full-disclosure - Re: UTF reverse-writing WYSINWG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <9438978.53381188249495391.JavaMail.juha-matti.laurio@netti.fi>
Date: Tue, 28 Aug 2007 00:18:15 +0300 (EEST)
From: Juha-Matti Laurio <juha-matti.laurio@...ti.fi>
To: Full-Disclosure@...ts.grok.org.uk, Tonu Samuel <tonu@....ee>
Subject: Re: UTF reverse-writing WYSINWG

This works on Mac using TextEdit 1.4 too, but the browser name issue you reported doesn't work (FF 2.0.0.6).

- Juha-Matti

Tonu Samuel <tonu@....ee> wrote: 
> Hi!
> 
> Reading today http://www.digg.com/offbeat_news/WTF_is_this_Character
> rang bells in my head. There is a nice utf character which just confuses
> software and all display goes instead left-to-right into right-to-left.
> It is difficult to exaplain but go and read original. 
> 
> But by concerns are related to security. For example even looking title
> of this digg.com page with Firefox or Konqueror and you see that browser
> name is reversed! I looked into source code with Firefox and lot of
> things are reversed too!
> 
> I was thinking about possible (ab)uses of this "feature". Let say, I
> want to write some rude words into some portal but they regexp it out.
> Now I have way to do it. 
> 
> http://www.epl.ee/?artikkel=317582&kommentaarid=0 is random example.
> "sitt" is bit rude word and they do not allow to use it inside
> comments.  
> 
> Another example is Delfi. This is locally huge portal and they colour
> word "delfi" in comments into their trademark colours:
> 
> http://www.delfi.ee/archive/article.php?id=16722806&ndate=1187643600&categoryID=120&com=1&s=1&no=180
> 
> Why it is in this list? I think this is serious security issue when you
> have to audit source code of bank and you read 
> 
> if ( sum == 123 ) 
> 
> but actually machine understands it as 
> 
> if ( sum == 321 )
> 
> I am sure people in this list can come up with more ideas. Just wanted
> to warn about such "feature".
> 
>    Tõnu
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/