[ILUG] [OT] a spammer who ``knows'' Unicode?

[Brian Foster]

 this isn't really Linux related other than I received
 the phishing spam on a Linux system .... but I was
 wondering if anyone else has seen this trick before?

 the spam, which was HTML, rendered as:

   “Drae Baryalcs Mbmeer,

    Tihs eliam was snet by the Barcalys sevrer to verify
    yruo eamil addrsse.  You mtsu comlpete tsih procses
    by cikci [ ... ]”

 I first took that to be the the worse English I'd ever
 seen, and then — once I realized it is surprisingly
 understandable — a interesting trick to avoid spam
 filters, but completely unconvincing to any human.

 puzzled, I looked at the raw HTML.  it was (this is
 just the first line):

   “D‮rae‬ Bar‮yalc‬s M‮bme‬er,”

 that is fasinating.  U+202E (8238 decimal) is the
 “Right-to-Left Override”, and U+203C (8236) is “Pop
 Directional Formatting”:  so what the above is trying
 to do is to write “Dear ...” as (in effect):

    D <switch to R-to-L> ear <restore L-to-R> ...

 if I am understanding some W3C BiDi doc correctly:

    http://www.w3.org/International/questions/qa-bidi-controls

 you need to write the characters in the order marked.
 so what is actually written is (as in the above-quoted
 spam HTML):

    D <switch to R-to-L> rae <restore L-to-R> ...

 that should then  (i) display as “Dear ...”,
 and (ii) might confuse / sneak by some filters?

 has anyone run across this before?  this is not only
 a new one (to me), but I did not even know of U+202C
 et.al. until I tried to decipher the phishing!  ;-(

cheers!
	-blf-
-- 
Experienced (20+ yrs) kernel/software Eng: | Brian Foster   Montpellier,
 • Unix, embedded, &tc;  • Linux;  • doc;  | blf at utvinternet.ie   FRANCE
 • IDL, automated testing, process, &tc.   |  Stop E$$o (ExxonMobile)!
Résumé (CV) http://www.blf.utvinternet.ie  |     http://www.stopesso.com