Funny Accents: Exploring Genuine Interest in Internationalized - PowerPoint PPT Presentation

Funny Accents: Exploring Genuine Interest in Internationalized Domain Names Victor Le Pochat , Tom Van Goethem, Wouter Joosen PAM 2019 , 29 March 2019

What do these brands have in common? 2

What do these brands have in common? 3

Internationalized Domain Names (IDNs) allow Unicode characters in domain names DNS köln.de xn--kln-sna.de google.com google.com xn--d1acpjx3f.xn--p1ai User agent Punycode яндекс . рф 4

5

IDNs can be abused due to visual similarity [Hol06, Liu18] www.google.com www.go ọ gle.com ≠ www.nestle.com www.nestl é .com ? www.google.com www.goog I e.com ≠ www.google.com ≠ www.go о gle.com 6

Brands may want to use IDNs with genuine interest ... › corresponds to brand › easier to read and understand 7

... but malicious actors might want to do so too › corresponds to brand › easier to read and understand › more difficult to distinguish legitimate site from phishing › abuse typed domain with accents 8

Generating candidate domains Ownership, use and abuse User agent behavior 9

Generating candidate domains Ownership, use and abuse User agent behavior 10

nestle.com Home | Nestlé Global home nestlé global home nestle global Root page title Original domain Convert to lowercase, remove punctuation Remove accents 11 (Apply substitutions) (köln → koeln)

nestle .com Home | Nestlé Global home nestlé global home nestle global 12

nestle .com Home | Nestlé Global home nestlé global home nestle global 13

nestle .com nestlé .com Home | Nestlé Global home nestlé global home nestle global 14

Generating candidate domains Ownership, use and abuse User agent behavior 15

Have these IDNs already been registered? unavailable/ 1 000 000 Tranco [LeP19] 16 readily available 6 608 (54.7%) restrictions additional 4 116 (34.1%) 15 276 with TLD policy non-compliant 1 363 (11.3%) unregistered 12 087 (79.1%) registered 3 189 (20.9%) candidates ↓

Who owns the registered IDNs? 17 59.1% 34.6% (likely) same different

How are the registered IDNs being used? 18 26.8% 41.6% 23.5% 'forgotten' parked/for sale same content

Are the registered IDNs being abused? Phishing domains can evade blacklisting Parked domains only sometimes redirect to malicious content [Vis15, Tia18] 19 › No known malicious activity (blacklists) › Some questionable behavior

pokémongo.com 20

Generating candidate domains Ownership, use and abuse User agent behavior 21

Browsers display IDNs differently (even on popularity) 22 pokémon.com xn--pokmon-dva.com Unicode Unicode unless popular Punycode Email clients: similar inconsistencies, even within vendors

IDNA standard revision introduced “deviations” strasse.de xn--strae-oqa.de IDNA2003 IDNA2008 ≠ straße.de 23 A 89.31.143.1 A 81.169.145.78

IDNA standard revision introduced “deviations” strasse.de xn--strae-oqa.de IDNA2003 IDNA2008 ≠ straße.de 24 A 89.31.143.1 A 81.169.145.78

iOS Mail before 12.1.1 was vulnerable to phishing 25 victor@straße.de From: Subject: Test of IDN support by Victor Hello This is a test for IDN support by email Awesome Email Client [CVE-2018-4429] From: <victor@xn--strae-oqa.de> Date: Tue, 2 Oct 2018 14:22:27 +0200 Subject: Test of IDN support by Victor

iOS Mail before 12.1.1 was vulnerable to phishing Hello here. You can trust us ;) Please input your bank credentials Important mail from your bank it@sparkasse-giessen.de Awesome Email Client Please input your bank credentials here. Important mail from your bank 26 Subject: it@sparkasse-gießen.de From: Sparkasse IT From: <it@xn--sparkasse-gieen-2ib.de> Date: Tue, 2 Oct 2018 14:22:27 +0200 Subject: Important mail from your bank

Shortcomings of key actors limit IDN uptake but not widely implemented but they sometimes 'forget' them and many also leave them to squatters but inconsistent support 27 › Registries: guidelines to prohibit or limit registrations of IDNs › Brand owners: some own their 'genuine interest' IDNs › User agents: primary point of interaction with IDNs for users

Thank you! Datasets: https://osf.io/s96dg/ Victor.LePochat@cs.kuleuven.be

References Distributed System Security Symposium, February 2019. https://doi.org/10.14722/ndss.2019.23386 https://doi.org/10.1145/3278532.3278569 phishing domains in the wild. In: Internet Measurement Conference, pp. 429–442. ACM (2018). [Tia18] Tian, K., Jan, S.T.K., Hu, H., Yao, D., Wang, G.: Needle in a haystack: tracking down elite 5. (2015) domains. In: 22nd Annual Network and Distributed System Security Symposium. Internet Society [Vis15] Vissers, T., Joosen, W., Nikiforakis, N.: Parking sensors: analyzing and detecting parked 4. research-oriented top sites ranking hardened against manipulation. In: 26th Annual Network and 1. [LeP19] Le Pochat, V., Van Goethem, T., Tajalizadehkhoob, S., Korczyński, M., Joosen, W.: Tranco: a 3. 654–665 (2018). https://doi.org/10.1109/DSN.2018.00072 ugly. In: 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, pp. [Liu18] Liu, B., et al.: A reexamination of internationalized domain names: the good, the bad and the 2. (2006) of homograph attacks. In: USENIX Annual Technical Conference, pp. 261–266. USENIX Association [Hol06] Holgers, T., Watson, D.E., Gribble, S.D.: Cutting through the confusion: a measurement study 29