[ILUG] Firefox/Mozilla/Opera exploit

[fuzzbucket]

Conor Wynne wrote:
> Hi all,
> 
> This is pretty shocking, and on FC3 I cannot tell the difference 
> between the real paypal and the faked one.
> 
> Whats worse is the fact the IE does not have this problem.
> 
> I'm surprised no-one has brought this up as it directly affects linux
>  users aswell as dozers.
> 
> http://secunia.com/multiple_browsers_idn_spoofing_test
> 
> All my online buying is at an end untill this is resolved (not that I
>  have any cash left)
> 

I remember when IDN was first being looked at seriously - I believe
concerns such as your own were raised back then. I think it went
something like "Oi! Verisign! Noooo!" But when have verisign ever
listened to anyone?

I checked out this vuln myself and thought you'd have to be on crack to
fall for it, but then I saw screen grabs from other systems that looked
a lot more convincing. I could still see where the spoof was, but I knew
what to look for. For what it's worth, here's how it looks on my system:

http://homepage.eircom.net/~wastedyouth/spoof.png

There's also a whole shedload of hype around this one. The main use of
this exploit is phishing scams so if you get any email asking you to
confirm account details then you know what to do already. If you type
the url yourself there's little chance of the site suddenly transforming
into a spoofed one so I wouldn't go calling off all financial
transactions just yet (There are far worse reasons to do so than the IDN
exploit, I reckon).

FWIW, any contact I've had with people who speak languages with
characters beyond those allowable in domain names say that IDN is just
not used. It might be time to re-evaluate this functionality.

-- 
ICQ:139064407 Jabber:fuzzbucket at jabber.org Yahoo:rapidyokes