Show threadAnnual Computer Security Applications ConferenceMay 14
Ending the session, we saw Gao et al.'s "Fooling Machine's Eyes: Unicode Modifier Letter Evasion Attack" reveal how Unicode modifier letters let malicious commands evade detection. (https://www.acsac.org/2025/program/final/s96.html) 6/6
#AttackDetection #ThreatHunting #IDN #UnicodeSecurity
Pi3cHDec 13, 2024

Great code page parser bug by @orange_8361 BestFit suffers from similar issue of NFKC/NFKD where the original character is converted to look a like. This can be misused to inject special characters that should be otherwise escaped. https://worst.fit.

There are so many other issues in Unicode. If you want to learn and practice these type of vulns, I've a free short course at https://learn.secdim.com/course/paypal-homograph/topic/introduction-visual-spoofing #unicode #worstfit #unicodesecurity

WorstFit!