Date: Mon, 1 Nov 2021 17:51:08 -0400 From: Santiago Torres <torresariass@...il.com> To: oss-security@...ts.openwall.com Subject: Re: Trojan Source Attacks On Mon, Nov 01, 2021 at 09:51:38PM +0100, Jan Engelhardt wrote: > > On Monday 2021-11-01 18:27, Nicholas Boucher wrote: > > > >We have identified an issue affecting all compilers and interpreters that support Unicode. > >[...] > >The attached paper describes an attack paradigm -- which we believe to be novel -- discovered by security researchers at the > >University of Cambridge. > > Not so novel. At one time, this picture made the rounds > (https://twitter.com/acronis/status/1019152990022787072 - the pic is likely > older than this 2018 tweet), and anyone who knew that Unicode had zero-width > characters already made the connection. Along the same lines, there were a myriad of attacks using bash-style sequences to obscure parts of patches inside of git show/git log/less/ other pagers not too long ago (circa 2017, maybe?). We even discussed similar possibilities on this paper (sec 4.3) when mentioning git commit signing of content displayed on collaborative coding platforms. Overall there's a plethora of work around "punycode meets tool X" that I'm surprised this is called novel. Cheers! -Santiago  https://ssl.engineering.nyu.edu/papers/afzali_asiaccs_2018.pdf Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.