3 ms·
Hmm. What would you attack? That is, if you were writing a crate that I was thinking of using in my program, how would homographs allow you to compromise my cod
by db48x 7y ago
Hmm. What would you attack? That is, if you were writing a crate that I was thinking of using in my program, how would homographs allow you to compromise my code?
- saagarjha 7y agoHere’s a somewhat contrived “attack”: I write a crate with two functions that are named similarly, wait for you to integrate it, then file a pull request using the Unicode function name (and hence calling the malicious function) and be relatively assured that if you looked up the function you’d stop reading code at the ASCII one.
- fluffything 7y agoThe code published on crates.io does not need to match the code in your github repository, so... you don't need unicode homographs to do this kind of attack. Also, homographs currently produce a warning...
- wyldfire 7y agoThe best attack is of an alias of a popular crate. Duplicate the functionality/behavior/version number but include a subtle backdoor.
- db48x 7y agoHow would people end up using your evil crate though? I guess you could rely on having people copy and paste code from your documentation or tutorials, but if they just type the name then they get the original.