BugTraq
RE: thoughts and a possible solution on homograph attacks Mar 07 2005 08:05PM
Scovetta, Michael V (Michael Scovetta ca com) (2 replies)
Re: houghts and a possible solution on homograph attacks Mar 08 2005 06:50PM
Sven Putteneers (svennieboy linux be) (1 replies)
Re: houghts and a possible solution on homograph attacks Mar 09 2005 12:48AM
Nick FitzGerald (nick virus-l demon co uk) (1 replies)
Re: Thoughts and a possible solution on homograph attacks Mar 11 2005 10:42AM
Paul Smith (paullocal pscs co uk) (1 replies)
Re: Thoughts and a possible solution on homograph attacks Mar 15 2005 11:27AM
Riccardo Murri (murri dmmm uniroma1 it) (2 replies)
Re: Thoughts and a possible solution on homograph attacks Mar 16 2005 12:10AM
khockenb (khockenb stevens edu) (1 replies)
Re: Thoughts and a possible solution on homograph attacks Mar 16 2005 10:02AM
Riccardo Murri (riccardo murri ictp it)
[khockenb, Tue, Mar 15, 2005 at 07:10:16PM -0500]
> On Tue, 15 Mar 2005, Riccardo Murri wrote:
>
> > I would rather suggest that the string comparison function used in IDN
> > takes "homograph caracters"[1] into account: just like the current DNS
> > considers 'a' == 'A', the IDN DNS should consider "LATIN SMALL LETTER
> > a" == "CYRILLIC SMALL LETTER a" == "CYRILLIC CAPITAL LETTER A" ==
> > "GREEK CAPITAL LETTER A"[2], and similarly for the other homograph chars.
>
> But that breaks case insensitivity for Greek, for instance (other
> languages, too, I am sure).
>
> Consider Greek letters eta and nu.
>
> A upper case eta looks like an upper case Latin "H", but a lower
> case eta looks like a lower case Latin "n".
>
> Similarly, an uppercase nu looks like a upper case Latin "N", but a lower
> case nu looks like a lower case Latin "v".
>
> If such a system as you suggest is in place, and someone in Greece wants
> the site (Greek nu).gr, they would have to have control of both N.gr and
> v.gr, otherwise people who type in the wrong case would go to the wrong
> site. Now let's say a competitor comes along, and wants (Greek eta).gr.
> They can get H.gr, but n.gr is already take, since N=n.
>
> I suppose we could get around that by making H=n=N=v(=V=H), but that would
> get cohfusivg.
>

You're perfectly right - this equivalence relation would backfire on
ASCII-only domains too.

Riccardo

--
Riccardo Murri
EGRID Project
The Abdus Salam ICTP

Strada Costiera, 11
34016 Trieste
Italy

email: riccardo.murri (at) ictp (dot) it [email concealed]
phone: +39 040-2240-542
fax: +39 040-224531

[ reply ]
Re: Thoughts and a possible solution on homograph attacks Mar 15 2005 09:09PM
Valdis Kletnieks vt edu
Re: thoughts and a possible solution on homograph attacks Mar 08 2005 12:33PM
Mike Nice (niceman att net)


 

Privacy Statement
Copyright 2010, SecurityFocus