11 ms·
Can we believe our eyes? Misleading people with Unicode.
- mikelward 15y agoOn Linux, how could you make standard tools highlight or differentiate potentially misleading characters? I guess the solution would have to be in the terminal emulator? Would a blacklist of Unicode ranges be sufficient?
- mikelward 15y agoA "safe" font that renders Cyrillic characters as a box? Change my system back to ASCII? :-)
- feydr 15y agood -h -- I used to run into this problem a lot when I was writing grammars against different locales
- mikelward 15y agoI'm aware of od, xxd, etc. I'm wondering if there's a way to make it more obvious that doesn't require running od. It should be immediately apparent any time there's a file with a whacky name, not something you find out two minutes into investigating a compromise.
- evilswan 15y agoYes - reminds me of how several users would exploit the Bolt.com chat system (back in the day) using upper-case 'I's as lower case 'L's to pose as different users and cause mayhem.
- neilk 15y agoIn systems that allow spaces in the middle of your username, there are some that do the same with the various unicode variations on white space. That's confusing even to people who know what to look for. I have thought someone should compile a mapping of all the visually similar characters in Unicode to one canonical character. Then we can all include a check for potential impersonation in account-creation code.
- hasenj 15y agoIn the old days, I tried once to put a backtick ` on my username in counter-strike as a way to prevent admins from kicking me :P (the backtick toggles the console, and kicking requires typing 'kick <name>' from the console). I was kicked within 2 seconds from joining the server.
- Tyr42 15y agoI run a tf2 server, and we can just type /kick na`me in chat to kick you. (tf2 is like cs is that ` is console)
- Rygu 15y agoI'm pretty shocked that I have never heard of the RLO unicode character before this article. Let's see if it works: ppa.emorhCelgooG => ppa.emorhCelgooG
- yahelc 15y agoWhoa. Check out you did to the markup of this page. http://d.pr/HKSQ http://d.pr/HKSQ
- nzmsv 15y agoLooks like the bug is in Chrome's View Source - the markup itself is fine.
- cbr 15y agoIs it a bug? Or is chrome correctly interpreting the right-to-left override character it sees in the source?
- nzmsv 15y agoGood point. It is probably the right thing to do technically, since the source view can't rely on parsing the markup. I think I'd prefer such non-printable characters to be simply escaped though.
- yahelc 15y agoAre you sure? curling from Terminal, I get the same result.
- cbr 15y agoThat's probably because your terminal interprets the RLO character. Should it? I'm not sure.
- icebraining 15y ago
- tantalor 15y agoBut, how does this work? Does Windows source all of the files in your %SystemRoot%\system32\drivers\etc? Why does it matter what the file is named? To hide from idiots?
- cbr 15y agoThe operating system sees the hosts file as normal. A person trying to debug it through the gui (with hidden files hidden) sees the dummy hOsts file and thinks that's not where the problem is.
- omh 15y agoWindows is loading the real "hosts" file. This is hidden, and there's a non-hidden "h_sts" file there as well. It seems like it would only work for hiding from people casually checking. Personally I'd open the file by typing the path myself, so I'd end up finding the trojan's file. The same would be true for any automated anti-spyware tool. So yes, this looks like it would only affect a very limited number of people - technical enough to check the hosts file, but naive enough to do it manually and not notice the other hidden file.
- juliano_q 15y agoSince Windows by default don't show hidden files, I must say that most of my engineer coleagues would fall in the trick. Sadly, most people that I worked open the files manually.
- matthavener 15y agoThis is why "filters" that prevent XSS, etc by remove malicious characters are so easily breakable. This type of attack is called a canonicalization attack (more here https://www.owasp.org/index.php/Canonicalization,_locale_and_Unicode https://www.owasp.org/index.php/Canonicalization,_locale_and...)
- cbr 15y agoThis is not a canonicalization attack. Those attacks are based on there being multiple ways to encode the same unicode codepoint in utf8. A utf8 decoder should reject portions of utf8 streams that don't use the shortest possible encoding, but not all do. If there are multiple ways to encode '<', then an xss prevention filter is going to have trouble. The attack described here is simpler: two unicode codepoints, roman 'o' and cyrillic 'o', usually look identical. So by substituting cyrillic we can make a file called 'hosts' that the operating system won't pay attention to. This is the same problem with punycode internationalized domain names, where paypal.com might be spelled with a cyrillic 'a' and mislead people. The fix for domain names was to restrict what unicode you could use where. I'm not sure what the fix is here, aside from always showing hidden files.
- pilif 15y ago> A utf8 decoder should reject portions of utf8 streams that don't use the shortest possible encoding so you would say that there should be no file names using the cyrillic o? So if a russian-speaking person wants to save a file, that file name should be rejected? Or translated into a mish-mash between cyrillic and roman characters? How will that work if that filename is reused on a system on which the default font doesn't contain the roman characters (I'm sure such a thing exists) and thus font substitution needs to happen? The fix definitely isn't this easy. Maybe one could disallow homoglyphs of a different language than the one dominating the current file name. But this might be a lot of work and I doubt it's fool-proof.
- cyann 15y agoA simpler fix would be to allow only ASCII characters in system folders.
- nodata 15y agoSeems easy enough to guard against. Highlight the characters which are unexpected for my locale.
- mikelward 15y agoWith a whitelist of multiple languages/ranges for those who can speak multiple languages. But then what's the solution for someone who speaks both Russian and English?
- nodata 15y agoDoes Russian contain/mix English characters within words?
- neilk 15y agoThat's a clever idea, but I don't know how one would determine what "unexpected" is an increasingly international world.
- adobriyan 15y agoCode point has script property and mixing it inside strings which aren't likely to contain multiscript code points (like filenames) is a sign of trouble.
- cbr 15y agoThen I could spell "hosts" entirely with cyrillic characters. (I'm not sure if it's possible with the word "hosts", but there's probably some word.)
- adobriyan 15y agoMaybe you could. Anyway you could do it right now as well. I doubt there is an acceptable non-heuristic solution.
- xentronium 15y ago
- adr_ 15y agoI've had a Fасевоок Offіcіal account lying around for a year or so.
- deleted 15y ago[deleted]
- noahc 15y agoSomewhat related to this is the ability to change 'l" and "I" around when they both look the same, basically a straight line. This was very common in Yahoo Chat Rooms when folks would pretend to be someone else by registering their name with the opposite of what they had (assuming it had an "i" or "l" in it). They would then take a screen shot of their font and copy that exactly so they could appear to be the other person. I'll let you imagine the chaos that could occur because of this!
- Timothee 15y agoSomebody got me with that exact trick during the Charlie Sheen debacle: I was going back and forth between the Twitter page for @CharlieSheen and @CharIieSheen and couldn't figure out how this was possible… I didn't feel exactly smart when I realized what was going on. edit: on a related note, I half-jokingly tend to read RockMelt as rock-me-it…
- carussell 15y agoI've seen an unblinking use of "RockMeIt" before. I'm fairly sure it was here on HN.
- pavel_lishin 15y agoI have a friend whose last name is McIntire, and his handle everywhere was xmcintire. I used to have a lot of fun changing my username to xrncintire - exploiting keming to impersonate him on any non-fixed-width-font system. (name changed to protect him, he was pretty peeved that I did this - though I think he registered a few places as pavellishir to exploit the r/n similarity, too :P)
- shabble 15y agoThe original site doesn't seem to be there any more, but here's a (horribly mangled) version from the Wayback machine: http://web.archive.org/web/20080922234800/http://www.rnicrosoft.com/ http://web.archive.org/web/20080922234800/http://www.rnicros...
- ams6110 15y agoIsn't the real issue that in order to be vulnerable to this, you have to be running as a user who has permission to diddle with the hosts file? Or that your hosts file has too-liberal write permissions? Hosts file attacks are well-known enough that on windows I always set them to read-only, so that even administrators can't change them without first clearing the read-only flag.
- lallysingh 15y agoCheck out the second example, where you can have a .exe file show up as a .jpg, which is much, much nastier.
- andresmh 15y agothis reminds me of IDN domains, a few weeks ago I purchased fácebook.com and góogle.com. I get a few hundred visits every day. I posted about it here https://plus.google.com/110362380602139255131/posts/NPS3VNyDxuJ https://plus.google.com/110362380602139255131/posts/NPS3VNyD...
- pavel_lishin 15y agoI wonder how/why people end up typing á in that URL - on my machine, it takes extra effort (OPTION-e a) to enter that.
- sesqu 15y agoOn my keyboard, it's '-a, with ' in a place that's easy to hit accidentally, and since it's combining, it doesn't print. I suspect some layouts might have OPTION-a, which would be almost as easy a mistake to make.
- njharman 15y agonon-english keyboards links
- andresmh 15y agoYes. I think this is part of it. Here are the logs from a few weeks ago: http://j.mp/pBqfbx http://j.mp/pBqfbx I'd be curious if anyone can figure out why so many visitors are using a browser called Netfront (apparently from Samsung mobiles).
- mcantor 15y agoIt's funny to think that a hapless vimmer who happens to be running Windows would have never noticed this, because they would simply have typed ":edit $SYSTEMROOT\system32\drivers\etc\hosts" and gotten the real file. (This isn't a "look how cool command line junkies are" comment; I was just musing.)
- delinka 15y agoWith the exe as jpg example, it'd be even more misleading if the exe used a photo for an icon, launched the photo viewer app for a matching jpg photo, and launched an insidious process in the background. Even harder to detect from whence the malware came.
- sarenji 15y agoThis is an important issue in some chat programs. I had to deal with this all the time: malicious users using i vs. l to pose as others, and using unicode to mess up or reverse the entire chat. One of the more interesting unicode had characters going left, right, and up and down. This confused moderators about who to kick/ban and obscured other users' text. The solution was to implement a regex of whitelisted characters; since it's an English-only program, this works well and is future-safe. For multiple languages, a blacklist is probably okay, but the difficulty lies in keeping the blacklist both complete and up to date.
- derleth 15y ago> malicious users using i vs. l to pose as others It seems like it would be easy to implement a blacklist that automatically updates based on the current crop of registered names such that filters are applied to each registered name to generate a number of lookalike names which are all unavailable for use. This should allow any good-faith user to register any name they want without causing confusion.
- byrneseyeview 15y agoThis was how some folks pretended that Google had erased all mentions of "Oracle": http://giorgiosironi.blogspot.com/2010/08/google-never-removed-oracle-from-its.html http://giorgiosironi.blogspot.com/2010/08/google-never-remov... I used this to prank some people on the in-house SEO team at my last job. I'd ask them if they had done anything that might be considered black-hat. Then I sent him a link to a "site:" query on Google indicating that our site had been removed from the index. e.g. http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=site%3An%D0%B5ws.ycombinator.com http://www.google.com/search?sourceid=chrome&ie=UTF-8...
- tomp 15y agoWow, clicking your link (the google search for site:news.ycombinator.com) sure was scary, but since I kinda knew what it was about, I didn't freak out, and simply changed the encoding of the website to some ASCII code page, revealing the illusion. HOWEVER, what I find extremely worrying, is that the URL in the URL bar remained the same all the time, with the embedded query string site%3Anеws.ycombinator.com, and IT DIDN'T CHANGE TO ASCII when I changed the encoding of the web page. Haven't they/we learned yet, that this is a very serious security issue?
- sesqu 15y agoThey've gone back and forth on this. It is a serious security issue, but for people who regularly use non-ascii characters, it's a usability issue. A blacklist might be a usable compromise, but I bet it would feel terribly confusing - in part because of font variability.
- recoiledsnake 15y agoEven better: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=site%3An%D0%B5ws.ycombinator.com#hl=en&sa=X&ei=oDhETqW2BKL50gHbyJX2CQ&sqi=2&ved=0CBcQvgUoAA&q=n%D0%B5ws.ycombinator.com&nfpr=1&bav=on.2,or.r_gc.r_pw.r_cp.&fp=b57b638593c212fa&biw=1920&bih=968 http://www.google.com/search?sourceid=chrome&ie=UTF-8...
- 15y ago
- driverdan 15y agoI personally find the RLO / LRO issue much more concerning. I just tested Chrome and Firefox and found it works in URLs. You could rewrite pyapla.com to paypal.com and phish people easily.
- deleted 15y ago[deleted]
- driverdan 15y agoI've done a bit more testing and found that while it can be used in URLs it's problematic. When pasted in the navigation bar it causes errors in both Chrome and Firefox. There's probably a way to exploit this and make it work but I don't have time to dig into it right now.
- lucianof 15y agoAbsolutely! I wouldn't call myself as "unwary", but I would totally click a file with .jpg extension! (the article says 'Unwary people treat this file as a picture'). EXE is especially dangerous because you can make "SEXe.jpg". Who wouldn't click that? But I guess from now on I look at the chars to the left of the dot as well..
- HankMcCoy 15y ago0x43E (о) is the stuff of nightmares facebооk.com is still available ;)
- arvinjoar 15y agoSeems like there's a hidden benefit to always keeping a tab with the hosts file open in notepad++. I use the hosts file from time to time, and I just leave the tab open, never thought it could help me out security-wise though.
- gwern 15y agoI remember years back on Wikipedia, clever vandals would play Unicode tricks. It was interesting, to say the least - you'd register a name that looks identical to a real user, vandalize, and hope the administrator would type the name in... This was ultimately stopped by Antispoof (https://secure.wikimedia.org/wikipedia/mediawiki/wiki/Extension:AntiSpoof https://secure.wikimedia.org/wikipedia/mediawiki/wiki/Extens...) but the bug reports are still interesting: - https://bugzilla.wikimedia.org/show_bug.cgi?id=2593 https://bugzilla.wikimedia.org/show_bug.cgi?id=2593 - https://bugzilla.wikimedia.org/show_bug.cgi?id=2290 https://bugzilla.wikimedia.org/show_bug.cgi?id=2290
- carussell 15y agoAlthough it's not vandalism, something else that permeated Wikipedia is the use of the Cyrillic ya (Я) in places of R, where the stylized artwork for the article subject reverses the R (and varies it in many other ways, for sure). The difference between the two is that this phenomenon is not wholly in the past. One of the biggest thorns of the situation is when editors bring up an official or semi-offical website related to the subject and using Я, pointing to its existence as "proof". No, that isn't proof; whoever is managing that area of the web properties is just a jackass.
- eavc 15y agoCan you point to a few examples?
- carussell 15y agohttp://en.wikipedia.org/wiki/Toys_%22R%22_Us http://en.wikipedia.org/wiki/Toys_%22R%22_Us http://en.wikipedia.org/wiki/Korn http://en.wikipedia.org/wiki/Korn Thankfully, Cyrillic as a poor approximation of the artwork doesn't always win out http://en.wikipedia.org/wiki/Talk:Superunknown#Track_name_.22Superunknown.22 http://en.wikipedia.org/wiki/Talk:Superunknown#Track_name_.2... And hey! It looks like discussion that I wasn't even aware of spawned on the Toys R Us talk page about it.
- fferen 15y agoA while ago I compiled a list of unicode characters that looked like letters, to get past curse filters. Not comprehensive, because I just manually skimmed through a unicode table, but here it is if anyone cares: Wide letters: Ａ Ｂ Ｃ Ｄ Ｅ Ｆ Ｇ Ｈ Ｉ Ｊ Ｋ Ｌ Ｍ Ｎ Ｏ Ｐ Ｑ Ｒ Ｓ Ｔ Ｕ Ｖ Ｗ Ｘ Ｙ Ｚ ａ ｂ ｃ ｄ ｅ ｆ ｇ ｈ ｉ ｊ ｋ ｌ ｍ ｎ ｏ ｐ ｑ ｒ ｓ ｔ ｕ ｖ ｗ ｘ ｙ ｚ Better looking letters: ϲ р с Ѕ І А В Е М Н О Р С а е о ѕ і ԛ Anyone know of a better resource?
- losethos 15y agoLoseThos doesn't use Unicode, it uses PC Screen Codes. ALT-2-2-7 will place a pi character into source code with the editor. It will appear with the pi symbol. The compiler understands.