oss-sec mailing list archives
Re: Trojan Source Attacks
From: Siddhesh Poyarekar <siddhesh.poyarekar () gmail com>
Date: Tue, 2 Nov 2021 07:53:45 +0530
On Tue, 2 Nov 2021 at 05:21, Perry E. Metzger <perry () piermont com> wrote:
On 11/1/21 16:51, Jan Engelhardt wrote:We have identified an issue affecting all compilers and interpreters that support Unicode. [...] The attached paper describes an attack paradigm -- which we believe to be novel -- discovered by security researchers at the University of Cambridge.Not so novel. At one time, this picture made the rounds (https://twitter.com/acronis/status/1019152990022787072 - the pic is likely older than this 2018 tweet), and anyone who knew that Unicode had zero-width characters already made the connection.If it was known to everyone, then why are so many language interpreters and compilers impacted? Surely if this was truly something that was well
That's because unicode rendering is a UI element and calling compilers "impacted" is misunderstanding the issue. There's scope for adding new diagnostics to square with UI representation of unicode, but that's at best an optional warning and it may not even be feasible in all cases. A comprehensive language aware CI lint check is perhaps more suitable but if such a check devolves into "7-bit ascii only allowed" for all cases then we've regressed. Also, this is not just about compilers, the idea of such obfuscation is central to any content that a human and a computer program are required to see consistently. A rootkit could obfuscate configuration files in a way that's invisible to a human and evades visual or basic syntax based audit, or example configuration files of daemon programs could be similarly compromised at source, resulting in the compromised files landing on various systems. Likewise for build configuration, makefiles, etc. Siddhesh
Current thread:
- Trojan Source Attacks Nicholas Boucher (Nov 01)
- Re: Trojan Source Attacks Jan Engelhardt (Nov 01)
- Re: Trojan Source Attacks Perry E. Metzger (Nov 01)
- Re: Trojan Source Attacks Jan Engelhardt (Nov 01)
- Re: Trojan Source Attacks Siddhesh Poyarekar (Nov 01)
- Re: Trojan Source Attacks Stuart D Gathman (Nov 02)
- Re: Trojan Source Attacks Seth Arnold (Nov 02)
- Re: Trojan Source Attacks Perry E. Metzger (Nov 01)
- Re: Trojan Source Attacks Jan Engelhardt (Nov 01)
- Re: Trojan Source Attacks Santiago Torres (Nov 01)
- Re: Trojan Source Attacks Josh Bressers (Nov 02)
- Re: Trojan Source Attacks David A. Wheeler (Nov 02)
- Re: Trojan Source Attacks Michael Orlitzky (Nov 02)
- Re: Trojan Source Attacks Leonid Isaev (ifax) (Nov 04)