Your browser is obsolete!

The page may not load correctly.

Caught

На удочке

Other issues in this category (15)
  • add to favourites
    Add to Bookmarks

Fraud in the truest sense of the word!

Read: 23372 Comments: 2 Rating: 43

Monday, January 9, 2017

Everyone knows that you can enter a website URL using upper- or lowercase letters. It doesn't matter, whether we enter drweb.com, Drweb.com or DrWeb.com in a browser’s address bar—the same website will open. But cybercriminals have even found a vulnerability there.

The truth is that we get used to the fact that company and product names are written in uppercase letters (Dr.Web, Google), and website names—in lowercase letters (drweb, google).

Small capitals or small caps (German— kapitälchen; from Latin— capitellum (English—the head)) — are uppercase (capital) characters set at the same height and weight as surrounding lowercase (small) letters or text figures.

https://en.wikipedia.org/wiki/Small_caps

Thus, fonts contain not only upper- and lowercase letters, but also uppercase letters that are the same size as lowercase ones!

Attackers were able to register a domain after they replaced the first letter "g" in the legitimate domain name "Google" with "ɢ" (google.com→ ɢoogle. com). According to the registration rules, small caps are allowed in domain names—and cybercriminals exploited that vulnerability.

According to experts, attackers used secret.ɢoogle.com to distribute referral spam, in particular, messages containing calls to vote for Donald Trump.

http://www.securitylab.ru/news/484517.php

#security #cybercrime #Parental_control #browser #non-recommended_sites

The Anti-virus Times recommends

It is important not only to scan a link to find out whether it contains some variant of a legitimate Internet resource, but also to make sure that all the letters in the link are in the same register!

  1. Don't click on links; enter them manually. This is not easy, but it is effective. At first glance, the difference between drweb.com and ᴅrweb.com is not visible.
  2. Take advantage of Dr.Web Parental Control—only it can bar fraudulent websites.
  3. If Dr.Web Parental Control reports that the website you want to view is malicious, don’t hurry to add it to the white list; first check whether the URL is correct or enter the address manually.

[Twitter]

Tell us what you think

To leave a comment, you need to log in under your Doctor Web site account. If you don't have an account yet, you can create one.

Comments

Comments to other issues | My comments