Good thread about the recent Unicode attacks and some previous work that predates it. I agree that citations could be improved. But I want to push back a little. 1/
https://twitter.com/liveoverflow/status/1455288276764532737
What was interesting to me about the recent Unicode/Trojan attacks (link below) isn’t that Unicode contains some exploitable fluffery. *Of course* it does. Unicode is terrible. 2/ trojansource.codes
What was surprising to me is how many compilers, source management tools and IDEs were vulnerable to the attacks. I expected this from pomo languages like, say, Golang or Swift. But even compilers for ancient languages like C/C++ were happy to eat Unicode and not complain. 3/
This is a pretty common thing in infosec, where somebody says “that attack isn’t new, it’s been known for years” and then you look around and literally *everything* is still vulnerable to it. Maybe “new” isn’t what’s important. 4/
Over the past few days we’ve seen several advisories from compiler developers, source management systems and others. This is the result of a coordinated disclosure process, and, yes publicity process (with a website and logo!) That’s a good thing! 5/
To me what distinguishes this work is not “we found a vulnerability,” because the vulnerability is itself is fairly simple. But rather the effort that was put into classifying all the vulnerable tools and scanning for pre-existing exploitation. Thank god for grad students. 6/
With all those things said, crediting previous work is really important. And I think the citation here could be a lot more robust. 7/ 
Anyway, to conclude: we shouldn’t worry about 0days. We should worry about the 1538days that someone discovered, described in a quick blog or pastebin, and are now lying around for someone to find and exploit. //
• • •
Missing some Tweet in this thread? You can try to
force a refresh
