The impact of zero-width characters on ENS may be greater than you think

Yesterday, the domain name trader "Hero Jie" published an article titled "Please stop registering all ENS domain names because it is worthless" on his personal Mirror. Hero Jie claims to be a senior Web2.0 domain name trader. He has sold many well-known domain names such as xiaomiquan and wuyinli, and still holds the high-quality domain name ouyi.

This article points out that a design omission caused by an invisible "ZWJ (zero-width character)" is burying a major security risk for ENS. The article was widely circulated in some encryption communities, and caused some investors to question ENS.

This problem allows multiple .eth domain names to appear at the same time that are identical to the naked eye. Just as Web3.0 has revolutionized the old traditional Internet, in the era of Web3.0, ENS has also brought new and upgraded methods to phishing attacks that have never appeared in Web2.0.

At this stage, ".eth" domain names are widely used as "network names". A unique eth domain name is like the Web2.0 era QQ account. In this kind of application scenario that is difficult to call infrastructure, although some design omissions will cause troubles to users, they will not be able to shake the leading position of ENS in the decentralized domain name.

And after the vision of ENS is realized, is this omission still negligible? "Decentralized naming for wallets, websites, & more." This is the grand mission written in eye-catching fonts on the ENS official website. In this vision, ENS will become the domain name system for naming all digital resources. Opening theblockbeats.eth is as natural as opening theblockbeats.info. At this time, the zero-width characters of ENS will bring profound security risks to the entire Web3.0 world .

Zero-width characters bring ENS one step closer to becoming a Web3.0 infrastructure.

I, God V, play money

When you see "vitalik.eth", who do you think this person is? There is no doubt that this ENS domain name is owned by V God. So, can I register this domain name? According to the rules of ENS, this domain name has already been registered, and naturally other users cannot register the same domain name. But it is worth noting that this only refers to the domain name that is completely consistent for the computer. So, is there any way for me to find a domain name that is different from V God's domain name but looks the same?

Of course, just insert ZWJ anywhere.

ZWJ (zero width joiner) is a zero-width character, and this symbol is quite special. For computers, ZWJ is still a character with an independent encoding in the Unicode character set. If you type this character in Word, it will still be counted in the word count. However, this character has a width of 0, which means that zero-width characters are completely invisible to the naked eye.

This also means that I just need to insert a zero-width character anywhere in the word "vitalik" to register a visual and V God The domain name is exactly the same as the ENS domain name.

When registering an ENS domain name, just type "%E2%80%8C" or "%E2%80%8D" anywhere to insert a zero-width character into a word. In this way, a V God with the same ENS can be successfully registered. If after inserting zero-width characters, it is still registered in advance, you can even insert two, three, four... multiple zero-width characters in a row until no one registers.

The ENS of the domain name is not well done, and the narrative is difficult to continue

ENS is not only one of the important infrastructures of the Ethereum network, but also an important infrastructure of the Web3.0 network. The founder of ENS has publicly stated that the vision of ENS is to do " Domain Name Service Provider for Every Digital Property in the World". Not only the user's account name, but also the naming system of the entire Web3.0 network.

Remember the imagination of the initial version of Web3.0 in the early years? Decentralized storage saves files, decentralized domain names provide addressing systems, smart contracts have on-chain computing capabilities, and decentralized wallets act as payment channels. In this version of Web3.0, everything runs on decentralized Web, permissionless, censorship-free, it's a truly free internet. In this version, using a Web3.0 browser to access theblockbeats.eth is as natural as opening theblockbeats.info.

Unfortunately, this version of Web3.0 has not yet been realized. Moreover, mainstream browsers have not yet supported access to .eth domain names. Although ENS is still under construction, it seems difficult to become the mainstream infrastructure of this version of Web3.0. If it is really built, it will also leave a huge security risk for surfing the Internet in the Web3.0 era.

Recall carefully, how did you open this article?

Presumably you must have seen the link of this article somewhere, a click of the mouse or finger will bring you to this page. Rather than typing a long string in the address bar  https://www.theblockbeats.info /news/28611  . Needless to say, almost all users use URLs to surf the web. One after another, criss-crossing hyperlinks constitute the Internet of our era. Hyperlinks organize the complicated information of the Internet. Hyperlinks provide search engines with the technical basis for finding information. Hyperlinks provide open and free interconnection channels for information. , It can be said that without hyperlinks, there would be no Internet in today's world.

Can a Web3.0 website based on an ENS domain name do all of this? At least currently it is extremely difficult. Because it brings us a great security risk.

In the era of Web2.0, phishing website attacks are causing serious losses to Internet users all over the world, and this is still the case that the domain name cannot be duplicated. Imagine that when you are surfing the Internet, you see a link shared by a netizen.The link is "visible" to a well-known platform, and the spelling of the domain name is exactly the same as the real address, so you click on it. But in fact, this is a phishing website faked by zero-width characters.

When users are only doing peer-to-peer transfers, the habit of manually typing zero-width characters may be just an innocuous prank. That all changed when ENS tried to live up to its mission of naming all digital resources. The phishing of Web2.0 is only similar to the domain name, while the phishing of Web3.0 has been iterated to be exactly the same. This would be a major security risk.

We are in an Internet based on hyperlinks. DeFi, trading platforms, Web3.0 blogs, Web3.0 social networking; website links, dapp links, API interface links, entry links for all use cases... If the .eth domain name in the form of a link is no longer credible, . How does eth expand its use cases beyond "network names"? How to become a Web3.0 infrastructure? How does the grand narrative of the ENS domain continue to unfold? This risk may fundamentally impact the valuation system of ENS.

Ironically, this problem doesn't even exist in Web2.0.

How does Web2.0 solve this problem?

The solution of Web2.0 is simple and clear-Does not support the use of mixed zero-width characters and Latin letters as domain names. For details, please refer to the "UTS46" standard of the "IDN2008 Specification".

Previously we mentioned two sets of mysterious codes of zero-width characters "%E2%80%8C" and "%E2%80%8D". This is UTF-8 encoding in hexadecimal. Their Unicode numbers are "U+200C" and "U+200D". These characters are usually used in scripts such as Arabic and Indic to control whether the effect of ligatures is generated between characters. In most other languages, you can't type this character.

In Web2.0 domain name registration, such special characters are not accepted. But this does not mean that Web2.0 does not have similar attack methods. In fact, phishing websites disguised by domain names with similar appearances have been widely present in the Web2.0 world.

For example, can you accurately distinguish between "e" and "е", "a" and "а", "Ο" and "O" and "О"? These alphabets include the Latin alphabet that we use frequently, as well as the Cyrillic and Greek alphabets that are less commonly used.

At first, domain name registration only supported ASCII characters, which is what we call "English letters ” and Arabic numerals. This is also the most widely used character set around the world. Almost all devices that support character display support ASCII, but it may not be able to display other characters normally. After the popularity of IDN (Internationalized Domain Names), domain name registration has added support for multiple languages, extending the supported characters from the ASCII character set to some Unicode character sets. This allows people from all over the world to use their native language to register domain names. Taking Chinese as an example, you can use "http://Xinhua Net.China/” to directly access Xinhuanet.

It is not difficult to find characters similar to the Latin alphabet in so many texts . This kind of fraudulent use of similar characters to pretend to be phishing websites has gradually increased. This deception is known as a homograph attack.

As early as 2001, Israeli security personnel published a paper called "Homograph Attack , and registered a variant of microsoft.com that included the Cyrillic alphabet. This is also the first verifiable homograph scam domain. It can be said that the homograph problem has been around for a long time in the Web2.0 era, but its harm and severity are far less than the ENS domain name of Web3.0.

Let's take a set of IDN domain names as an example: ԚԚ.com, аӏірау.com, аӏірау.com. Open these domain names, what can you see?

The browser automatically converts the domain name to a domain name beginning with "xn--". This encoding method is called Punycode.

In the "IDNA2003" specification, in order to avoid homograph fraud, the domain name should undergo secondary processing, this process is called "compatibility normalization (compatibility normalization) , NFKC)". In non-ASCII character domain names, all characters can be converted to more general ASCII characters ("xn--" domain names) through Punycode. This encoding method follows the UTR36 standard and has been used by mainstream browsers, which reduces the risk of homograph attacks from the user side.

Similarly, ICANN has also made corresponding regulations on the registration of IDN domain names. Domain name registration organizations in various countries are also gradually following up. For example, the Russian domain name management agency has banned the mixing of Cyrillic and Latin letters in .ru domain names.

ENS domain names undoubtedly support far more characters than DNS domain names. Not only can you use various characters to register domain names like DNS, you can even use emoji to register domain names , and the zero-width character registration domain name that has been hotly discussed this time. (It is worth mentioning that emoji domain names are not a special case of Web3.0, and root domain names such as ".tk" and ".ws" in traditional domain names also support emoji registration.)

In Web3.0, can we eliminate this hidden danger through similar means?

In the face of homograph attack, ENS developers have an ambiguous attitude

Unfortunately, ENS developers do not seem to intend to solve this problem from the registration entrance.

This issue has been raised by users as early as April 2021 in discussions in the ENS community. The ENS developer's explanation for this is that the support for zero-width characters is at the contract level, so it is impossible to remove these characters that may be used for fraud. In addition, there is a more important reason - zero-width characters support the application of emoji in ENS.

ENS founder nick.eth responded to the zero-width character issue like this: "We are not as strict as ICANN for most gTLDs. Domains like emoji use ENS very well." "ENS prohibits Parsing non-UTS-46 domain names is not implemented at the contract level - it is impractical to write the specification into the contract - this should be part of the problem that the client needs to solve." Of course, he also made a positive contribution to the user "We will consider making additions to the canonicalization rules to prohibit the situation you found."

The number of emoji emoticons is complex. In fact, there are a large number of emojis that are composites of basic emoji, for example, "woman", The combination of "zero-width character" and "rocket" will be recognized by the computer as "astronaut". Through zero-width characters, more expressions can be included on the basis of the reduced code set. And this is the basis for ENS to support almost all emoji. Therefore, ENS cannot mask the use of zero-width characters.

In the previous article, we mentioned the ".tk" domain name of Web2.0, which is the first domain name in the world to support emoji. How do traditional Web2.0 domain names solve this problem? ? In the "UTS46" standard of the "IDN2008 Specification" mentioned above, the use of zero-width characters in different texts and emoji are strictly regulated.

In a discussion in April, nick explained to community members that the use of zero-width characters is at the smart contract level,“That’s fine though, ENS has always been designed to That's it." "Whitelist rules are useless here, because domain names can contain multiple characters, not just emoji."

Risk control and hidden danger elimination

As of now, we have not seen any action by the ENS team to fix this security risk at the contract level. All protection against this risk is made by the centralized Web2.0 front end.

On OpenSea, ENS domains containing zero-width characters are marked with a yellow exclamation mark.

In etherscan, ENS domain names with the same risk are marked with an asterisk.

On Metamask, although no additional risk warning is given, Metamask can recognize that a string contains a zero-width character and display this character with "?".

By means of centralization, the security risks of ENS domain names are reduced to a certain extent. But when we enter a completely open Web3.0 world, how effective will centralized means be? If this hidden danger cannot be eliminated, ENS is still far from his vision of naming all digital resources.

Someday in the future, someone will send you a link to an announcement at www.binance.eth, would you dare to click on it?

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia