3 ms·
10 years or so ago I shocked coworkers with using U+202D LEFT-TO-RIGHT OVERRIDE mid in filenames on windows. So funnypicturegnp.exe became funnypictureexe.png C
by omnibrain 2y ago
10 years or so ago I shocked coworkers with using U+202D LEFT-TO-RIGHT OVERRIDE mid in filenames on windows. So funnypicturegnp.exe became funnypictureexe.png
Combined with a custom icon for the program that mimics a picture preview it was pretty convincing.
- hosteur 2y agoWow this is a clever trick.
- mdup 2y agoI worked in phishing detection. This was a common pattern used by attackers, although .exe are blocked automatically most of the time, .html is the new malicious extension (often hosting an obfuscated window.location redirect to a fake login page). RTL abuse like cute-cat-lmth.png was relatively common, but also trivial to detect. We would immediately flag such an email as phishing.
- taneq 2y agoI’d never heard of this particular trick but I’m glad my decades of paranoia-fueled “right click -> open with” treatment of any potentially sketchy media file was warranted! :D
- omoikane 2y agoThe source code version of that is CVE-2021-42574, and they have a website: https://trojansource.codes/ https://trojansource.codes/ Basically it's possible to hide some code that looks like comments but compiles like code. I seem to recall the CVE status was disputed since many text editors already make these suspicious comments visible.
- oefnak 2y agoI created a guitar_tab.txt which was a bat file.