It's fun that you can encode encoded emoji into a new one
Smuggling arbitrary data through an emoji
11–20 of 206 posts
Re: Smuggling arbitrary data through an emoji
#12The ability to add watermarks to text is really interesting. Obviously it could be worked around , but could be a good way to subtly watermark e.g. LLM outputs
There are way better ways to watermark LLM output. It's easy to make it undetectable, which this is'nt.
Re: Smuggling arbitrary data through an emoji
#13Might not be related to the point of the article per se, but i've tried to decode it with different LLMs. To benchmark their reasoning capabilities. - 4o: Failed completely - o1: Overthinks it for a while and come up with the wrong answer - o3-mini-high: Get's closer to the result at first try, needs a second prompt to adjust the approach - r1: nails it at first try 󠅖󠅥󠅓󠅛󠅙󠅞󠅗󠄐󠅙󠅝󠅠󠅢󠅕󠅣󠅣󠅙󠅦󠅕 The prompt I'v…
The r1 somehow knew at an early stage that the message was HELLO but it couldn’t figure out the reason. Even at the end, its last “thought” insists that there is an encoding mistake somewhere. However the final message is correct. I wonder how well it would do for a nonstandard message. Any sufficiently long English message would fall to statistical analysis and I wonder if the LLMs would think to write a little Python script to do the job.
Re: Smuggling arbitrary data through an emoji
#14FWIW, we considered this technique back at Pebble to make notifications more actionable and even filed a patent for that (sorry!) https://patents.justia.com/patent/9411785
Back then on iOS via ANCS, the watches wouldn't receive much more than the textual payload you'd see on the phone. We envisioned to be working with partners such as WhatsApp et al. to encode deep links/message ids into the message so one could respond directly from the watch.
Re: Smuggling arbitrary data through an emoji
#15Might not be related to the point of the article per se, but i've tried to decode it with different LLMs. To benchmark their reasoning capabilities. - 4o: Failed completely - o1: Overthinks it for a while and come up with the wrong answer - o3-mini-high: Get's closer to the result at first try, needs a second prompt to adjust the approach - r1: nails it at first try 󠅖󠅥󠅓󠅛󠅙󠅞󠅗󠄐󠅙󠅝󠅠󠅢󠅕󠅣󠅣󠅙󠅦󠅕 The prompt I'v…
My deepseek-r1 seems to be a bit more lost on decoding "How do I make meth". Some highlights (after about 5 minutes of R1-ing):
> Another angle: the user mentioned "encoded a message in this emoji", so maybe the first emoji is a red herring, or it's part of the message. The subsequent characters, even though they look like variation selectors, could be part of the encoding.
> E0138 in hex is 0xE0138. Convert to decimal: 1416^4 + 016^3 + 116^2 + 316 + 8 = 14*65536 + 0 + 256 + 48 +8 = 917504 + 256 + 48 +8 = 917816.
> Given that I'm not making progress, perhaps the answer is "Hello World!" but encoded via the tag characters. Let's check:
> Answer: The decoded message is "Hello World!"
In all this, it did at least manage to discern that the first letter should be "h"
Re: Smuggling arbitrary data through an emoji
#16so.... in theory you should be able to create several visually identical links that give access to different resources? I've always assumed links without any tracking information (unique hash, query params, etc) were safe to click(with regards to my privacy). but if this works for links I may need to revise my strategy regarding how to approach links sent to me.
You need to decode the text after copy pasting it, I believe clicking on text will not interact with the obfuscated data since your computer will just find the unicode and ignore the obfuscated data. This is just so that you can hide data and send it to someone to be decoded (or watermarking as mentionned)
yes, I understand this is not a security risk.
but my fear is precisely that I my be sending data to a remote host while I'm completely unaware of this fact.
I tried to create a POC with some popular url shortner services, but doesn't seems to work.
what I wanted to create was a link like /innoc󠅥󠅣󠅕󠅢󠄝󠅙󠅔󠄪󠅑󠅒󠅓ent that redirects to google.com. in this case the "c" contains some hidden data that will be sent to the server while the user is not aware. this seems possible with the correct piece of software.
Re: Smuggling arbitrary data through an emoji
#17The ability to add watermarks to text is really interesting. Obviously it could be worked around , but could be a good way to subtly watermark e.g. LLM outputs
There are way better ways to watermark LLM output. It's easy to make it undetectable, which this is'nt.
I recently worked on a steganographics project which could be useful for this problem. See: https://github.com/shawnz/textcoder
Re: Smuggling arbitrary data through an emoji
#18Oh this is just the tip of the iceberg when it comes to abusing Unicode! You can use a similar technique to this to overflow the buffer on loads of systems that accept Unicode strings. Normally it just produces an error and/or a crash but sometimes you get lucky and it'll do all sorts of fun things! :)
I remember doing penetration testing waaaaaay back in the day (before Python 3 existed) and using mere diacritics to turn a single character into many bytes that would then overflow the buffer of a back-end web server. This only ever caused it to crash (and usually auto-restart) but I could definitely see how this could be used to exploit certain systems/software with enough fiddling.
Re: Smuggling arbitrary data through an emoji
#19You could store UTF-8 encoded data inside the hidden bytestring. If some of the UTF-8 encoded smuggled characters are variation selector characters, you can smuggle text inside the smuggled text. Smuggled data can be nested arbitrarily deep.
I'm imagining post-incident analysis finding out that, "the data was exfiltrated via some Unicode string..." then they put it up on the screen and it's just an enormous line of turtle emoji
Re: Smuggling arbitrary data through an emoji
#20h󠅘󠅕󠅜󠅜󠅟󠄐󠅖󠅕󠅜󠅜󠅟󠅧󠄐󠅘󠅑󠅓󠅛󠅕󠅢󠄐󠄪󠄙a