New Browser Exploit Found (but not on IE)

DSL Reports ^ | 2/7/2005 | DSL Reports

[smith288]

New Browser Trick Found
Uses homograph attack to spoof links

As members of our Security forum discuss, a new homograph browser trick (see demo page) has been discovered that oddly works in every browser but IE. The trick uses International Domain Name (IDN) character support (using foreign characters that resemble American alphabet letters) to trick your browser into showing fake domain names in hyperlinks and in the address bar. IE doesn't support IDN (though it can via plug-in), so by default isn't vulnerable. More detail in this advisory from the group that discovered it.

[Richard Kimball]

For this spoof to work, you'd have to head to the site from another phishing site or click on a fraudulent email link. This would be one sharp phisher, as the logistics of making a convincing site are pretty difficult using foreign letter codes. Heck, I have a big enough problem making links work with a regular alphabet.

I've never been whacked on my Windows machine or my Mac, by following a couple of simple rules:

1. Don't click on email links
2. Keep virus protection up to date
3. Use a firewall
4. Turn off java
5. Turn off activeX except at trusted sites
6. Turn off javascript when surfing unknown sites
7. Run an Adaware check every so often.
8. If a popup window asks if you want to install the plugin, the answer is no.

[smith288]

I have found the best Anti-Adware program is Microsoft's new one they have out on beta. It caught everything on my machine at work that was completly stifled by ad ware that was running resident in memory. I have it run at 3am and when I get in the next day, it has a dialog box report of what the scan results were. I havent had any problems since.

[steve86]

I have FF 1.0 and it works for me

Even after you restart and run the test?

[papasmurf]

Just curious, but how do you KNOW it got everything? 'Cause, you know, you just don't know what you don't know, you know? :)

:O)

P

[yellowhammer]

Here's some browsers that have tabs, popup blocking, etc. but still use the IE engine and most are free:

Maxthon
SlimBrowser
Avant Browser
Netcaptor
Irider

[yevgenie]

Unfortunately, after restarting Firefox, the about:config setting reads false, but the system is susceptible. =(

[Titan Magroyne]

Once again, thanks for the tips! :o)

[smith288]

Just curious, but how do you KNOW it got everything? 'Cause, you know, you just don't know what you don't know, you know? :)

I dont have casino icons popping up on my desktop or see any weird traffic leaving my machine... All the processes running are accounted for and legit. :)