Monday 7 February, 2005 at 12:09PM (Nereus)  ::  permalink  ::  comments (18)

Want to own ANY domain? Want a trusted SSL cert for it? Now you can. Website shmoocon.org (basically a website for last weekends first annual hacker convention held in Washington DC) just released details of this very nasty browser exploit. Summed up in one sentence, International Domain Name [IDN] support in modern browsers allows attackers to easily spoof domain name URLs and SSL certificates.

In December 2001, a paper was released describing 'homograph' attacks which theoretically allowed an attacker/phisher to spoof the domain/URLs of businesses, however no browsers had implemented Unicode/UTF8 domain name resolution at the time this paper was written, so it wasn't really an issue.

Now we are in 2005, pretty much every recent gecko/khtml based browser implements IDN. The exception, ironically, is Microsoft's Internet Explorer, which in recent times has been synonymous with the term 'exploit'. The reason IE appears to be uneffected is because it has not yet fully implemented support for unicode in links; for once being non-standard may actually have helped MSIE.

Vulnerable browsers include (but are not limited to) most mozilla-based browsers (Firefox 1.0, Camino .8.5, Mozilla 1.6, etc), Safari 1.2.5, Opera 7.54 and Omniweb 5. Verisign and Apple have not responded to this exploit as yet, Opera believe they have correctly implemented IDN and will not be making any changes (oh really?), and Mozilla are working on finding a good long-term solution but have provided a clear workaround for disabling IDN in the interim, which appears to be effective.

To see this in effect, go to the site http://www.shmoo.com/idn/. Clicking on either of the two links in that webpage using anything but IE should result in a spoofed paypal.com webpage. What happens is that the links are really directed at the URL of "http://www.p & # 1 0 7 2 ; ypal.com/", which the browsers code handlers render as www.xn--pypal-4ve.com, and the code there with the 1072 in it is read as the letter 'a' (when all the spaces are removed) using character coding, which is how the exploit works. Scary.

Phishing attacks are the largest growing class of attacks on the internet today, and you can bet that phishing attacks of doom (and similar) will be commonplace very soon using this method.

There are a few methods to detect that you are under a spoof attack. One easy method is to cut & paste the url you are accessing into notepad or some other tool (under OSX, paste into a terminal window) which will allow you to view what character set/pagecode the string is in. You can also view the details of the SSL cert to see if it's using a punycode wrapped version of the domain (starting with the string 'xn-'). Basically the only 'safe' way to follow a link is to view the target and just type it into the address bar manually.

An apparent workaround for FireFox has been posted by BoingBoing.net:

• Goto your Firefox address bar. Enter about:config and press enter. Firefox will load the (large!) config page.
• Scroll down to the line beginning network.enableIDN (this is International Domain Name support, and it is causing the problem here). We want to turn this off for now (ideally we want to support international domain names, but not with this exploit around). To turn it off, click the network.enableIDN line and Firefox will show the default dialog set to 'true'. Double-click to change it to 'false' (no quotes!).
• You are done. Go check out the shmoo demo again and it should no longer work.

Check your browser manufacturer's home page frequently over the coming weeks for updates and patches which are bound to appear, and be very cautious in the meantime in following links, particularly where any of your personal details or passwords are required. Thanks to John who informed me of this exploit.

..update 3:20pm same day..

The FireFox workaround isn't exactly successful. It works after doing that workaround while the browser is still open, but if you close the browser altogether and then reopen it, the browser reverts to the default setting of 'true' for that network.enableIDN setting, even though it still says 'false' on the about:config page. I'm waiting for some kind of release from Mozilla regarding this issue.

..update 9:20pm same day..

A successful workaround has been discovered so that the IDN support stays off from session to session, and involves a simple edit to the compreg.dat file. Please refer this comment for details of the fix. Cheers.

weasling's birthday

      Thursday 3 February, 2005 at 10:32PM (Nereus)  ::  permalink  ::  comments (3)

It's IceQueens birthday today! Happy birthday Weasling! Ice has her core exam tomorrow which is major; she's been studying almost 24/7 for ages, even taking the last three weeks off work to study for it. You only get two attempts at it and it's really tough, but she'll do well I'm sure. Clever little Weasling. Birthdays have been a bit of a non-event around here for study reasons, so perhaps we'll go out and celebrate when we've both finished with our exams (my finals for the winter semester are the week after next).

endangered maui's dolphins

      Wednesday 2 February, 2005 at 8:01PM (Nereus)  ::  permalink  ::  comments (0)

This is a notice for all New Zealand surfers on the west coast of the North Island. The Maui's Dolphin lives only in New Zealand waters along the west coast of the North Island, and is thought to be down to a total population of just 100 mammals. The World Wildlife Fund is asking surfers at beaches like Piha and Muriwai to watch for the species and report any sightings, particularly near harbours where limited protection is provided against fishing threats such as set netting. If you spot any of these dolphins, please report the sighting asap on the toll-free number 0800 4 MAUIS, or you can submit the sighting online at the World Wildlife Fund NZ page, set up specifically for this purpose. If you see a stranded Maui's dolphin, please call DOC (Dept of Conservation) immediately. The contact details are:
Simon Mowbray - Mobile: 025 293 9420
Karl McLeod - Mobile: 025 288 4555 , Pager: 0868 15996

Maui's dolphins are very easy to identify. Their most distinctive features are their:

• rounded dorsal fin, unlike the sickle-shaped fins of other dolphins
• gently sloping snout unlike the "bottlenose" snout of common dolphins
• size - they are shorter than adult humans - adult Maui's are normally 1.2 - 1.4 metres long and weigh about 50 kg

Basically look for distinctive black markings: a black face, flippers, dorsal fin and tail and a crescent-shaped black mark that runs between the top of each eye, up over the blowhole.

Thanks.

« January 2005 | current entries | archive index | March 2005 »