{"id":54102,"date":"2019-12-18T00:00:00","date_gmt":"2019-12-17T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii"},"modified":"2020-02-18T14:02:04","modified_gmt":"2020-02-18T11:02:04","slug":"ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","title":{"rendered":"Using similar Unicode characters to bypass authentication","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub turned out to be<\/a><\/noindex> susceptible to an attack that allows account access to be taken over by manipulating Unicode characters in email. The issue is that some Unicode characters, when applying case conversion functions, are transliterated into regular characters that look similar (when several different characters are transliterated into one character \u2014 for instance, the Turkish character «ı» and «i» are both converted to «I» when uppercased).<\/p>\n

Before checking the login parameters in some services and applications, the data provided by the user is initially converted to uppercase or lowercase and then checked against the database. If the service allows the use of Unicode characters in the login or email, then an attacker can use similar Unicode characters to carry out an attack that manipulates collisions in the character case conversion tables (Unicode Case Mapping Collisions). <\/p>\n

'\u00df'.toUpperCase() == 'ss' \/\/ 0x0131
\n '\u212a'.toLowerCase() == 'K'.toLowerCase() \/\/ 0x212A
\n 'John@G\u0131thub.com'.toUpperCase() == 'John@Github.com'.toUpperCase()<\/p>\n

On GitHub, the attacker could<\/a><\/noindex> initiate the sending of a recovery code to another email through the password recovery form by specifying an address in the form that includes a Unicode character causing a collision (for example, instead of mike@example.org, the email m\u0131<\/b>ke@example.org was provided). The address passed validation because it was converted to uppercase and matched the original address (mike@example.org), but during the email sending, it was inserted as is, and the recovery code was sent to the fraudulent address (m\u0131<\/b>ke@example.org).<\/p>\n

Some of the characters<\/a><\/noindex>, causing collisions during case conversion:<\/p>\n

\u00df \t0x00DF \tSS
\n \u0131 \t0x0131 \tI
\n \u02ff \t0x017F \tS
\n \ufb00 \t0xFB00 \tFF
\n \ufb01 \t0xFB01 \tFI
\n \ufb02 \t0xFB02 \tFL
\n \ufb03 \t0xFB03 \tFFI
\n \ufb04 \t0xFB04 \tFFL
\n \u222b \t0xFB05 \tST
\n \u222e \t0xFB06 \tST
\n \u212a \t0x212A \tk<\/p>\n

<\/a><\/noindex><\/p>\n

Source: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u0430\u0442\u0430\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 Unicode-\u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438 \u0432 email. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u044b Unicode \u043f\u0440\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043d\u0438\u0436\u043d\u0438\u0439 \u0438\u043b\u0438 \u0432\u0435\u0440\u0445\u043d\u0438\u0439 \u0440\u0435\u0433\u0438\u0441\u0442\u0440 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u043e\u0431\u044b\u0447\u043d\u044b\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u044b, \u0431\u043b\u0438\u0437\u043a\u0438\u0435 \u043f\u043e \u043d\u0430\u0447\u0435\u0440\u0442\u0430\u043d\u0438\u044e (\u043a\u043e\u0433\u0434\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u043e\u0434\u0438\u043d \u0441\u0438\u043c\u0432\u043e\u043b — \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0442\u0443\u0440\u0435\u0446\u043a\u0438\u0439 \u0441\u0438\u043c\u0432\u043e\u043b «ı» \u0438 «i» […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54102","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Using similar Unicode characters to bypass authentication | ProHoster","description":"GitHub turned out to be susceptible to an attack that allows access to an account through manipulation with.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 Unicode-\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"GitHub \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u0430\u0442\u0430\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-17T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54102","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 10:02:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:12:23","updated":"2026-01-24 10:02:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/54102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=54102"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/54102\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=54102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=54102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=54102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}