4 ms·
Some notes: - The syntax highlighting gets it every time. Seeing last word of the comment or half of the function name in different color is pretty clear indic
by theamk 5y ago
Some notes:
- The syntax highlighting gets it every time. Seeing last word of the comment or half of the function name in different color is pretty clear indicator of shenanigans.
- emacs respects the bidi controls (and thus is vulnerable), vi does not and shows thing as"
if access_level != 'none<202e>':
but homoglyph attack gets them both... unless you set LANG=C.
- "git log" gets them all
+if access_level != 'none<U+202E><U+2066>': # Check if admin <U+2069><U+2066>' and access_level != 'user
- Some linters flag the techniques used. I guess one can also add lint disable comments, but that makes attack more complex and makes code stand out more.
Python/early-return.py:6:4: W0101: Unreachable code (unreachable)
Python/homoglyph-function.py:3:0: C0103: Function name "sayHello" doesn't conform to snake_case naming style (invalid-name)
(the last one is especially powerful.. pylint by default checks all function names against strict regex'es which outright reject all the fancy names http://pylint-messages.wikidot.com/messages:c0103 http://pylint-messages.wikidot.com/messages:c0103 )
- "less" also shows all the non-printable characters, unicode included. This comes handy when looking at unknown binary files, but apparently it helps with text files, too!
- l0b0 5y agoYeah, my first thought was that the plethora of tools the code has to go through — version control, whichever tools are used for code review, linters, formatters and tests — means the odds of getting anything like this into a big code base must be pretty low. Maybe if someone manages to combine this with impersonating a highly trusted person and that person doesn't find out soon enough. Or of course if there's no QA process in place at all, which is definitely the case at a lot of big companies.
- jwilk 5y ago> "less" also shows all the non-printable characters Only if you pass -U.
- theamk 5y agoNo. What "-U" does is (quoting manpage): "Causes backspaces, tabs and carriage returns to be treated as control characters;" So even without -U, all non-printable characters except BS, CR, TAB will be shown in hexadecimal notation. The BS (backspace) will be used to defined underlining in the typewriter-style -- it is technically hidden character, but since most web-based apps do not support this, that will not make an efficient attack. (the homoglyphs are harder... in default mode, "less" defines printable as "32-126"; in "utf-8" mode it uses unicode character database. And mode depends on system-wide locale, and often is utf-8 in modern systems, so you want "LANG= less file.py" to see homoglyphs.. on the other hand, that homoglyph attack will be detected by pretty much any linter)
- jwilk 5y agoWhat the man page says about the -U option is either super confusing or outright wrong. You do need -U to make bidi formatting characters visible: $ less --version | head -n1 less 551 (GNU regular expressions) $ locale charmap UTF-8 $ printf 'a\342\200\216b\n' | less -F ab $ printf 'a\342\200\216b\n' | less -U -F a<U+200E>b