IDN Homograph Attack Spreading Betabot Backdoor

itman · Sep 6, 2017

An IDN homograph attack leveraging Adobe’s brand has been discovered, with the malicious site spreading the Betabot backdoor and ultimately infecting compromised machines with cryptocurrency-mining and data-stealing malware.

Attacks using internationalized domain name homographs rely on users falling for Unicode or ASCII characters that appear similar to Latin characters. Attackers host a malicious site and lure potential victims there, exposing them to exploits or malware downloads with the user none the wiser to the fact that the domain name is incorrect without a close inspection.

In this case, researcher Ankit Anubhav said the attackers have registered adoḅe[.]com (note the “b”) and are using it to spread a phony Flash Player download that instead serves up Beta Bot.

“The homograph protection mechanism in Chrome, Firefox, and Opera unfortunately fails if every character is replaced with a similar character from a single foreign language,” Zheng wrote in his disclosure published April 14. “The domain ‘аррӏе.com,’ registered as ‘xn--80ak6aa92e.com,’ bypasses the filter by only using Cyrillic characters.”

Zheng said the Punycode vulnerability is present in Firefox as well, but Mozilla decided against fixing it.
Click to expand...

https://threatpost.com/idn-homograph-attack-spreading-betabot-backdoor/127839/

Minimalist · Jun 26, 2018

Number of Fake Homograph Domains Continues to Increase

The risks around IDN Homographs are “significant and growing” according to research by Farsight Security.

Its research around IDN lookalike domain names (also called Homographs) over a 12-month period focused on 466 top global brands across 11 vertical sectors. From this, it found 8000 IDN Homographs representing or containing a top global brand name, and 91% offering some sort of webpage and “clear violations of the ICANN Guidelines for the Implementation of Internationalized Domain Names.”
Click to expand...

https://www.infosecurity-magazine.com/news/fake-homograph-domains-iincrease/

Log in or Sign up

IDN Homograph Attack Spreading Betabot Backdoor

itman Registered Member

Minimalist Registered Member

Log in or Sign up

IDN Homograph Attack Spreading Betabot Backdoor

itman Registered Member

Minimalist Registered Member

Useful Searches