{"uuid": "10e832cf-35b9-44f3-8c83-2937a22c3a60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42574", "type": "seen", "source": "https://t.me/hacking_Attack/29907", "content": "Black Hat Ethical Hacking\n\u2018Trojan Source\u2019 attack method can hide bugs into open-source code\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png \u2018Trojan Source\u2019 attack method can hide bugs into open-source codePost Views: 134 \nReading Time: 2 Minutes\nAcademic researchers have released details about a new attack method they call \u201cTrojan Source\u201d that allows injecting vulnerabilities into the source code of a software project in a way that human reviewers can\u2019t detect.\nTrojan Source relies on a simple trick that does not require modifying the compiler to create vulnerable binaries.\n\nThe method works with some of the most widely used programming languages today and adversaries could use it for supply-chain attacks. Abusing text-encoding standardsResearchers from the University of Cambridge, United Kingdom, disclosed and demonstrated the \u201cTrojan Source\u201d class of attacks that could compromise first-party software and supply chains.\n\nThe examples they provide are for projects written in C, C++, C#, JavaScript, Java, Rust, Go, and Python where an attacker can target the encoding of source code files to inject vulnerabilities.\n\n\u201cThe trick is to use Unicode control characters to reorder tokens in source code at the encoding level,\u201d reveals Nicholas Boucher, one of the researchers that discovered Trojan Source.\n\n\u201cWe have discovered ways of manipulating the encoding of source code files so that human viewers and compilers see different logic. One particularly pernicious method uses Unicode directionality override characters to display code as an anagram of its true logic,\u201d explains Ross Anderson, the other researcher behind testing the Trojan Source attack method.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nBy using control characters embedded in comments and strings, a threat actor can reorder the source code to change its logic in a way that creates an exploitable vulnerability. Bidirectional and homoglyph attackThe researchers showed that one way this can be achieved is by using Unicode controls for bidirectional text (e.g. LRI -left-to-right isolate, and RLI -right-to-left isolate) to dictate the direction in which the content is displayed. This method is now tracked as CVE-2021-42574.\n\nThe bidirectional (Bidi) controls LRI and RLI are invisible characters, and they are not the only ones. By injecting these instructions, a compiler can compile code that is completely different from what a human sees.\n\nIn the image below, using the RLI/RLI controls inside the string the second line is compiled while the human eye reads it as a comment that the compiler would ignore.\nhttps://www.bleepstatic.com/images/news/u/1100723/2021/TrojanSourceAttack02.jpg \nA destructive infectionThis particular variant of the Chaos Ransomware is configured to search the infected systems for different file types smaller than 2\u039c\u0392 and encrypts them.\n\nHowever, if the file is larger than 2MB is will inject random bytes into the files, making them unrecoverable even if a ransom is paid.\n\nDue to the destructive nature of the attack, those who pay the[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:10.812718Z"}