New 'Trojan Source' Method Lets Attackers Hide Vulns in Source Code
Researchers discover a new technique attackers could use to encode vulnerabilities into software while evading detection.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Security researchers have discovered a new technique to inject malware into source code while remaining invisible to human reviewers.
The Cambridge University researchers who shared the "Trojan Source" method say the attack "exploits subtleties in text-encoding standards such as Unicode to produce source code whose tokens are logically encoded in a different order from the one in which they are displayed, leading to vulnerabilities that cannot be perceived directly by human code reviewers."
This tactic manipulates the encoding of source code files so compilers and human viewers see different logic, as discovered by Nicholas Boucher and Ross Anderson, the latter explained in a blog post.
One attack, tracked as CVE-2021-42574, uses Unicode directionality override characters to show code as an anagram of its true logic. This attack works against C, C++, C#, JavaScript, Java, Rust, Go, and Python; the researchers believe it will work against most other modern languages as well. A related attack using visually similar characters is tracked as CVE-2021-42694.
The team made responsible disclosure to all companies and organizations whose products they found to have vulnerabilities.
Read more details here.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024