Hosting Provided By

Re: Apple Safari: idn urlbar spoofing

From: Robert Swiecki <jagger(at)swiecki.net>
Date: Wed Jun 27 2007 - 05:27:40 EDT

Michal Zalewski wrote:

> Whether Safari devs are to blame here exclusively, I'm not sure - IDN
> concept is by itself pretty evil, and this can be viewed simply a clever
> take on homograph attacks.

I found out that firefox has a configuration property: network.IDN.blacklist_chars. It includes the character used in the demonstration (ㅤ - HANGULL FILLER) and many more. So, the problem seems to be known (at least in firefox).

-- 
Robert Swiecki
http://www.swiecki.net

Received on Wed Jun 27 11:50:56 2007

This message: [ Message body ]
Next message: esc6(at)hush.com: "Conti FTP Server v1.0 DoS"
Previous message: Ivan Buetler: "SAP Internet Communication Framework (BC-MID-ICF) Vulnerability"
In reply to: Michal Zalewski: "Re: [Full-disclosure] Apple Safari: idn urlbar spoofing"

Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ] [ By messages with attachments ]

This archive was generated by hypermail 2.1.8 : Wed Jun 27 2007 - 12:00:03 EDT