Worm’s Eye, Fri 11 Feb 05

The IDN bug

When the great spy Kim Philby retired, he affected to be unable to read Cyrillic; walking around Moscow with his biographer Philip Knightley, he would suggest they dive into a “pectopah” for a drink. This is more or less what the Russian word “Restoran” looks like to the English-speaking eye when it is written out in Cyrillic capitals as PECTOPAH. There are half a dozen Cyrillic letters which closely resemble Western ones in shape, but stand for entirely different characters. The word Paypal, for instance, can be written out all in Cyrillic letters except for the L.

Last week this fact stopped being simply curious. It turns out that you can register a domain like “paypal.com” in which almost all the characters are Cyrillic; and the most advanced web browsers will be fooled. They will display the name, in English look-alike characters, and, if you click, take you to the spoofed web site behind them.

It has always been easy to fake the appearance of web sites like paypal or amazon and try to get idiots to type in their credit card details; but, until now, the actual address has been very much harder to fake. When I get one of those charming letters from the Russian mafia inviting me to check my account details at ebay, or the Washington Mutual Bank (for some reason they are convinced I hold an account there), I need only hover the mouse over the link they supply to see the real destination appear in a tooltip.

But the trick doesn’t work with spoofed international domain names. This is a horrible security hole. There’s only one thing that could make it worse; and that has happened too: Internet Explorer, which is normally the least safe browser in the world, turns out to be immune to this particular problem. It refuses to recognise any domain names that aren’t in the American alphabet.

But this can’t be a long-term solution. A browser that won’t recognise domain names which use European, Cyrillic, or – soon -- Chinese, Japanese and Korean characters is not going to be much use on a web that is really world wide. There’s no good reason why Austrian railways, or the Swedish red cross, should not have domain names that contain the letters of their names.

If this were just a hacking story, it wouldn’t be terribly interesting. But as soon as you dive into the technical details, it turns out to be a political story, too: one which exposes the hollowness of the assumption that globalisation can work without friction as a natural process overseen by benign technocrats.

The problem starts with something called unicode, which is, in its way, one of the most impressive achievements of the last decade: a way to map every single character in every writing system in the world so that computers can use them to communicate. However many alphabets you think there are, you’re almost certainly underestimating. The current Unicode standard lists 12,886 alphabetic characters (and around another 80,000 ideographs in Chinese, Japanese, or Korean).

Among these 12,000 characters, there may be tens of thousands of confusing duplicates – no one knows just how many, since pairs of characters can be combined in more than 83m ways. The Unicode people noticed in 2002 that this might make a problem for domain names; they decided it was a problem for the domain name registrars, who shouldn’t be selling potentially confusing names. But the sellers of domain names are not chosen for social responsibility. They sell domains through a process that it almost completely automated and it’s not clear that any human system would, in practice, be much better. If I were to register pectopah.com in Britain, it is unlikely that an ISP employee would think I was trying to defraud a Russian restaurant site.

Working out a solution at a browser level turns out to be almost as difficult. You can warn users that there might be a problem, but nothing is more certain than that some will be confused by this, some will grow angry, and some will ignore it and get stung anyway.

In fact, the longer I think about this story, the more it looks as if there can be no lasting technical solution. What starts out as a simple, irritating hacking exploit turns out to expose the way in which no standard is so refined and technical that it can lift us above the messy human worlds of politics and greed; less than ten years ago, the Internet was supposed to lift us into a utopia, a word which meant “nowhere” in Greek. Utopia got it exactly wrong. In fact it has taken us everywhere, all at once, and we find ourselves sharing all the world’s problems; and the only really effective solution is good old earth-bound governments and police forces catching the crooks.

Andrew Brown

2005-02-11T13:21:31