TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Mimic – abusing Unicode to create tragedy

408 pointsby epsylonover 9 years ago

39 comments

omgtehlionover 9 years ago
Slightly tangential:<p>In Russia there is a government procurement portal. Where gov organizations have to post their requests to enforce competetion and best prices.<p>The usual tactics [1] of corrupt officials was replacing cyrillic (russian) letters with respective latin homoglyphs so only affiliated companies can find and win this contract.<p>[1] <a href="http:&#x2F;&#x2F;www.bbc.com&#x2F;russian&#x2F;rolling_news&#x2F;2013&#x2F;04&#x2F;130409_rn_state_auctions_improve" rel="nofollow">http:&#x2F;&#x2F;www.bbc.com&#x2F;russian&#x2F;rolling_news&#x2F;2013&#x2F;04&#x2F;130409_rn_st...</a>
评论 #10439296 未加载
b0ner_t0nerover 9 years ago
Taylor Swift? Never heard of her: <a href="https:&#x2F;&#x2F;www.google.com&#x2F;search?q=Τаylοr+Ѕwіft" rel="nofollow">https:&#x2F;&#x2F;www.google.com&#x2F;search?q=Τаylοr+Ѕwіft</a><p>:D
评论 #10438661 未加载
评论 #10438781 未加载
wodenokotoover 9 years ago
So, one might wonder why these homo-graphs have different code points. After all the French A and the English A share the same code point.<p>It&#x27;s really difficult to do the right thing here. If Greek question marks share code point with semi-colon, it obstructs search and replace for question marks.<p>Subtle differences in how Japanese and Chinese are written has led to differently written characters sharing the same code point. It&#x27;s nice that you can easily look up most Japanese characters in a Chinese dictionary and see how they are used in China, but it has become frustratingly hard to get subtleties in their written form right. The Chinese version may have the line strike through another line, while the Japanese only has it touching.<p>I honestly don&#x27;t know how to go about posting how to same code points have different written forms!<p>But it seems like it would be nice if code editors warned about text outside ascii. You usually only want that in strings and comments.
评论 #10439227 未加载
评论 #10439985 未加载
评论 #10438054 未加载
评论 #10439443 未加载
评论 #10438130 未加载
评论 #10441201 未加载
评论 #10438043 未加载
acdhaover 9 years ago
Mac users might appreciate the great UnicodeChecker:<p><a href="http:&#x2F;&#x2F;earthlingsoft.net&#x2F;UnicodeChecker&#x2F;" rel="nofollow">http:&#x2F;&#x2F;earthlingsoft.net&#x2F;UnicodeChecker&#x2F;</a><p>It offers a convenient utility to diff arbitrary strings, which is also quite handy for e.g. detecting normalization discrepancies, and installs a service so you can highlight a character in any app and use “Display character information” to see what it actually is.<p>I have Python command-line version in my PATH which displays the character info for arbitrary input strings: <a href="https:&#x2F;&#x2F;github.com&#x2F;acdha&#x2F;unix_tools&#x2F;blob&#x2F;master&#x2F;bin&#x2F;unicode-characters.py" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;acdha&#x2F;unix_tools&#x2F;blob&#x2F;master&#x2F;bin&#x2F;unicode-...</a>
评论 #10440555 未加载
mottiover 9 years ago
This sort of stuff can be the basis for many XSS attacks, see <a href="http:&#x2F;&#x2F;websec.github.io&#x2F;unicode-security-guide&#x2F;character-transformations&#x2F;" rel="nofollow">http:&#x2F;&#x2F;websec.github.io&#x2F;unicode-security-guide&#x2F;character-tra...</a><p>For instance, \u2329, \uFE64, \uFF1C and \u3008 can be best-fitted automatically to \u003C (the regular &#x27;&lt;&#x27; mark in HTML)
评论 #10439807 未加载
mattlondonover 9 years ago
I had something similar happen in the wild to me.<p>I work for a &quot;major search engine&quot; that does a lot of advertising &amp; marketing stuff. To get the most out of it, we need customers to implement some javascript on their ecommerce sites.<p>As is often the case, javascript code that needs to get implemented on an ecommerce site often gets copy-pasted or emailed around a lot internally within a customer before it reaches the right person who can add it to the site&#x27;s pages.<p>In this example somewhere along the way, a normal javascript snippet got all of the semi-colons changed from ; to ;.<p>In case you&#x27;ve not already spotted it, ; is not a ; but is actually &quot;Greek Question Mark&quot; (<a href="http:&#x2F;&#x2F;www.fileformat.info&#x2F;info&#x2F;unicode&#x2F;char&#x2F;037e&#x2F;index.htm" rel="nofollow">http:&#x2F;&#x2F;www.fileformat.info&#x2F;info&#x2F;unicode&#x2F;char&#x2F;037e&#x2F;index.htm</a>).<p>It was very confusing why Chrome was moaning about a semi-colon an illegal token. I had a genuine &quot;Am I going mad? Seriously?&quot; moment before I realised what was happening.
评论 #10438101 未加载
评论 #10437942 未加载
sherazover 9 years ago
There is a special place in hell for anyone doing this. I&#x27;m going to watch this repo and blacklist pull requests from anyone who forks it :-)
评论 #10437795 未加载
评论 #10438601 未加载
pierrecover 9 years ago
I can foresee a new phenomenon arising in stackoverflow-style sites and coding discussion forums:<p>&quot;<i>My simple piece of code looks perfect and should work without problems. Yet it won&#x27;t compile! Help!</i>&quot;<p>Answer:<p>&quot;<i>Try running `.&#x2F;mimic --reverse` on your source.</i>&quot;
评论 #10438764 未加载
评论 #10438475 未加载
austinjpover 9 years ago
I&#x27;m reminded how very useful I&#x27;ve found Text::Unidecode in the past.<p><a href="http:&#x2F;&#x2F;search.cpan.org&#x2F;~sburke&#x2F;Text-Unidecode-1.27&#x2F;lib&#x2F;Text&#x2F;Unidecode.pm" rel="nofollow">http:&#x2F;&#x2F;search.cpan.org&#x2F;~sburke&#x2F;Text-Unidecode-1.27&#x2F;lib&#x2F;Text&#x2F;...</a>
评论 #10438360 未加载
adrianNover 9 years ago
On a Mac you (used to?) get a non-ascii space when you hit the space bar while holding Alt or something like that. Easy to fat-finger it in any case and looks the same in most text editors. It&#x27;s a great source of fun for novice Mac-using programmers to find out why the compiler complains.
评论 #10437864 未加载
评论 #10438916 未加载
评论 #10438979 未加载
评论 #10437905 未加载
评论 #10446518 未加载
sly010over 9 years ago
Ironically I have weird OCD where I always assume I made a typo, so I keep deleting and retyping code a few dozen character at a type, often in lines where I see nothing wrong. Over time this has just become something my hands do whenever my brain needs time to think about something else. So in a way I developed natural immunity to said unicode tricks ;)
评论 #10438234 未加载
评论 #10438235 未加载
Animatsover 9 years ago
There&#x27;s a set of rules used on domain names to stop homoglyph abuse there.[1][2] Applying those rules to language identifiers would prevent this problem. It&#x27;s also useful to apply those rules to login names for forum&#x2F;social systems. The rules prevent mixed language identifiers, mixed left to right and right to left text, and similar annoyances.<p>[1] <a href="https:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;rfc5893" rel="nofollow">https:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;rfc5893</a> [2] <a href="http:&#x2F;&#x2F;unicode.org&#x2F;reports&#x2F;tr46&#x2F;" rel="nofollow">http:&#x2F;&#x2F;unicode.org&#x2F;reports&#x2F;tr46&#x2F;</a>
rbinvover 9 years ago
I guess someone should develop an IDE&#x2F;editor plugin that marks non-ASCII characters outside of string literals.
评论 #10438080 未加载
评论 #10438076 未加载
评论 #10441569 未加载
AUmryshover 9 years ago
I think the line about &quot;Mimic substitutes common ASCII characters for obscure homographs&quot; has it backward. Shouldn&#x27;t it say Mimic substitutes obscure homographs for common ASCII characters?
评论 #10438323 未加载
评论 #10439136 未加载
评论 #10438870 未加载
评论 #10438342 未加载
cstrossover 9 years ago
Also GREAT if you&#x27;re trying to identify untaken phishing domain names to register for your next scam!
评论 #10438150 未加载
评论 #10437791 未加载
reinderienover 9 years ago
Mimic author here... sorry, humanity...
Svenstaroover 9 years ago
Wow, now that&#x27;s just pure evil.
评论 #10438523 未加载
ant6nover 9 years ago
One could name variables and functions to later identify whether code was copied (e.g. to find out whether somebody copied some GPL code).
评论 #10438271 未加载
tucifover 9 years ago
Spotify used to have a security problem with this kind of characters:<p><a href="https:&#x2F;&#x2F;labs.spotify.com&#x2F;2013&#x2F;06&#x2F;18&#x2F;creative-usernames&#x2F;" rel="nofollow">https:&#x2F;&#x2F;labs.spotify.com&#x2F;2013&#x2F;06&#x2F;18&#x2F;creative-usernames&#x2F;</a>
cruise02over 9 years ago
&gt; Replace a semicolon (;) with a greek question mark (;) in your friend&#x27;s C# code and watch them pull their hair out over the syntax error<p>I&#x27;m not sure how frustrating this would be. Wouldn&#x27;t most people just delete the character immediately and type a new one?
评论 #10441361 未加载
评论 #10440650 未加载
pmlnrover 9 years ago
This somewhat reminds me if this little entry on how &quot;tolerant&quot; JavaScript is...<p><a href="https:&#x2F;&#x2F;mathiasbynens.be&#x2F;notes&#x2F;javascript-identifiers" rel="nofollow">https:&#x2F;&#x2F;mathiasbynens.be&#x2F;notes&#x2F;javascript-identifiers</a>
gnudover 9 years ago
This can actually be used productively, to see how your app reacts to weird input :)
cammsaulover 9 years ago
The repo&#x27;s README mentions a vim plugin to highlight Unicode homoglyphs. As an Emacs user, I did a quick M-x package-list-packages, thinking I&#x27;ll find at least half a dozen equivalent Emacs packages.<p>To my dismay, there were <i>none</i>. So I spent the rest of my afternoon correcting this glaring deficiency. Fellow Emacs users, protect yourself from Unicode trolls and grab it here: <a href="https:&#x2F;&#x2F;github.com&#x2F;camsaul&#x2F;emacs-unicode-troll-stopper" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;camsaul&#x2F;emacs-unicode-troll-stopper</a>
Procrastesover 9 years ago
This seems like a useful tool for fuzztesting your dev ops person, or if you are the dev ops person, for fuzz testing development. Fuzz for all!
Kristine1975over 9 years ago
Piping the result through TTS creates weird results (on OS X):<p><pre><code> echo &quot;hello world&quot; | mimic --me-harder 100 | say</code></pre>
评论 #10441579 未加载
n-gaugeover 9 years ago
Just chuck the code into an XML validator. Any character &gt; 127 will be flagged as invalid.
foolfoolzover 9 years ago
is anyone aware of the reverse of this, a homoglyph normalization library? id love to be able to take strings that visually look the same and compare them against one master list, such as for spam detection
r721over 9 years ago
In cases like those I use unicodelookup.com to list suspicious characters :)
评论 #10437913 未加载
bradbeattieover 9 years ago
Add the following to your ~&#x2F;.vimrc to always highlight non-ascii characters:<p><pre><code> au BufWinEnter * let w:matchnonascii=matchadd(&#x27;ErrorMsg&#x27;, &quot;[\x7f-\xff]&quot;, -1)</code></pre>
Induaneover 9 years ago
These dang democrats done banned Ben Carson from google man!<p><a href="https:&#x2F;&#x2F;www.google.com&#x2F;search?q=Ben+Сarѕоn" rel="nofollow">https:&#x2F;&#x2F;www.google.com&#x2F;search?q=Ben+Сarѕоn</a>
perlancar2over 9 years ago
Made a perl port: <a href="https:&#x2F;&#x2F;metacpan.org&#x2F;pod&#x2F;mimic" rel="nofollow">https:&#x2F;&#x2F;metacpan.org&#x2F;pod&#x2F;mimic</a> (currently 50% faster)
TazeTSchnitzelover 9 years ago
In some languages which allow non-ASCII but aren&#x27;t Unicode-aware (PHP, for instance), you can add significant, invisible zero-width spaces to identifiers.
florian-fover 9 years ago
<p><pre><code> &gt; var ﷺ = 1; &lt; undefined</code></pre>
webXLover 9 years ago
Hmm... I wonder if this can be used in browser source maps.
cevarisover 9 years ago
Some people just want to see the world burn...
mrzoolover 9 years ago
Some men just want to watch the world burn.
ChrisArgyleover 9 years ago
And now I know what I&#x27;m doing for April 1st next year.
ehoscaover 9 years ago
i smell a Notepad++ extension
grabcocqueover 9 years ago
YOU ARE A TERRIBLE PERSON AND I LIKE YOU