Zero-Day Bug Allowed Attackers to Register Malicious Domains

guest · Mar 4, 2020

Zero-Day Bug Allowed Attackers to Register Malicious Domains
March 4, 2020
https://www.bleepingcomputer.com/ne...owed-attackers-to-register-malicious-domains/

A zero-day vulnerability impacting Verisign and several SaaS services including Google, Amazon, and DigitalOcean allowed potential attackers to register .com and .net homograph domain names (among others) that could be used in insider, phishing, and social-engineering attacks against organizations.

Before this flaw was disclosed by Soluble security researcher Matt Hamilton in collaboration with security testing firm Bishop Fox to Verisign and SaaS services, anyone could register homograph domain names on gTLDs (.com, .net, and more) and subdomains within some SaaS companies using homoglyph characters.

"Some of these vendors were responsive and engaged in productive dialog, though others have not responded or did not want to fix the issue," Hamilton says.
The vulnerability was discovered by Hamilton after attempting to register domains using Latin homoglyph characters (i.e., Unicode Latin IPA Extension homoglyphs).
Click to expand...

Homograph domains commonly used for malicious purposes
Abusing this domain registration vulnerability can lead to attacks very similar to IDN homograph attacks, presenting the same range of risks.
Click to expand...

Emoji to Zero-Day: Latin Homoglyphs in Domains and Subdomains

Discovery of this resulted in a zero-day re-classification for this vulnerability, which occurred on February 13, 2020. The deadline of February 20th, 2020 was later extended, allowing Verisign to apply mitigations for gTLDs.

Generally speaking, homograph attacks are not novel.
It appears that Verisign and other providers have been unaware of the homoglyphs within the Unicode Latin IPA Extension character set. This disclosure aims to spread awareness of this issue and allow vendors to establish mitigations for this risk.
Click to expand...

Log in or Sign up

Zero-Day Bug Allowed Attackers to Register Malicious Domains

guest Guest

Log in or Sign up

Zero-Day Bug Allowed Attackers to Register Malicious Domains

guest Guest

Useful Searches