34

‮?retcarahc "rorrim" edocinu eht htiw detaicossa ytilibarenluv fo tros emos ereht sI

?ksir yna ereht erA ?rof ti si tahW

2
  • 5
    The official name of the character U+202E is "OVERRIDE, RIGHT-TO-LEFT". Just FYI. Jun 25, 2010 at 18:02
  • 2
    Officially, "Mirrored" is a property of characters "(", ")", "༺", "༻", etc.
    – darw
    Jun 1, 2021 at 10:23

4 Answers 4

35

We've talked about attacks using the RLO (U+202E RIGHT TO LEFT OVERRIDE) character in the past, which shifts the 'visual' display of a string from the position it's placed inside that string. So for example:

document[U+202E]fdp.exe visually looks like documentexe.pdf

I talked about these and other attacks of this sort here http://www.casaba.com/products/UCAPI/. In fact we're starting to hear of real world attacks using these techniques to bypass spam and other filters. Firefox closed a bug in their file download dialog box.

I see a big difference between attacks leveraging BIDI text and the playful sort of 'mirror' effects you get from tools like txtn.us.

!luʇmɿɒʜ ƨɒ mɘɘƨ ƚ'nƨɘob ƚxɘƚ bɘɿoɿɿim ɘʜƚ

14

Well, you can abuse it for pishing attacks. Take this URL for example:

 ‮http://www.example.com?site/moc.elgoog.www//:ptth

It looks like if you click it it will take you to google.com, where in reality it will take you to example.com. Not all browsers support it, though.

4
  • 3
    Oh please note that this dosnt work with all browsers. I was just viewing it on chrome for mobile and the mirror char is compleatly ignored here...
    – omni
    Nov 24, 2014 at 18:36
  • 2
    Does any browser support it? That sounds like a bug.
    – bchurchill
    Dec 4, 2017 at 9:45
  • 1
    I certainly believe no browser nor URL library should support it. But since it's a regular char in the unicode space if no proper exceptions have been made in the application's URL encoding then it will work. Thus, I'd see it as a potentialy exploitable bug.
    – omni
    Oct 14, 2020 at 9:41
  • As of September 2023, Opera GX (which is based on Chromium) still directs me to example.com.
    – mselmany
    Sep 10 at 18:27
11

There are no digital risks, but there can be human risks as it may cause things to be misread or misinterpreted.

1
  • What do you consider to be the boundary between a "digital risk" and a "human risk", in the context of a human interacting with the digital world? Seems like a fuzzy line, to me, which makes the first phrase of your sentence seem a bit... unreliable.
    – lindes
    Nov 18, 2022 at 19:43
-1

Poorly written code could make itself vulnerable to anything. In that regard, there is nothing special about this character.

In the past, non-conforming (deliberate miscodings) UTF-8 was used by some malware to take advantage of some poorly written code. There is still nothing special about this character.

Not the answer you're looking for? Browse other questions tagged or ask your own question.