Seems easy enough to guard against. Highlight the characters which are unexpected for my locale.
That's a clever idea, but I don't know how one would determine what "unexpected" is an increasingly international world.
Can we believe our eyes? Misleading people with Unicode.
21–30 of 128 posts
Re: Can we believe our eyes? Misleading people with Unicode.
#22[deleted]
Re: Can we believe our eyes? Misleading people with Unicode.
#23I'm pretty shocked that I have never heard of the RLO unicode character before this article. Let's see if it works: ppa.emorhCelgooG => ppa.emorhCelgooG
Inspecting the element with Chrome shows an amusing behavior. Try it.
Re: Can we believe our eyes? Misleading people with Unicode.
#24This is why "filters" that prevent XSS, etc by remove malicious characters are so easily breakable. This type of attack is called a canonicalization attack (more here https://www.owasp.org/index.php/Canonicalization,_locale_and... )
This is not a canonicalization attack, although it is similar. The attacks described used semantically different strings that just happened to look like what the user was expecting.
Re: Can we believe our eyes? Misleading people with Unicode.
#25But, how does this work? Does Windows source all of the files in your %SystemRoot%\system32\drivers\etc? Why does it matter what the file is named? To hide from idiots?
Windows is loading the real "hosts" file. This is hidden, and there's a non-hidden "h_sts" file there as well. It seems like it would only work for hiding from people casually checking. Personally I'd open the file by typing the path myself, so I'd end up finding the trojan's file. The same would be true for any automated anti-spyware tool. So yes, this looks like it would only affect a very limited number of people…
Since Windows by default don't show hidden files, I must say that most of my engineer coleagues would fall in the trick. Sadly, most people that I worked open the files manually.
Re: Can we believe our eyes? Misleading people with Unicode.
#26Re: Can we believe our eyes? Misleading people with Unicode.
#27This is why "filters" that prevent XSS, etc by remove malicious characters are so easily breakable. This type of attack is called a canonicalization attack (more here https://www.owasp.org/index.php/Canonicalization,_locale_and... )
This is not a canonicalization attack. Those attacks are based on there being multiple ways to encode the same unicode codepoint in utf8. A utf8 decoder should reject portions of utf8 streams that don't use the shortest possible encoding, but not all do. If there are multiple ways to encode ' The attack described here is simpler: two unicode codepoints, roman 'o' and cyrillic 'o', usually look identical. So by substi…
> A utf8 decoder should reject portions of utf8 streams that don't use the shortest possible encoding
so you would say that there should be no file names using the cyrillic o? So if a russian-speaking person wants to save a file, that file name should be rejected? Or translated into a mish-mash between cyrillic and roman characters?
How will that work if that filename is reused on a system on which the default font doesn't contain the roman characters (I'm sure such a thing exists) and thus font substitution needs to happen?
The fix definitely isn't this easy. Maybe one could disallow homoglyphs of a different language than the one dominating the current file name. But this might be a lot of work and I doubt it's fool-proof.
Re: Can we believe our eyes? Misleading people with Unicode.
#28Yes - reminds me of how several users would exploit the Bolt.com chat system (back in the day) using upper-case 'I's as lower case 'L's to pose as different users and cause mayhem.
In the old days, I tried once to put a backtick ` on my username in counter-strike as a way to prevent admins from kicking me :P (the backtick toggles the console, and kicking requires typing 'kick ' from the console).
I was kicked within 2 seconds from joining the server.
Re: Can we believe our eyes? Misleading people with Unicode.
#29Earlier quoted context omitted.
Windows is loading the real "hosts" file. This is hidden, and there's a non-hidden "h_sts" file there as well. It seems like it would only work for hiding from people casually checking. Personally I'd open the file by typing the path myself, so I'd end up finding the trojan's file. The same would be true for any automated anti-spyware tool. So yes, this looks like it would only affect a very limited number of people…
Since Windows by default don't show hidden files, I must say that most of my engineer coleagues would fall in the trick. Sadly, most people that I worked open the files manually.
How is the real hosts file rendered hidden in Explorer?
Re: Can we believe our eyes? Misleading people with Unicode.
#30Earlier quoted context omitted.
Windows is loading the real "hosts" file. This is hidden, and there's a non-hidden "h_sts" file there as well. It seems like it would only work for hiding from people casually checking. Personally I'd open the file by typing the path myself, so I'd end up finding the trojan's file. The same would be true for any automated anti-spyware tool. So yes, this looks like it would only affect a very limited number of people…
Since Windows by default don't show hidden files, I must say that most of my engineer coleagues would fall in the trick. Sadly, most people that I worked open the files manually.
I find that disturbing, one of the first things I do after a clean install of windows is to check the "Show Hidden Files", which was hard to find in Windows 7 :/ I thought most tech savvie people did that?