There is a vulnerability where some applications (such as explorer.exe) respond to Unicode characters that change the direction of the text (right-to-left vs left-to-right). This may be used to mask an EXE file into one that looks like a text document.

More information on this topic...

What applications are vulnerable to this threat, and what are the mitigations/countermeasures?


For example:

  • Mitigate Windows Explorer with AntiVirus product XXX
  • Filter email attachments using YYY
  • Limit Mac exposure with product iZ

My personal experience suggests that most products need updating or configuration to prevent end users from being taken advantage of.

Perhaps calling 'Backwards Unicode names' a vulnerability is incorrect of me. However I consider any application that does not provide the controls to mitigate hostile use a vulnerability. Perhaps this security is regulated to a class of products such as email filters or AV products.

My intent is to identity the products needed to prevent this from being exploited and maintain the reasonable and appropriate use of B.U.N.'s.

  • 1
    Thanks for posting about this! I wasn't previously aware of this risk. Fascinating. – D.W. May 15 '11 at 2:29

Doubt if we can classify this as a vulnerability. This is a case when support of legitimate feature fails to provide protection of usability in proper form. There are some languages where text direction is from right to left. Unicode consortium had sincere intentions to make support of such languages. By the way, topic itself is not new. About Unicode exploitation there were released two papers by Chris Weber:

I would say that you should point attention to any modern desktop application that supports Unicode - there is a high possibility that it is subjected to such attacks. Going further, want to admit that incorrect or bogus implementation of Unicode can lead to any type of bug starting from visual spoofing till buffer overflows.

Unicode advises following document to be read: http://www.unicode.org/reports/tr36/tr36-9.html.

  • I don't quite follow your logic, it's exploitable but not a vulnerability? – Steve May 13 '11 at 17:15
  • 1
    @SteveS, one can kill with a kitchen knife, but it's not a weapon. – anonymous May 13 '11 at 17:24
  • @ams ah. Semantics, I suppose. – Steve May 13 '11 at 17:27
  • @SteveS, this sounds similar to the issues with IDN - they look like a different domain name, and so can be used to fool the ignorant. Does that make IDN support a vulnerability? Well, no, not really, even though it can create and exploitable issue. Basically the problem is that it doesnt prevent social hacks. – AviD May 14 '11 at 20:54

The root of the problem is that the OS will interpret a file as an executable but does not display that fact. Right now, the user must look at the file name, and think something like "mmh, this ends with '.exe', so Windows will try to execute that file". The Windows in question is right there ! So this is a case of a user trying to outguess his own computer, and failing at that. This is not limited to Unicode: very few users are aware that '.pif', '.com', '.scr'... also trigger execution.

The "clean" way would be to make the application display the name with an explicit, unambiguous visual indication of what will happen if the user decides to "open" the file; however, a recent enough Windows system will already do that (it will warn you that the file is from the Internet at large) and most users will simply click on the "do as I say, stupid!" button -- and not even remember that such a warning even appeared.

In shorter words, Unicode is not really a vulnerability here: it is just a feature which can be used, among many other features, to make a file type somewhat hidden. But the real security problem is not there; it is in users insisting on running untrustworthy executable files. Efficient countermeasures often involve filtering data upstream, so that the user never sees offending files at all. Many mail servers automatically remove executable files from emails (but users -- and virus makers -- soon learn workarounds such as storing executable files in encrypted Zip archives).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.