Advertisement by Easy Branches NetworkContribute your contents

Chrome, Firefox, and Opera users beware: This isn’t the apple.com you want

By: arstechnica.com 1 year ago
Chrome, Firefox, and Opera users beware: This isn’t the apple.com you want

Unicode slight of hand makes it hard for even savvy users to detect impostor sites.

News Chrome, Firefox, and Opera users beware: This isn’t the apple.com you want

About Chrome, Firefox, and Opera users beware: This isn’t the apple.com you want

Online Chrome, Firefox, and Opera users beware: This isn’t the apple.com you want
How Chrome, Firefox, and Opera users beware: This isn’t the apple.com you want

Enlarge / This is how a Chrome 57 displays https://www.xn--80ak6aa92e.com/. Note the https://www.apple.com in the address bar.

If you're using Chrome, Firefox, or Opera to view websites, you should be aware of a weakness that can trick even savvy people into trusting malicious impostor sites that want you to download software or enter your password or credit card data.

The weakness involves the way these browsers display certain characters in the address bar. Until Google released version 58 in the past 24 hours, for instance, Chrome displayed https://www.xn--80ak6aa92e.com/ as https://www.apple.com. The latest versions of Firefox and Opera by default continue to present the same misleading address. As the screenshot above demonstrates, the corresponding website has nothing to do with Apple. Had a malicious attacker registered the underlying xn--80ak6aa92e.com domain, she could have used it to push backdoored software or to trick visitors into divulging passwords or other sensitive information.

Xudong Zheng, a Web application developer who developed the apple.com look-alike site to demonstrate the threat, explained here how the attack works.

Chrome,Firefox,Operausersbeware:Thisisn’tapple.comwant