What applications are at risk from “Backwards Unicode Names” and what are the mitigations?

Question

There is a vulnerability where some applications (such as explorer.exe) respond to Unicode characters that change the direction of the text (right-to-left vs left-to-right). This may be used to mask an EXE file into one that looks like a text document.

More information on this topic...

What applications are vulnerable to this threat, and what are the mitigations/countermeasures?

Update

For example:

• Mitigate Windows Explorer with AntiVirus product XXX
• Filter email attachments using YYY
• Limit Mac exposure with product iZ

My personal experience suggests that most products need updating or configuration to prevent end users from being taken advantage of.

Perhaps calling 'Backwards Unicode names' a vulnerability is incorrect of me. However I consider any application that does not provide the controls to mitigate hostile use a vulnerability. Perhaps this security is regulated to a class of products such as email filters or AV products.

My intent is to identity the products needed to prevent this from being exploited and maintain the reasonable and appropriate use of B.U.N.'s.

Answer 1

The root of the problem is that the OS will interpret a file as an executable but does not display that fact. Right now, the user must look at the file name, and think something like "mmh, this ends with '.exe', so Windows will try to execute that file". The Windows in question is right there ! So this is a case of a user trying to outguess his own computer, and failing at that. This is not limited to Unicode: very few users are aware that '.pif', '.com', '.scr'... also trigger execution.

The "clean" way would be to make the application display the name with an explicit, unambiguous visual indication of what will happen if the user decides to "open" the file; however, a recent enough Windows system will already do that (it will warn you that the file is from the Internet at large) and most users will simply click on the "do as I say, stupid!" button -- and not even remember that such a warning even appeared.

In shorter words, Unicode is not really a vulnerability here: it is just a feature which can be used, among many other features, to make a file type somewhat hidden. But the real security problem is not there; it is in users insisting on running untrustworthy executable files. Efficient countermeasures often involve filtering data upstream, so that the user never sees offending files at all. Many mail servers automatically remove executable files from emails (but users -- and virus makers -- soon learn workarounds such as storing executable files in encrypted Zip archives).

Answer 2

Doubt if we can classify this as a vulnerability. This is a case when support of legitimate feature fails to provide protection of usability in proper form. There are some languages where text direction is from right to left. Unicode consortium had sincere intentions to make support of such languages. By the way, topic itself is not new. About Unicode exploitation there were released two papers by Chris Weber:

• Exploiting Unicode-enabled Software
• Visual Spoofing Attacks and Defenses

I would say that you should point attention to any modern desktop application that supports Unicode - there is a high possibility that it is subjected to such attacks. Going further, want to admit that incorrect or bogus implementation of Unicode can lead to any type of bug starting from visual spoofing till buffer overflows.

Unicode advises following document to be read: http://www.unicode.org/reports/tr36/tr36-9.html.