Do you see anything suspicious in the message displayed above in this article's featured image?
Alton Towers is giving away 5 free tickets to 500 families
Many WhatsApp users would probably view it as innocent enough, appearing to offer free tickets to a British theme park. Indeed, some might be so convinced that the message is legitimate that they forward it on to their own friends and family via WhatsApp, hoping to increase the chances of their loved ones enjoying a free day out at Alton Towers. But the truth is that clicking or sharing the link could put you, or your nearest and dearest, at risk of being scammed by internet fraudsters. The message should not only be treated with caution because it seems too good to be true but also because when examined closely there's evidence that the message isn't all it claims to be. The clue is in the URL, reported The Sun.
Do you see the dot above the "o" in altontowers.com? The "o" is in fact an "ȯ" - a regular "o" with a dot, or diacritic mark, placed above it. It's not a character that many of us are used to seeing, but it is used in some central European languages, and for that reason, it's supported by Unicode. Unfortunately, technology's admirable ability to handle a wide variety of languages comes at a price - fraudsters are able to abuse the feature to trick you into believing that you are reading something different from what is being shown. This is known as a homoglyph attack in that it exploits the close similarity between two different characters. For years, scammers have been duping unsuspecting internet users into clicking on dangerous links by using the simple technique. Most users will never notice the dot, especially if it's displayed on a screen as small as a smartphone, and so may think it is perfectly safe to click through to the website where they will be encouraged to take an online survey and forward the message to 20 of their friends. And once on the bogus website, they may believe that they are on the real altontowers.com and think nothing of entering personal information for the empty chance to win a family day our on the rollercoasters.
It's not a new method of attack, but it's a remarkably effective one. And until messaging apps like WhatsApp begin to apply some of the methods that desktop browser users can use to protect against homoglyph attacks, we're likely to see more and more of them. Users should also familiarize themselves with common phishing attack types so that they are less likely to click on a suspicious link, email attachment or text message. Editor’s Note: The opinions expressed in this guest author article are solely those of the contributor, and do not necessarily reflect those of Tripwire, Inc.
Meet Fortra™ Your Cybersecurity Ally™
Fortra is creating a simpler, stronger, and more straightforward future for cybersecurity by offering a portfolio of integrated and scalable solutions. Learn more about how Fortra’s portfolio of solutions can benefit your business.
