Homoglyph Approachesīesides invisible characters one could also introduce backdoors using Unicode characters that look very similar to e.g. The script behaves as described at least with Node 14.
#Ivisible letter code#
At least Notepad++ and VS Code render it correctly (in VS Code the invisible character is slightly wider than ASCII characters). The attack requires the IDE/text editor (and the used font) to correctly render the invisible characters. This approach cannot be detected through syntax highlighting as invisible characters are not shown at all and therefore are not colorized by the IDE/text editor: For an attacker to execute arbitrary OS commands, they would have to pass a parameter named “ㅤ” (in it’s URL-encoded form) to the endpoint: Similarly, when the checkCommands array is constructed, this variable ㅤ is included into the array: const checkCommands = [Įach element in the array, the hardcoded commands as well as the user-supplied parameter, is then passed to the exec function. Contrary to what can be seen, the parameter timeout is not the sole parameter unpacked from the req.query attribute! An additional variable/HTTP parameter named “ㅤ” is retrieved – if a HTTP parameter named “ㅤ” is passed, it is assigned to the invisible variable ㅤ. Can you spot it? const express = require('express') Ĭonst exec = util.promisify(require('child_process').exec) Īpp.get('/network_health', async (req, res) => = req.query Ī destructuring assignment is used to deconstruct the HTTP parameters from req.query. Without further ado, here’s the backdoor. We have implemented a different take on what the paper titles “ Invisible Character Attacks” and “ Homoglyph Attacks“. Their approach, however, is quite different from ours – it focuses on the Unicode bidirectional mechanism (Bidi). Just as we were finishing up this blog post, a team at the University of Cambridge released a paper describing such an attack.
This post inspired an idea: What if a backdoor literally cannot be seen and thus evades detection even from thorough code reviews? A few months ago we saw a post on the r/programminghorror subreddit: A developer describes the struggle of identifying a syntax error resulting from an invisible Unicode character hidden in JavaScript source code.
0 kommentar(er)
