GCC & LLVM Patches Pending To Fend Off Trojan Source Attacks

Making rounds today are the "Trojan Source" attacks by which text displayed to the end-user/developer doesn't match what is actually being executed. The problem stems from Unicode standards and could lead to malicious code being inadvertently introduced into upstream code-bases that could be overlooked during code review processes, etc. GCC and LLVM/Clang are among the early compilers preparing defenses against Trojan Source style attacks.

This class of "invisible" vulnerabilities that could sneak into codebases through Unicode issues is explained in detail at trojansource.codes. Basically it stems from Unciode control characters being maliciously used to reorder tokens in source code at the encoding level that lead to differing behavior between what is displayed versus executed by the compiler or interpreters.

Trojan Source comes from research out of the University of Cambridge. Preventing such attacks requires updates to code compilers and interpreters against possibly misleading Unicode bidirectional characters. Red Hat's Marek Polacek today posted a preliminary patch for helping to fend off Trojan Source. With the -Wbidirectional= proposed switch, GCC could warn developers around possibly misleading Unicode bidirectional characters encountered by the pre-processor.

Similarly, LLVM patches for similar handling are also pending.