Punycode URL attack can trick Chrome and Firefox users

[Kevin Lancaster]

Punycode URL attack can trick Chrome and Firefox users

The way Chrome, Firefox, and Opera handle special characters in URLs may be exploited to set up a website with a URL that looks exactly the same as a reputable website, Bleeping Computer reported.

 

[MickZA]

Zheng said Firefox users can set the browser to always display non-Latin URLs in Punycode by going to “about:config” and setting “network.IDN_show_punycode” to true.

Done

 

[RyanPCMR]

Thanks for the warning MyBB and well done!

 

[Chris.Geerdts]

I presume if you click on xn–pple–43d.com and get an error message, then your browser is safe from this

 

[Thor]

Thanks for the warning MyBB and well done!

I think there was a thread about this

 

[Johnatan56]

I presume if you click on xn–pple–43d.com and get an error message, then your browser is safe from this

https://www.xn--80ak6aa92e.com/

Can confirm that the above link:hover also changes to the correct URL in firefox if enabled, on Chrome the link:hover is still apple.com


EDIT:

 

[gregmcc]

Damn. Neat trick that. (And nasty)

 

[MickZA]

... takes you to the article by Xudong Zheng

 

[RyanPCMR]

I think there was a thread about this

I must have missed that thread but am glad that I saw this one.

Just saw that this is fixed in Google Chrome Canary.

 

[Praeses]

https://www.xn--80ak6aa92e.com/

Can confirm that the above link:hover also changes to the correct URL in firefox if enabled, on Chrome the link:hover is still apple.com


EDIT:
View attachment 431490

Chrome 58 Stable is now available which fixes it

 

[Praemon]

Just to add that I got tricked by a punycode url this morning, and was none the wiser until things started getting suspicious. So I was sent an imgur url. Looked perfectly fine. Opened it up, and looks like the normal Imgur site, however, the thumbnail was quite small. I clicked on it to enlarge, but it downloaded a zip. That was when I was like WTF. So looked into the source and it was pulling from a weird domain, which obviously was using punycode (started with xn--). I immediately deleted the zip and ran virus scanners, but hopefully nothing untoward happened unless you opened the zip.

And to note, the latest Chrome (using 58.0.3029.81) DOES NOT pick up this issue. Latest Firefox did not pick up anything suspicious either. I've since turned on "show punycode" in Firefox, which helps. However, Chrome currently has no defences against this. I've installed an add-on that gives a small pop-up, but it's not great, and seems to have false-positives.

I believe only Chrome v59 will properly detect this when it comes out. So just a big warning, that you aren't safe with the latest browser versions without making some changes or installing extensions for additional insight.