Invisible Malicious Unicode Risks

Kicksecure ™

Download

On Computer USB Installation Debian morph to Kicksecure Windows (VM) Linux (VM) Mac (VM) VirtualBox (VM) KVM (VM) Qubes (VM) More options Source Code

About

Overview Features Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

This wiki page explains the security risk of invisible characters in Unicode that can be copied and pasted into terminal emulators or introduced as vulnerabilities/backdoors in source code contributions, along with documentation that can help to check files and folders for malicious Unicode.

OOPS! They tricked me to install MALWARE! Clipboard Hidden Text Attacks explained

Unicode as a Security Risk

There are invisible characters that might be copied that can do malicious actions. This is a security risk for:

• A) For users: Commands copied and pasted into a terminal emulator.
• B) For developers: Introduction of invisible vulnerabilities or backdoors through source code contributions.

These adversarial encodings produce no visual artifacts probably in most editors and terminals.

Original attack research: https://trojansource.codes/

Forum discussion: https://forums.whonix.org/t/detecting-malicious-unicode-in-source-code-and-pull-requests/13754

Checking Files for Unicode

NOTE: Not all unicode in files is necessarily malicious. Only some unicode characters in some files is suspicious or potentially malicious.

grep-find-unicode-wrapper can help to check files for unicode.

Syntax for files:

grep-find-unicode-wrapper /path/to/filename

Example for files:

Note: The following example check file ~/.bashrc. Replace ~/.bashrc with the actual file to check.

grep-find-unicode-wrapper ~/.bashrc

Syntax for folders:

grep-find-unicode-wrapper -r /path/to/folder

Example for folders:

Note: The following example check the user's home folder. Replace ~/ with a different folder if another folder should be checked.

grep-find-unicode-wrapper -r ~/

Expected output:

• A) If no unicode has been found: None.
• B) If unicode has been found: All lines that include unicode.

Resources

gcc protects from this https://www.phoronix.com/news/GCC-LLVM-Trojan-Source but other compilers and script interpreters don't even have bug reports.

See Also

• IDN Homograph Attacks
• Hidden Text Attacks

Footnotes

Kicksecure A secure by default operating system with the latest security research in place.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Kicksecure is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Kicksecure we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2024 ENCRYPTED SUPPORT LP

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!