14 DAY TRIAL // A security consultant ran an experiment by registering a domain whose name resembles the legitimate website of LLoyds Bank and even got a TLS certificate to promote secure communication on the website.
The lawful site for the bank is lloydsbank.com, but Paul Moore found that the domain IIoydsbank.com (beginning with capital “i”) was up for grabs, which could have been used by a malicious actor for phishing attacks.
This is known as a homograph attack, and in the internationalized domain name (IDN) system, it relies on replacing characters in a domain name with ones from a different language set that look the same in the web browser.
SSL Server Test result of fake domain better than the original
In a tweet on Saturday (embedded below), Moore presented a simple problem of spotting the difference between the genuine bank domain and the one he registered on Friday.
Users landing on the bogus page would be warned of the potential damage, were that a real scam. “This site, registered by a security professional, was chosen to exploit a subtle but crucial issue which compounds the problem,” Moore alerted.
In a browser, the unlikeness passes unobserved. Mixed with a fake page of the bank and with the HTTPS mark, a user accessing the fake resource could be tricked into believing they were actually on the bank’s page.
Moore obtained the TLS certificate from content delivery network service Cloudflare, which obtained an A+ score in Qualys’ SSL Server Test, much better than the original domain, which only got a C mark.
The security boffin asked Cloufdflare to offer a comment on the easiness of obtaining the certificate for a domain that could be used to impersonate a bank.
At the moment, the certificate is revoked and more details on the matter are to be disclosed. The bank has been alerted of the fraud potential and has taken ownership of the domain.
Can you spot the difference? http://t.co/KpMyCrFXJh http://t.co/tD5nq7SG3W #phishing #scam #caseSensitive #security pic.twitter.com/oLfHus7hM7
— Paul Moore (@Paul_Reviews) June 27, 2015
