For the past three months, Google's security team has been working on a radical change regarding URLs! It should be clarified that the team's researchers are not trying to change the structure of URLs but want to carefully review the way URLs transform the content of websites, so that users are not faced with strange addresses that are fake and possibly lead to suspicious activities.
Specifically, Google held its security conference yesterday, and ChromeEmily Stark spoke about the company's first steps on the hacking issue. Stark said that Google is not trying to eliminate URLs and cause chaos around the world. Instead, researchers want to find ways to make it harder for hackers to tamper with URLs and confuse users.
Today, there are a huge number of complex URLs that allow attackers to carry out malicious activities and profit at the expense of users. In fact, they can create malicious links that appear to lead to simple sites but actually redirect victims to phishing pages. In addition to this, attackers design malicious pages with URLs that look innocent at first glance, hoping that users will not notice small changes. For example, placing the word G00gle in an address with two zeros is a sneaky technique of hackers instead of the regular word Google in the URL. So because of all these sneaky techniques, the Chrome team is trying to work on two projects that will help users not get trapped in malicious URLs!
Stark's team is working on figuring out how to detect URLs that appear to deviate from legitimate addresses first. To that end, they've created an open-source tool called TrickURI that will help developers test whether their software displays URLs accurately and consistently. The goal is to give developers something to test how URLs will appear to users in different situations.
In addition to TrickURI, Stark and her team are working on creating warnings for Chrome users when a URL looks phishy. Of course, the warnings are still in their early stages, as the necessary processes developers have to follow are very complex. However, the biggest challenge is showing users the parts of URLs that are relevant to their security while filtering out all the extra parts that make the URLs difficult to read.
Finally, Stark said that although she and her team are working in an experimental stage to begin with, she is excited about their progress with the creation of the “TrickURI” tool.
