Cutting through the confusion: a measurement study of homograph attacks

摘要: Web homograph attacks have existed for some time, and the recent adoption of International Domain Names (IDNs) support by browsers DNS registrars has exacerbated problem [Gabr02]. Many international letters similar glyphs, such as Cyrillic letter P (lower case 'er,' Unicode 0x0440) Latin p. Because large potential misuse IDNs, browser vendors, policy advocates, researchers been exploring techniques mitigating [=Mozi05, Appl05, Oper05, Mark05]. There plenty attention on recently, but we are not aware any data that quantifies degree to which currently taking place. In this paper, use a combination passive network tracing active probing measure several aspects homographs. Our main findings four-fold. First, many authoritative sites users visit confusable domain names registered. Popular much more likely domains Second, registered tend consist single character substitutions from their domains, though saw instances five-character substitutions. Most confusables homographs, did find non-trivial number IDN Third, associated with non-authoritative most commonly show advertisements. Less common functions include redirecting victims competitor spoofing content site. Fourth, during our nine-day trace, none 828 clients observed visited site. Overall, measurement results suggest rare severe in nature. However, given increases phishing incidents, seem like an attractive future method attackers lure spoofed sites.