trojan-source - Trojan Source: Invisible Vulnerabilities

项目说明

Trojan Source

*Trojan Source: In *

O

We present a new type of attack in which source code is maliciously encoded so that it appears different to a compiler and to the human eye. This attack exploits subtleties in text-encoding standards such as Unicode to produce source code whose tokens are logically encoded in a different order from the one in which they are displayed, leading to that cannot be percei by human code re.

'Trojan Source' attacks, as we call them, pose an immediate threat both to first-party software and supply-chain compromise across the industry. We present working examples of Trojan-Source attacks in C, C++, C#, Ja, Java, Rust, Go, Python, SQL, Bash, Assembly, and Solidity. We propose definiti defenses, and describe other mitigating controls that can be deployed in editors, repositories, and build pipelines while compilers are upgraded to block this attack.

Additional details can be found in our related paper (also on arXiv) and at trojansource.codes.

Proofs-of-Concept

This repository is divided into per-language subdirectories. Each subdirectory contains a series of proofs-of-concept implementing Trojan-Source attacks as well as a README describing the compilers/interpreters with which these attacks were . The source code for the website publishing these attacks can is located in the website/ subdirectory.

Languages

We include a summary of the languages e in the table below:

| Language | to<br />Early Return| to<br />Commenting-Out| to<br />Stretched Strings| Tool E |
|-----|-----|-----|-----|-----|
| C | ~ | &check; | &check; | GNU gcc v7.5.0<br />Apple clang v12.0.5 |
| C++ | ~ | &check; | &check; | GNU g++ v7.5.0<br />Apple clang++ v12.0.5 |
| C\# | ~ | &check; | &check; | .NET 5.0 via dotnet-script |
| Ja | ~ | &check; | &check; | Node.js v16.4.1 |
| Java | ~ | &check; | &check; | OpenJDK v16.0.1 |
| Rust | ~ | &check; | &check; | rustc v1.53.0 |
| Go | ~ | &check; | &check; | go v1.16.6 |
| Python | &check; | &check; | &check; | Python 3.9.5 via clang<br />Python 3.7.10 via gcc |
| SQL | &check; | &check; | &check; | SQLite v3.39.4 |
| Bash | ~ | &check; | &check; | zsh v5.8.1 |
| Assembly | &check; | &check; | ~ | x86_64 gas on Apple clang v14.0.0 |
| Solidity | &check; | &check; | ~ | Solidity v0.8.16 |

&check; means the rendered code matches common style for that language, while ~ means renderings adhere to language syntax but deviate from common style (e.g. the multiline comment terminator \*/ is written as /\*/). The proofs-of-concept included in this respository provide explicit examples for clarity.

We note that this list of affected languages is non-exhaustive, and welcome community contributions to expand to further languages.

We further note that some of the abo have been patched since the disclosure of Trojan-Source attacks, and therefore include the of each tool e. For example, rustc now throws errors for unterminated Bidi control characters.

Finally, in addition to the Bidi attacks shown above, we e each language against the Homoglyph and In character attacks also described in the related paper. These e can be found in the README files of each language subdirectory.

Code

We include a summary of the code e in the table below:

| | Bidi Attack (Windows) | Bidi Attack (MacOS) | Bidi Attack (Ubuntu) | Homoglyph Attack (Windows) | Homoglyph Attack (MacOS) | Homoglyph Attack (Ubuntu) |
|---|---|---|---|---|---|---|
| Studio Code (v1.61) | &check; | &check; | &check; | &check; | &check; | &check; |
| Atom (v1.58.0) | &check; | &check; | &check; | &check; | &check; | &check; |
| SublimeText (v4121) | Bidi unactioned | Bidi unactioned | Bidi unactioned | &check; | &check; | &check; |
| Notepad++ (v8.1.9) | Displays control symbol | &check; | N/A | N/A | N/A | N/A |
| Eclipse (v4.21) | Mangled | Missing Glyph | &check; | &check; | &check; | &check; |
| IntelliJ (v2021.2.3) | Displays control char | Displays control char | Displays control char | &check; | &check; | &check; |
| Studio (v16.11.5/v8.10.11) | Mangled | &check; | N/A | &check; | &check; | N/A |
| Xcode (v14.0.1) | N/A | &check; | N/A | N/A | &check; | N/A |
| vim (v8.2.1790) | Mangled | Displays codepoint | Displays codepoint | Misrendered | &check; | &check; |
| emacs (v27.2) | &check; | Displays underscores | &check; | &check; | &check; | &check; |
| GitHub (patched Oct '21) | &check; | &check; (except Safari) | &check; | &check; | &check; | &check; |
| Bitbucket (patched Nov '21) | &check; | &check; (except Safari) | &check; | &check; | &check; | &check; |
| GitLab (patched Oct '21) | &check; | &check; (except Safari) | &check; | &check; | &check; | &check; |

&check; means that the code is to the attack on that platform. N/A indicates that the code is not a on that platform. All web-based products were tested on October 2021 releases of Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple Safari. Any de on non- platforms are described.

We note that many of these code ha been patched, and for patched Trojan Source defenses may need to be disabled in settings to these attacks as described in the related paper.

Reproducability

To maximize reproducability, we note that all e were performed on the following operating systems:

As noted, many of the compilers, code editors, and repository frontends examined in this work has since been patched with Trojan Source defenses. To reproduce the results, we recommend installing the known- of software listed above, or disabling any defenses in the settings of later .

To our results, we recommend opening each of the proofs-of-concept in a code , confirming that the code is displayed as depicted in the related paper, and that the program executes the hidden logic rather than the logic when compiled/executed with a compiler/interpreter. Example compiler or interpreter commands are provided in the subdirectory README for each language included in this repository.

#### Docker

To ease reproducability, we provide a Dockerfile that pre-installs and compiles the POCs in this repository using tooling. The following commands will build the image, launch a container, and attach a terminal to the container for faster reproduction of our findings:

Note that the Solidity and Assembly POCs are exluded from the Docker image because they target different platforms than the Ubuntu base image. Reproduction instructions for these two platforms are given in Solidity/README.md and Assembly/README.md.

Attack Detection

Interested in analyzing source code files for the presence of Trojan Source attacks? Check out this repo, which bidirectional o.

Citation

If you use anything in this repository, in the *Trojan Source* paper, or on trojansource.codes in your own work, please cite the following:

项目信息

开发语言：SCSS

Star 数：1287

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Trojan Source: Invisible Vulnerabilities展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。