password, and another “location ... and when the extra input field is submitted ... for the users where this concatenation of the two input field ...
      (microsoft.public.dotnet.framework.aspnet)
    • RE: unable to login as user
      ... unable to login as user ... Log in as root and look closely at the user account. ... the system just seems to hang and then go back to the username ...
      (RedHat)
    • Re: Unable to log into OWA despite using correct username and pass
      ... the OWA interface despite using the correct username and password. ... OWA login page is displayed correctly but when trying to login users get ... "You could not be logged on to Outlook Web Access. ... The issue is affecting all accounts including the 'Administrator' ...
      (microsoft.public.exchange.clients)
    • Re: ADSL connection username change (bt_test) - Side effects?
      ... automatically re-establish itself after a failure, ... does using the BT test login have any side effects. ... Has you tried re-entering the username and PW prior to trying ... My router recently locked me out of MAC code filtering settings and it was ...
      (uk.telecom.broadband)
    • Re: failed password tries...!!
      ... but log only the username if the ... password/username pair is reversed but otherwise valid; and if a login ... The encryption code must be on the auth ... without first compromising your private key somehow. ...
      (comp.lang.java.programmer)