This was how some folks pretended that Google had erased all mentions of "Oracle": http://giorgiosironi.blogspot.com/2010/08/google-never-remov... I used this to prank some people on the in-house SEO team at my last job. I'd ask them if they had done anything that might be considered black-hat. Then I sent him a link to a "site:" query on Google indicating that our site had been removed from the index. e.g. http://ww…
Can we believe our eyes? Misleading people with Unicode.
91–100 of 128 posts
Re: Can we believe our eyes? Misleading people with Unicode.
#92Earlier quoted context omitted.
How is the real hosts file rendered hidden in Explorer?
Like any other hidden file, it's not rendered until you choose to show hidden files and then at the point, it shows the file, but the icon is semi transparent.
Sorry, I meant how do you make a file hidden?
Re: Can we believe our eyes? Misleading people with Unicode.
#93This was how some folks pretended that Google had erased all mentions of "Oracle": http://giorgiosironi.blogspot.com/2010/08/google-never-remov... I used this to prank some people on the in-house SEO team at my last job. I'd ask them if they had done anything that might be considered black-hat. Then I sent him a link to a "site:" query on Google indicating that our site had been removed from the index. e.g. http://ww…
The wide variety of exploits such as these suggests that we need to integrate character spoofing into the general malware detection system on devices, which evolves over time (in the way that virus checkers evolve, with lots of human input) to deal with known or anticipated problems.
I'm thinking of a system that combines aspects of virus checking, malware detection, bayesian spam filtering, and spell checking.
A Unicode system can be supplied with tables of characters that could easily be mistaken (visually) for one another. These tables, combined with dictionaries, could spot words that could look like dictionary entries visually but are not spelled in the ordinary way. This approach could even spot things that have been problems for years in pure ASCII: confusion of 0 and O, of l and 1 and I, of rn and m, etc, It could also spot insertions of non-visible characters into such things as URLs and filenames.
Such a system would be able to spot .exe files that had names written in such a way that the .exe extension was not visually displayed at the end of the name. If you double-clicked such a file the first time, it could ask you if you realized that it is program you are about to run and not a ".jpg" as the name might suggest. In fact, it could ask you about any file whose real extension and apparent visual extension differed.
There will still be problems that will sneak through, just as today you can phish people with subtle misspellings that don't require anything more than ASCII.
But making this a part of the system's evolving general malware detection system, with human-created tables and heuristics borrowed from malware detectors, spam filters, and spell checkers, is the best solution, IMO.
Re: Can we believe our eyes? Misleading people with Unicode.
#94I remember years back on Wikipedia, clever vandals would play Unicode tricks. It was interesting, to say the least - you'd register a name that looks identical to a real user, vandalize, and hope the administrator would type the name in... This was ultimately stopped by Antispoof ( https://secure.wikimedia.org/wikipedia/mediawiki/wiki/Extens... ) but the bug reports are still interesting: - https://bugzilla.wikimedia…
Although it's not vandalism, something else that permeated Wikipedia is the use of the Cyrillic ya (Я) in places of R, where the stylized artwork for the article subject reverses the R (and varies it in many other ways, for sure).
The difference between the two is that this phenomenon is not wholly in the past.
One of the biggest thorns of the situation is when editors bring up an official or semi-offical website related to the subject and using Я, pointing to its existence as "proof". No, that isn't proof; whoever is managing that area of the web properties is just a jackass.
Re: Can we believe our eyes? Misleading people with Unicode.
#95Somewhat related to this is the ability to change 'l" and "I" around when they both look the same, basically a straight line. This was very common in Yahoo Chat Rooms when folks would pretend to be someone else by registering their name with the opposite of what they had (assuming it had an "i" or "l" in it). They would then take a screen shot of their font and copy that exactly so they could appear to be the other p…
Somebody got me with that exact trick during the Charlie Sheen debacle: I was going back and forth between the Twitter page for @CharlieSheen and @CharIieSheen and couldn't figure out how this was possible… I didn't feel exactly smart when I realized what was going on. edit: on a related note, I half-jokingly tend to read RockMelt as rock-me-it…
I've seen an unblinking use of "RockMeIt" before. I'm fairly sure it was here on HN.
Re: Can we believe our eyes? Misleading people with Unicode.
#96Earlier quoted context omitted.
non-english keyboards links
Yes. I think this is part of it. Here are the logs from a few weeks ago: http://j.mp/pBqfbx I'd be curious if anyone can figure out why so many visitors are using a browser called Netfront (apparently from Samsung mobiles).
On my BlackBerry, inadvertently swiping the trackpad while typing a vowel results in an accented version of the vowel. There might a similar mechanism at work in Samsung devices.
Re: Can we believe our eyes? Misleading people with Unicode.
#97Earlier quoted context omitted.
The HTML standard specifies that changes in text direction are bounded to the block they occur in: http://www.w3.org/TR/1999/REC-html401-19991224/struct/dirlan... I discovered this as I was writing a paranoid HTML cleanup library and wanted to prevent the attack where a user sticks a text-direction-change character into the page and reverses the whole thing. As we've all just witnessed, that can't happen in a conform…
Is this 'really, really paranoid' library available somewhere?
Not yet. But it'll be in Haskell anyhow, so you're probably not actually interested :)
There are other such libraries for other languages, poke around. See for instance http://htmlpurifier.org/ .
Re: Can we believe our eyes? Misleading people with Unicode.
#98Earlier quoted context omitted.
Yes. I think this is part of it. Here are the logs from a few weeks ago: http://j.mp/pBqfbx I'd be curious if anyone can figure out why so many visitors are using a browser called Netfront (apparently from Samsung mobiles).
On my BlackBerry, inadvertently swiping the trackpad while typing a vowel results in an accented version of the vowel. There might a similar mechanism at work in Samsung devices.
I see. What is interesting is that most of the requests come from Samsung devices in Spanish-speaking countries, so I guess their keyboards must make it even easier to make the mistake.
Re: Can we believe our eyes? Misleading people with Unicode.
#99A while ago I compiled a list of unicode characters that looked like letters, to get past curse filters. Not comprehensive, because I just manually skimmed through a unicode table, but here it is if anyone cares:
Wide letters: Ａ Ｂ Ｃ Ｄ Ｅ Ｆ Ｇ Ｈ Ｉ Ｊ Ｋ Ｌ Ｍ Ｎ Ｏ Ｐ Ｑ Ｒ Ｓ Ｔ Ｕ Ｖ Ｗ Ｘ Ｙ Ｚ ａ ｂ ｃ ｄ ｅ ｆ ｇ ｈ ｉ ｊ ｋ ｌ ｍ ｎ ｏ ｐ ｑ ｒ ｓ ｔ ｕ ｖ ｗ ｘ ｙ ｚ
Better looking letters: ϲ р с Ѕ І А В Е М Н О Р С а е о ѕ і ԛ
Anyone know of a better resource?
Re: Can we believe our eyes? Misleading people with Unicode.
#100Seems easy enough to guard against. Highlight the characters which are unexpected for my locale.
That's a clever idea, but I don't know how one would determine what "unexpected" is an increasingly international world.
how one would determine what "unexpected" is an increasingly international world
1. Highlight any two adjacent characters from different languages. Virtually no one needs an English word with one Cyrillic letter substituted in.
2. Highlight any word whose letters all look like they are for the current locale but is made entirely of code points from another language.