A “semantic attack” is an attack in which the attacker uses the computing infrastructure/system in a way that fools the victim into thinking they are doing something, but are doing something different, yet the computing infrastructure/system is working exactly as it was designed to do. Semantic attacks often involve financial scams, where the attacker is trying to fool the victim into giving the attacker large sums of money (e.g., thinking they’re investing in something). For example, the attacker may try to convince the user that they’re looking at a trusted website, even if they aren’t.
Semantic attacks are difficult to counter, because they’re exploiting the correct operation of the computer. The way to deal with semantic attacks is to help give the human additional information, so that when “odd” things happen the human will have more information or a warning will be presented that something may not be what it appears to be.
One example is URIs that, while legitimate, may fool users into thinking they have a different meaning. For example, look at this URI:
http://www.bloomberg.com@www.badguy.com |
Another example is homographs, particularly international homographs. Certain letters look similar to each other, and these can be exploited as well. For example, since 0 (zero) and O (the letter O) look similar to each other, users may not realize that WWW.BLOOMBERG.COM and WWW.BL00MBERG.COM are different web addresses. Other similar-looking letters include 1 (one) and l (lower-case L). If international characters are allowed, the situation is worse. For example, many Cyrillic letters look essentially the same as Roman letters, but the computer will treat them differently. Currently most systems don’t allow international characters in host names, but for various good reasons it’s widely agreed that support for them will be necessary in the future. One proposed solution has been to diplay letters from different code regions using different colors - that way, users get more information visually. If the users look at URI, they will hopefully notice the strange coloring. [Gabrilovich 2002] The page Phishing - Browser-based Defences provides another set of possible defenses against this attack. However, this does show the essence of a semantic attack - it’s difficult to defend against, precisely because the computers are working correctly.