Si vous êtes informaticien·ne, je recommande la lecture intégrale de l'article sur la faille de sécurité #WorstFit, c'est bien écrit et expliqué. https://devco.re/blog/2025/01/09/worstfit-unveiling-hidden-transformers-in-windows-ansi/

Notamment le chapitre sur « qui aurait dû faire quoi » ("The Dusk–or Dawn–of the WorstFit"). La réponse de Microsoft est belle :-)

(Avec du @bagder dedans)

'worst-fit' attacks are the latest iteration of the classic "let's guess what the user wants" idea. This has always lead to issues down the line.

It will be really hard to reason about and fix for apps that rely on the affected Windows APIs.

https://blog.orange.tw/posts/2025-01-worstfit-unveiling-hidden-transformers-in-windows-ansi/

If you want a deep dive on the underlying mechanicss of these types of attacks, check out my colleague's blog post from a couple months ago: https://herolab.usd.de/en/the-security-risks-of-overlong-utf-8-encodings/

#WorstFit #ANSII #utf8 #pwn #rce #pentesting #hacking

Great code page parser bug by @orange_8361 BestFit suffers from similar issue of NFKC/NFKD where the original character is converted to look a like. This can be misused to inject special characters that should be otherwise escaped. https://worst.fit.

There are so many other issues in Unicode. If you want to learn and practice these type of vulns, I've a free short course at https://learn.secdim.com/course/paypal-homograph/topic/introduction-visual-spoofing #unicode #worstfit #unicodesecurity