<p><div><div><div><div data-width="100" data-show-faces="false" data-send="true" data-layout="button_count" data-height="21" data-href="https://www.r-bloggers.com/when-homoglyphs-attack-generating-phishing-domain-names-with-r/"></div></div><div></div></div><div></div></div>
<div>
(This article was first published on <strong><a href="https://rud.is/b/2017/04/17/when-homoglyphs-attack-generating-phishing-domain-names-with-r/"> R – rud.is</a></strong>, and kindly contributed to <a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers)</a> </div>
<p>It’s likely you’ve seen <a target="_blank" rel="nofollow" href="https://www.xn--e1awd7f.com/">the news</a> regarding yet-another researcher showing off a phishing domain attack. The technique is pretty simple:</p>
<ul>
<li>find a target domain you want to emulate</li>
<li>register a <a target="_blank" rel="nofollow" href="https://en.wikipedia.org/wiki/Homoglyph">homoglpyh</a> version of it</li>
<li>use <strike>the hacker’s favorite tool,</strike> Let’s Encrypt to serve it up with a nice, shiny green lock icon</li>
<li>deploy some content</li>
<li>phish someone</li>
<li>Profit!</li>
</ul>
<p>The phishing works since International Domain Names have been “a thing” for a while (anything for the registrars to make more money) and Let’s Encrypt provides a domain-laundering service for these attackers. But, why should attackers have all the fun! Let’s make some domain homoglyphs in R.</p>
<h3>Have Glyph, Will Hack</h3>
<p>Rob Dawson has a spiffy <a target="_blank" rel="nofollow" href="https://github.com/codebox/homoglyph">homoglyph generator</a> and even has a huge glyph-alike file, but we don’t need the full list to don the hacker cap for this exercise. I’ve made a <a target="_blank" rel="nofollow" href="https://rud.is/dl/homoglyphs.txt">stripped-down version</a> of it that has (mostly) glyphs that should display correctly in “western” locales. You can pull the full list and tweak the example to broaden the attack capabilities. Let’s take a look:</p>
<pre><code>library(stringi)
library(urltools)
library(purrr)

URL &lt;- &quot;https://rud.is/dl/homoglyphs.txt&quot; # trimmed down from https://github.com/codebox/homoglyph
fil &lt;- basename(URL)
invisible(try(httr::GET(URL, httr::write_disk(fil)), silent = TRUE))

chars &lt;- stri_read_lines(fil)
idx_char &lt;- stri_sub(chars, 1,1)
stri_sub(chars, 1, 1) &lt;-  &quot;&quot;
chars &lt;- set_names(chars, idx_char)

tail(chars)
##                                         u 
##          &quot;ʋυцս\u1d1cｕ𝐮𝑢𝒖𝓊𝓾𝔲𝕦𝖚𝗎𝘂𝘶𝙪𝚞𝛖𝜐𝝊𝞄𝞾&quot; 
##                                         v 
##        &quot;νѵט\u1d20ⅴ∨⋁ｖ𝐯𝑣𝒗𝓋𝓿𝔳𝕧𝖛𝗏𝘃𝘷𝙫𝚟𝛎𝜈𝝂𝝼𝞶&quot; 
##                                         w 
##                                      &quot;ｗ&quot; 
##                                         x 
##                &quot;×хᕁᕽ᙮ⅹ⤫⤬⨯ｘ𝐱𝑥𝒙𝓍𝔁𝔵𝕩𝖝𝗑𝘅𝘹𝙭𝚡&quot; 
##                                         y 
## &quot;ɣʏγуүყ\u1d8c\u1effℽｙ𝐲𝑦𝒚𝓎𝔂𝔶𝕪𝖞𝗒𝘆𝘺𝙮𝚢𝛄𝛾𝜸𝝲𝞬&quot; 
##                                         z 
##                   &quot;\u1d22ｚ𝐳𝑧𝒛𝓏𝔃𝔷𝕫𝖟𝗓𝘇𝘻𝙯𝚣&quot;</code></pre>
<p>What we did there was to read in the homoglpyh lines and create a lookup table for Latin characters. Now we need a transformation function.</p>
<pre><code>to_homoglyph &lt;- function(domain) {

  suf &lt;- suffix_extract(domain)
  domain &lt;- stri_replace_last_fixed(domain, sprintf(&quot;.%s&quot;, suf$suffix[1]), &quot;&quot;)

  domain_split &lt;- stri_split_boundaries(domain, type=&quot;character&quot;)[[1]]

  map_chr(domain_split, ~{
    found &lt;-  chars[.x]
    pos &lt;- sample(stri_count_boundaries(found, type=&quot;character&quot;), 1)
    stri_sub(found, pos, pos)
  }) %>%
    c(&quot;.&quot;, suf$suffix[1]) %>%
    stri_join(collapse=&quot;&quot;)

}</code></pre>
<p>The basic idea is to:</p>
<ul>
<li>carve out the domain suffix (we need to ensure valid TLDs/suffixes are used in the final domain) </li>
<li>split the input domain into separate characters</li>
<li>select a homoglyph of the character at random</li>
<li>join the separate glpyhs and the TLD/suffix back together.</li>
</ul>
<p>We can try it out with a very familiar domain:</p>
<pre><code>(converted &lt;- to_homoglyph(&quot;google.com&quot;))
## [1] &quot;ƍ၀໐𝘨|𝖾.com&quot;</code></pre>
<p>Now, that’s using all possible homoglyphs and it might not look like <code>google.com</code> to you, but imagine whittling down the list to ones that are really close to Latin character set matches. Or, imagine you’re in a hurry and see that version of Google’s URL with a shiny, green lock icon from Let’s Encrypt. You might not really give it a second thought if the page looked fine (or were on a mobile browser without a location bar showing). </p>
<h3>What’s the solution?</h3>
<p>Firefox has a configuration setting to turn these IDNs into <a target="_blank" rel="nofollow" href="https://en.wikipedia.org/wiki/Punycode">punycode</a> in the location bar. What does that mean? We can use the <code>urltools::puny_encode()</code> function to find out:</p>
<pre><code>puny_encode(&quot;ƍ၀໐𝘨|𝖾.com&quot;)
## [1] &quot;xn--|-npa992hbmb6w79iesa.com&quot;</code></pre>
<p>Most folks will be much less likely to trust that domain name (if they bother looking in the location bar). Note that it will still have the “everything’s <img alt="👍" class="wp-smiley" src="https://s.w.org/images/core/emoji/2/72x72/1f44d.png">” green Let’s Encrypt lock icon, but you shouldn’t be trusting SSL/TLS anymore for integrity or authenticity anyway.</p>
<p>Chrome Canary (super early bird alpha versions) expands IDNs to punycode by default today and a shorter-cycle release to stable channel is forthcoming. I’m told Edge does somewhat sane things with IDNs and if Safari doesn’t presently handle them Apple will likely release an interstitial security update to handle it.</p>
<h3>FIN</h3>
<p>See if you can generate some fun look-alike’s, such as <code>𝓻𝓼𝗍𝘂𝒅𝓲𝝈.com</code> and drop some latte change to register an IDN and add a free hacking certificate to it to see just how easy this entire process is. Note that attackers are automating this process, so they may have beat you to your favorite homoglyph IDN.</p>
<p>If you’re on Chrome, give the <a target="_blank" rel="nofollow" href="https://chrome.google.com/webstore/detail/punycode-alert/djghjigfghekidjibckjmhbhhjeomlda">Punycode Alert</a> extension a go if you’d like some extra notification/protection from these domains.</p>
<p>NOTE: <code>to_homoglyph()</code> is not vectorised (it’s an exercise left to the reader).</p>
<p>
<div>
<div>To <strong>leave a comment</strong> for the author, please follow the link and comment on their blog: <strong><a href="https://rud.is/b/2017/04/17/when-homoglyphs-attack-generating-phishing-domain-names-with-r/"> R – rud.is</a></strong>.</div>
<hr>
<a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers.com</a> offers <strong><a rel="nofollow" href="https://feedburner.google.com/fb/a/mailverify?uri=RBloggers">daily e-mail updates</a></strong> about <a title="The R Project for Statistical Computing" rel="nofollow" href="https://www.r-project.org/">R</a> news and <a title="R tutorials" rel="nofollow" href="https://www.r-bloggers.com/search/tutorial">tutorials</a> on topics such as: <a title="Data science" rel="nofollow" href="https://www.r-bloggers.com/search/data%20science">Data science</a>, <a title="Big Data" rel="nofollow" href="https://www.r-bloggers.com/search/Big%20Data">Big Data, <a title="R jobs" rel="nofollow" href="https://www.r-users.com/">R jobs</a>, visualization (<a title="ggplot and ggplot2 tutorials" rel="nofollow" href="https://www.r-bloggers.com/search/ggplot2">ggplot2</a>, <a title="Boxplots using lattice and ggplot2 tutorials" rel="nofollow" href="https://www.r-bloggers.com/search/boxplot">Boxplots</a>, <a title="Maps and gis" rel="nofollow" href="https://www.r-bloggers.com/search/map">maps</a>, <a title="Animation in R" rel="nofollow" href="https://www.r-bloggers.com/search/animation">animation</a>), programming (<a title="RStudio IDE for R" rel="nofollow" href="https://www.r-bloggers.com/search/RStudio">RStudio</a>, <a title="Sweave and literate programming" rel="nofollow" href="https://www.r-bloggers.com/search/sweave">Sweave</a>, <a title="LaTeX in R" rel="nofollow" href="https://www.r-bloggers.com/search/LaTeX">LaTeX</a>, <a title="SQL and databases" rel="nofollow" href="https://www.r-bloggers.com/search/SQL">SQL</a>, <a title="Eclipse IDE for R" rel="nofollow" href="https://www.r-bloggers.com/search/eclipse">Eclipse</a>, <a title="git and github, Version Control System" rel="nofollow" href="https://www.r-bloggers.com/search/git">git</a>, <a title="Large data in R using Hadoop" rel="nofollow" href="https://www.r-bloggers.com/search/hadoop">hadoop</a>, <a title="Web Scraping of google, facebook, yahoo, twitter and more using R" rel="nofollow" href="https://www.r-bloggers.com/search/Web+Scraping">Web Scraping</a>) statistics (<a title="Regressions and ANOVA analysis tutorials" rel="nofollow" href="https://www.r-bloggers.com/search/regression">regression</a>, <a title="principal component analysis tutorial" rel="nofollow" href="https://www.r-bloggers.com/search/PCA">PCA</a>, <a title="Time series" rel="nofollow" href="https://www.r-bloggers.com/search/time+series">time series</a>, <a title="finance trading" rel="nofollow" href="https://www.r-bloggers.com/search/trading">trading</a>) and more...
<img height="1" alt="" width="1" src="http://feeds.feedburner.com/~r/RBloggers/~4/TNAoI6yMf2A"></a></div>