{"id":474,"date":"2020-11-11T10:19:58","date_gmt":"2020-11-11T15:19:58","guid":{"rendered":"https:\/\/domainsure.com\/?p=474"},"modified":"2020-11-11T10:20:27","modified_gmt":"2020-11-11T15:20:27","slug":"ledger-users-lose-1-1m-xrp-via-homoglyph-attack","status":"publish","type":"post","link":"https:\/\/domainsure.com\/articles\/ledger-users-lose-1-1m-xrp-via-homoglyph-attack\/","title":{"rendered":"Ledger users lose 1.1M XRP via homoglyph attack"},"content":{"rendered":"

\"registrar<\/p>\n

Many crypto-currency holders use Ledger hardware wallets to store their bitcoin off the exchanges. This is actually the safer way to play it, except when you fall prey to a phishing campaign to lure you to a fake site to update your firmware that instead, drains your wallet.<\/p>\n

Unfortunately even when employing a hardware wallet, you still have be on your guard against credential stuffing and phishing attacks.<\/p>\n

Earlier in the year, Ledger suffered a data breach<\/a> that exposed 1 million customer emails, with an under 10,000 user subset of that having their complete contact and address info exposed. Whether it was the same perpetrators who conducted that attack or that the data was simply circulated in the underground economy on the dark web makes little difference. Either way, Ledger users came under attack from phishers.<\/p>\n

Most recently, many Ledger customers succumbed to a homoglyph attack<\/strong>, that’s when attackers register an IDN (Internationalized Domain Name) that visually looks like the domain ledger.com, but is really something else entirely.<\/p>\n

Example, using this IDN homoglyph attack generator tool<\/a>, I created this lookalike string for\u00a0ledger.com:<\/strong><\/p>\n

l\u0435dger.com<\/span><\/strong><\/p>\n

Looks the same, doesn’t it? But it’s not, that first “e” is really from a foreign character set, and when you render that in punycode that nameservers can understand, it’s actually this:<\/p>\n

xn--ldger-zwe.com<\/strong><\/p>\n

Any recipients who were fooled by the fake domain who then followed the link and installed the malware had their wallets drained to the tune of 1.1 million XRP, or about $250,000 USD.<\/p>\n

Homoglyph attacks like this can be detected by our domPhisher<\/strong> detection system. When and if somebody registers a domain that is a homoglyph for your core brand, we’ll make sure you know about it.<\/p>\n

See also:<\/h3>\n