News for hackers. Stuff that matters.

A comment on Phishing attack uses Unicode characters in domains to clone known safe sites.

Re:Phishing attack uses Unicode characters in domains to clo... by protomyth on Saturday April 15, 2017 @08:20AM (#14120443)
Is there any name servers that would allow me to block / redirect any non-ASCII domain names? At this point, the value of Unicode domain names is a lot less than local safety.

We currently use unbound for users.

[ Parent | on HN ]
Re:Phishing attack uses Unicode characters in domains to clo... by Retr0spectrum on Saturday April 15, 2017 @08:29AM (#14120465)
You could probably block the `xn--` prefix, which is how it appears over the wire.
[ Parent | on HN ]
Re:Phishing attack uses Unicode characters in domains to clo... by blechschmidt on Saturday April 15, 2017 @08:40AM (#14120489)
You could use libnetfilter_queue and some DNS library like ldns to parse the packets and drop them if the DNS question contains "xn--".
[ Parent | on HN ]