Two lookalike characters slip past Chromium's typosquatting defences

[RainyDayFund]

Security researchers have found two characters that let lookalike web addresses get past Chromium based browsers' defences, The Register reports. Ian Muscat and Leanne Briffa of Have I Been Squatted identified the Cyrillic letter ө, which looks like an o, and the Latin letter ƙ, a k with a hook. They registered 20 test domains, including oƙta.com and niƙe.com. All of them bypassed the main protections in Chrome and other Chromium browsers

Chromium has two key checks. One is a set of seven checks dating from 2017, which only act if every character comes from a hard coded list of Cyrillic lookalikes. The other compares domains against around 8,500 popular sites, and ƙ beats it because it has no accent to strip away. Chromium's Safety Tips warnings also ignore domains shorter than five characters

Email clients behaved differently. Gmail showed all 20 test domains as normal looking text, which could fool people. Outlook on the web displayed all 20 in their encoded Punycode form, which starts with xn-- and makes fakes obvious. That shows how much display choices matter for security

The researchers also looked at the wider picture. Of about 167 million .com domains, roughly 162,000 internationalised domains resemble plain ASCII ones. Not all of those are malicious, as many are legitimate sites in other languages. But the potential for abuse is clear

Internationalised domain names are important, because they let people use web addresses in their own scripts. The challenge is keeping that inclusiveness while stopping phishing. Fixes for these two characters should be straightforward, and the research helps browser makers tighten their rules. In the meantime, password managers are a great defence, since they will not autofill on a fake domain

Have you ever been fooled by a lookalike domain? And should browsers show Punycode by default for mixed script domains?

Two characters open up a world of typosquatting opportunities in Chromium browserswww.theregister.com