Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smuggling arbitrary data through an emoji

paulbutler.org

Post reply on HN
Print view View original

171–180 of 206 posts

Re: Smuggling arbitrary data through an emoji

#171

Post by the_hoffa »

rafram wrote: post #126

This is cool. I tried pasting the output into an Instagram comment and it stayed intact, so I have a feeling someone could do some interesting stuff with that. Who needs a botnet C&C server when you can post totally invisible commands on public forums?

I mean, steganography has been a thing for quite a while. Not disagreeing, just saying this is how some programs/ideas were passed around the internet decades ago by "less than upstanding netizens" ;)

Wanted to pass a secret code to a friend? Encode the bit-data in the alpha channel of an image. It could even be encrypted/scrambled within the image itself. Post the perfectly normal image to a public forum, ping your friend, they run it through the "decoder" and Robert's your mother's brother.

Of course these weren't "logic bombs" like this post is describing, but even those have been around for a while too.

Hacking is fun :)

Re: Smuggling arbitrary data through an emoji

#172

Post by JoelJacobson »

Imagine using the ID card emoji (U+1FAAA) as a universal carrier for digital ID tokens. A dumb demo is available at https://pit.lovable.app/ which—without any secure protocol—simply encodes a National Identification Number into the emoji using variation selectors.

The idea is that banks could issue encrypted ID tokens in this way, letting them move seamlessly across any platform that supports Unicode (messaging apps, email, web forms, etc.). The heavy lifting of security (preventing replay attacks, interception, ensuring token freshness, etc.) would be managed separately with robust cryptography, while the emoji serves purely as a transport layer.

It's not about reinventing security but about creating a cross-platform way to carry identity tokens. Thoughts?

Re: Smuggling arbitrary data through an emoji

#173

Post by mdup »

omnibrain wrote: post #164

10 years or so ago I shocked coworkers with using U+202D LEFT-TO-RIGHT OVERRIDE mid in filenames on windows. So funnypicturegnp.exe became funnypictureexe.png Combined with a custom icon for the program that mimics a picture preview it was pretty convincing.

I worked in phishing detection. This was a common pattern used by attackers, although .exe are blocked automatically most of the time, .html is the new malicious extension (often hosting an obfuscated window.location redirect to a fake login page).

RTL abuse like cute-cat-lmth.png was relatively common, but also trivial to detect. We would immediately flag such an email as phishing.

Re: Smuggling arbitrary data through an emoji

#174

Post by bruce343434 »

paulgb wrote: post #94
ComputerGuru wrote: post #91

This is cute but unnecessary - Unicode includes a massive range called PUA: the private use area. The codes in this range aren’t mapped to anything (and won’t be mapped to anything) and are for internal/custom use, not to be passed to external systems (for example, we use them in fish-shell to safely parse tokens into a string, turning an unescaped special character into just another Unicode code point in the string,…

I just tested and private use characters render as boxes for me (󰀀), the point here was to encode them in a way that they are hidden and treated as "part of" another character when copy/pasting.

On my Android phone,that displays "Go[][]" in the Google logo font.

Re: Smuggling arbitrary data through an emoji

#175

Post by bruce343434 »

JoelJacobson wrote: post #172

Imagine using the ID card emoji (U+1FAAA) as a universal carrier for digital ID tokens. A dumb demo is available at https://pit.lovable.app/ which—without any secure protocol—simply encodes a National Identification Number into the emoji using variation selectors. The idea is that banks could issue encrypted ID tokens in this way, letting them move seamlessly across any platform that supports Unicode (messaging apps,…

What is wrong with just using the actual SSN? Why hide it in an emoji?

Re: Smuggling arbitrary data through an emoji

#176

Post by taneq »

omnibrain wrote: post #164

10 years or so ago I shocked coworkers with using U+202D LEFT-TO-RIGHT OVERRIDE mid in filenames on windows. So funnypicturegnp.exe became funnypictureexe.png Combined with a custom icon for the program that mimics a picture preview it was pretty convincing.

I’d never heard of this particular trick but I’m glad my decades of paranoia-fueled “right click -> open with” treatment of any potentially sketchy media file was warranted! :D

Re: Smuggling arbitrary data through an emoji

#177

Post by JoelJacobson »

bruce343434 wrote: post #175
JoelJacobson wrote: post #172

Imagine using the ID card emoji (U+1FAAA) as a universal carrier for digital ID tokens. A dumb demo is available at https://pit.lovable.app/ which—without any secure protocol—simply encodes a National Identification Number into the emoji using variation selectors. The idea is that banks could issue encrypted ID tokens in this way, letting them move seamlessly across any platform that supports Unicode (messaging apps,…

What is wrong with just using the actual SSN? Why hide it in an emoji?

So that the operating system could recognize it automatically, and to include a potentially long URL to the retail bank's web service to initiate the protocol, such as signing a document or an identification protocol.

Re: Smuggling arbitrary data through an emoji

#178

Post by _1tem »

blmarket wrote: post #120

This and several other abuse cases forced my previous work to use code pointers to count 'characters' for user's nickname / status messages. No one wanted to download 9MB simply browsing other users.

NoSQL? Sounds like it should’ve been caught by basic length checks on the database field where it was stored.
Post reply on HN