研究人员表示，两个可供错别字抢注者和网络钓鱼者利用的字符，能够欺骗 Chromium 内核浏览器将伪造的 URL 显示为真实的网址。注册一个看起来极像热门网站的域名并非新鲜事。我们在日常对抗垃圾邮件的过程中，早已见识过 macrosoft[.]com 和 applle[.]com 这类钓鱼网站。然而，随着浏览器的成熟，可用的字符不断增加。这为使用非 ASCII 合规字符/同形异义字的语言用户带来了新机遇，但也给攻击者利用 Chrome、Edge 等程序中的显示逻辑漏洞提供了新手段。
Researchers say two characters available to typosquatters and phisherfolk can trick Chromium browsers into displaying lookalike URLs as genuine web addresses. Wangling a domain name to look an awful lot like that of a popular website is nothing new. We’ve all encountered phishing sites such as macrosoft[.]com and applle[.]com before in our daily struggles against spam. However, as browsers mature, new characters are always being made available for use. This opens up new opportunities for those whose languages contain characters/homoglyphs that aren’t ASCII-compliant, but it also introduces new ways for attackers to abuse display logic quirks in programs like Chrome and Edge.
据 Have I Been Squatted 的 Ian Muscat 和 Leanne Briffa 称，网络冒名顶替者仍可利用某些字符，可靠地诱使用户信任那些绝对不该信任的 URL。最新绕过浏览器安全检查的字形，使骗子能够运行在 Punycode 显示下明显为假的域名，但在 Unicode 显示下却与真品无异。
According to Ian Muscat and Leanne Briffa of Have I Been Squatted, there are still characters available to cyber-imposters that can reliably fool web users into trusting URLs that they certainly should not. The latest glyphs bypassing browser safety checks allow tricksters to run websites from a clearly fake domain name (when displayed in Punycode), although they appear just like the real deal in Unicode.
此次涉及的字符分别是 ө（见于哈萨克语、蒙古语、鞑靼语等多种西里尔语言）和带钩的拉丁字母 K ƙ（用于豪萨语和卡赖-卡赖语）。二者在视觉上分别与 e/o、i 和 k 相似，研究人员借此构造了 20 个外观相似的域名。其中包括：aррӏө[.]com sрапөх[.]com oƙta[.]com niƙe[.]com以下是这些 URL 的 Punycode 等效形式——即浏览器应以此安全方式显示：xn--80a6aa68c8d.com xn--80a5aeq0fr0c.com xn--ota-f6a.com xn--nie-g6a.com你可以亲自试访；它们由 Have I Been Squatted 注册，访问安全。
The characters of note, in this case, are ө, which is found in various Cyrillic languages such as Kazakh, Mongolian, and Tatar, and the Latin K with hook, ƙ, used in Hausa and Karai-karai. Both are visually similar to the letters e/o, i, and k, respectively, and allowed the researchers to 20 lookalike domain names. These included: aррӏө[.]com sрасөх[.]com oƙta[.]com niƙe[.]com Below are the URLs’ Punycode equivalents – how browsers should display them safely: xn--80a6aa68c8d.com xn--80a5aeq0fr0c.com xn--ota-f6a.com xn--nie-g6a.com You can try them out; they’reed by Have I Been Squatted and are safe to visit.
它们会跳转至研究人员搭建的演示页面，每个页面都详细解释了如何绕过浏览器防护。关键在于，它们全部绕过了基于 Chromium 的浏览器所部署的关键安全措施。绕过原理浏览器部署了两道主要防线。
They take you to research demo pages set up by the researchers, and each page explains how exactly they bypass browser protections. Crucially, they all bypass the key security measures deployed by Chromium-based browsers. How the bypasses work Browsers deploy two main defense layers.
第一项是由 Chromium 的 SafeToDisplayAsUnicode 函数运行的一组七个顺序检查，用于检测一系列常见的欺骗方法。供应商自 2017 年起开始引入这些检查，这是在研究人员徐东正（Xudong Zheng）发现了 аррӏе.com（一个由全西里尔字符组成的域名）之后。Chromium 的这些检查会考虑一个硬编码的已知西里尔字符列表，这些字符常被用来替代拉丁字母，因此可以视为“全有或全无”的机制。
The first is a set of seven sequential checks run by Chromium’s SafeToDisplayAsUnicode function, which check for a range of common spoofing methods. Vendors began introducing these checks in 2017 after researcher Xudong Zhenged аррӏе.com – a domain consisting of all-Cyrillic characters. Chromium’s checks, which factor in a hardcoded list of known Cyrillic characters known to be used in place of Latin letters, can be seen as "all or nothing."
该机制专门用于检测全西里尔字符串，只有当字符串中的每个字符都在其硬编码列表中时，才会对域名采取行动。如果有一个字符不在列表中，则该检查会被跳过。字符如 ө、ї 和 ү 被称为“破坏者”，因为它们不在相似字符列表中，这一点在 Chrome 154（于 2022 年 9 月 22 日发布至稳定版）中仍然成立。如果七个显示检查中的任何一个失败，浏览器会认为这些字符不适合以 Unicode 形式显示，而是应显示 Punycode，从而暴露它们与试图模仿的真实域名之间的巨大差异。
Built to detect all-Cyrillic strings, the measure only takes action against domain names if every character in the string is on its hardcoded list. If one character is missing, the check is bypassed. Characters such as ө, ї, and ү, are known as “breakers,” as these are not present in the lookalike list, as of Chrome 154 (released to stable channel on September 22). Failing any of the seven display checks tells the browser that the characters are unsafe to display as Unicode and to instead display the Punycode, revealing just how dissimilar they are to the genuine domains they try to imitate.
浏览器采取的第二项措施是将域名与热门网站列表进行比较，以判断其是否试图模仿其中某个网站。在 Chromium 中，这些检查由 GetSimilarTopDomain 函数处理。此步骤会将提供的域名转换为一个“骨架”，去除其字符上的变音符号（例如 ó 变为 o），然后将该骨架 URL 与一个硬编码的热门网站列表进行比较。Chromium 会检查近 8500 个网站，如果骨架匹配其中任意一个，则会显示 Punycode。
The second measure browsers take is to compare the domain name against a list of popular websites to see if it is trying to imitate one of them. In Chromium, these checks are handled by the GetSimilarTopDomain function. This step converts a supplied domain name into a "skeleton," stripping its characters of diacritics, such as accents (ó becomes o), and checking the skeleton URL against a hardcoded list of popular websites. Chromium checks against almost 8,500, and if the skeleton matches any of them, then it displays Punycode.
然而，带钩的拉丁字母 K（ƙ）没有变音符号，在骨架中会被处理为带有额外组合标记的拉丁字母 k，从而绕过了安全检查。在这种情况下，骨架形成为：[o k ‘ t a . c o r n]。（骨架将“m”映射为“rn”）。同样地，对于 аррӏө.com，西里尔字母带横杠的 o 在骨架中保留其横杠作为组合标记，因此它不会匹配真实的 Apple 域名。
However, the Latin K with hook, ƙ, does not have an accent, and is added to the skeleton as a Latin k with an added combining mark, bypassing the security check. In this case, the skeleton is formed as: [o k ‘ t a . c o r n]. (The skeleton maps "m" to "rn"). Likewise, with аррӏө.com, the Cyrillic barred o retains its bar in the skeleton as a combining mark, meaning it does not match the genuine Apple domain.
其骨架形成方式为：[a p p l o - . c o r n]。浏览器一直在努力阻止这些冒充工具。例如，Chrome 148 终止了攻击者使用 ҏ 和 ӿ 作为破坏字符来模仿其拉丁字母相似字符的能力。两个主要的安全检查并不是唯一的防御线。Chromium 还在导航时部署名为“安全提示”（Safety Tips）的警告。一个能够绕过两个主要检查的域名示例是 ínstagarm[.]com。
Its skeleton is formed as: [a p p l o - . c o r n]. Browsers are always working to stymie these tools of imposterment. Chrome 148 put an end to attackers being able to use ҏ and ӿ as breakers to imitate their Latin lookalikes, for example. The two main security checks are not the only lines of defense. Chromium also deploys warnings at the time of navigation called Safety Tips. An example domain that would bypass the two main checks is ínstagarm[.]com.
开头字符的变音符号被移除后，剩余部分基本上就是真实的 Instagram 域名，只是两个字母互换了位置。Instagarm 域名不匹配任何硬编码站点，也不包含任何被禁止的字符。在这种情况下，Chrome 会弹出两种弹窗之一，询问用户是否真的想访问真实域名，警告当前的访问方向看起来是假的。然而，这一额外安全层也有其局限性。
The inflection on the beginning character is removed and what’s left is essentially the real Instagram domain with two letters swapped. The Instagarm domain does not match any of the hardcoded sites, nor does it contain any banned characters. In this case, Chrome will display one of two popups, asking the user if they meant to visit the genuine domain, warning that the current direction of travel appears fake. However, there are limits to this extra security layer.
警告仅在模仿域名与真实 URL 完全匹配、单字符编辑匹配，或相邻字符交换匹配时触发。两个或更多改动，例如 аррӏө[.]com（在 ".com" 前全为西里尔字符），不会触发这些警告。此外，当域名字符少于五个时，警告也不会触发。例如 oƙta.com（仅比真实 Okta 多一个编辑）可能不会触发防御，这是因为单编辑规则以及它仅有四个字符。
The warnings only trigger when an imitation domain is an exact-character match, a one-edit match, or a match with an adjacent swap from the genuine URL. Two or more changes, like with аррӏө[.]com, which has all-Cyrillic characters preceding the ".com," will not trigger these warnings. The warnings will also not trigger with domains consisting of fewer than five characters. Domains such as oƙta.com, which is only one edit from the real Okta, may not trigger defenses because of the one-edit rule and the fact that it is only four characters.
Safety Tips 还会将骨架与用户经常访问的站点进行对比，而不仅仅是硬编码的可信站点列表。经常访问的站点可能会触发相同的警告，但对于访问历史不全面的用户，这一防御层可能会失效。这里描述的防御仅适用于浏览器。电子邮件客户端对仿冒域名字符的检查甚至更宽松。
Safety Tips also checks the skeleton against the sites users visit regularly, not just the hardcoded list of trusted sites. Frequently visited sites may trigger the same warnings, but for users who do not have a comprehensive visit history, the defense layer may fail. The defenses described here only apply to browsers. Email clients are even less picky with imitation domain strings.
像 Gmail 这样的网站在显示 HIBS 提供给客户的 20 个域名时，会以攻击者希望的方式呈现 — — 这些域名是拼写相似域名和真实国际化域名（IDN）的混合体，全部以 Unicode 形式显示。而 Outlook Web 则将全部 20 个域名显示为 Punycode 形式，即使是无害的域名也不例外，这表明两者都没有应用正确的检查机制来恰当地向用户提示风险。
Websites like Gmail displayed each of the 20 domains HIBS fed the clients, which were a mix of lookalikes and genuine internationalized domain names (IDNs), as an attacker would want it to, all in Unicode. Outlook Web showed all 20 as Punycode, even the harmless ones, suggesting neither apply the right checks to properly inform users.
为了量化此问题的规模，研究人员查看了 ICANN 列出的所有 .com 域名。目前约有 1.67 亿个 .com 域名，其中大约 73.3 万个是 IDN，即包含非 ASCII 字符并以 Punycode 形式存储的域名。研究人员对每个 IDN 进行处理，将其非 ASCII 字符替换为 ASCII 等效字符，以确定存在多少匹配项。他们发现大约有 16.2 万对 — — 即与纯 ASCII 域名相似的 IDN。
To quantify the scale of the issue, the researchers looked at ICANN’s list of every .com domain. There are around 167 million of them, approximately 733,000 of which are IDNs, those that contain non-ASCII characters and are stored in Punycode form. The researchers took each of the IDNs and swapped their non-ASCII characters for ASCII equivalents to determine how many matches there were. They found around 162,000 pairs – IDNs that resemble plain ASCII domains.
需要说明的是，这并不意味着大约有 16.2 万个域名正在被拼写错误抢注（typosquatting），而是说许多 IDN 会产生相似的外观。其中一些可能被企业出于防御目的而注册；也可能被同一家企业所拥有，用于运营面向不同语言用户的多个网站。然而，组织应意识到拼写错误抢注者可利用的手段，并相应地对域名进行监控。®
It should be said that this does not mean there are circa 162,000 typosquatted domains, just that many yield lookalikes. Some may beed by businesses for defensive purposes; others may be owned by the same business that wants to operate multiple websites catering to different languages. However, organizations should be aware of the means available to typosquatters, and monitored domains accordingly. ®