• Create BookmarkCreate Bookmark
  • Create Note or TagCreate Note or Tag
  • PrintPrint
Share this Page URL
Help

Chapter 21. Implementing Windows Vista’s... > Encoding Addresses to Prevent IDN Sp...

Encoding Addresses to Prevent IDN Spoofing

I mentioned earlier that phishers often resort to IDN spoofing to fool users into thinking an address is legitimate. For example, instead of the address ebay.com, a phisher might use εbáy.com (with the Greek letters ε (epsilon) and α (alpha) in place of e and a). Almost all the world’s characters have a Unicode value, but Internet Explorer is usually set up to recognize only a single language (such as English). If it comes across a character it doesn’t recognize, it works around the problem by converting all Unicode values into an equivalent value that uses only the ASCII characters supported by the domain name system.

This conversion uses a standard called Punycode. If the domain name uses only ASCII characters, the Punycode value and the Unicode value are the same. For a domain such as εbáy.com, the Punycode equivalent is xn- -by- -c9b0.com (the xn- - prefix always appears; it tells you that the domain name is encoded). Internet Explorer encodes the domain to this Punycode value and then surfs to the site. For example, in Figure 21.14, you can see that I entered http://εbáy.com in the Address bar, but Internet Explorer shows the Punycode value http://xn- -by- -c9b0.com in the status bar. If you were able to successfully surf to this site (it doesn’t exist, of course), you’d also see the Punycode domain in the Address bar. (Internet Explorer also displays a message in the Information Bar telling you that the address contains characters it doesn’t recognize.) In other words, an IDN spoofing site is less likely to fool users because the URL that appears in the status bar and the address no longer looks similar to the URL of the legitimate site.


PREVIEW

                                                                          

Not a subscriber?

Start A Free Trial


  
  • Creative Edge
  • Create BookmarkCreate Bookmark
  • Create Note or TagCreate Note or Tag
  • PrintPrint