Homoglyphs and homographs are linguistic terms, used also in IT to describe certain types of internet deception.
Basic Linguistics
Homoglyphs are different letters that look similar or almost identical to each other. For example, English letters c, y, p (See, Why, Pee) appear the same as Russian (Cyrillic) letters с, ү and р (Ess, Oo and Err).
A homograph is when a word has two different pronunciations/meanings. Consider polish (with a rag) vs. Polish (coming from Poland), or the word does (verb or animals?).
These elements of language can sometimes cause confusion or misunderstandings. And scammers thrive on those! In the tech world, homoglyphs and homographs are used somewhat interchangeably, when describing a style of trickery. Here’s what I want you to admire and be aware of:
Convincing-Looking URLs
Using homoglyphs, cybercriminals can make their phishing websites addresses look legitimate, by closely modeling URLs that you already know and trust. Some easy-to-spot examples:
www.bluescreençomputer.com
www.blueścreencomputer.com
www.bluescreencomрuter.com
OK, I fibbed. That third example is not-so-easy to spot, but it contains a homoglyph (the ‘р’). None of the above URLs would go to my website.
This is the tactic that scammers use, with websites more popular than mine. They may take Amazon’s address, or your bank’s URL, and create a brand-new domain that looks just like it. It’s just one or two letters off, because they substituted a Cyrillic or European letter. On top of that domain, they create a phishing website that looks like the real deal. Lastly, they start emailing or texting their lookalike URL to potential victims.
www.ΒANKOFAMERICA.com
www.whitehousԑ.gov
www.FACEBOOК.com
Besides character substitution, another tactic for this type of URL masquerade is to misspell a URL, so that the letters run together in your mind. It’s similar to typosquatting. You think that you’re reading (for example) “washingtongas.com”, but it actually says “washmgtongas.com”. Or you simply don’t see the extra letter in “tolllroadsinvirginia.com”. The predictive nature of your brain can have you gloss right over these letter-tricks!
Guarding Against This
You have a variety of options:
- Don’t trust any unexpected emails or texts and don’t click links or attachments inside of them. Listen to your gut or Spidey-sense or second & third thoughts
- Use bookmarks (Favorites) to go to your most important websites
- Make sure your browser’s security settings are turned up to their maximum (e.g.: Google Safe Browsing)
- Install a “security advisor” type of extension in your browser, so that it will warn you if you visit a toxic website (BD Web Sage or MWB Browser Guard are free options)
- Check suspicious URLs for homographs at homoglyph detection websites