5 ms·

This was how some folks pretended that Google had erased all mentions of "Oracle": http://giorgiosironi.blogspot.com/2010/08/google-never-removed-oracle-from-i

This was how some folks pretended that Google had erased all mentions of "Oracle": http://giorgiosironi.blogspot.com/2010/08/google-never-removed-oracle-from-its.html http://giorgiosironi.blogspot.com/2010/08/google-never-remov... I used this to prank some people on the in-house SEO team at my last job. I'd ask them if they had done anything that might be considered black-hat. Then I sent him a link to a "site:" query on Google indicating that our site had been removed from the index. e.g. http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=site%3An%D0%B5ws.ycombinator.com http://www.google.com/search?sourceid=chrome&ie=UTF-8&#3...

tomp 15y ago
Wow, clicking your link (the google search for site:news.ycombinator.com) sure was scary, but since I kinda knew what it was about, I didn't freak out, and simply changed the encoding of the website to some ASCII code page, revealing the illusion. HOWEVER, what I find extremely worrying, is that the URL in the URL bar remained the same all the time, with the embedded query string site%3Anеws.ycombinator.com, and IT DIDN'T CHANGE TO ASCII when I changed the encoding of the web page. Haven't they/we learned yet, that this is a very serious security issue?
- sesqu 15y ago
  They've gone back and forth on this. It is a serious security issue, but for people who regularly use non-ascii characters, it's a usability issue. A blacklist might be a usable compromise, but I bet it would feel terribly confusing - in part because of font variability.
recoiledsnake 15y ago
Even better: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=site%3An%D0%B5ws.ycombinator.com#hl=en&sa=X&ei=oDhETqW2BKL50gHbyJX2CQ&sqi=2&ved=0CBcQvgUoAA&q=n%D0%B5ws.ycombinator.com&nfpr=1&bav=on.2,or.r_gc.r_pw.r_cp.&fp=b57b638593c212fa&biw=1920&bih=968 http://www.google.com/search?sourceid=chrome&ie=UTF-8&#3...
- jleader 15y ago
  That one at least triggers a "Did you mean...", which the site: version avoids (because Google doesn't try to spell-correct site names).
SiVal 15y ago
The wide variety of exploits such as these suggests that we need to integrate character spoofing into the general malware detection system on devices, which evolves over time (in the way that virus checkers evolve, with lots of human input) to deal with known or anticipated problems. I'm thinking of a system that combines aspects of virus checking, malware detection, bayesian spam filtering, and spell checking. A Unicode system can be supplied with tables of characters that could easily be mistaken (visually) for one another. These tables, combined with dictionaries, could spot words that could look like dictionary entries visually but are not spelled in the ordinary way. This approach could even spot things that have been problems for years in pure ASCII: confusion of 0 and O, of l and 1 and I, of rn and m, etc, It could also spot insertions of non-visible characters into such things as URLs and filenames. Such a system would be able to spot .exe files that had names written in such a way that the .exe extension was not visually displayed at the end of the name. If you double-clicked such a file the first time, it could ask you if you realized that it is program you are about to run and not a ".jpg" as the name might suggest. In fact, it could ask you about any file whose real extension and apparent visual extension differed. There will still be problems that will sneak through, just as today you can phish people with subtle misspellings that don't require anything more than ASCII. But making this a part of the system's evolving general malware detection system, with human-created tables and heuristics borrowed from malware detectors, spam filters, and spell checkers, is the best solution, IMO.
- nitrogen 15y ago
  I would augment the human-generated tables of confusable characters with something like OCR run on each font to detect similarly-shaped characters. The algorithm could provide a score indicating how similar any two characters are (or maybe how similar a given character is to all other characters, combined with statistical frequency of that character), which could be weighted and incorporated in a malware detection heuristic.
  - mtraven 15y ago
    Overdesign alert. How about the OS adopting the convention that any codes outside of a few trusted (expected) alphabets get displayed in a way that makes it obvious to a human that they aren't what they look like (eg, a bright red border or something).
deleted 15y ago
[deleted]

tomp 15y ago

Wow, clicking your link (the google search for site:news.ycombinator.com) sure was scary, but since I kinda knew what it was about, I didn't freak out, and simply changed the encoding of the website to some ASCII code page, revealing the illusion. HOWEVER, what I find extremely worrying, is that the URL in the URL bar remained the same all the time, with the embedded query string site%3Anеws.ycombinator.com, and IT DIDN'T CHANGE TO ASCII when I changed the encoding of the web page. Haven't they/we learned yet, that this is a very serious security issue?

sesqu 15y ago
They've gone back and forth on this. It is a serious security issue, but for people who regularly use non-ascii characters, it's a usability issue. A blacklist might be a usable compromise, but I bet it would feel terribly confusing - in part because of font variability.

recoiledsnake 15y ago

Even better: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=site%3An%D0%B5ws.ycombinator.com#hl=en&sa=X&ei=oDhETqW2BKL50gHbyJX2CQ&sqi=2&ved=0CBcQvgUoAA&q=n%D0%B5ws.ycombinator.com&nfpr=1&bav=on.2,or.r_gc.r_pw.r_cp.&fp=b57b638593c212fa&biw=1920&bih=968 http://www.google.com/search?sourceid=chrome&ie=UTF-8&#3...

jleader 15y ago
That one at least triggers a "Did you mean...", which the site: version avoids (because Google doesn't try to spell-correct site names).

SiVal 15y ago

The wide variety of exploits such as these suggests that we need to integrate character spoofing into the general malware detection system on devices, which evolves over time (in the way that virus checkers evolve, with lots of human input) to deal with known or anticipated problems. I'm thinking of a system that combines aspects of virus checking, malware detection, bayesian spam filtering, and spell checking. A Unicode system can be supplied with tables of characters that could easily be mistaken (visually) for one another. These tables, combined with dictionaries, could spot words that could look like dictionary entries visually but are not spelled in the ordinary way. This approach could even spot things that have been problems for years in pure ASCII: confusion of 0 and O, of l and 1 and I, of rn and m, etc, It could also spot insertions of non-visible characters into such things as URLs and filenames. Such a system would be able to spot .exe files that had names written in such a way that the .exe extension was not visually displayed at the end of the name. If you double-clicked such a file the first time, it could ask you if you realized that it is program you are about to run and not a ".jpg" as the name might suggest. In fact, it could ask you about any file whose real extension and apparent visual extension differed. There will still be problems that will sneak through, just as today you can phish people with subtle misspellings that don't require anything more than ASCII. But making this a part of the system's evolving general malware detection system, with human-created tables and heuristics borrowed from malware detectors, spam filters, and spell checkers, is the best solution, IMO.

nitrogen 15y ago
I would augment the human-generated tables of confusable characters with something like OCR run on each font to detect similarly-shaped characters. The algorithm could provide a score indicating how similar any two characters are (or maybe how similar a given character is to all other characters, combined with statistical frequency of that character), which could be weighted and incorporated in a malware detection heuristic.
- mtraven 15y ago
  Overdesign alert. How about the OS adopting the convention that any codes outside of a few trusted (expected) alphabets get displayed in a way that makes it obvious to a human that they aren't what they look like (eg, a bright red border or something).

deleted 15y ago

[deleted]