this isn't really Linux related other than I received
the phishing spam on a Linux system .... but I was
wondering if anyone else has seen this trick before?
the spam, which was HTML, rendered as:
“Drae Baryalcs Mbmeer,
Tihs eliam was snet by the Barcalys sevrer to verify
yruo eamil addrsse. You mtsu comlpete tsih procses
by cikci [ ... ]”
I first took that to be the the worse English I'd ever
seen, and then — once I realized it is surprisingly
understandable — a interesting trick to avoid spam
filters, but completely unconvincing to any human.
puzzled, I looked at the raw HTML. it was (this is
just the first line):
“D‮rae‬ Bar‮yalc‬s M‮bme‬er,”
that is fasinating. U+202E (8238 decimal) is the
“Right-to-Left Override”, and U+203C (8236) is “Pop
Directional Formatting”: so what the above is trying
to do is to write “Dear ...” as (in effect):
D <switch to R-to-L> ear <restore L-to-R> ...
if I am understanding some W3C BiDi doc correctly:
you need to write the characters in the order marked.
so what is actually written is (as in the above-quoted
D <switch to R-to-L> rae <restore L-to-R> ...
that should then (i) display as “Dear ...”,
and (ii) might confuse / sneak by some filters?
has anyone run across this before? this is not only
a new one (to me), but I did not even know of U+202C
et.al. until I tried to decipher the phishing! ;-(
Experienced (20+ yrs) kernel/software Eng: | Brian Foster Montpellier,
• Unix, embedded, &tc; • Linux; • doc; | blf at utvinternet.ie FRANCE
• IDL, automated testing, process, &tc. | Stop E$$o (ExxonMobile)!
Résumé (CV) http://www.blf.utvinternet.ie | http://www.stopesso.com
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!