Google Is Battling a Russian Spammer Over the Use of the Letter 'G' | Hacker News Reader

Google Is Battling a Russian Spammer Over the Use of the Letter 'G'

motherboard.vice.com

52 pointsbloomca58 comments

I think an issue here is Google is showing "ɢoogle" as "ɢoogle.com" and not "xn--oogle-wmc.com". The .com TLD has no support for IDNA2008 so they allow registration of these similar-looking unicode TLDs. This is why if you paste ɢoogle.com in your browser it will show the punycode instead. Basically it looks like Google is decoding punycode for all TLDs, not just those that support IDNA2008.

This shows the problems with unicode in domain names. Some Cyrillic characters look exactly like Latin characters but have different codepoints, e.g. a (0x61) and а (0xB0D0). This is pretty important for businesses whose domain include an a, like banks.

Google is now noticing that those malicious domains don't even have to be an exact visual match but a similar looking one is sufficient to trick users.

Ironically this is made worse by some fontsets such as Noto, that unify the look over a variety of scripts (which is something you normally _want_).

This is going to be fun to watch. Unicode domain names are a can of worms.

Yep.

"Unicode is too complex to ever be secure" - Bruce Schneier

Could be made a standard to signal non ascii chars by programs. A (red squared g)oogle might grab attention. Maybe a full underline ..

That might be nice for you but it would be annoying for those of us who use non-latin scripts.

Good point .. maybe a dual set based on the user locale..

That's why browsers should color the backgrounds by the character codepoint. And do something crazier with multi-character icons.

This is a good idea, but I worry that non-technical people might not notice or care about such a minor difference. Thinking of my family and relatives, I'd imagine that almost none of them would think to avoid typing in their password if some characters in the URL bar had a different colored background but looked visually similar to domains they recognized.

I found some fonts reuse exact same vector instructions for Cyrillic "А" and English "A" in the same file

People create parody or trick Twitter accounts using a similar trick with typical sans-serif fonts where capital I (I) and lower case L (l) look the same. (Note: This is not true with whatever font Hacker News uses.)

So instead of @realdonaldtrump you could create @reaIdonaIdtrump and to the untrained eye, you'd think it was the same thing.

Accessing the domain in question (ɢoogle.com) redirects to this fairly bizarre chain of subdomains

  http://money.get.away.get.a.good.job.with.more.pay.and.you.are.okay.money.it.is.a.gas.grab.that.cash.with.both.hands.and.make.a.stash.new.car.caviar.four.star.daydream.think.i.ll.buy.me.a.football.team.money.get.back.i.am.alright.jack.ilovevitaly.com/

With an even more bizarre website http://webcache.googleusercontent.com/search?q=cache:RWLWj2k...

The buttons on the background are particularly strange.

Wow, that site is... interesting.

> No any corporation is not associated with this project. All product names and brands are property of their respective owners. All service names used in this website are for identification of services to open only. Why the richest and the most technologically advanced multinational corporation in the world shows 'Secret.ɢoogle.com You are invited! Enter only with this ticket URL. Copy it. Vote for Trump!' in tens of millions accounts since 5 November ask not me. I don't working in their support so it's not a my problem. This site domain is ilovevitaly.com. Despite the huge number of lies without any proofs in the media, this search shell is absolutely safe and very useful. Just one very rich and influential hidden evil corporation doesn't like competitors very much.

"Ask not me", sure...

That's Pink Floyd.

Good catch! https://genius.com/Pink-floyd-money-lyrics

s/bizarre/almost redeeming/ :)

> ilovevitaly.com

Ah, it's the guy that keeps spamming Google Analytics. I'm glad Google is finally doing something about this, although they be working on a technical solution alongside a legal one.

iloveitaly.com is also known for referrer spam in Google Analytics.

Popovs argument seems to contradict his statement as seen in this other Motherboard article: https://motherboard.vice.com/read/this-pro-trump-russian-is-...

Before:

> “I was fully prepared from April, but I wait. I could begin in a month before the elections and on a wave of the anti-Russian hysteria to receive a lot of traffic,” he said.

Later:

> “Lie! Not my domain!” Popov writes in bright red text regarding the site with dodgy pop-ups.

> “Lie! I'm not a spammer!” he continues.

Either someone is running an extensive anti-Popov campaign or Popov is realising that the campaign has been a huge mistake.

Cached version (as original URL is returning 404):

http://webcache.googleusercontent.com/search?q=cache:KZq3KBV...

Seems that they sued vice.com too, now displays 404.

I can't believe it took this long for someone to register that name.

I would've thought Google themselves would have bought it many years ago, to protect their users (and their brand.)

There's a lot of Unicode variations on "google". Potentially too many to make that practical...

not that many to make it even remotely unfeasible.

Uh, no, more than enough to make it remotely unfeasible. There are tons of variations of the letters in "google" and with all its permutations + all the TLDs, I wouldn't be surprised if there's at least a few million domains. With all the new TLDs as well which are extremely pricey, the costs for this aren't a joke.

And don't forget that there's an endless amount of misspellings and word variations (googleapps.com, ...).

googleapps.com is registerd to google ;) Google isn't just anyone, they aren't going to pay 40$ per year per domain.

Exactly, it's a google domain. And yet, "googleapps.website" is up for grabs right now.

They have thousands of these domain variations. googleusercontent.com? picasa? googleplus? gmail? googlemail? ...

How many could there possible be? 1000? 5000? If google had to spend $50,000/year to never have to worry about this, it would easily be worth it.

Probably considerably more, basically depending on how many unicode variations that would render into graphically similar latin font characters of G,g,O,L,l,E,e and then you have all the permutations.

So that's probably a few 10,000's overall and then you need to register them for every top level domain that Google operates in so, com., de., co.uk. etc...

Overall there are probably a like 100,000's domains that can be registered, under Google.tld_x alone, more if you count in all the other services they have.

It will cost a small fortune for an individual even in bulk registration prices but still it's more than affordable for a company the size of Google.

That said using cyrillic is even better http://www.miсrosoft.com doesn't looks any different than http://www.microsoft.com but it translates to http://www.xn--mirosoft-gch.com/

If there are just 5 alternate ways to represent each letter, that's already over 15000 domains.

If bidi control characters are allowed (not sure if they are), it's even worse.

Then you could have something like *elgoog display as google

My coworker built a little tool to identify potential domain spam problems: http://upsidedown.domains/alternate.html?google

I stumbled upon this vulnerability during a white hat phishing test. The success rate was very high when I used the alternate G domains even among hard core IT folks. People have a tendency to overlook the difference. At that point I faced an ethical dilemma: should I just forget about this or maybe publish something? Neither options seemed right. Finally decided to get all the unreserved domain names for the fortune 500. Had to set a limit somewhere... To my surprise 102 of the vulnerable 103 fortune 500 was still available. Now I own these domains... If these companies want them, I am happy to transfer them over. If they do not care, I just let them expire. For my company - we set the spam filters according, changed our web proxies, and also own the alternate domains. I also submitted a bug report with a major software vendor, because their solution further amplified the problem. They are working on a fix...

unicode in domains is tricky; on the one hand; it's good that we can allow people whom have non-ascii characters in their language to create domains using them, but it introduces the problems pointed out here. It would be sane to say that, when you abuse the system to trick people (as is clear with the google and lifehacker examples), that the registration is voided (and barred from future use).

Maybe it should be restricted to certain TLD's though; e.g. only allow the unicode characters in TLD's that have a good reason for using them. That way, it won't be an issue for .com/.net/etc.

I always thought that enforcing domain names use characters in the same glyph subset would solve a lot of problems - either all Latin or all Cyrillic, etc. (although I don't have any experience of what people put in their internationalised domain names so maybe that would conflict with a key use case somehow?)

Or you could also enforce that all characters that look similar become unavailable.

For example, thèta.com might be a French fighter jet company, while théta.com could be very easily confused as the same thing, especially to non-French speakers. So I think registering that weird version of google.com should never have been possible, since the Gs could obviously be confused by a layman.

Also, in general I think web browsers need to be more machine learning backed. The browser should warn you when you're about to do something dumb or when you're reading lie-based propaganda. We're trying to teach laymen to be intelligent enough to check for HTTPS and to be discerning enough to figure out what news is false, but I don't think a majority of our population is able to do so.

why yes, let's cram machine learning into everything so people don't have to learn anymore. Learning is boring and takes so much time. /s

I don't understand the love for voluntary infantilism. Why is it such an impossibility to have to learn a system before using it? I don't think anybody here would argue that using a keyboard is too difficult. But couldn't we just back it with machine learning and let that algorithm figure out what we want to type when we just hit random keys?

You say that in jest, but that's basically what the Swype keyboard does, ML and all.

I don't love it, but I'm a realist. People have shown time and time again that they get sucked into stupid conspiracy theories and anti-intellectualism. They don't know basic facts like who is the VP of the USA or the leader of the UK.

At some point informed people just throw up their hands and start making it harder for people to hurt themselves or others.

Sorry but the Vice-President of the US is some peripheral guy or gal for us who are not in the US. Sure, the POTUS is obviously one of the key people in the world but the VP is not. I belive that not much people will know who the president of Italy or Germany is. In Europe we know (*conditions apply) but I would not expect anyone outside our region to have heard about Mr Gauck.

>I don't understand the love for voluntary infantilism.

Because people seek leisure and ease and going against that means the competitor who recognizes this is going to beat you. Also on a more pedantic front, did you write your own operating system or create your own cpu? What does "learning the system" mean here? Its arbitrary. Even a hard code dev today would seem like a child to the guys in the 60s who had to do literally everything by hand.

>I don't think anybody here would argue that using a keyboard is too difficult.

Ever watch someone learn a keyboard for the first time? Its painful. The common layouts are questionable and lots of keys are extraneous. I dont need a sysrq or break key, thanks. Look at mobile. When I use a mobile device I either use voice or a swipe keyboard. When I'm at home I use my Google Home and Amazon Fire via voice instead of a hunt and peck virtual keyboard. Keyboards are actually fairly terrible, but right now for a lot of tasks are the least of the worst.

That doesn't really help, though, because now you ask eg: a Cyrillic speaker to use Latin characters in place of their own characters that are different but simply look the same. That's like us expecting Germans to use B instead of ß (I know it's not a close example, but it's the first that came to mind for me) even though ß translates to a 'ss' sound, which is nothing like a B sound. so 'heißt' goes from 'heisst' to 'heibt'.

Enforcing all of one subset makes more sense to me, though even that's not foolproof because the above example uses both B and ß in the same language. But at least it'll reduce the attack surface, I guess.

I don't see what the problem is. For example, you could do this: create a string->"final string" hash function, where heißt and heibt both hash to the same final string (let's say it's HEIBT). You're only allowed to register final strings. If I create a company called heißt.com, then going to heibt.com (or HeIbT.com, hêìbŤ.com, or whatever) will also go to that same domain. A company can use heißt.com if it likes, or hêìbŤ.com, or whatever it prefers. But a spammer can't create a lookalike string. Why wouldn't this work?

It would work, and it is exactly what I recommended. He just didn't understand what I was asking for.

So like a lexical DNS service for figuring out DNS names.

A Domain Name Name Service - DNNS!

You'd at least be more aware of them though.

I don't think I've ever accessed one, and if I ever do it will probably be accidental - something illegitimate like this.

If I regularly used a site that legitimately used such a character, I imagine I'd be more in tune to it and less likely to fool for it.

Same subset doesn't really help

* ɢᴏᴏɢʟᴇ uses all Latin Small Caps

* ᏀᎤᎤᏀᏞᎬ uses the Cherokee block

* ԌООԌӏЕ uses Cyrillic block

Not perfect, but would you notice them in the small type of your typical address bar?

>Not perfect, but would you notice them in the small type of your typical address bar?

Requiring that all characters come from the same block certainly doesn't solve the problem but it would help make it a little more obvious - your examples above are much easier for me to spot as suspicious vs the ɢoogle.com in the article.

I hadn't thought about latin small caps before, that's an interesting one - although perhaps that block could be blacklisted entirely.

Overall it's a bit of a mess, isn't it!

Same subset plus identifying flag/icon showing which block is in use?

Restricting to certain TLD's doesn't solve underlying problem, because this problem stays there for those TLD's. There should be better solution.

Is it possible to disable Unicode chars for domains in FF?

`network.enableIDN` apparently. Interesting reading (2005) here:

https://bugzilla.mozilla.org/show_bug.cgi?id=279099

-- EDIT:

It doesn't 'disable' as such, but renders the 'punycode' in full, so a fake 'http://www.miсrоsоft.com' is rendered as instead 'http://www.xn--mirsft-yqfbx.com'.

For comparison, here's fake on top of real (not in monospace since it destroys the illusion):

http://www.miсrоsоft.com

http://www.microsoft.com

Thanks! Setting "network.enableIDN" seems not to work, but this setting works: network.standard-url.encode-utf8 [0]

[0] http://kb.mozillazine.org/Network.standard-url.encode-utf8

EDIT: doesn't work either. And the same for network.standard-url.escape-utf8. :(

I get a "404 horse".

Possibly to mitigate this? https://motherboard.vice.com/en_us/article/spammer-now-spamm...

Vice is under ddos now

Reply on news.ycombinator.com