oss-security - Re: Trojan Source Attacks

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211102232554.GA3040970@millbarge>
Date: Tue, 2 Nov 2021 23:25:54 +0000
From: Seth Arnold <seth.arnold@...onical.com>
To: Stuart D Gathman <stuart@...hman.org>
Cc: oss-security@...ts.openwall.com
Subject: Re: Trojan Source Attacks

On Tue, Nov 02, 2021 at 04:43:48PM -0400, Stuart D Gathman wrote:
> Having some sample source files to test your code editor/viewer on would be
> helpful.

There's examples on https://github.com/nickboucher/trojan-source

GitHub was kind enough to include a banner like this on many of the files:

     This file contains bidirectional Unicode text that may be interpreted
     or compiled differently than what appears below. To review, open
     the file in an editor that reveals hidden Unicode characters. Learn
     more about bidirectional Unicode characters

eg: https://github.com/nickboucher/trojan-source/blob/main/Go/stretched-string.go

But not all of them:

https://github.com/nickboucher/trojan-source/blob/main/Go/homoglyph-function.go
Looks completely normal to me, but mouse hovering over the sayHello
function names shows the difference.

https://github.com/nickboucher/trojan-source/blob/main/Rust/invisible-function.rs
The isAdmin function name is rendered three different ways, but it's
pretty subtle, and the colouring gives no indication which of the two
definitions is actually going to be used (though I've got a guess).

There's otherwise no warnings today from GitHub that these two are out
of the ordinary.

Thanks

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.