Unicode and Security: Homograph Attacks and Confusable Characters

Unicode's breadth — over 149,000 characters from hundreds of scripts — creates security challenges that don't exist in pure-ASCII environments. Characters from different scripts can look identical or nearly identical, enabling attacks that exploit visual ambiguity.

The Homograph Attack

A homograph attack uses characters that are visually similar (or identical) to legitimate characters to create deceptive URLs, identifiers, or content. The most common form targets domain names: the Cyrillic letter "а" (U+0430) looks exactly like the Latin letter "a" (U+0061) in most fonts. A URL like pаypal.com (with a Cyrillic "а") is distinct from paypal.com but may appear identical to a user. This technique can be used for phishing.

Internationalized Domain Names

ICANN addressed homograph attacks in IDN (Internationalized Domain Names) by requiring registries to follow mixing rules: most registries prohibit domain names that mix scripts (e.g., Latin and Cyrillic), and Unicode-aware browsers show the Punycode representation (xn--...) for mixed-script domains. However, same-script homographs (all Cyrillic, for example) can still be used to spoof Cyrillic-language sites.

Unicode Confusables

The Unicode Consortium publishes a confusables data file listing pairs of characters that may be confused with each other. The data covers not just visual similarity but also "skeleton" normalization — a way to map confusable characters to a canonical representative. Security-sensitive applications (registries, authentication systems) use confusables data to detect spoofing attempts.

Other Attack Vectors

Beyond domain spoofing, Unicode enables other attacks: overlong UTF-8 encodings (exploiting non-strict decoders), right-to-left override characters that disguise file extensions, and homograph attacks in source code identifiers. Our character browser shows visual representations of characters that can help identify potential confusables.