{"id":47617,"date":"2021-11-01T12:27:39","date_gmt":"2021-11-01T16:27:39","guid":{"rendered":"http:\/\/pappp.net\/?guid=0d9bd3f9a765cc8280c2b922ae97177a"},"modified":"2021-11-12T14:36:04","modified_gmt":"2021-11-12T19:36:04","slug":"hiding-vulnerabilities-in-source-code","status":"publish","type":"post","link":"https:\/\/pappp.net\/?p=47617","title":{"rendered":"Hiding Vulnerabilities in Source Code"},"content":{"rendered":"<p class=\"syndicated-attribution\">Source: <a href=\"https:\/\/www.schneier.com\/blog\/archives\/2021\/11\/hiding-vulnerabilities-in-source-code.html\">Schneier on Security<\/a><\/p>\n<div style=\"background-color : #fff7d5;\n\t\t\tborder-width : 1px; padding : 5px; border-style : dashed; border-color : #e7d796;margin-bottom : 1em; color : #9a8c59;\">Article note: Complexity always has costs. \nUnicode is absurdly complex to allow it to not just represent goddamn everything, but to mix all those things together, and we pay for that shit everywhere it appears.\nMy usual preference is \"make parsers vigorously flag and\/or refuse to allow mixed pages.\"<\/div><p>Really interesting <a href=\"https:\/\/trojansource.codes\/trojan-source.pdf\" rel=\"noopener noreferrer\">research<\/a> demonstrating how to hide vulnerabilities in source code by manipulating how Unicode text is displayed. It&rsquo;s really clever, and not the sort of attack one would normally think about.<\/p>\n<p>From Ross Anderson&rsquo;s <a href=\"https:\/\/www.lightbluetouchpaper.org\/2021\/11\/01\/trojan-source-invisible-vulnerabilities\/\" rel=\"noopener noreferrer\">blog<\/a>:<\/p>\n<blockquote><p>We have discovered ways of manipulating the encoding of source code files so that human viewers and compilers see different logic. One particularly pernicious method uses Unicode directionality override characters to display code as an anagram of its true logic. We&rsquo;ve verified that this attack works against C, C++, C#, JavaScript, Java, Rust, Go, and Python, and suspect that it will work against most other modern languages.<\/p>\n<p>This potentially devastating attack is tracked as CVE-2021-42574, while a related attack that uses homoglyphs &ndash;- visually similar characters &ndash;- is tracked as CVE-2021-42694. This work has been under embargo for a 99-day period, giving time for a major coordinated disclosure effort in which many compilers, interpreters, code editors, and repositories have implemented defenses.<\/p><\/blockquote>\n<p><a href=\"https:\/\/trojansource.codes\/\" rel=\"noopener noreferrer\">Website<\/a> for the attack. Rust <a href=\"https:\/\/blog.rust-lang.org\/2021\/11\/01\/cve-2021-42574.html\" rel=\"noopener noreferrer\">security advisory<\/a>.<\/p>\n<p>Brian Krebs has a <a href=\"https:\/\/krebsonsecurity.com\/2021\/11\/trojan-source-bug-threatens-the-security-of-all-code\/\" rel=\"noopener noreferrer\">blog post<\/a>.<\/p>\n<p>EDITED TO ADD (11\/12): An <a href=\"https:\/\/www.ssi.gouv.fr\/agence\/publication\/mind-your-languages-nouvel-article-sur-limportance-des-langages-pour-la-securite\/\" rel=\"noopener noreferrer\">older paper<\/a> on similar issues.<\/p>","protected":false},"excerpt":{"rendered":"<p>Really interesting research demonstrating how to hide vulnerabilities in source code by manipulat&#8230;<\/p>\n<p> <a href=\"https:\/\/pappp.net\/?p=47617\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[226],"tags":[],"class_list":["post-47617","post","type-post","status-publish","format-standard","hentry","category-news-2"],"_links":{"self":[{"href":"https:\/\/pappp.net\/index.php?rest_route=\/wp\/v2\/posts\/47617","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pappp.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pappp.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pappp.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pappp.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=47617"}],"version-history":[{"count":0,"href":"https:\/\/pappp.net\/index.php?rest_route=\/wp\/v2\/posts\/47617\/revisions"}],"wp:attachment":[{"href":"https:\/\/pappp.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=47617"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pappp.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=47617"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pappp.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=47617"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}