Unicode Transformations: Finding Elusive Vulnerabilities › › Unicode... · OWASP AppSecDC...

OWASP AppSecDCNovember 2009

Chris Weber

chriscasabasecuritycom

Casaba Security

Unicode Transformations Finding Elusive Vulnerabilities

OWASP AppSecDC - November 2009 copy 2009 Chris Weber

bull Visual spoofing and counterfeiting

bull Text transformation attacks

wwwcasabasecuritycom

Whatrsquos this about


bull Why you should care about Visual Integrityhellip

ndash Branding

ndash Identity

ndash Cloud Computing ndash URIrsquos


What will you learn


bull Good techniques for finding bugs

ndash Web-apps and clever XSS

ndash Test cases for fuzzing


What will you learn


bull Watcher

ndash Microsoft SDL recommended tool

ndash Passive Web-app testing for free

ndash httpwebsecuritytoolcodeplexcom

bull Unibomber

ndash Deterministic auto-pwn XSS testing


What about tools

OWASP AppSecDC - November 2009 copy 2009 Chris Weberwwwcasabasecuritycom

Can you tell the difference


How about now


ltscrİptgt

becomes

ltscriptgt


The TransformersWhen good input turns bad


Agenda



bull Unicode crash course

bull Root Causes

bull Attack Vectors

bull Tools

ndash Watcher

ndash Unibomber


Unicode TransformationsAgenda



bull Root Causes

bull Attack Vectors

bull Tools




bull Globalization

bull One framework for all languages

bull Storage and transmission of text

bull A large database


Unicode Crash CourseWhat is Unicode


bull All software

bull All users


Unicode Crash CourseThe Unicode Attack Surface


Unicode Crash CourseUnthink it


bull A large and complex standard

Unicode Crash Course

code pointsencodingscategorizationnormalizationbinary propertiescase mappingconversion tablesbi-directional properties

canonical mappingsdecomposition typescase foldingbest-fit mapping17 planesprivate use rangesscript blocks

escapings


Shift_jis

Gb2312

ISCII

Windows-1252

ISO-8859-1

EBCDIC 037


Unicode Crash CourseCode pages and charsets


bull Unicode can represent them all

bull ASCII range is preserved

ndash U+0000 to U+007F are mapped to ASCII


Unicode Crash CourseAd Infinitum


bull Unicode 51 uses a 21-bit scalar value with space for over 1100000 code points

U+0000 to U+10FFFF


Unicode Crash CourseCode points


A = U+0041

Every character has a unique number


Unicode Crash CourseCode Points



AU+0041



ſU+017F


UTF-8 ndash variable width 1 to 4 bytes (used to be 6)

UTF-16ndash Endianessndash Variable width 2 or 4 bytesndash Surrogate pairs

UTF-32ndash Endianessndash Fixed width 4 bytesndash Fixed mapping no algorithms needed


Unicode Crash CourseEncodings


U+FF21 FULLWIDTH LATIN CAPITAL LETTER A

EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21


Unicode Crash CourseEncodings and Escape sequences



bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Unicode crash coursebull Root Causes

ndash Visual Spoofing and IDNrsquosndash Best-fit mappingsndash Normalizationndash Overlong UTF-8ndash Over-consumptionndash Character substitutionndash Character deletionndash Casingndash Buffer overflowsndash Controlling Syntaxndash Charset transformationsndash Charset mismatches

bull Tools


Unicode TransformationsOverview


Visual Spoofing and IDNrsquos



bull Over 100000 assigned characters

bull Many lookalikes within and across scripts

AΑАᐱᗅᗋᗩᴀᴬＡ


Root CausesVisual Spoofing


httpnottrustedcomidnphp


Open your Web browserAnd follow along


Some browsers allow COM IDNrsquos

based on script family

ndash (Latin has a big family)


Attack VectorsIDN homograph attacks


Safari




Opera





wwwgooglecom is not wwwgooɡlecom

Latin U+0069

LatinU+0261

gɡ


ICANN guidelines v20

ndash Inclusion-based

ndash Script limitations

ndash Character limitations


Root CausesThe state of International Domain Names

Deny-all default seems to be the right concept

A script can cross many blocks Even with limited script choices therersquos plenty to choose from

Great for domain labels but sub domain labels still open to punctuation and syntax spoofing


bull Divergent user-agent implementations

bull Lookalikes everywhere

bull IDNA and Nameprep based on Unicode 32

ndash Wersquore up to Unicode 51 (larger repertoire)


Root CausesIDN ndash so whatrsquos the problem


bull Registrars still allow

ndash Confusables

ndash Combining marks

ndash Single Whole and Mixed-script

bull Registrars canrsquot control

ndash Syntax spoofing in sub domain labels




bull Non-Unicode attacks

bull Confusables

bull Invisibles

bull Problematic font-rendering

bull Manipulating Combining Marks

bull Bidi and syntax spoofing


Attack VectorsVisual spoofing Vectors


rn can look like m in certain fonts


Attack VectorsNon-Unicode homograph attacks

wwwmulletscom is not wwwrnulletscom

Latin U+006D

LatinU+0073 U+006E


Are you using mono-width fonts

0 and O

1 and l

5 and S




Classic long URLrsquos

httploginfacebookintvitationvideomessageid-

h048892r39sessionnfbidcomhomehtmdisbursements




wwwɑpplecom

All Latin using Latin small letter Alpha lsquoɑrsquo

wwwfaϲebookcom

Mixed LatinGreek with lunate sigma symbol lsquocrsquo

wwwаЬсcom

All Cyrillic lsquoabcrsquo


Attack VectorsUnicode and The Confusables


Browsers whitelist ORG




Others donrsquot necessarily buthellip





wwwmozillaorg is not wwwmoziacutellaorg

Latin U+0069

LatinU+00ED


(This case doesnrsquot work anymore)


Attack VectorsIDN Syntax Spoofing with lookalikes

httpwwwgooglecompathfilenottrustedorg

FULLWIDTH SOLIDUSU+FF0F


(Normalized to a U+002F)




SOLIDUSU+002F


(However punctuation not requiredhellip)



httpwwwgooglecomﾉpathﾉfilenottrustedorg


Attack VectorsThe Invisibles


Attack VectorsVisual Spoofing with Bidi Explicit Directional Overrides


Best-fit Mappings



Commonly occur in charset transformations and even innocuous APIrsquos

Impact Filter evasion Enable code execution

When σ becomes s

U+03C3 GREEK SMALL LETTER SIGMA

When prime becomes

U+2032 PRIME


Root CausesBest-fit mappings


bull Scrutinize charactercharset manipulation APIrsquos

bull Use EncoderFallback with SystemTextEncoding

bull Set WC_NO_BEST_FIT_CHARS flag with WideCharToMultiByte()

bull Use Unicode end-to-end


Root CausesGuidance for Best-Fit mappings


bull A popular social networking site in 2008

bull Implemented complex filtering logic to prevent XSS

ndash Attack Filter evasion code execution

ndash Exploit Bypass filtering logic with best-fit mappings to leverage cross-site scripting

ndash Root Cause best-fit mappings


Case Study Social NetworkingBest-fit mappings


-moz-binding()

was not allowed buthellip

-[U+ff4d]oz-binding()

would best-fit map




Normalization



Normalizing strings after validation is dangerous



Root CausesNormalization


İ becomes I +



U+0130 U+0049 U+0307


But are there dangerous characters

You bethellip with NFKC and NFKD you could control HTML or other parsing

﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt

toNFKC(ldquo﹤scriptgtrdquo) = ldquoltscriptgtrdquo



U+FE64 U+003C


Overlong UTF-8

(Canonicalization)



Non-shortest or overlong UTF-8


Application gets C0A7

OSFramework sees 27

Database gets


Root CausesNon-shortest form UTF-8


bull Unicode specification forbids

ndash Generation of non-shortest form

ndash Interpretation of non-shortest form for BMP

bull Validate UTF-8 encoding (throw on error)


Root CausesGuidance for Non-shortest form UTF-8


How many ways can you say


Attack VectorsDirectory traversal


Attack Vectors


Handling the Unexpected

(Good fuzzing test cases)



bull Unassigned code points

ndash U+2073

bull Illegal code points

ndash Half a surrogate pair

bull Code points with special meaning

ndash U+FEFF is the BOM


Root CausesHandling the Unexpected


Over-Consumption



Over-consuming ill-formed byte sequences

Big problem with MBCS lead bytes

lt41 C2 3E 41gt becomes

lt41 41gt


Root CausesHandling the Unexpected Over-consumption


ltimg src=0xC2gt onerror=alert(1)ltbr gt

Browser sees

ltimg src=gt onerror=alert(1) gtltbr gt




Character Substitution



Correcting insecurely rather than failing

ndash Substituting a lsquorsquo or a lsquorsquo would be bad


Root CausesHandling the Unexpected Character-substitution


Character Deletion



ldquodeletion of noncharactersrdquo


Root CausesHandling the Unexpected Character-deletion


ltscr[U+FEFF]iptgt becomes ltscriptgt




bull Fail or error

bull Use U+FFFD instead

ndash A common alternative is lsquorsquo which can be safe


Root CausesSolutions for Handling the Unexpected


bull Bypass filters WAFrsquos NIDS and validation

bull Exploit delivery techniques

ndash Eg Cross-site scripting


Attack VectorsFilter evasion


Safari and Firefox BOM consumption


ndash Exploit Bypass filtering logic with specially crafted strings to leverage cross-site scripting

ndash Root Cause Character deletion


Case Study Apple and Mozilla


lta href=ldquojava[U+FEFF]scriptalert(bdquoXSS‟)gt




A Closer Look The BOM

BOMU+FEFF


Casing



bull Upper and lower-casing can produce dangerous text

bull Casing can multiply the buffer sizes needed

bull Impact Filter evasion Enable code execution


Root CausesCasing


toLower(ldquoİrdquo) == ldquoirdquo

toLower(ldquoscrİptrdquo) == ldquoscriptrdquo


Root CausesCasing


len(x) = len(toLower(x))


Root CausesCasing


bull Perform casing operations before validation

bull Leverage existing frameworks and APIrsquos

ndash ICU Net


Root CausesGuidance for Casing


Buffer Overflows



bull Incorrect assumptions about string sizes (chars vs bytes)

bull Improper width calculations

bull Impact Enable code execution


Root CausesBuffer Overflows


Casing - maximum expansion factors



Operation UTF Factor Sample

Lower 8 15 Ⱥ U+023A

16 32 1 A U+0041

Upper 8 16 32 3 ΐ U+0390Source Unicode Technical Report 36


Normalization- maximum expansion factors




NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X

ملسو هيلع هللا ىلص U+FDFA16 32 18X

Source Unicode Technical Report 36


Controlling Syntax



bull White space and line breaks

ndash Eg when U+180E acts like U+0020

bull Quotation marks



Root CausesControlling Syntax


bull Manipulate HTML parsers and javascriptinterpreters

bull Control protocols


Attacks and ExploitsControlling syntax


bull Unicode formatter characters exploited for XSS

ndash Damage Filter evasion controlling syntax

ndash Exploit Bypass filtering logic with specially crafted characters to leverage cross-site scripting

ndash Root Cause Interpreting ldquowhite spacerdquo

ndash A problem with HTML 40 spec


Case Study Opera


lta href=[U+180E]onclick=alert()gt


Case Study Opera


Case Study Opera

MVSU+180E


Specifications



1) Character stabilityndash IDNANameprep based on Unicode 32

2) Designsndash Specs are carefully designed but not always perfect

bull This was a problemndash ldquoWhen designing a markup language or data protocol the use of

U+FEFF can be restricted to that of Byte Order Mark In that case any U+FEFF occurring in the middle of the file can be ignored or treated as an error rdquo

ndash HTML 401 bull Defines four whitespace characters and explicitly leaves

handling other characters up to implementer


Root CausesSpecifications


Charset Transformations



bull Converting between charsets is dangerous

bull Mapping tables and algorithms vary across platforms

bull Impact Filter evasion Enable code execution Data-loss


Root CausesCharset Transformations


bull Avoid if possible

bull Use Unicode as the broker

bull Beware the PUA mappings

bull Transform case and normalize prior to validation and redisplay


Root CausesGuidance for Charset Transformations


Charset Mismatches



bull Some charset identifiers are ill-defined

bull Vendor implementations vary

bull User-agents may sniff if confused

bull Attackers manipulate behavior



Root CausesCharset Mismatches



Content-Type charset=ISO-8859-1

ltmeta http-equiv=Content-Type content=texthtml charset=shift_jisgt

Attacker-controlled input


bull Force UTF-8

bull Error if uncertain


Root CausesGuidance for Charset Mismatches



bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher


ndash Passive Web-app security testing and auditing

bull Unibomber

ndash XSS autopwn testing tool


Tools


bull Unicode transformation hot-spotsbull XSS hot-spotsbull User-controlled HTMLbull Cross-domain issuesbull Insecure cookiesbull Insecure HTTPHTTPS transitionsbull SSL protocol and certificate issuesbull Flash issuesbull Silverlight issuesbull Information disclosurebull Morehellip


ToolsWatcher ndash Some of the Passive Checks Included


Tools


httpwebsecuritytoolcodeplexcom


ToolsWatcher - Web-app Security Testing and Auditing


bull Deterministic testing

bull Auto-inject payloads

bull Unicode transformers

ndash lt gt lsquo ldquo etc

bull Detect transformations and encoding hotspots


ToolsUnibomberndash runtime XSS testing tool

Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet

Email chriscasabasecuritycom

LinkedIn httpwwwlinkedincominchrisweber


bull Visual spoofing and counterfeiting

bull Text transformation attacks


Whatrsquos this about



ndash Branding

ndash Identity



What will you learn






What will you learn


bull Watcher




bull Unibomber



What about tools




How about now


ltscrİptgt

becomes

ltscriptgt




Agenda




bull Root Causes

bull Attack Vectors

bull Tools

ndash Watcher

ndash Unibomber





bull Root Causes

bull Attack Vectors

bull Tools




bull Globalization







bull All software

bull All users










escapings


Shift_jis

Gb2312

ISCII

Windows-1252

ISO-8859-1

EBCDIC 037











U+0000 to U+10FFFF




A = U+0041






AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet





ndash Branding

ndash Identity



What will you learn






What will you learn


bull Watcher




bull Unibomber



What about tools




How about now


ltscrİptgt

becomes

ltscriptgt




Agenda




bull Root Causes

bull Attack Vectors

bull Tools

ndash Watcher

ndash Unibomber





bull Root Causes

bull Attack Vectors

bull Tools




bull Globalization







bull All software

bull All users










escapings


Shift_jis

Gb2312

ISCII

Windows-1252

ISO-8859-1

EBCDIC 037











U+0000 to U+10FFFF




A = U+0041






AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet








What will you learn


bull Watcher




bull Unibomber



What about tools




How about now


ltscrİptgt

becomes

ltscriptgt




Agenda




bull Root Causes

bull Attack Vectors

bull Tools

ndash Watcher

ndash Unibomber





bull Root Causes

bull Attack Vectors

bull Tools




bull Globalization







bull All software

bull All users










escapings


Shift_jis

Gb2312

ISCII

Windows-1252

ISO-8859-1

EBCDIC 037











U+0000 to U+10FFFF




A = U+0041






AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




bull Watcher




bull Unibomber



What about tools




How about now


ltscrİptgt

becomes

ltscriptgt




Agenda




bull Root Causes

bull Attack Vectors

bull Tools

ndash Watcher

ndash Unibomber





bull Root Causes

bull Attack Vectors

bull Tools




bull Globalization







bull All software

bull All users










escapings


Shift_jis

Gb2312

ISCII

Windows-1252

ISO-8859-1

EBCDIC 037











U+0000 to U+10FFFF




A = U+0041






AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet






How about now


ltscrİptgt

becomes

ltscriptgt




Agenda




bull Root Causes

bull Attack Vectors

bull Tools

ndash Watcher

ndash Unibomber





bull Root Causes

bull Attack Vectors

bull Tools




bull Globalization







bull All software

bull All users










escapings


Shift_jis

Gb2312

ISCII

Windows-1252

ISO-8859-1

EBCDIC 037











U+0000 to U+10FFFF




A = U+0041






AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




ltscrİptgt

becomes

ltscriptgt




Agenda




bull Root Causes

bull Attack Vectors

bull Tools

ndash Watcher

ndash Unibomber





bull Root Causes

bull Attack Vectors

bull Tools




bull Globalization







bull All software

bull All users










escapings


Shift_jis

Gb2312

ISCII

Windows-1252

ISO-8859-1

EBCDIC 037











U+0000 to U+10FFFF




A = U+0041






AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




Agenda




bull Root Causes

bull Attack Vectors

bull Tools

ndash Watcher

ndash Unibomber





bull Root Causes

bull Attack Vectors

bull Tools




bull Globalization







bull All software

bull All users










escapings


Shift_jis

Gb2312

ISCII

Windows-1252

ISO-8859-1

EBCDIC 037











U+0000 to U+10FFFF




A = U+0041






AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet





bull Root Causes

bull Attack Vectors

bull Tools

ndash Watcher

ndash Unibomber





bull Root Causes

bull Attack Vectors

bull Tools




bull Globalization







bull All software

bull All users










escapings


Shift_jis

Gb2312

ISCII

Windows-1252

ISO-8859-1

EBCDIC 037











U+0000 to U+10FFFF




A = U+0041






AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet





bull Root Causes

bull Attack Vectors

bull Tools




bull Globalization







bull All software

bull All users










escapings


Shift_jis

Gb2312

ISCII

Windows-1252

ISO-8859-1

EBCDIC 037











U+0000 to U+10FFFF




A = U+0041






AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




bull Globalization







bull All software

bull All users










escapings


Shift_jis

Gb2312

ISCII

Windows-1252

ISO-8859-1

EBCDIC 037











U+0000 to U+10FFFF




A = U+0041






AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




bull All software

bull All users










escapings


Shift_jis

Gb2312

ISCII

Windows-1252

ISO-8859-1

EBCDIC 037











U+0000 to U+10FFFF




A = U+0041






AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet










escapings


Shift_jis

Gb2312

ISCII

Windows-1252

ISO-8859-1

EBCDIC 037











U+0000 to U+10FFFF




A = U+0041






AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




Shift_jis

Gb2312

ISCII

Windows-1252

ISO-8859-1

EBCDIC 037











U+0000 to U+10FFFF




A = U+0041






AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet











U+0000 to U+10FFFF




A = U+0041






AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




A = U+0041






AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet





AU+0041



ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet





ſU+017F









EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet











EFBCA1

ampxFF21

amp65313

xEFxBCxA1

uFF21





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet





bull Root Causes

bull Attack Vectors

bull Tools






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet






bull Tools























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet























Safari




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




Opera






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet






Latin U+0069

LatinU+0261

gɡ




















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet






















ndash Confusables









bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet





bull Confusables

bull Invisibles











Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet








Latin U+006D

LatinU+0073 U+006E



0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet





0 and O

1 and l

5 and S










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet










wwwɑpplecom


wwwfaϲebookcom


wwwаЬсcom















Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet














Latin U+0069

LatinU+00ED












SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet














SOLIDUSU+002F











Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet













Best-fit Mappings





When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet






When σ becomes s


When prime becomes

U+2032 PRIME



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet



















-moz-binding()



would best-fit map




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




Normalization








İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet









İ becomes I +



U+0130 U+0049 U+0307




﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet






﹤ becomes lt



U+FE64 U+003C


﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




﹤ becomes lt




U+FE64 U+003C


Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




Overlong UTF-8

(Canonicalization)






OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet







OSFramework sees 27

Database gets















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet















Attack Vectors







ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet









ndash U+2073








Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




Over-Consumption






lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet







lt41 41gt





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet





Browser sees













Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet












Character Deletion











bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet












bull Fail or error
























BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet






















BOMU+FEFF


Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




Casing







Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet








Root CausesCasing





Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet







Root CausesCasing




Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet






Root CausesCasing




ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet






ndash ICU Net




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




Buffer Overflows














16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet















16 32 1 A U+0041







NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet








NFC8 3X 119136 U+1D160

16 32 3X ש U+FB2C

NFD8 3X ΐ U+0390

16 32 4X ᾂ U+1F82

NFKCNFKD8 11X




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




Controlling Syntax





















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet






















Case Study Opera




Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet






Case Study Opera


Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




Case Study Opera

MVSU+180E


Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




Specifications




























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet





























Charset Mismatches
















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet

















bull Force UTF-8






bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet





bull Root Causes

bull Attack Vectors

bull Tools





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet





bull Root Causes

bull Attack Vectors

bull Tools




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet




bull Watcher



bull Unibomber



Tools






Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet








Tools













Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet















Thank you

Casaba Security


Chris Weber

Blog wwwlookoutnet



Unicode Transformations: Finding Elusive Vulnerabilities › › Unicode... · OWASP AppSecDC...

Documents

Transcript of Unicode Transformations: Finding Elusive Vulnerabilities › › Unicode... · OWASP AppSecDC...