When identical-looking letters are actually different characters
In short: A single character substitution can lead you to a fraudulent website. In the digital realm, the Latin 'a' and the Cyrillic 'а' look identical to the human eye, but computers treat them as entirely different entities. This visual deception is the foundation of the IDN homograph attack.
An Internationalized Domain Name (IDN) homograph attack, also known as script spoofing, exploits the visual similarities between different writing systems. While a user sees a familiar URL like 'paypal.com', an attacker can register a domain using a Cyrillic 'а' instead of a Latin 'a'. To the human eye, the glyphs are indistinguishable in most fonts, but the computer processes them as distinct code points, allowing a malicious actor to direct traffic to a spoofed site.
The vulnerability stems from the expansion of the Unicode character set. While Unicode allows for thousands of characters across many scripts, it also creates a vast repertoire for attackers. Cyrillic is particularly problematic because it contains 11 lowercase glyphs that are nearly identical to Latin counterparts. To illustrate, the Latin alphabet contains visual matches for the Cyrillic characters 'а, с, е, о, р, х and у'. Even the Greek alphabet offers opportunities, such as omicron (ο) which can appear identical to the Latin 'o'.
The risk of such attacks was formally identified in December 2001 by researchers Evgeniy Gabrilovich and Alex Gontmakher from Technion, Israel. They proved the concept by successfully registering a variant of 'microsoft.com' using Cyrillic characters. Despite early warnings and guidelines advising registries to limit character sets, many major Top-Level Domains (TLDs) neglected these precautions. This creates a breakdown in the user's assumption that a name's visual appearance always corresponds to its actual identity.
The complexity of the problem is compounded by typography. In certain narrow-spaced fonts, such as Tahoma, characters like 'c' combined with 'j', 'l', or 'i' can produce homoglyphs. Furthermore, the use of italic typefaces can create even more confusion, such as the Greek alpha (α) resembling a Latin 'a'. These subtle nuances make it difficult for even advanced computer technology to reliably distinguish between legitimate and fraudulent links.
Opens the Intellect+ feed with this card first. Swipe up for the next one.
Sources
- Summary by Intellect · source: IDN homograph attack
To cite this card, link to https://intellectplus.co.uk/app/design-idn-homograph-attack.
How we source, check and correct cards: Editorial standards.
General information, not professional advice. Spotted an error? Flag the card or see corrections and complaints.
Intellect Plus is a visual educational discovery platform for exploring fascinating facts and ideas. Brain Food, Not Brain Rot. What is Intellect Plus?
Related
More in Typography · More in Design · Latest · A–Z · All topics
