Attackers Used Look-Alike Domains to Steal $1M from a Chinese VC

Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi... by bayarrhea on Saturday December 07, 2019 @11:47AM (#21731170)

Encryption doesn’t help Unicode homoglyph attacks. I can send you encrypted messages all day long from google.com, even though they’re not coming from who you think they are.

[ Parent | on HN ]

Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi... by yabadabadoes on Saturday December 07, 2019 @12:47PM (#21731514)

If you are using web of trust in a gpg style then homoglyph attacks are not particularly effective..

If you are using CAs then homoglyph attacks are the simplest of many attacks based on a system of minimal technical compliance.

[ Parent | on HN ]

Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi... by DyslexicAtheist on Saturday December 07, 2019 @11:58AM (#21731230)

if you don't care about unicode domains then mitigation can be very simple using dnsmasq, e.g.:

in /etc/dnsmasq.conf add something like:

  # Add domains which you want to force to an IP address here.
  address=/:xn--*:/0.0.0.0

(in case your dnsmasq doesn't support this then there is a patch here: https://github.com/spacedingo/dnsmasq-regexp_2.76)

[ Parent | on HN ]

Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi... by zelly on Saturday December 07, 2019 @01:48PM (#21731849)

You wouldn't be able to sign the fake message with the fake domain unless you compromised the sender's PGP private key, which was not the vector of this attack.

[ Parent | on HN ]

Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi... by pbhjpbhj on Saturday December 07, 2019 @12:51PM (#21731534)

When I use the actual second party's public key, the decryption won't work though, so you'd be found out immediately, surely?

[ Parent | on HN ]

Re:Attackers Used Look-Alike Domains to Steal $1M from a Chi... by mirimir on Sunday December 08, 2019 @12:51AM (#21734535)

Exactly so.

[ Parent | on HN ]