Domain Phishing in Safari

[Hemingray]

Okay, this may be old news to some, but I certainly didn't know about this:

http://flashrocket.worldoptimizer.com/article/21/phishing-an-apple-with-idn-domains

With IDN-Domains, apparently it's possible for a domain name to contain international characters that perfectly resemble English characters, yet are a completely different domain name.

Now that's scary!

[Edit: I tried to show the link to the fake apple.com website here, but apparently the forum won't display the weird "a" correctly... it shows up as a "?"]

 

[mkrishnan]

Okay, this may be old news to some, but I certainly didn't know about this:

http://flashrocket.worldoptimizer.com/article/21/phishing-an-apple-with-idn-domains

With IDN-Domains, apparently it's possible for a domain name to contain international characters that perfectly resemble English characters, yet are a completely different domain name.

Now that's scary!

There is a plug-in fix, within SAFT, for Safari that addresses this: http://haoli.dnsalias.com/

I think FF 1.0.1 also addresses this. Which reminds me...

 

[Hemingray]

Good news! According to Apple, the latest security update (05-003) has fixed this problem:

http://docs.info.apple.com/article.html?artnum=301116

I'm sure Apple jumped on this one quickly partly because flashrocket showed how easy it was to spoof the apple.com web site. Kudos to him! One less vulnerability to worry about.