oss-sec mailing list archives
Re: Trojan Source Attacks
From: "Perry E. Metzger" <perry () piermont com>
Date: Mon, 1 Nov 2021 19:50:36 -0400
On 11/1/21 16:51, Jan Engelhardt wrote:
We have identified an issue affecting all compilers and interpreters that support Unicode. [...] The attached paper describes an attack paradigm -- which we believe to be novel -- discovered by security researchers at the University of Cambridge.Not so novel. At one time, this picture made the rounds (https://twitter.com/acronis/status/1019152990022787072 - the pic is likely older than this 2018 tweet), and anyone who knew that Unicode had zero-width characters already made the connection.
If it was known to everyone, then why are so many language interpreters and compilers impacted? Surely if this was truly something that was well understood by the community, then it wouldn't be a problem. (Claims that people who write compilers are fools will be cheerfully ignored.)
There's a phenomenon in many social groupings of there being "folklore" that people don't seem to find worth writing down because "everyone" knows it, except then it turns out that most people don't actually know it, and people get hurt because that which "everyone" knows isn't actually something everyone knows. "Why should we have put the safety stop on the cutting machine? Everyone is aware of the needed precautions when using it."
In my opinion, if someone writes down the "obvious" thing that most people don't know and makes sure everyone is _actually_ warned about it, they get full credit, because the previous "discoverers" didn't bother to tell people in such a way that most people who might come to harm would be protected.
Perry
Current thread:
- Trojan Source Attacks Nicholas Boucher (Nov 01)
- Re: Trojan Source Attacks Jan Engelhardt (Nov 01)
- Re: Trojan Source Attacks Perry E. Metzger (Nov 01)
- Re: Trojan Source Attacks Jan Engelhardt (Nov 01)
- Re: Trojan Source Attacks Siddhesh Poyarekar (Nov 01)
- Re: Trojan Source Attacks Stuart D Gathman (Nov 02)
- Re: Trojan Source Attacks Seth Arnold (Nov 02)
- Re: Trojan Source Attacks Perry E. Metzger (Nov 01)
- Re: Trojan Source Attacks Jan Engelhardt (Nov 01)
- Re: Trojan Source Attacks Santiago Torres (Nov 01)
- Re: Trojan Source Attacks Josh Bressers (Nov 02)
- Re: Trojan Source Attacks David A. Wheeler (Nov 02)
- Re: Trojan Source Attacks Michael Orlitzky (Nov 02)