Re: Unicode domain names issue (Encrypting a "fake" domain name)

In mozilla.dev.security, Igor Bukanov  <[email protected]> wrote:
> On 21 April 2017 at 00:54, Eli the Bearded <*@eli.users.panix.com> wrote:
>> More baked: Using the confusables list from Unicode, if a domain label
>> consists entirely of letters in one script that are "confusable" to
>> another (single) script, start raising red flags.
> The problem is that at least for Russian/English language the words
> consisting of only confusable characters are frequent enough to bring
> way too many false positives to be usable.

Hmmm. Checking for Cyrillic to Latin / Digit issues in confusables.txt,
there are more than I had suspected.


A644 ;  0032 ;  MA      # ( Ꙅ → 2 ) CYRILLIC CAPITAL LETTER REVERSED DZE → DIGIT TWO    # →Ƨ→
0417 ;  0033 ;  MA      # ( З → 3 ) CYRILLIC CAPITAL LETTER ZE → DIGIT THREE    #
04E0 ;  0033 ;  MA      # ( Ӡ → 3 ) CYRILLIC CAPITAL LETTER ABKHASIAN DZE → DIGIT THREE # →Ʒ→
0431 ;  0036 ;  MA      # ( б → 6 ) CYRILLIC SMALL LETTER BE → DIGIT SIX        #

0430 ;  0061 ;  MA      # ( а → a ) CYRILLIC SMALL LETTER A → LATIN SMALL LETTER A      #
0410 ;  0041 ;  MA      # ( А → A ) CYRILLIC CAPITAL LETTER A → LATIN CAPITAL LETTER A  #
042C ;  0062 ;  MA      # ( Ь → b ) CYRILLIC CAPITAL LETTER SOFT SIGN → LATIN SMALL LETTER B    # →Ƅ→
0412 ;  0042 ;  MA      # ( В → B ) CYRILLIC CAPITAL LETTER VE → LATIN CAPITAL LETTER B #
0441 ;  0063 ;  MA      # ( с → c ) CYRILLIC SMALL LETTER ES → LATIN SMALL LETTER C     #
0421 ;  0043 ;  MA      # ( С → C ) CYRILLIC CAPITAL LETTER ES → LATIN CAPITAL LETTER C #
0501 ;  0064 ;  MA      # ( ԁ → d ) CYRILLIC SMALL LETTER KOMI DE → LATIN SMALL LETTER D        #
0435 ;  0065 ;  MA      # ( е → e ) CYRILLIC SMALL LETTER IE → LATIN SMALL LETTER E     #
0415 ;  0045 ;  MA      # ( Е → E ) CYRILLIC CAPITAL LETTER IE → LATIN CAPITAL LETTER E #
050C ;  0047 ;  MA      # ( Ԍ → G ) CYRILLIC CAPITAL LETTER KOMI SJE → LATIN CAPITAL LETTER G   #
04BB ;  0068 ;  MA      # ( һ → h ) CYRILLIC SMALL LETTER SHHA → LATIN SMALL LETTER H   #
041D ;  0048 ;  MA      # ( Н → H ) CYRILLIC CAPITAL LETTER EN → LATIN CAPITAL LETTER H #
0456 ;  0069 ;  MA      # ( і → i ) CYRILLIC SMALL LETTER BYELORUSSIAN-UKRAINIAN I → LATIN SMALL LETTER I       #
0458 ;  006A ;  MA      # ( ј → j ) CYRILLIC SMALL LETTER JE → LATIN SMALL LETTER J     #
0408 ;  004A ;  MA      # ( Ј → J ) CYRILLIC CAPITAL LETTER JE → LATIN CAPITAL LETTER J #
043A ;  006B ;  MA      # ( к → k ) CYRILLIC SMALL LETTER KA → LATIN SMALL LETTER K     #
041A ;  004B ;  MA      # ( К → K ) CYRILLIC CAPITAL LETTER KA → LATIN CAPITAL LETTER K #
0406 ;  006C ;  MA      # ( І → l ) CYRILLIC CAPITAL LETTER BYELORUSSIAN-UKRAINIAN I → LATIN SMALL LETTER L     #
041C ;  004D ;  MA      # ( М → M ) CYRILLIC CAPITAL LETTER EM → LATIN CAPITAL LETTER M #
043F ;  006E ;  MA      # ( п → n ) CYRILLIC SMALL LETTER PE → LATIN SMALL LETTER N     #
043E ;  006F ;  MA      # ( о → o ) CYRILLIC SMALL LETTER O → LATIN SMALL LETTER O      #
041E ;  004F ;  MA      # ( О → O ) CYRILLIC CAPITAL LETTER O → LATIN CAPITAL LETTER O  #
0440 ;  0070 ;  MA      # ( р → p ) CYRILLIC SMALL LETTER ER → LATIN SMALL LETTER P     #
0420 ;  0050 ;  MA      # ( Р → P ) CYRILLIC CAPITAL LETTER ER → LATIN CAPITAL LETTER P #
051B ;  0071 ;  MA      # ( ԛ → q ) CYRILLIC SMALL LETTER QA → LATIN SMALL LETTER Q     #
0433 ;  0072 ;  MA      # ( г → r ) CYRILLIC SMALL LETTER GHE → LATIN SMALL LETTER R    #
0455 ;  0073 ;  MA      # ( ѕ → s ) CYRILLIC SMALL LETTER DZE → LATIN SMALL LETTER S    #
0405 ;  0053 ;  MA      # ( Ѕ → S ) CYRILLIC CAPITAL LETTER DZE → LATIN CAPITAL LETTER S        #
0442 ;  0074 ;  MA      # ( т → t ) CYRILLIC SMALL LETTER TE → LATIN SMALL LETTER T     # →τ→
0422 ;  0054 ;  MA      # ( Т → T ) CYRILLIC CAPITAL LETTER TE → LATIN CAPITAL LETTER T #
0446 ;  0075 ;  MA      # ( ц → u ) CYRILLIC SMALL LETTER TSE → LATIN SMALL LETTER U    #
0475 ;  0076 ;  MA      # ( ѵ → v ) CYRILLIC SMALL LETTER IZHITSA → LATIN SMALL LETTER V        #
0474 ;  0056 ;  MA      # ( Ѵ → V ) CYRILLIC CAPITAL LETTER IZHITSA → LATIN CAPITAL LETTER V    #
051C ;  0057 ;  MA      # ( Ԝ → W ) CYRILLIC CAPITAL LETTER WE → LATIN CAPITAL LETTER W #
0445 ;  0078 ;  MA      # ( х → x ) CYRILLIC SMALL LETTER HA → LATIN SMALL LETTER X     #
0425 ;  0058 ;  MA      # ( Х → X ) CYRILLIC CAPITAL LETTER HA → LATIN CAPITAL LETTER X #
0443 ;  0079 ;  MA      # ( у → y ) CYRILLIC SMALL LETTER U → LATIN SMALL LETTER Y      #
04AF ;  0079 ;  MA      # ( ү → y ) CYRILLIC SMALL LETTER STRAIGHT U → LATIN SMALL LETTER Y     # →γ→
04AE ;  0059 ;  MA      # ( Ү → Y ) CYRILLIC CAPITAL LETTER STRAIGHT U → LATIN CAPITAL LETTER Y #

I don't have a Russian wordlist to compare to any of the English
wordlists I do have (and that would be subpar because my English word
lists don't include internet names like "paypal" (CYRILLIC: ER A U ER A
BYELORUSSIAN-UKRAINIAN I)). But, yeah, I can see potential for there
being a lot of natural overlaps.

Elijah
------
possibly some in ARMENIAN and other widely used alphabets, too

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security