A trained eye can usually spot a site trying to pass itself off as another, but phishing still works remarkably well at stealing credentials, and the last thing it needs is better camouflage. Unfortunately, that's exactly what it gets through Punycode support in Firefox and Chrome, which can hide a malicious address and present it to the user as a valid, protected domain.
A couple of months ago we discussed the subtle differences between normal characters and those available via Unicode that can confuse users. It's a simple trick, but despite new security efforts, phishing hasn't lost its effectiveness. It all starts with a bit of education: most companies on the Web don't contact the user unless they have explicitly authorized it, or there's an urgent need to communicate something, such as the security crisis that affected Yahoo!. Many security experts say that the recommendation to "don't click on links" is not appropriate because the Web itself is a network of links, but that doesn't stop links from being taken with a grain of "caveat emptor". The link may not be what it seems, and the latest proof comes from researcher Xudong Zheng.
The Homograph Attack
This latest homograph attack exploits the Punycode system that encodes special Unicode characters in web domains. As a reference, "nеotеo.com" is not the same as "neoteo.com", no matter what our eyes say. But the real problem is that the latest versions of Firefox and Chrome (including their variants) are showing the disguised domain in the address bar instead of the unencoded address.
The example published by the folks at Wordfence is compelling: what appears to be "https://www.epic.com" is actually "https://www.xn--e1awd7f.com". The security certificate was obtained with the help of Let's Encrypt, and the whole process took about five minutes. That's enough for Firefox and Chrome to announce the fake site as "secure".
The Fix
Fortunately, the fix in Chrome is progressing. The Canary build includes the necessary hotfix, and it will reach stable editions within a few days. Better news for Firefox users: just go to about:config, search for the parameter network.IDN_show_punycode, and change its value from "false" to "true".
Wordfence
