ICANN Issues Statement on IDN Homograph Attacks
 

Internet Corporation for Assigned Names and Numbers (ICANN), in response to the recently publicised concerns regarding Internationalised Domain Name (IDN) homographs, today released a statement and asked the community to participate in an online public comment forum.

Homograph domain name spoofing works by exploiting the visual resemblance, or near resemblance of certain characters and symbols. These can be characters in the standard ASCII character set, such as the resemblance between the numeral '1' and the lower-case letter 'l' or the letter 'O' and the numeric zero (0) in some fonts. Alternatively, these could be characters taken from different languages, such as the character '?' (Greek capital letter Beta), and the character 'B' (Latin capital letter B), or the potential confusion amongst Chinese, Japanese, and Korean character sets.

The vulnerability identified by the recently publicised advisory is focused on how standard punycode-based IDNs offer additional opportunities for homograph attacks. The Internet community recognises that homograph domain name and URI spoofing is a problem that pre-exists the adoption of IDN implementation standards, but increasing the total number of characters available for domain names inevitably increases the opportunities for character confusion and spoofing.

ICANN is concerned about the potential exacerbation of homograph domain name spoofing as IDNs become more widespread, and is equally concerned about the implementation of countermeasures that may unnecessarily restrict the use and availability of IDNs. Statements have also been issued by members of the ccTLD community through APTLD and CENTR, and through a communique from the Registry Constituency. All of these statements, and links to the public comment forum can be found at the ICANN IDN website.