新山祐介 (Yusuke Shinyama) @mootastic@mstdn.social
Public

ソースコードやCIスクリプト中のドメイン名に使われている文字をよく似たUnicode文字に置き換えるサプライチェーン攻撃 (たとえば英語のgとアルメニア語のアルファベットցなど)。人間の目は当然のこと、CIもこの違いは検出できない。

daniel.haxx.se/blog/2025/05/16

Detecting malicious Unicode

In a recent educational trick, curl contributor James Fuller submitted a pull-request to the project in which he suggested a larger cleanup of a set of scripts. In a later presentation, he could show us how not a single human reviewer in the team nor any CI job had spotted or remarked on one of … Continue reading Detecting malicious Unicode →

daniel.haxx.se · daniel.haxx.se

0
0
0

If you have a fediverse account, you can quote this note from your own instance. Search https://mstdn.social/users/mootastic/statuses/114520817894402491 on your instance and quote it. (Note that quoting is not supported in Mastodon.)