Unicode: It is more than funny domain names., (Wed, Nov 12th)
Source SANS ISC Handlers Diary
Description
When people discuss the security implications of Unicode, International Domain Names (IDNs) are often highlighted as a risk. However, while visible and often talked about, IDNs are probably not what you should really worry about when it comes to Unicode. There are several issues that impact application security beyond confusing domain names.
Impact
For European organizations, the impact of these Unicode-related vulnerabilities can be substantial. Many European countries have multilingual populations and applications that support diverse character sets, increasing exposure to confusable characters and normalization issues. Impersonation attacks can lead to unauthorized access, fraud, and reputational damage. Injection attacks facilitated by normalization bypass can compromise databases and backend systems, risking data breaches and service disruption. The use of variant selectors for obfuscation can enable supply chain attacks, such as malicious code insertion in software extensions or internal tools, undermining software integrity. Bidirectional text attacks complicate code review and audit processes, increasing the risk of undetected malicious code in critical software, which is particularly concerning for sectors like finance, healthcare, and government. The difficulty in detecting these attacks and the potential for widespread exploitation across web applications, messaging platforms, and development environments amplify the threat. Overall, the threat can affect confidentiality, integrity, and availability of systems, leading to financial loss, regulatory penalties under GDPR, and erosion of trust.
Defensive guidance
European organizations should implement several targeted measures to mitigate these Unicode-related threats: 1) Enforce strict input validation that limits allowed Unicode characters based on context and use case, avoiding unrestricted acceptance of the full Unicode range where unnecessary. 2) Avoid normalization or best-fit mapping transformations after input validation; if normalization is required, apply it consistently and securely before validation. 3) Use tools to detect and block or flag confusable characters in usernames, domain names, and other user-generated content to prevent impersonation. 4) Monitor and filter variant selectors and other invisible Unicode characters in code, scripts, and text inputs, especially in software development and extension marketplaces. 5) Enhance code review processes and tools to visualize bidirectional text control characters and highlight suspicious text direction changes to prevent Trojan Source-style attacks. 6) Educate developers, security teams, and users about Unicode risks and encourage vigilance for unusual characters or behaviors. 7) Employ security solutions that incorporate Unicode-aware parsing and anomaly detection. 8) Collaborate with software vendors to ensure patches and updates address Unicode-related vulnerabilities. These steps go beyond generic advice by focusing on Unicode-specific controls and detection mechanisms.
Summary
Unicode is a comprehensive character encoding standard that supports over 159,000 characters across multiple languages, symbols, and emojis. While Internationalized Domain Names (IDNs) are often cited as a Unicode-related security risk, this threat highlights deeper and less obvious vulnerabilities in application security stemming from Unicode's complexity. One major issue is the use of confusable characters—characters that look alike but have different Unicode code points—allowing attackers to impersonate legitimate users or entities, which has been observed on social media platforms and internal messaging systems. Another problem arises from normalization and best-fit mapping, where systems convert certain Unicode characters into visually similar ASCII characters or others, potentially bypassing input validation or injection filters. For example, a fullwidth grave accent could be converted into a single quote, enabling SQL injection or other code injection attacks. Variant selectors, which are invisible Unicode code points used to specify alternate character representations, have been exploited in attacks like the "Glass Worm" to embed obfuscated malicious code in software extensions, evading detection because these selectors do not render visibly. Lastly, Unicode includes bidirectional text control characters that can alter the display order of text, making code appear benign to human reviewers while executing maliciously, as demonstrated by the Trojan Source attack. These issues collectively pose significant risks to confidentiality, integrity, and availability of systems, especially those processing user input, code, or multilingual content. Detection and mitigation are challenging due to the invisible or subtle nature of these Unicode features and their legitimate uses.