They Look the Same, but They're Different - Unicode's Visual Attacks

Do apple.com and аpple.com look the same to you? They're actually different. The first "а" in the second URL is not the Latin letter "a" but the Cyrillic letter "а" (U+0430). Indistinguishable to the human eye, but to a computer they are completely different characters - and therefore different domains.

Unicode is a groundbreaking system that can handle characters from around the world uniformly, but its rich character set also creates security threats.

Homograph Attacks - How Fake Domains Are Created

A homograph attack (IDN homograph attack) creates fake domain names using different characters that look identical (or very similar).

  • Latin "a" (U+0061) and Cyrillic "а" (U+0430)
  • Latin "o" (U+006F) and Cyrillic "о" (U+043E)
  • Latin "p" (U+0070) and Cyrillic "р" (U+0440)
  • Latin "e" (U+0065) and Cyrillic "е" (U+0435)

Combining these, you can create аррle.com (the leading "а" and both "р" are Cyrillic) - a domain name visually indistinguishable from apple.com. Used as a phishing site URL, even careful users could be deceived.

Browser Countermeasures

Major browsers counter homograph attacks by displaying domain names that mix scripts (multiple writing systems) in Punycode notation. The аррle.com above mixes Cyrillic with Latin, so the address bar shows xn--le-6kc8da.com and the disguise becomes obvious at a glance.

The Cyrillic palochka (U+04CF), however, resembles a Latin "l" closely enough that an attacker can spell the whole label in Cyrillic alone (аррӏе.com = xn--80ak6aa92e.com). Unicode's technical standard UTS #39 calls this a whole-script confusable, and because it never triggers the mixed-script condition, browsers have to layer on further checks - such as showing Punycode for single-script labels that closely resemble well-known domains.

Invisible Characters - The Threat of Zero-Width Characters

Unicode includes several "zero-width characters" that are not displayed on screen.

  • U+200B: Zero Width Space
  • U+200C: Zero Width Non-Joiner
  • U+200D: Zero Width Joiner
  • U+FEFF: Zero Width No-Break Space (BOM)

These characters are invisible but affect string comparison and hash calculations.

  • Watermarking: A technique that embeds zero-width characters in confidential documents to identify who leaked them. By inserting different patterns of zero-width characters for each recipient, the leaker can be identified from the pattern in the leaked document
  • Password issues: When copy-pasting a password, if zero-width characters are included, you get the situation of "the correct password won't log in"
  • Code tampering: Crafting source code that looks identical but behaves differently. Trojan Source (CVE-2021-42574), published in 2021, is the best-known example of this technique; it centres on the bidirectional control characters covered in the next section, with zero-width and confusable characters serving as variants

Directional Control Characters - Manipulating Text Flow

Unicode includes characters that control text display direction. Since Arabic and Hebrew are written right-to-left, these control characters serve legitimate purposes, but they can also be exploited for attacks.

  • U+202E: Right-to-Left Override. Forces all subsequent text to display right-to-left

For example, the filename document_‮fdp.exe displays on screen as document_exe.pdf. The user thinks it's a PDF file and double-clicks, but it's actually an .exe file (executable).

What Developers Should Watch For

  • When accepting user input, sanitize (remove) zero-width characters and directional control characters
  • When validating domain names, convert to Punycode before comparison
  • When displaying filenames, remove or escape directional control characters
  • During code reviews, use tools to detect zero-width character injection (e.g., grep -P '[\x{200B}-\x{200F}\x{202A}-\x{202E}]')

Summary

Unicode is a remarkable system that handles characters from around the world uniformly, but its richness also creates security threats. Homograph attacks, zero-width characters, directional control characters - knowing about these threats heightens your vigilance against phishing site URLs and suspicious filenames. When accessing IP Check-san, make it a habit to verify that the domain name in the URL bar is correct.

Related Terms

Phishing A technique that creates fake domains using homograph attacks to impersonate legitimate sites. DNS Internationalized Domain Names (IDN) are converted to Punycode and resolved through DNS. HTTPS TLS certificates can be obtained even for fake domains, so HTTPS alone doesn't guarantee safety. IP Address Different domains point to different IP addresses. A homograph attack's fake domain points to a different IP.

Frequently Asked Questions

Which Unicode property do homograph attacks rely on?

The fact that similar shapes are still separate code points. The Latin 'a' is U+0061 while the Cyrillic 'а' is U+0430, and since a domain name is converted to Punycode before it is resolved, a single different character is enough to send you to a completely different server.

What are zero-width characters?

Zero-width characters are invisible Unicode characters that take up no visible space but exist in the text. They can be used as invisible watermarks to trace document leaks, but also maliciously to tamper with code, bypass filters, or create strings that look identical but behave differently.

Do browsers protect against homograph attacks?

Major browsers apply IDN (Internationalized Domain Name) display policies that show the Punycode form of a domain name when it mixes scripts, so a label combining Latin and Cyrillic appears as 'xn--...' instead of its deceptive visual form. A label spelled entirely in one script - what UTS #39 calls a whole-script confusable - does not meet that condition, so browsers also weigh how closely the name resembles a well-known domain. Checking the spelling character by character remains your last line of defence.