4 ms·
As I previously noted on a related post: Interesting paper. Note, however, that the general problem is already known and there are a number of pre-existing wor
by dwheeler 5y ago
As I previously noted on a related post:
Interesting paper. Note, however, that the general problem is already known and there are a number of pre-existing works that discuss it. This is typically called "underhanded code" or sometimes "maliciously misleading code". I'm surprised that they didn't use the normal term for the problem nor cite the previous work on it - maybe they didn't realize this was a widely-known problem? Previous works on underhanded code didn't discuss Bidi to my knowledge (though other attacks on text like this have exploited Bidi).
Here are a number of other materials about underhanded code:
The Obfuscated V Contest (http://graphics.stanford.edu/~danielh/vote/vote.html http://graphics.stanford.edu/~danielh/vote/vote.html) was created by Daniel Horn in 2004 and is the earliest “underhanded” programming contest that I found. It was a contest to create source code that looked like it did one thing, but actually did another.
Underhanded C Contest (http://www.underhanded-c.org/ http://www.underhanded-c.org/) has run in many years. Per its FAQ, "The Underhanded C Contest is an annual contest to write innocent-looking C code implementing malicious behavior."
My PhD dissertation "Fully Countering Trusting Trust through Diverse Double-Compiling" discusses how to counter the "trusting trust" problem & includes a section about maliciously misleading source code. See: https://dwheeler.com/trusting-trust/ https://dwheeler.com/trusting-trust/
The JavaScript Misdirection Contest announced the winner on September 27, 2015 http://misdirect.ion.land/ http://misdirect.ion.land/
My paper "Initial Analysis of Underhanded Source Code", (by David A. Wheeler, April, 2020, IDA document: D-13166), discusses underhanded code and the effectiveness of several potential countermeasures. It also includes a number of citations to other works on underhanded code.
https://www.ida.org/research-and-publications/publications/all/i/in/initial-analysis-of-underhanded-source-code https://www.ida.org/research-and-publications/publications/a...
- kfichter 5y agoFirst place winner of last year's underhanded Solidity contest used exactly this trick: https://blog.soliditylang.org/2020/12/03/solidity-underhanded-contest-winners/ https://blog.soliditylang.org/2020/12/03/solidity-underhande...
- axic 5y agoThere was related issue in 2018 regarding line endings, which would allow disguised some lines as code, but keeping them as comments: https://docs.google.com/document/d/1PZBSCBWBwd6AqWCgXqLnw8FNQ4HRurP5usrXuKuU0a0/edit#heading=h.y1dslkvhlt7h https://docs.google.com/document/d/1PZBSCBWBwd6AqWCgXqLnw8FN... Both of these were fixed in Solidity shortly after the bug reports. (P.S. I'm a member of the Solidity team)
- kfichter 5y agoThis is a great treasure trove of deep Solidity trivia. Thanks for the link!
- taviso 5y agoIt's also worth noting that if you're caught playing games like this, there is really no way to explain your actions that would avoid serious consequences. If however, you used the "bugdoor" method, you can plausibly deny any malicious intent and you will absolutely get away with it.
- Too 5y agoOldest trick in the book: /* Legitimate comment. <a lot of white space to go off screen> */ #define malicious code Nobody will notice the horizontal scroll bar.