Could malicious backdoors be hiding in your code, that otherwise appears perfectly clean to the human eye and text editors alike?

A security researcher has shed light on how invisible characters can be snuck into JavaScript code to introduce security risks, like backdoors, into your software.

Not everything is what it seems, in Unicode Earlier this month, University of Cambridge researchers revealed a clever attack dubbed 'Trojan Source' for injecting vulnerabilities into the source code, in a way that the malicious code cannot be easily detected by human reviewers.

The method works with some of the most widely used programming languages today and adversaries could use it for supply-chain attacks.

Trojan Source attack, however, leverages the ambiguity introduced by homoglyphs, and the Unicode bidirectional mechanism (Bidi)—a feature used for accommodating both left-to-right and right-to-left character sets.

This week, a researcher has disclosed how certain characters could be injected into JavaScript code to introduce invisible backdoors and security vulnerabilities.

See also https://www.bleepingcomputer.com/news/security/invisible-characters-could-be-hiding-backdoors-in-your-javascript-code/

ICYMI: Important insights from Nate Bartram

reddit comments

The German BlueYard invests in founders with transforming ideas that decentralize markets and empower humanity.

Well, I think nobody here use Chrome

You can check the websites which use keylogger with Blacklight, among the sites which use Keylogger is f.Exmpl Microsoft US with the TowerData company

Crossgeposted von: https://lemmy.ml/post/305787

Yattee is an alternative YouTube frontend for iOS, tvOS and macOS built with Invidious and Piped.

What do you think about this?

• 1 A smartphone isn't a secure dispositive
• 2 It's not a good idea to store sensitive data in a smartphone or using it for banking or with pay apps
• 3 Disconnect the GPS, if you don't need it
• 4 Use a good AV , p.Exmpl. BitDefender (Free version is enough), because Google Play Protect is only a better placebo
• 5 Review the permissions of the apps and remove those which are not needed for the app (Candy Crush don't need access to your camara or mic, f.Exmpl.)
• 6 Prefer apps from F-Droid
• 7 Use Exodus Privacy to check the apps before download or using.
• 8 Use a VPN if you are on a public WiFi, but be aware of the most free VPN, there are few exceptions of thrustworth free VPN, you can use
• Proton VPN (no logs, no data limit, encrypted end2end, developed by Suiss CERN scientifics. -Windscribe (same as Proton, but only 10 Gb/month)
• Calyx VPN (No logs, encrypted, no data limit, but only one server from the Calyx Institute)

Protect your device from dangerous sites, get rid of annoying ads and tracking, get access to blocked resources in your country!

InviZible Pro includes the well known modules DNSCrypt, Tor and Purple I2P. These modules are used to achieve maximum security, privacy and ease of use of the Internet.

InviZible Pro can use root, if your device has root privileges, or uses a local VPN to deliver Internet traffic to Tor, DNSCrypt and I2P networks.

Features:

• No root required
• Hides location and IP
• Unblocks the restricted web content
• Prevents tracking
• Allows access to hidden networks
• ARP spoofing detection
• Built-in firewall
• Tethering supported
• Material design theme

If you want, there is also a Premium version for $5

Most COM domains are blocked in China.