Hacker News new | ask | show | jobs
by TeMPOraL 4010 days ago
That is an excellent idea! In fact, we've just implemented the billing service, so please go to http://cuttIeph1sh.com/account/billing, log in to your account and provide your payment information to continue receiving our phishing reports!
1 comments
Intermernet 4009 days ago
Cyrillic homographs[1] are your friend here :-)

http://сuttlерhish.com/account/billing

(PunyCode [2]: http://xn--uttlhish-f8g4if.com/account/billing )

Also, it seems that Firefox (v38.0.5 Windows) doesn't convert URL interpuncts (mid-dots) into punycode, so clicking on something like http://www.billing·cuttlephish.com/ doesn't actually rewrite the URL in the address bar. Chrome converts it to http://www.xn--billingcuttlephish-c4a.com/ .

[1]: https://en.wikipedia.org/wiki/IDN_homograph_attack

[2]: https://en.wikipedia.org/wiki/Punycode

link
Manishearth 4009 days ago
Filed https://bugzilla.mozilla.org/show_bug.cgi?id=1178095, thanks!
link
Intermernet 4009 days ago
No problem.

Out of interest, do the Firefox team and the Chromium team compare notes on decisions like this?

Purely in this one area (IDN homograph attacks), it might be an idea to look at the Chromium Unicode vetting rules (Which characters and combos get "punycoded") as they seem to be more conservative from a "Latin" perspective.

I'm not sure if a "blacklist" (mentioned in the bug report) is the best way of handling this. Perhaps only direct-encoding the "exemplar characters" for the language setting, and punycoding everything else? I'm pretty sure it would have eliminated the mid-dot issue, but perhaps this "whitelist" is too prohibitive.

link