Script spoofing

Script spoofing or homograph attack is a variant of spoofing attack which implements visually confusable characters. For example, a person frequenting citibank.com may be lured to click the link [сitibank.com] (punycode: xn--itibank-xjg.com/) where C is replaced with С. Unicode incorporates numerous writing systems, and for a number of reasons similarly looking characters, such as Greek Ο, Latin O and Cyrillic О, were not assigned the same code. Their incorrect or malicious usage is a possibility for security attacks.

One may recognize two major types: mixed-script spoofing (shown in the "citibank" example) and single-script spoofing.

Mixed-script spoofing

The phenomenon of look-alike character substitution with different aphabets has already been known in various contexts. For example, Faux Cyrillic has been used as an amusement or attention-grabber and "Volapuk encoding" was used in early days of Internet as a folk way to overcome the lack of support of Cyrillic alphabet.

Mixed sripts may aslo have a legitimate use. For example, many technical abbreviations, such as XML, etc., are used "as is" in Russian text. A well-known other way example is Toys-Я-Us.

Cyrillic, Latin, and Greek have a very high number of common glyphs.

Single-script spoofing

Single-script spoofing is spoofing with characters from the same script. An early nuisance of this kind, predating internet and even text terminals, was confusion "l"/"1" and "0"/"O", which gave rize a tradition of crossing zeros (Ø), so that a computer operator would type them correctly. Unicode may contribute to this greatly with its combinig characters, accents, several types of hyphen-alikes, etc., often due to indaquate rendering support, especially with smaller fonts sizes and wide variety of fonts.

In some complex alphabets, such as Arabic, glyphs may change depending on their surroundings, which is also prone to abuse.