School of Computer & Security Science Edith Cowan University Say my name, BITCH An Investigation...

School of Computer & Security ScienceEdith Cowan University

Say my name, BITCH

An Investigation into IDN Homograph Mitigation Strategies

Peter HannaySECAU Security Research Centre

Edith Cowan University

Greg BaatardEdith Cowan University


UNRELATED COMPLAINT SOMEBODY ON THE INTERNET IS WRONG

• People get USB sticks all the time. The problem isn't that people are idiots, that they should know that a USB stick found on the street is automatically bad and a USB stick given away at a trade show is automatically good. The problem is that the OS trusts random USB sticks. The problem is that the OS will automatically run a program that can install malware from a USB stick. The problem is that it isn't safe to plug a USB stick into a computer. Bruce Schneier


People are Idiots

• 20 government agencies

• 70%+ hit rate

• Some sticks phoned home from multiple ‘sensitive’ networks


WHATThis marks the beginning of the section titled


IDN

☃��


Homoglyph

ј j


Homograph

http://gooɡle.com/ http://google.com/


Mitigation• Unicode Punycode• http://gooɡle.com/ http://xn--goole-tmc.com

• Alerts


PICSThis marks the beginning of the section titled


Web


Email

• Phishing

• Better than spoofed address

• You can get replies and everything!

Sweet kiwicon@kiwіcon.org


THE TESTINGThis marks the beginning of the section titled


Tests

• URL Bar

• Certificate Information

• Geolocation Request


Evaluation


Internet Explorer


Firefox


Chrome


Opera


Safari


Comparison


Email Testing


CONCLUSIONIts time for the…

School of Computer & Security Science Edith Cowan University Say my name, BITCH An Investigation...

Documents

Transcript of School of Computer & Security Science Edith Cowan University Say my name, BITCH An Investigation...