Can we believe our eyes? Misleading people with Unicode.
blogs.technet.com
Can we believe our eyes? Misleading people with Unicode.
1–10 of 128 posts
Re: Can we believe our eyes? Misleading people with Unicode.
#2Yes - reminds me of how several users would exploit the Bolt.com chat system (back in the day) using upper-case 'I's as lower case 'L's to pose as different users and cause mayhem.
Re: Can we believe our eyes? Misleading people with Unicode.
#3I'm pretty shocked that I have never heard of the RLO unicode character before this article. Let's see if it works: ppa.emorhCelgooG => ppa.emorhCelgooG
Re: Can we believe our eyes? Misleading people with Unicode.
#4But, how does this work? Does Windows source all of the files in your %SystemRoot%\system32\drivers\etc? Why does it matter what the file is named? To hide from idiots?
Re: Can we believe our eyes? Misleading people with Unicode.
#5I'm pretty shocked that I have never heard of the RLO unicode character before this article. Let's see if it works: ppa.emorhCelgooG => ppa.emorhCelgooG
Whoa. Check out you did to the markup of this page. http://d.pr/HKSQ
Re: Can we believe our eyes? Misleading people with Unicode.
#6But, how does this work? Does Windows source all of the files in your %SystemRoot%\system32\drivers\etc? Why does it matter what the file is named? To hide from idiots?
The hosts file is very important to windows because it maps domains to ips. So I could actually point google.com in my hosts and send myself to the ip of yahoo.com. The key observation here is that the REAL hosts file was hidden, and a hosts file that only looked like a hosts file (with a different kind of o) was the non hidden one.
Re: Can we believe our eyes? Misleading people with Unicode.
#7This is why "filters" that prevent XSS, etc by remove malicious characters are so easily breakable. This type of attack is called a canonicalization attack (more here https://www.owasp.org/index.php/Canonicalization,_locale_and...)
Re: Can we believe our eyes? Misleading people with Unicode.
#8But, how does this work? Does Windows source all of the files in your %SystemRoot%\system32\drivers\etc? Why does it matter what the file is named? To hide from idiots?
The operating system sees the hosts file as normal. A person trying to debug it through the gui (with hidden files hidden) sees the dummy hOsts file and thinks that's not where the problem is.
Re: Can we believe our eyes? Misleading people with Unicode.
#9But, how does this work? Does Windows source all of the files in your %SystemRoot%\system32\drivers\etc? Why does it matter what the file is named? To hide from idiots?
Windows is loading the real "hosts" file. This is hidden, and there's a non-hidden "h_sts" file there as well.
It seems like it would only work for hiding from people casually checking. Personally I'd open the file by typing the path myself, so I'd end up finding the trojan's file. The same would be true for any automated anti-spyware tool.
So yes, this looks like it would only affect a very limited number of people - technical enough to check the hosts file, but naive enough to do it manually and not notice the other hidden file.
Re: Can we believe our eyes? Misleading people with Unicode.
#10On Linux, how could you make standard tools highlight or differentiate potentially misleading characters?
I guess the solution would have to be in the terminal emulator? Would a blacklist of Unicode ranges be sufficient?