Shmoo Group Finds Exploit For non-IE Browsers

shut_up_man writes "Saw this on Boing Boing: East coast hacker con Shmoocon ended today and they had a nasty browser exploit to show off... using International Domain Name (IDN) character support to display fake domain names in links and the address bar. Their examples use Paypal (with SSL too) and this looks very useful for phishing attacks. Interesting note that it works in every browser *except* IE (which makes this exploit a lot less dangerous in the end, I suppose)."v The reason IE isn't vulnerable is because it doesn't natively support IDN; with the right plug-in, it too is vulnerable.

Comments

Canned Slashdot Response

[bigtallmofo]

Serves those Internet Explorer users right! They should immediately switch to ... uh, wait. Nevermind.

Switch

[Anonymous Coward]

Damnit... now I'm switching back.

I'm waiting the patch from MS

[gustgr]

Ok, it doesn't work in IE... so when the patch will be released? I mean... it is IE, the exploits HAVE to work. Microsoft should be worried, they are not doing their job properly.

Strength from weakness

[XxtraLarGe]

The reason IE isn't vulnerable is because it doesn't natively support IDN; with the right plug-in, it too is vulnerable.

IE is safer because it doesn't support a feature? Don't worry, I'm sure the plug-in will be installed with the next security update!

New Microsoft Security Mantra

[IvanHo]

Security through inutility

Rebuttals

[Jacco de Leeuw]

• Oh, come on! Even I saw the differences between those two a's!
• Move your pointer to the padlock and you'll see that the certificate was signed by the UserTrust Network instead of the usual suspects (Verisign, Thawte etc.).
• Certificates from the UserTrust Network are not to be trusted anyway. They don't check anything and you cannot trace back the owner of the domain.
• CAs should rejects CSRs with these characters.
• The CA should revoke those certificates. (You did enable OCSP, didn't you?)
• It doesn't work with links/lynx.

:-)

Re:Another IDN bug on Firefox

[callipygian-showsyst]

I wonder if there's a quick and easy fix for this for Safari users,

There is! Run I.E. in a VirtualPC window.

You're being too elitist

[Tibor the Hun]

I'm planning on taking an airplane flight in 7 years, and am already taking classes on aeronautics, history of flight, airplane engineering, and am enrolled in the technical school for airplane building and maintenancy.^H^H

Uh-oh, looks like my "delete" key stopped working again. Must need another .5 ohm resistor, with a diode overlay. I'll do that as soon as I'm done casting the waterpump for my car.

The old MS spoofing quick-patch...

[Curtman]

Why don't you just start typing in your URIs from now on?