Can we believe our eyes? Misleading people with Unicode.

#1

Post by bensummers » Thu, Aug 11, 2011, 1:48 PM UTC

Can we believe our eyes? Misleading people with Unicode.
blogs.technet.com

Re: Can we believe our eyes? Misleading people with Unicode.

#2

Post by evilswan » Thu, Aug 11, 2011, 2:20 PM UTC

Yes - reminds me of how several users would exploit the Bolt.com chat system (back in the day) using upper-case 'I's as lower case 'L's to pose as different users and cause mayhem.

Re: Can we believe our eyes? Misleading people with Unicode.

#3

Post by Rygu » Thu, Aug 11, 2011, 2:22 PM UTC

I'm pretty shocked that I have never heard of the RLO unicode character before this article. Let's see if it works: ppa.emorhCelgooG => ‮ppa.emorhCelgooG

Re: Can we believe our eyes? Misleading people with Unicode.

#4

Post by tantalor » Thu, Aug 11, 2011, 2:36 PM UTC

But, how does this work? Does Windows source all of the files in your %SystemRoot%\system32\drivers\etc? Why does it matter what the file is named? To hide from idiots?

Re: Can we believe our eyes? Misleading people with Unicode.

#5

Post by yahelc » Thu, Aug 11, 2011, 2:36 PM UTC

Rygu wrote: post #3

I'm pretty shocked that I have never heard of the RLO unicode character before this article. Let's see if it works: ppa.emorhCelgooG => ‮ppa.emorhCelgooG

Whoa. Check out you did to the markup of this page. http://d.pr/HKSQ

Re: Can we believe our eyes? Misleading people with Unicode.

#6

Post by 3pt14159 » Thu, Aug 11, 2011, 2:39 PM UTC

tantalor wrote: post #4

But, how does this work? Does Windows source all of the files in your %SystemRoot%\system32\drivers\etc? Why does it matter what the file is named? To hide from idiots?

The hosts file is very important to windows because it maps domains to ips. So I could actually point google.com in my hosts and send myself to the ip of yahoo.com. The key observation here is that the REAL hosts file was hidden, and a hosts file that only looked like a hosts file (with a different kind of o) was the non hidden one.

Re: Can we believe our eyes? Misleading people with Unicode.

#7

Post by matthavener » Thu, Aug 11, 2011, 2:40 PM UTC

This is why "filters" that prevent XSS, etc by remove malicious characters are so easily breakable. This type of attack is called a canonicalization attack (more here https://www.owasp.org/index.php/Canonicalization,_locale_and...)

Re: Can we believe our eyes? Misleading people with Unicode.

#8

Post by cbr » Thu, Aug 11, 2011, 2:45 PM UTC

tantalor wrote: post #4

But, how does this work? Does Windows source all of the files in your %SystemRoot%\system32\drivers\etc? Why does it matter what the file is named? To hide from idiots?

The operating system sees the hosts file as normal. A person trying to debug it through the gui (with hidden files hidden) sees the dummy hOsts file and thinks that's not where the problem is.

Re: Can we believe our eyes? Misleading people with Unicode.

#9

Post by omh » Thu, Aug 11, 2011, 2:45 PM UTC

tantalor wrote: post #4

But, how does this work? Does Windows source all of the files in your %SystemRoot%\system32\drivers\etc? Why does it matter what the file is named? To hide from idiots?

Windows is loading the real "hosts" file. This is hidden, and there's a non-hidden "h_sts" file there as well.

It seems like it would only work for hiding from people casually checking. Personally I'd open the file by typing the path myself, so I'd end up finding the trojan's file. The same would be true for any automated anti-spyware tool.

So yes, this looks like it would only affect a very limited number of people - technical enough to check the hosts file, but naive enough to do it manually and not notice the other hidden file.

Re: Can we believe our eyes? Misleading people with Unicode.

#10

Post by mikelward » Thu, Aug 11, 2011, 2:46 PM UTC

On Linux, how could you make standard tools highlight or differentiate potentially misleading characters?

I guess the solution would have to be in the terminal emulator? Would a blacklist of Unicode ranges be sufficient?