Chromium's Domain Lookalike Checks Still Evaded by Cyrillic Corner Cases

Lookalike Domains Still Get Through

Typo-squatting attacks against major domain names remain viable even against the most advanced browser protections, according to a detailed analysis from the research project Have I Been Squatted (HIBS). When the IETF allowed Unicode characters in domain names, the move was seen as commendable but also dangerous, because hundreds of characters look similar or identical across multiple alphabets.

Bad actors can create functioning websites with deliberately misspelled addresses that appear identical to real URLs, launching attacks against users who mistype an address or land on the site through misleading search results.

The аррӏө.com Corner Case

The HIBS blog post uses the address "аррӏө.com" as an example. The domain is not identical to "apple.com", yet it evades multiple layers of protection thanks to the specific combination of Cyrillic characters used. The Cyrillic alphabet contains lookalikes for many Latin letters, including а for a, е for e, о for o, р for p, and с for c.

Chromium has the most advanced ruleset for finding and blocking mischievous domains, but the corner cases are revealing. Sneaking a single Cyrillic homoglyph into the middle of standard Latin text triggers the safeguards, causing the browser to display the domain in Punycode format, as in "xn--pple-43d.com". Composing a domain entirely from Cyrillic lookalikes, such as "аррӏе.com", also fails, because Chromium keeps a list of 29 Cyrillic characters that routinely masquerade as their Latin counterparts and blocks combinations built only from that list.

The address "аррӏө.com" passes because it uses the Cyrillic character ө, an oval with a line across it, which is not on the list of 29. A more recent Chromium release can and probably will add it, but the episode exposes the core difficulty: there is no one-size-fits-all solution for detecting typo-squatting, and even the best rule set will eventually meet a corner case.

An Evolving Character Set

The Unicode character set continually evolves and now counts nearly 173,000 entries, though only a subset is eligible for use in domain names or TLDs in practice. A 2020 study showed that Chromium caught 64.1% of typo-squatting attempts, with Firefox and Safari trailing behind. Chromium underpins the Chrome, Edge, and Brave browsers and, besides many per-alphabet verifications, maintains a list of more than 8,000 popular domains bound to be typo-squatted, running stronger checks against 836 of them. Domain registries likewise impose rules about which characters can go into which TLDs, but that alone is not nearly enough to solve the problem.

Recommended Defenses

All things considered, HIBS recommends that companies worried about impersonation register lookalike domains of their own and encourage users to adopt passkeys. Passkeys are always tied to a specific domain, so a user would not be able to log in to a sneaky lookalike website with them.

Sources: Tom's Hardware