Full transcript
0:00Oh, it's back everybody. The old
0:03lookalike characters, the old social
0:05engineering and fishing trick, the
0:07homoglyph. Honestly, it really never
0:10left. Booking.com fishing campaign uses
0:13sneaky that squiggly character to trick
0:17you. I saw this hit the interwebs just a
0:19bit ago on Twitter or X, whatever you
0:21want to call it. Now, of course, a
0:22bleeping computer article out and about
0:24where thread actors are leveraging a
0:26Unicode character to make fishing links
0:28appear like legitimate links.
0:31Booking.com, specifically in this case,
0:33a new campaign distributing malware. Of
0:36course, the attack makes use of the
0:38Japanese hiragana character, I hope I'm
0:41getting that pronunciation right, which
0:42can on some systems appear as a forward
0:44slash. So like folders or directories or
0:48just the usual slashes that you see in
0:50your address bar might look realistic,
0:52but instead it's a lie. This symbol
0:55specifically and seeing this out and
0:56about in the wild, it looks like was
0:58first covered by James WT. And the
1:01hiragana character or this little
1:02squiggly with the unic code hex value
1:053093 closely resembles the Latin letter
1:08sequence forward slashn or forward/tild.
1:11Now, the forward slash is the key
1:12component there because the visual
1:14similarity enables scammers or bad
1:17actors to create URLs or links that
1:19appear like they belong to a legitimate
1:21or genuine website, but instead it'll
1:24redirect or direct users to a malicious
1:26site. So, the researcher James first saw
1:28this fishing email and really it's HTML,
1:31right? Okay. Rendered and displayed in
1:33your web browser to add all the sort of
1:35table colors and design and aesthetic
1:37here. So you could mask or hide what the
1:40link or lure really looks like in the
1:42email. But for going to the actual URL,
1:45like if you were to hover over it, even
1:47if you were to hover over it, those
1:48forward slashes might look like, oh,
1:52legitimate. And I say keyword might,
1:54because maybe you did or didn't fall for
1:56this. That symbol isn't probably what
1:58everyone would note as a forward slash.
2:01But here's what bad actors get to do
2:03that's a little bit interesting. The
2:04text in the email, like if you were to
2:06click it, might look deceptive. If it
2:08looks like a Booking.com address or any
2:10other, I know that's just specific to
2:12this case. The actual link is
2:14account.booking.com
2:16hiragana character detail hiragana
2:18character restrict access blah blah
2:20blah. So you can see even in this
2:22picture here, the solid black color is
2:24your browser telling you that's the
2:26actual domain. The forward slash and
2:28that slightly gray or faded after that
2:30is everything else that might be a page.
2:32But that means this is literally the
2:34domain like the website you visit. and
2:37what's typed in the address bar,
2:38facebook.com rather than Facebook. Oh,
2:41you've got all this accountbooking.com
2:43blah blah blah. And all the periods or
2:44dots could be subdomains. You have a lot
2:47of flexibility and power there. And
2:49using these sneaky characters as part of
2:51the domain basically lets them put the
2:53beginning or the very start of the
2:55domain and make that whatever they want
2:57as close or as realistic or as
2:59absolutely as identical as they can to
3:02the real impersonated site and then tack
3:04on a bunch of nonsense and potentially
3:06hide the rest of the real website name
3:09there at the rest. So that's clever. Not
3:12meaning to drill down into the rest of
3:14the malware incident here. Looks like
3:16that could lead to an MSI installer from
3:18some other rogue website. Very likely an
3:21info stealer, like some malware that
3:23will intentionally grab all of the
3:25passwords, secrets, cookies,
3:27credentials, session tokens, and
3:29information on your computer so that
3:31could later be sold out and about on the
3:33dark web. Or it's a fishing page itself
3:35that has you log in and steals your
3:37credentials right then and there, again,
3:39later to be put out on the dark web.
3:41Social engineering in fishing kits and
3:43info steeler malware runs rampant. But
3:46maybe you didn't fall for this. Maybe
3:49this symbol, that hiragana character,
3:51maybe that wouldn't trick you and oh
3:54that's a forward slash as it usually is
3:56in a web URL. So I'm wondering what are
3:59the other Unicode characters or other
4:02characters that fall into the same
4:04lookalike category that could lead to
4:06that homoglyph? I want to dig into that
4:09in this video. But before we do, please
4:11let me take a quick moment to tell you
4:13about the sponsor of today's video,
4:14Flare. Flare is a threat exposure
4:16management platform that tracks cyber
4:19crime activities, illegal and illicit
4:21conversations, chatter, things on
4:23Telegram even, and all the stuff that
4:26enables adversaries and threat actors
4:28about your information, your exposed
4:31attack surface. Personally, I really
4:33like to use Flare for research, some of
4:34that cyber threat intelligence, and just
4:36seeing what threat actors and bad actors
4:38are up to on the dark web. But you can
4:40define a handful of identifiers for your
4:42tenant. You get to say who are the
4:44folks, who are the team members, who are
4:46the employees, individuals in your
4:48company, business, and organization that
4:50you want to keep an eye on. And really
4:52keep an eye on their info, their digital
4:54footprint. Is their information out and
4:56about on the open internet in the
4:58clearet or the dark web? And are threat
5:00actors and adversaries already buying
5:02and selling that info? Like think of
5:04data breaches or information that's been
5:06published by ransomware gangs or
5:08ransomware actors and all the folks
5:10chatting about it. Flare has collected
5:12so much stuff from all these different
5:14sources in the dark web, signal group
5:16chats, telegram chats, and more. It
5:18gives you the visibility and telemetry
5:20alongside reporting or pertinent
5:22information for different industries,
5:25sectors, and even supply chain threats
5:27and leaked credentials like username and
5:29password combinations. Hey, there's a
5:31link to the free trial of Flare in the
5:33video description, but seriously, it is
5:35just so cool to use even for research.
5:37It's like Google of the entire dark web.
5:40That way, you and your team can be
5:41notified with alerts when any info is
5:44exposed. So, attackers don't have the
5:46information advantage. Check out Flare
5:48link below in the video description.
5:50Thanks so much. Okay, now let's start to
5:53explore and let's go see what other
5:55characters might look like a forward
5:57slash in this homoglyph attack or puny
6:01code attack you might also hear because
6:02it's using unic code characters most
6:05often. Now I got to be honest, we could
6:08scroll through like a whole website that
6:10lists out and displays all of the
6:12possible unicode characters, but there
6:14might be a better solution. AI Chad GPT
6:17could probably crank through this, not
6:19going to lie. This way we can get a
6:21filtered list. Please read this article.
6:24I pasted that link to the bleeping
6:25computer article. Tell me what other
6:28unic code characters could be used to
6:31look like a forward slash. See how that
6:35does. You're asking what other unic code
6:37characters besides the Japanese
6:39hiragara. Uh-oh. I hope I wasn't
6:41mispronouncing that earlier based off of
6:42memory. Some folks suggest the division
6:44slash the fraction slash big solidus
6:48like big chungus. There must be more
6:50than that. Please give me an exhaustive
6:52and extensive list of all possible
6:56Unicode characters that look like a
6:58slash. Give me a table with just one
7:01column with all the characters
7:03themselves so I can easily copy this
7:05into my clipboard with each individual
7:08character on its own on each individual
7:11line. And forgive me for hopping into
7:13chat GPT. This is just so that we have
7:16big long list little compilation
7:18collection of the characters that look
7:20like this slash character. You could do
7:22this for just about anything but it
7:24saves us the manual work of scrolling
7:26through the unic code reference and then
7:27trying to find them one by one. Okay,
7:29chat GBT is done. Here you go. One per
7:31line. Easy to copy. Big thanks. So, what
7:34I want to do is actually copy all of
7:37this. And now I actually want to jump
7:39into my Kali Linux virtual machine just
7:42so I could easily stage these in a place
7:45that we could play with them. So let me
7:46make a directory in actually we'll do it
7:48in our temp directory for like
7:50homoglyph. And now let me actually work
7:52with these as individual files. So I'm
7:54going to open this in a text editor in
7:56Sublime Text. And what I want to do is
7:58hit control A to select everything.
7:59Control shift L to create multiple
8:01cursors on each line. And now I'll hit
8:03the home and end keys to be able to kind
8:05of rapidly stage these as like a echo.
8:09Let's create a file that would render in
8:11our web browser. So let's just use HTML
8:13tags here. And then a line like hello
8:16world and redirecting that out to what
8:18would be a file now prefix of please.
8:21And then say we were in another
8:22directory of our folder. Let's just do a
8:24please subscribe.com.
8:26Haha. He he. And I want to nuke the
8:29bottom two cuz those look a little bit
8:31dangerous. and the others don't even
8:32really render. So, let's use maybe those
8:35options. Or, you know what? Let's just
8:37try it all. I'm going to copy these. And
8:38now that these are all commands, I can
8:41paste them into here and then see how
8:43well it will do. We've created all of
8:46the files in our current directory. Oh,
8:48and Chad GPT didn't even give me the
8:51hiragana symbol. I want that one. So,
8:53I'm going to copy that just as well. And
8:55I do want to stage this one. So, let me
8:57grab that same echo line. please
9:00subscribe.com.
9:01Let's just run that as well. Done. Okay,
9:04so now we have all of these that could
9:06be displayed probably in a web browser,
9:08right? Let me spin up an HTTP server for
9:10this. And I'll put it on port 80 so it's
9:12nice and convenient. What is my current
9:15IP address in this virtual machine? I'm
9:17using IPAS or IP adder show and I need a
9:21local IP 1921681179.
9:24But now over in a Windows virtual
9:27machine, let me open up a browser and
9:29try to go to that page. So I can see all
9:31of these listed here. Now, which of
9:34these look more like a forward slash to
9:38the point where you would be tricked or
9:40moving quick? Mom, dad, grandma, grandpa
9:43might be fooled. I want to be able to
9:45see the address bar up here. So let me
9:47see how this one would look. Oh, the com
9:50file extension is going to make it think
9:51that it's a whole actual file. I was
9:53trying to do that so that we could view
9:55it as a domain in a second, but maybe
9:57it's worth doing that as HTML instead.
10:01HTML. Making those quick changes. Let's
10:03run all these commands once again. And
10:06now we have HTML. Okay, I can refresh
10:09this. Spin up that server one more time.
10:12Let's go try to see this page now. Okay,
10:15can I access these? Yeah, that kind of
10:18looks like a forward slash to me. This
10:21one also a little bit dangerous. Another
10:25granted these are all in the file name.
10:28It is not actually creating a directory
10:30but including that as a file. Correct.
10:33That one's a little bit egregious. You
10:35could probably see that pretty well cuz
10:36there's so much white space around it.
10:38And then you got weird stuff in here.
10:40But I wonder if that could be used or
10:41leveraged and how those would perform. I
10:44am just curious taking a look at all
10:45these. The overline on the slash is well
10:49if you didn't see that you know moving
10:50quick. Big one actually big one might
10:53fool us. That one looks good. The three
10:55slashes or double slashes are kind of a
10:58giveaway. I don't think those would work
11:00as well as we would want if we were to
11:02poke and play with this. That one looks
11:04good. And then the weird squigglies.
11:06Yeah, those don't look uh like what they
11:09should and nor does this truth be told.
11:11But I think that one has a special
11:14secret advantage. So once we're done
11:16kind of cruising through these, just
11:17seeing what they look like. That one
11:19doesn't work. Absolutely not. How about
11:21this forward slash? A little bit too
11:22wide. How about this one? Also still a
11:25little bit angled the wrong way. But
11:27look, again, I'm showing you these as
11:29the file that would be referenced and
11:31not the domain. So how could we get this
11:34to see what it might look like as a
11:36domain? Well, uh, quick convenience for
11:38us. What I want to do is actually modify
11:41just the etc hosts file that's on
11:45Windows. So if you aren't familiar, this
11:46is where you could uh almost sometimes
11:49do like a poor man's domain synhole or
11:51DNS synhole because I want the
11:54privileges to be able to modify in the
11:56path C windows system 32 drivers etc
12:00hosts. That's where this file is. uh
12:02looking at that host file, we could
12:04actually specify or craft our own domain
12:08for any other IP address or actual
12:10location out on the interwebs. So, let
12:12me go back to the Sublime Text kind of
12:15scratch pad that we had. And if I walk
12:18this back to where we were previously on
12:21just the Unicode characters themselves,
12:24granted, I do still want the original
12:26character in it. So, let me cut this up.
12:28So, let's just use our local IP address
12:30that we've been using for testing,
12:32192.1681179.
12:35And then let's craft the domain on this
12:38side. And this is where things could get
12:39creative, right? Say we went to
12:41youtube.com/account
12:44login or whatever.com.
12:47Again, you can make that realistically
12:49whatever you want, but you would not be
12:51buying or trying to impersonate or
12:53replicate the domain YouTube.com. You
12:55would be doing the entire thing.
12:57youtube.com/
12:58whatever other nonsense you want to fill
13:01up the back. Does that make sense for
13:03the trickery? Anyway, again, over in our
13:05Windows world, let me paste all of those
13:08in. Uh, and a couple of them have those
13:10oddities, but if I save this, I should
13:13be able to get to youtube.com
13:16sketchy/account
13:17login, whatever. Right. So, let me try
13:20to access that in my URL address bar
13:23rather than the forward slash. Now, I
13:25think we'll need to http colon slash
13:28this just so the browser knows to hey
13:30try to go to the one that I set
13:32specifically and it's at rahost rather
13:34than doing a search on brave. I guess it
13:36did. Okay, let me actually clean up some
13:38of those weird ones because uh that
13:41white space is just doing odd stuff. Let
13:43me try to save this one more time. And
13:44now let's see if we could access these.
13:46Aok. Okay, so rather than the IP address
13:50in the address bar as we were testing it
13:52as like a follow on file in different
13:55folders, now let's try it as if it were
13:58a domain. And I've just basically using
14:00the etc host file as the quick way so I
14:03don't have to buy all of these domains
14:05or see if they're available. Let me try
14:06to get to http that. Okay, it looks like
14:08brave search is going to kick in. Maybe
14:10that character isn't as nice. Let's try
14:12with pleaseubscribe.com with a different
14:15kind http prefix again. Take a look at
14:18what happened here. This is using the
14:20xn- dash and then other oddities xh0i
14:26to denote. Okay, this is trying to use a
14:30puny code or unicode character within
14:32the domain. And web browsers have now
14:34gotten smart to this and stopped that
14:37from being possible. at least you've
14:40heard of these old different attacks and
14:42techniques that again this has gone on
14:44for quite some time and it's not new by
14:47any means but trying a whole lot of
14:49these options if I were to generally go
14:51through one by one we'll see if any of
14:54them will even work or if it's only our
14:57friend that symbol that was now allowed
15:00to go through I think a lot of these
15:02variations you can keep seeing even in
15:04the preview that's just not going to let
15:07it happen because of our browser
15:09security getting smarter and better
15:12about this. Okay, every single one
15:15except this Japanese hiragara character
15:19is going to be replaced and handled with
15:22the XN- usual thing that you see in the
15:25mix. Please subscribe is still present
15:27here. You can see that character is the
15:29one that made it through. That character
15:31probably isn't behaving well in our etc
15:34host file, so we'll have to ignore the
15:36DNS error there. But as you can see,
15:38even in the address bar, that one
15:40survived. Can I buy that on like
15:42Squarespace domains? Would that be a
15:45thing? I mean, it's available. I might
15:48have to get that. But look, this is
15:50still even using the XN- opportunity the
15:53same way that all the others were, but
15:55it will be rendered in the address bar
15:58for now. This is like again news
15:59articles that are being released
16:01currently at the time of recording. So,
16:02I wonder if we'll see that one get
16:04sniped and cleaned up just as well. As
16:06you saw previously though, all of them
16:08could be used within the file name as
16:10the extension of a domain in the address
16:12bar, but this so far is still standing
16:16the test of time. So, now that this has
16:17been brought to your attention, I really
16:19hope you're tracking this sneaky
16:21character, that special symbol that is
16:23lying to you. And I hope that education
16:25and awareness is out and about so you
16:28don't fall for these fishing scams,
16:30these info stealer malware tricks and
16:33lures or fishing kits. And again, if you
16:35are tracking any of those, hey, keep an
16:37eye out on Flare. Big thanks to the
16:38sponsor of today's video. Thanks so much
16:40for watching everybody. Hope you enjoyed
16:41this video. I'll see you in the next
16:42one.