Wednesday, May 22, 2024

Zero-Day Bug in Verisign & IaaS Services Such as Google, Amazon let Hackers to Register Malicious Domains

A critical zero-day vulnerability that affected Verisign and multiple IaaS services companies such as Google, Amazon and DeigitalOcean let attackers register t homograph domain names ( .com and .net).

Successfully register these Homograph domains looks like the same well-known domains, and subdomains used to perform social engineering attacks & insider attackers to the organization and it is similar to the IDN Homograph attack

Researchers identified several homograph domains are active since 2017 with HTTPS certificate that mimics the various sectors domains incusing financial, internet shopping, technology, and other Fortune 100 sites.

Matt Hamilton, a researcher from Soluble identified that several Generic top-level domains (gTLDs) are possible to register using the Unicode Latin IPA Extension character, and also he was able to register the following Homograph domains.


The above registered homographic domains are exactly similar to the respective original domains with the use of Unicode Latin IPA.

Similarly, the researcher tested nearly 300 prominent domains and the vulnerability believed to be only used in highly-targeted social engineering campaigns that will install malware, and steal sensitive data.

According to the Soluble report ” It appears that Verisign and other providers have been unaware of the homoglyphs within the Unicode Latin IPA Extension character set”

Register Homographic Domain by a Mix of Unicode & Latin characters

Basically, Verisign prevents users to register the domains that used mixed scripts such as “gоо” using Cyrillic “о”s .

But due to the Zero-day bug, it was possible to register domains with a mix of Unicode and Latin characters as long as the Unicode characters were themselves Latin.

“Registrars, like Verisign, explicitly enforce anti-homograph measures (disallowing mixed-scripts) because they don’t want lookalike domains on their gTLDs. Public services that exist on a shared root, such as “”, “”, or other services which allow users to create arbitrarily-named subdomains, should apply these same restrictions—they are effectively acting as registrars for those roots in the same way Verisign does for “.com”. Researcher said.

This bug affected not only VeriSign gTLDs but, any TLD which allows Latin IPA characters is likely affected. 

This vulnerability consider as Zero-day since multiple instances of HTTPS certificate logs through Certificate Transparency have been identified, also one “unofficial” JavaScript library hosted at a prominent domain.

Follow us on TwitterLinkedinFacebook for Daily cyber security & hacking news updates.


Latest articles

Hackers Claiming Access to Qatar National Bank Database

A group of hackers has claimed to have accessed the database of Qatar National...

Cloud-Based Malware Attack Abusing Google Drive & Dropbox

A phishing email with a malicious zip attachment initiates the attack. The zip contains...

OmniVision Technologies Cyber Attack, Hackers Stolen Personal Data in Ransomware Attack

OmniVision Technologies, Inc. (OVT) recently disclosed a significant security breach that compromised its clients'...

Critical Flaw In Confluence Server Let Attackers Execute Arbitrary Code

The widely used team workspace corporate wiki Confluence has been discovered to have a...

Threat Actors Leverage Bitbucket Artifacts to Breach AWS Accounts

In a recent investigation into Amazon Web Services (AWS) security breaches, Mandiant uncovered a...

Hackers Breached Western Sydney University Microsoft 365 & Sharepoint Environments

Western Sydney University has informed approximately 7,500 individuals today of an unauthorized access incident...

Memcyco Report Reveals Only 6% Of Brands Can Protect Their Customers From Digital Impersonation Fraud

Memcyco Inc., provider of digital trust technology designed to protect companies and their customers...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles