More on lookalikes, confusables, IDN homograph attacks, and other fun stuff, continued from the previous post.

The Confusables

These types of visual attacks are attributed to what's known as 'the confusables' and have been documented in Unicode's Technical Report 36 and TR39.  The confusables is a name given to scripts that essentially lookalike each other. The Unicode consortium has defined three main classes of confusable strings which are possible:

1. Single-script


2. Mixed-script


3. Whole-script

I want to investigate each one in turn.  Because I'm simplifying things here, I may not be accurate in my use of the terms script, alphabet, letter, and so on.  Linguistics people get it better than I do but for the rest of us, the term 'script' refers to:

A collection of letters and other written signs used to represent textual information in one or more writing systems. For example, Russian is written with a subset of the Cyrillic script; Ukranian is written with a different subset. The Japanese writing system uses several scripts.

Single-script confusables

These occur when letters from the same alphabet, or script, are used to give the same visual appearance.  This definition should be extended to say that these occur when letters from either the same script, inherited script, or common script, are used together.   For example, the following two combinations of Latin letters look identical:

• so̷s


• søs

If you take these apart, there's a big difference.  While the letter 's' is the same in each, the 'o̷' and 'ø' are different.  The first uses the Basic Latin 'o' with a combining diacritical mark named COMBINING SHORT SOLIDUS OVERLAY, which is considered an inherited script.  To put it a different way, we have two atomic Unicode code points here, which together give the affect of a single character or letter.  The second uses the atomic character LATIN SMALL LETTER O WITH STROKE.  Let's take these apart and look at the Unicode code point values for each.

• so̷s == \u0073\u006F\u0337\u0073


• søs == \u0073\u00F8\u0073

As you can see, the first 'o̷' gets formed from two Unicode code points, u006F and u0337.  If you copy and paste that word into a text editor that supports Unicode (e.g. Notepad) and click backspace, you'll see the first backspace removes the combining diacritical mark, and the second removes the 'o'.  Continuing with the example, the second 'ø' is made of a single Unicode code point u00F8 part of the Latin-1 Supplement Unicode block. At a lower level, because we're using different code points and bytes to achieve the same visual affect, we have a case of the confusables.

Let's take a closer look at what qualifies as a single-script confusable for the Latin lower-case letter 'a' - taken from the confusables table at http://unicode.org/reports/tr39/data/confusables.txt.



Update: I just realized that some of the characters broke Wordpress so I've converted them all to NCR. In the above you can see three characters that all visually look similar to the Latin lowercase letter 'a'. The first number is the code point for the confusable, the second number 0041 is the code point for 'a', and the following stuff is some descriptive text.

The reason the 'Mathematical' characters are considered single-script confusables is because they have the common script class assigned to them.

Other scripts exist which have their own characters confusable with the Latin 'a', but those are considered mixed-script, which I'll go over in another post. For now I'll leave you with a list of test cases for single-script confusables. Some are more obvious than others, and it all depends on the font

• Microsoft → Micros𝗈ft


• Apple → Aｐ𝗉le


• Google → Ｇoogle


• IBM → IBＭ


• Oracle → O𝗿𝗮cle


• Intel → Int𝗲𝗹