‫‬‏‮txet lanoitcerid-iB

https://en.wikipedia.org/wiki/Bi-directional_text#Unicode_support

by mquandalle • 12 years ago

105 14 12 years ago

en.wikipedia.org

jakub_g• 12 years ago

You can exploit this trick to some extent to name a file in a way that spoofs its real extension. E.g. name an .exe file such that it looks like if it was .doc (and give the exe an icon associated often with .doc to be even more convincing).

132• 12 years ago

Works on URLs too.

‮http://myspace.com/#/segami/moc.koobecaf//:sptth

joelthelion• 12 years ago

Pretty dangerous, but at least my browser corrects it in the address bar.

cnrsvxz• 12 years ago

This has been done by FinFisher:

https://www.youtube.com/watch?v=sW-N7qQU-tA#t=14m04s

rwmj• 12 years ago

Nice - confuses XFCE as well: http://oirase.annexia.org/tmp/hackernews.png

jaachan• 12 years ago

Chrome tab has the title inverted as well

hayksaakian2• 12 years ago

The URL is on the left of the submission title.

Is this somehow related?

132• 12 years ago

The submission title is actually "txet lanoitcerid-iB", with a Right To Left Override control character at the front. The whole line is in reverse it just doesn't look like it when rendered in your browser. There's a variety of control characters in unicode which let you stack, reverse, raise and lower individual pieces of text as you desire.

‮.ekil skool yllaer ti tahw ees ll'uoy dna enil siht gnitsap dna ypoc yrT

hayksaakian2• 12 years ago

Interesting, I viewedmthe source of the page, and some of the tags are reversed too.

Is this an exploit/attack vector?

kowdermeister• 12 years ago

Yes, right click -> inspect element on the link.

glifchits• 12 years ago

Take a closer look at the URL while you're at it. It may look like an obscure domain, but its really not.

AReallyGoodName• 12 years ago

Check your browsers title bar right now.

im3w1l• 12 years ago

You can do the same with sourcecode too.

    System.out.println("Do ‮live‭"); // not ‬doog

Right-left-override is fun, but to see it really shine you have to combine it with some pop-directional-formatting.

‫‬‏‮txet lanoitcerid-iB

Related Stories