Hello, welcome to the Tuesday, April 18th, 2017 edition of the Sand Center, Storm Center's

Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Last week, reports surfaced of international domain names being used in fishing attacks. While this is in itself nothing new, it does look like this latest attempt was more widespread

and hit some large domains like Apple.com as well as some financial domains.

Also, the attacker in this case apparently went through trouble to get an

cell certificate via Let's Encrypt. The trick of course is pretty simple. The attacker registers a domain

that uses international characters that look very close to specific English characters. A user

clicking on a link has no idea that they're being

sent to a very different domain than the one that appears to show up in the link or the browser's

URL bar. In October 2015, I actually did some experience with this and the success of this attack depends a lot on the browser the victim is using.

Some browsers, like for example Internet Explorer, will for the most part not render international characters if a domain mixes different languages.

This sounds actually like a rather reasonable and effective approach.

Other browsers like Firefox use a whitelist approach

and will only render international domain names for some top-level domains.

Dot com is, for example, not on the list, while dotorg and country-level domains.com is for example not on the list, while dot org and country-level

domains are on the white list. Safari, on the other hand, appears to have no problem rendering

most international domains. If a browser does not render the international characters, then it will fall back

to Punicode, which is obviously different from the English characters and a domain could

not easily be impersonated if the browser displays Punicode. Remko Verhoff expanded on this issue a bit in today's diary. He is

listing some of the common homo crafts or lookalike letters used in the recent attacks. He also

wrote a tool to automatically find domains that use any of these specific letters. This approach could help

with a somewhat more fine-grained approach to filtering these domains. Now back at the end of

...