Security News Phishing Attack almost impossible to detect in Chrome, Firefox and Opera

[Winter Soldier]

While Mozilla is currently still discussing a fix, Google has already patched the vulnerability in its experimental Chrome Canary 59 and will come up with a permanent fix with the release of Chrome Stable 58, set to be launched later this month

Currently I'm using Edge, but it is bad news for Chrome users waiting for the new version's patch...

 

[ExploitBlocker10]

So I use Edge, is it affected by this vulnerability?

 

[LASER_oneXM]

i found a similar artcle about this issue on www.bleepingcomputer.com Here is the link:
Chrome, Firefox, and Opera Vulnerable to Undetectable Phishing Attack

here are two quotes from the article above:

Not all browsers are vulnerable

Of all the browsers Bleeping Computer tested, three rendered the page using Unicode characters, as аррӏе.com. These are Chrome, Firefox, and Opera (including the new Opera Neon variant).

Other browsers, such as Edge, Internet Explorer, Safari, Vivaldi, and Brave, did not render the page using Unicode characters and displayed the Punycode URL. The reasons are unknown, but we suspect there's a filter that checks if the Punycode URL is in the same character set as the user's default OS settings.

...and here is the solution that you can find at the buttom of the article:

Mozilla is currently still discussing a fix, but in the meantime, users have an option that will disable Punycode support and mitigate this attack.

Step 1: Type about:config in the Firefox address bar and hit enter.
Step 2: Type network.IDN_show_punycode and set this option to “true” (by double-clicking on it).

 

[ExploitBlocker10]

Interesting

 

[Parsh]

Currently I'm using Edge, but it is bad news for Chrome users waiting for the new version's patch...

You know what's more surprising?
This thread (FF bug report) talks about Punycode Homograph attack in title.
I'm not sure if it covers the same thing but the comments are 12 freaking years old!

So I use Edge, is it affected by this vulnerability?

Edge is safe as you can see on the BleepingComputer article.
It has screenshots showing how each browser responds to and displays that spoofed page.

 

[Winter Soldier]

I'm not sure if it covers the same thing but the comments are 12 freaking years old!

Good share @Parsh, Eh...I got the point for sure

 

[ForgottenSeer 19494]

So I use Edge, is it affected by this vulnerability?

Actually it was, but it seems to be fixed. I loaded the same site about 3 days ago and it showed as paypal.com (though it's not the real paypal). Also it had an SSL certificate (although not EV), which you can get nowadays for free. When it showed as paypal.com it was not with full white color, that it, it was the color the word "threads" is in the MalwareTips URL, not the full white color "malwaretips.com" is.

You know what's more surprising?
This thread (FF bug report) talks about Punycode Homograph attack in title.
I'm not sure if it covers the same thing but the comments are 12 freaking years old!

Not the first time I see such an old commented issue exists for Firefox. Sometimes they are fast, but if they decide to be slow they are kings of it.

 

[spaceoctopus]

As we are talking about phishing attacks, on Emsisoft blog, there is a nice and detailed article that was written about types of phishing attempts and attacks
Here it is:
Common phishing scams and how to prevent them

I think by now we’ve all been contacted by a Nigerian prince looking for someone to help him move his wealth out of the country in return for a share of his fortune. We all know it’s a scam, but did you know a whopping 30% of you still click on phishing scam links?

Phishing scams in particular are getting so sophisticated these days that most of us will need a magnifying glass just to spot the inconsistencies that give away their fraudulent nature.

In today’s post, we will tell you exactly how to recognize a phishing scam and share some classic examples we’ve encountered.

Link to full article : Common phishing scams and how to prevent them

 

[Brie]

i just fixed this in firefox version 58, 10 months after the last post.