1858
Homograph Attack : "Homograph" is often used as a synonym of "homoglyph" by researchers, but
according to Wikipedia, a homograph is a word that has multiple, distinct meanings.
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Other
An attacker may ultimately redirect a user to a malicious
website, by deceiving the user into believing the URL they
are accessing is a trusted domain. However, the attack can
also be used to forge log entries by using homoglyphs in
usernames. Homoglyph manipulations are often the first
step towards executing advanced attacks such as stealing
a user's credentials, Cross-Site Scripting (XSS), or log
forgery. If an attacker redirects a user to a malicious site,
the attacker can mimic a trusted domain to steal account
credentials and perform actions on behalf of the user,
without the user's knowledge. Similarly, an attacker could
create a username for a website that contains homoglyph
characters, making it difficult for an admin to review logs
and determine which users performed which actions.
Detection Methods
Manual Dynamic Analysis
If utilizing user accounts, attempt to submit a username that contains homoglyphs. Similarly,
check to see if links containing homoglyphs can be sent via email, web browsers, or other
mechanisms.
Effectiveness = Moderate
Potential Mitigations
Phase: Implementation
Use a browser that displays Punycode for IDNs in the URL and status bars, or which color
code various scripts in URLs. Due to the prominence of homoglyph attacks, several browsers
now help safeguard against this attack via the use of Punycode. For example, Mozilla Firefox
and Google Chrome will display IDNs as Punycode if top-level domains do not restrict which
characters can be used in domain names or if labels mix scripts for different languages.
Phase: Implementation
Use an email client that has strict filters and prevents messages that mix character sets to end
up in a user's inbox. Certain email clients such as Google's GMail prevent the use of non-Latin
characters in email addresses or in links contained within emails. This helps prevent homoglyph
attacks by flagging these emails and redirecting them to a user's spam folder.
Demonstrative Examples
Example 1:
The following looks like a simple, trusted URL that a user may frequently access.
Example Language: (Attack)
http://www.#x#m#l#.##m
CWE Version 4.14
CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User
CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User