Bits and Pieces

Monday, February 14, 2005

Attn: Firefox users

If you havent heard of the Spoofing vulnerability issue (Homograph Attacks) of Firefox, here's some info¹. The issue is related to IDN (Internationalized Domain Name). I do not have enough knowledge to explain this better, but in simple terms this is how it goes. Two strings may 'look' the same but in essence may be different. Possible, by using different unicode characters that creates visually similar symbols (ASCII). Modern browsers that are IDN-enabled² are prone to Homograph Attacks, whereby a spoof site³ could be created of an established business. So unaware users could be guided to a fake-site that could syphon out all critical information⁴.

To check if your Firefox build is secure, try this:
Visit http://www.shmoo.com/idn/
a) By clicking one of the two urls under "IDN Spoofed URL", if you get "The Fake TSG" message, you are not secure [details abt a soln that I tried, in comments section].

Update 1: Mozilla Foundation's Official Response. Current solution is to turn-off IDN.

Update 2: One of the authors of IDN has better solutions to this problem. Here.

Interesting fact: This bug was fixed within a day of reporting! Check bug-report page.

¹ Gathered from a detailed thread on Metafilter
² List of affected browsers. IE is not IDN-enabled, so IE users are safe
³ That could've been registered using symbols resembling a genuine site's
⁴ 'phishing'

posted by pradeep | Permalink | (5)

5 Comments:

I tried the following solution and later when I tried to log into Gmail, I couldnt (am not sure if they are related).

[To use or not is left to your discretion...be warned of problems that may arise thereof]:

a) Download and install the latest firefox build:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-aviary1.0.1/b) start Mozilla

c) enter configuration page (type about:config in the address bar), search for network.enableIDN and toggle the value to set it to "False".

d) restart Mozilla

e) visit http://www.shmoo.com/idn/ again, try the links. Should get appropriate Firefox-"site could not be found"-mesg.

By pradeep, at 9:41 PM

Reverted back to version 1.0 and was able to log into gmail. [turned off IDN]

By pradeep, at 10:15 PM

Scary possibilities, yes.

Solution is to type the URL of sensitive sites and not click links.

By pradeep, at 8:37 AM

fixed in no time - thats the beauty of open source.

Hackers will never rest, creators need to be unified to tackle the problem.

By saranyan r, at 10:27 AM

Man
I gotta update this in 4 machines. 2 work lab machines, 1 work desktop machine and then my home laptop.
Will try your path and see how it goes.

rp

By The Last Blogger, at 1:53 PM