Subject: [idn] space-like unicode char

From: Soobok Lee <[email-masked]>
Date: Sun, 20 Feb 2005 14:27:49 +0900

You can paste this html/javascript codelet  to an html file in your 
webserver and see in your  MSIE brower.
You will see "www.microsoft.com" isolated in the addressbar from the 
"mozilla.org" domain suffix.
Fortunately, you will see blank space (no phishing page) if  you have 
recent IE patch.
This won't work in firefox 1.x which strips off  those special chars  
for unknow reasons before sending to
the address bar.

<script>
window.open(unescape("http://www.microsoft.com%u1160%u1160%u1160%u1160%u1160%u1160.mozilla.org/"),"_blank");
</script>
 
U+1160 is  a space-like char and even stringprep/nameprep does not 
filter it out  because
the char  is not for punctuational purpose.
U+1160 is just one example, and i guess there may be many alternatives 
that can be
used   as blank char alternatives.

U+1160 in the above example  is placed  in the 3rd level domain name label,
 over which  .org registry cannot  impose any regulations.

Soobok Lee

---

From: Soobok Lee <[email-masked]>
Date: Sun, 20 Feb 2005 15:08:08 +0900

For those who do not have a webserver: plz copy this url into your MSIE
addressbar .

javascript:void(window.open(unescape("http://www.microsoft.com%u2044%u1160%u1160.uni.cc/"),"_self"))

You will see an error page if you have recent MSIE patch.

Soobok

---

From: Soobok Lee <[email-masked]>
Date: Sun, 20 Feb 2005 15:22:12 +0900

The real problem comes when "com.%1160%1160*" is punycoded into "xn--blah".
( You can increase the number of "%1160"s until 63-char limit is reached)

"www.microsoft.xn--blah.uni.cc"
is decoded and displayed in the native form on the MSIE/i-Nav or Firefox
1.x.
what would you see on the address bar and in the webpage?

The legitimate ASCII url http://www.microsoft.xn--blah.uni.cc would
succeed to be resolved and deliver the phishing page, while the end user see
"www.microsoft.com" isolated in the beginning part of the address bar.

the end user may not see "uni.cc" part if the frame width of the MSIE
window instance
is narrow enough to hide ".uni.cc" .

Soobok