Google-hosted malvertising leads to fake Keepass site that looks genuine
Google-hosted malvertising leads to fake Keepass site that looks genuine
Google-verified advertiser + legit-looking URL + valid TLS cert = convincing look-alike.
You're viewing a single thread.
The bot skips an important point. The site looks really close to the genuine site, only difference being "ķeepass dot info" and not "keepass". Definitely easy to miss.
I feel like browsers should flag urls with unicode in their domains as suspicious by default. Maybe they already do, not sure. It's honestly surprising to me in 2023 if they don't.
I wouldn't mind if FF popped up and said "hey, take another look at that URL" and very clearly drew attention to the weird k character. Of course it would have a "I'm absolutely sure this isn't a scam, I own this domain or know who owns it and you don't need to warn me about it in the future" button, but better safe than sorry.
Permanently Deleted
Permanently Deleted
FF Android redirects me to the real keepass page and I have no idea why :D
Lol are you sure?
Permanently Deleted
This should be ON by default, in my opinion. Also, I believe Mozilla has a massive opportunity here to demarcate themselves as the more security-conscious browser vendor. "This phishing trick works on all major browsers except Firefox" would be great publicity material.
Permanently Deleted
They could add some kind of warning message that notifies you when the URL has unicode in it. Then the user can decide if they want to disable the warning or not.
That's true. Also I guess domain names in most ideogram-based languages cannot be meaningfully converted to ASCII. The best detection method I'm aware of is detecting a mix of different alphabets in the domain, but I imagine even this has a lot of false positives
Turning it on by default would be a massive disservice to the work that domain registries and registrars have been doing to allow Unicode to be used in domain names. In Spanish speaking countries the ñ character is pretty ubiquitous for example, and the workaround of replacing it with an n creates many problems like misdirected web traffic and typos in email addresses. Unicode in URLs and domain names is a feature, abuse should be attacked by means other than disabling it.
Seems to be on by default in Librewolf(I just checked mine from the AUR on Arch), maybe consider that one!
enabled, thank you!!
I thought that they only show unicode chars if they are used in one of the installed languages of the browser and if not they show the punycode instead 🤔
Permanently Deleted
Incredibly easy to miss, damn.