Can ADRA NDR devices detect and respond to Punycode phishing attacks?
Applicable Products
ADRA NDR Appliances
Overview
To conduct Punycode phishing attacks, attackers register deceptive domain names by exploiting Internationalized Domain Names (IDNs) containing specific Unicode characters that visually resemble Latin letters. These fraudulent websites, visually mimicking legitimate websites, trick users into entering sensitive information, such as login credentials or banking details.
The key to the visual similarity is homoglyphs, which are Unicode characters from scripts like Armenian, Cyrillic, and Greek that look very similar to Latin letters. This visual similarity allows attackers to register domain names that closely resemble legitimate hostnames. For example, the homoglyphs Cyrillic lowercase "a" (U+0430) and the Latin lowercase "a" (U+0061) are visually indistinguishable to unsuspecting users. Attackers can present a link that seems to direct users to "apple.com", but actually sends them to a fake website registered with Punycode.
Punycode is an encoding system used to represent website addresses that contain non-ASCII characters, which are characters beyond the basic English alphabet, numbers, and symbols. This includes characters from languages like Chinese, Korean, and Thai. For example, "ชื่อของฉัน" ("my name") converts to Punycode as "xn--22ckgb2fvfb8ayc4k". The "xn--" prefix indicates to the web browser that the domain uses Punycode to represent Unicode characters.
Modern browsers, such as Apple Safari, Microsoft Edge, and Internet Explorer, prevent these homoglyph attacks by displaying Punycode URLs in their Unicode form (e.g., xn--80ak6aa92e.com). However, older browsers, such as Google Chrome 58 (stable) and Firefox versions earlier than 57, may automatically convert Punycode URLs containing different writing systems into ASCII characters, potentially hiding malicious website addresses.
Details
ADRA NDR devices can immediately detect potential phishing threats and homoglyph attacks that exploit IDNs containing Punycode. When such threats are detected, ADRA NDR sends a high-risk threat notification to network administrators, including details about the suspicious URL. Administrators can then verify if the URL is using a Punycode domain by examining its raw ASCII format.
Alternatively, network administrators can use a network firewall to perform URL filtering on every device on the network.
Further Reading
- For details on Punycode, refer to Wikipedia.
- What should I do when ADRA NDR detects high-risk activities?
- Can ADRA NDR devices detect and respond to EternalBlue exploits?
