BugTraq
RE: thoughts and a possible solution on homograph attacks Mar 07 2005 08:05PM
Scovetta, Michael V (Michael Scovetta ca com) (2 replies)
Re: houghts and a possible solution on homograph attacks Mar 08 2005 06:50PM
Sven Putteneers (svennieboy linux be) (1 replies)
Re: houghts and a possible solution on homograph attacks Mar 09 2005 12:48AM
Nick FitzGerald (nick virus-l demon co uk) (1 replies)
Re: Thoughts and a possible solution on homograph attacks Mar 11 2005 10:42AM
Paul Smith (paullocal pscs co uk) (1 replies)
Re: Thoughts and a possible solution on homograph attacks Mar 15 2005 11:27AM
Riccardo Murri (murri dmmm uniroma1 it) (2 replies)
Re: Thoughts and a possible solution on homograph attacks Mar 16 2005 12:10AM
khockenb (khockenb stevens edu) (1 replies)
On Tue, 15 Mar 2005, Riccardo Murri wrote:

> I would rather suggest that the string comparison function used in IDN
> takes "homograph caracters"[1] into account: just like the current DNS
> considers 'a' == 'A', the IDN DNS should consider "LATIN SMALL LETTER
> a" == "CYRILLIC SMALL LETTER a" == "CYRILLIC CAPITAL LETTER A" ==
> "GREEK CAPITAL LETTER A"[2], and similarly for the other homograph chars.

But that breaks case insensitivity for Greek, for instance (other
languages, too, I am sure).

Consider Greek letters eta and nu.

A upper case eta looks like an upper case Latin "H", but a lower
case eta looks like a lower case Latin "n".

Similarly, an uppercase nu looks like a upper case Latin "N", but a lower
case nu looks like a lower case Latin "v".

If such a system as you suggest is in place, and someone in Greece wants
the site (Greek nu).gr, they would have to have control of both N.gr and
v.gr, otherwise people who type in the wrong case would go to the wrong
site. Now let's say a competitor comes along, and wants (Greek eta).gr.
They can get H.gr, but n.gr is already take, since N=n.

I suppose we could get around that by making H=n=N=v(=V=H), but that would
get cohfusivg.

[ reply ]
Re: Thoughts and a possible solution on homograph attacks Mar 16 2005 10:02AM
Riccardo Murri (riccardo murri ictp it)
Re: Thoughts and a possible solution on homograph attacks Mar 15 2005 09:09PM
Valdis Kletnieks vt edu
Re: thoughts and a possible solution on homograph attacks Mar 08 2005 12:33PM
Mike Nice (niceman att net)


 

Privacy Statement
Copyright 2010, SecurityFocus