For Apple users without latest security updates, the letter 'd' is not always the letter 'd'

Science & Tech 14:09 20.11.2018

Most Apple users install updates, but there's always a small group of people who, for various reasons, lag behind when it comes to installing updates, for one reason or another, legitimate, or not.

If you're one of the users in the latter category, then you should be aware that the letter "d" is not always the letter "d" when displayed inside the Safari address bar.

This might sound like a non-issue, but it's actually a very important problem that all Apple users who don't run the latest OS software need to be aware of, as they could fall victims to what security researchers call "IDN homograph attacks."

IDN homograph attacks happen when someone registers a domain using Unicode characters that look like standard Latin letters, but they are not. For example, coinḃase.com is an IDM homograph attack for coinbase.com (notice the dot above the letter b).

These lookalike domains are usually used for phishing, tricking users into thinking they accessed a legitimate site when they're on a cleverly crafted clone.

IDN homograph attacks have been an issue over the past year, and several incidents have been reported in the security news media about homograph attacks against cryptocurrency exchanges in 2017 and 2018.

Driven by this new wave of homograph attacks, xisigr, a security researcher at Tencent Security Xuanwu Lab, has recently taken a look at how Apple products handle Unicode characters.

What the researcher found is that Apple does a good job with most Unicode characters, except one --which is the letter dum (ꝱ) (U+A771), part of the extended Latin alphabet character set.

The letter looks like a normal Latin lowercase letter 'd', except it comes with a lower apostrophe. But xisigr found that Safari did not render the small lower apostrophe, displaying the letter dum as a Latin letter d.

apple-letter-d-dum.png

The Tencent researcher reported his findings to Apple, who issued security updates in July for Safari, iOS, macOS, tvOS, and watchOS.

Unfortunately, users who have not applied those updates are still vulnerable to phishing attacks. An attacker can record domain names that include the letter dum and he can launch phishing campaigns against Apple users.

Xisigr says the issue should not be ignored because he found that the letter d is part of almost 25 percent of all Top 10,000 domains, providing attackers with a huge phishing surface.

Some of the domains that a phisher could impersonate include LinkedIn, Baidu, Dropbox, Adobe, WordPress, Reddit, or GoDaddy, just to name a few.

Furthermore, even if some domain registrars prevent users from registering domain names that contain Unicode characters, this limitation doesn't apply to the letter dum because it's part of the extended Latin character alphabet, and hence, is considered a standard Latin character.

If Apple users can't update, for the time being, they should at least take notice that the letter "d" in Safari's URL bar may not actually be "d" and they should use another browser to navigate the web until they can apply Apple's July security patches.

Azerbaijan Defense Minister informs NATO chief on situation in Azerbaijan-Armenia conditional border -VIDEO

News line

North Korea holds firing drill using super-large multiple rocket launchers
North Korea holds firing drill using super-large multiple rocket launchers
11:55 19.03.2024
Fenerbahçe to discuss withdrawing from 'Super Lig'
11:32 19.03.2024
Azerbaijani police found numerous weapons and ammunition in Khankandi
11:08 19.03.2024
US Maritime Administration issues new advisory amid rising maritime threats in Middle East
10:55 19.03.2024
EU looks forward to cooperation with Azerbaijan for successful COP29
10:38 19.03.2024
EU to impose tariffs on Russian grain
10:11 19.03.2024
Embassy of Azerbaijan in France appeals to Azerbaijanis
10:00 19.03.2024
Azerbaijani oil price exceeds $88
Azerbaijani oil price exceeds $88
09:48 19.03.2024
Mehriban Aliyeva makes post on Last Tuesday before Novruz Holiday
09:35 19.03.2024
Pashinyan: Delimitation process between Armenia and Azerbaijan entered practical stage
09:00 19.03.2024
Pakistan restricts foreign travels of ministers, government officials
Pakistan restricts foreign travels of ministers, government officials
20:39 18.03.2024
EU to boost military support fund for Ukraine by EUR 5 bln — Hungarian foreign minister
20:00 18.03.2024
Industrial zones to be created in Azerbaijan’s Zangilan, Jabrayil, and Gubadli
19:16 18.03.2024
Reuters: Only an oil slump can stop Russia
19:00 18.03.2024
Top Hamas operative killed in hospital raid, IDF says
Top Hamas operative killed in hospital raid, IDF says
18:33 18.03.2024
President Ilham Aliyev congratulates people of Azerbaijan on occasion of Novruz holiday - UPDATED
18:00 18.03.2024
Jens Stoltenberg: We fully support Georgia's sovereignty and territorial integrity
Jens Stoltenberg: We fully support Georgia's sovereignty and territorial integrity
17:47 18.03.2024
2 dead, 6 injured in Türkiye factory explosion
2 dead, 6 injured in Türkiye factory explosion
17:28 18.03.2024
Armenia’s anti-Russian policy reaches new level
17:11 18.03.2024
"The Middle Corridor plays a key role for Green Energy" - Expert Ali Pasha
16:45 18.03.2024
Central square of Khankandi named “Victory Square”
16:22 18.03.2024
President: We demonstrated tremendous heroism during the II Karabakh War and the anti-terror operation
16:16 18.03.2024
Nobel Peace Prize Laureate Muhammad Yunus visited IEPF - PHOTOS - VIDEO
16:00 18.03.2024
Historic opportunity emerged to advance the Azerbaijani-Armenian peace agenda - FM Bayramov
15:21 18.03.2024
Bayramov and Stoltenberg discuss normalization process between Azerbaijan and Armenia
15:03 18.03.2024
Azerbaijan Defense Minister informs NATO chief on situation in Azerbaijan-Armenia conditional border -VIDEO
14:58 18.03.2024
Stoltenberg's visit to the Caucasus: "NATO is in panic" - OPİNİON
14:29 18.03.2024
Hikmat Hajiyev holds discussions for upcoming COP29 with Chinese Vice FM
Hikmat Hajiyev holds discussions for upcoming COP29 with Chinese Vice FM
14:00 18.03.2024
Stoltenberg concludes his official visit to Azerbaijan
13:42 18.03.2024
Geomagnetic storm expected on March 20
13:33 18.03.2024
Mbappe celebrates his 250th goal in PSG
Mbappe celebrates his 250th goal in PSG
13:19 18.03.2024
President Ilham Aliyev makes a phone call to Vladimir Putin
13:00 18.03.2024
President Ilham Aliyev lit Novruz bonfire in Khankandi and congratulated Azerbaijani people
12:34 18.03.2024
Foreign students attacked in India over Ramadan prayers
12:30 18.03.2024
Spring comes to Northern Hemisphere
Spring comes to Northern Hemisphere
12:17 18.03.2024
Why does Azerbaijan matter to the European Union? - OPINION
12:00 18.03.2024
Number of human remains found in mass grave in Khojaly reaches 19
11:45 18.03.2024
Hikmat Hajiyev meets Pakistani envoy to China
Hikmat Hajiyev meets Pakistani envoy to China
11:33 18.03.2024
EU Council to discuss Armenian-Azerbaijani normalization
11:23 18.03.2024
Global Terrorism Index: Azerbaijan among countries with highest anti-terror rating worldwide
10:56 18.03.2024
Hamısı