HostSplit: Exploitable Antipatterns in Unicode Normalization

Jonathan Birch | Senior Security Software Engineer, Microsoft
Location: Breakers GHI
Date: Thursday, August 8 | 3:50pm-4:40pm
Format: 50-Minute Briefings
Tracks: Web AppSec, Applied Security

This talk demonstrates new exploit techniques that leverage Unicode normalization behavior to bypass URL security filters and, in some cases, allow one domain to impersonate another. Where previous attacks against internationalized domain names relied on visual spoofing, these attacks fool software with URL strings that are parsed as belonging to one hostname but resolved as belonging to a different host name.

The vulnerabilities that enable these attacks are widespread, because they result from practical compromises in implementing IDNA standards. The author of this talk identified several new CVE's which will be discussed, including vulnerabilities in Edge/IE, .NET, Python, Java, Office 365, and Gmail. A more general exploit pattern against OAuth is also explained.

Although some platform-level problems have already been corrected, many of the fixes for these vulnerabilities will need to be made at an application level. It is likely that there are still many software packages with Unicode normalization vulnerabilities of this type.

This talk discusses methods to test for these vulnerabilities as well as coding and design best practices for preventing them.

Black Hat - USA - 2019 Hacking conference
#hacking, #hackers, #infosec, #opsec, #IT, #security