SecurityFocus

Apple Safari: cookie stealing Jun 13 2007 10:34AM
Robert Swiecki (jagger swiecki net) (2 replies)

Re: [Full-disclosure] Apple Safari: urlbar/window title spoofing Jun 14 2007 11:31PM
Robert Swiecki (jagger swiecki net) (2 replies)

Re: Apple Safari: idn urlbar spoofing Jun 25 2007 08:33PM
Robert Swiecki (jagger swiecki net) (1 replies)

RE: [Full-disclosure] Apple Safari: idn urlbar spoofing Jun 25 2007 09:15PM
Larry Seltzer (Larry larryseltzer com) (1 replies)

Re: [Full-disclosure] Apple Safari: idn urlbar spoofing Jun 25 2007 09:22PM
Michal Zalewski (lcamtuf dione ids pl) (1 replies)

Re: Apple Safari: idn urlbar spoofing Jun 27 2007 09:27AM
Robert Swiecki (jagger swiecki net)

Michal Zalewski wrote:

> Whether Safari devs are to blame here exclusively, I'm not sure - IDN
> concept is by itself pretty evil, and this can be viewed simply a clever
> take on homograph attacks.

I found out that firefox has a configuration property:
network.IDN.blacklist_chars. It includes the character used in the
demonstration (ㅤ - HANGULL FILLER) and many more. So, the problem
seems to be known (at least in firefox).

--
Robert Swiecki
http://www.swiecki.net

[ reply ]

Re: [Full-disclosure] Apple Safari: urlbar/window title spoofing Jun 15 2007 02:07PM
Mark Senior (senatorfrog gmail com)

Re: [Full-disclosure] Apple Safari: cookie stealing Jun 13 2007 02:46PM
Michal Zalewski (lcamtuf dione ids pl)