New ‘Trojan Source’ Technique Lets Hackers Hide Vulnerabilities in Source Code

A novel class of vulnerabilities could be leveraged by threat
actors to inject visually deceptive malware in a way that’s
semantically permissible but alters the logic defined by the source
code, effectively opening the door to more first-party and supply
chain risks.

Dubbed “Trojan Source attacks^[1],” the technique
“exploits subtleties in text-encoding standards such as Unicode^[2] to produce source code
whose tokens are logically encoded in a different order from the
one in which they are displayed, leading to vulnerabilities that
cannot be perceived directly by human code reviewers,” Cambridge
University researchers Nicholas Boucher and Ross Anderson said in a
newly published paper.

The vulnerabilities^[3]
— tracked as CVE-2021-42574 and CVE-2021-42694 — affect compilers
of all popular programming languages such as C, C++, C#,
JavaScript, Java, Rust, Go, and Python.

Compilers are programs that translate high-level human-readable
source code into their lower-level representations such as assembly
language, object code, or machine code that can then be executed by
the operating system.

At its core, the issue concerns Unicode’s bidirectional (or
Bidi^[4]) algorithm which enables
support for both left-to-right (e.g., English) and right-to-left
(e.g., Arabic) languages, and also features what’s called
bidirectional overrides to allow writing left-to-right words inside
a right-to-left sentence, or vice versa, thereby forcing the
left-to-right text to be treated as right-to-left.

While a compiler’s output is expected to correctly implement the
source code supplied to it, discrepancies created by inserting
Unicode Bidi override characters into comments^[5]
and strings can enable a scenario that yields syntactically-valid
source code in which the display order of characters presents logic
that diverges from the actual logic.

Put differently, the attack works by targeting the encoding of
source code files to craft targeted vulnerabilities, rather than
deliberately introducing logical bugs, so as to visually reorder
tokens in source code that, while rendered in a perfectly
acceptable manner, tricks the compiler into processing the code in
a different way and drastically changing the program flow — e.g.,
making a comment appear as if it were code.

“In effect, we anagram program A into program B,” the
researchers surmised. “If the change in logic is subtle enough to
go undetected in subsequent testing, an adversary could introduce
targeted vulnerabilities without being detected.”

Such adversarial encodings can have a serious impact on the
supply chain, the researchers warn, when invisible software
vulnerabilities injected into open-source software make their way
downstream, potentially affecting all users of the software. Even
worse, the Trojan Source attacks can become more severe should an
attacker use homoglyphs^[6]
to redefine pre-existing functions in an upstream package and
invoke them from a victim program.

“The fact that the Trojan Source vulnerability affects almost
all computer languages makes it a rare opportunity for a
system-wide and ecologically valid cross-platform and cross-vendor
comparison of responses,” the researchers noted. “As powerful
supply-chain attacks can be launched easily using these techniques,
it is essential for organizations that participate in a software
supply chain to implement defenses.”