{"id":54102,"date":"2019-12-18T00:00:00","date_gmt":"2019-12-17T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii"},"modified":"2020-02-18T14:02:04","modified_gmt":"2020-02-18T11:02:04","slug":"ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","title":{"rendered":"Uso de caracteres Unicode semelhantes para contornar a autentica\u00e7\u00e3o","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub se tornou<\/a><\/noindex> vulner\u00e1vel a um ataque que permite o acesso \u00e0 conta por meio de manipula\u00e7\u00e3o de caracteres Unicode em e-mails. O problema est\u00e1 relacionado ao fato de que alguns caracteres Unicode, ao serem convertidos para mai\u00fasculas ou min\u00fasculas, s\u00e3o traduzidos em caracteres comuns semelhantes (quando v\u00e1rios caracteres diferentes s\u00e3o traduzidos em um \u00fanico caractere \u2014 por exemplo, o caractere turco «ı» e «i» ao serem convertidos para mai\u00fasculas se tornam «I»).<\/p>\n

Antes de verificar os par\u00e2metros de entrada em alguns servi\u00e7os e aplicativos, os dados fornecidos pelo usu\u00e1rio s\u00e3o primeiro convertidos para mai\u00fasculas ou min\u00fasculas e, em seguida, verificados no banco de dados. Se o servi\u00e7o permite a utiliza\u00e7\u00e3o de caracteres Unicode no login ou email, o atacante pode usar caracteres Unicode semelhantes para realizar um ataque que manipula colis\u00f5es em tabelas de convers\u00e3o de mai\u00fasculas e min\u00fasculas (Colis\u00f5es de Mapeamento de Caso Unicode). <\/p>\n

‘ß’.toUpperCase() == ‘ss’.toUpperCase() \\\/\\\/ 0x0131
\n ‘K’.toLowerCase() == ‘K’.toLowerCase() \\\/\\\/ 0x212A
\n ‘John@Gıthub.com’.toUpperCase() == ‘John@Github.com’.toUpperCase()<\/p>\n

No GitHub, o atacante pode<\/a><\/noindex> iniciar o envio de um c\u00f3digo de recupera\u00e7\u00e3o para outro email atrav\u00e9s do formul\u00e1rio de recupera\u00e7\u00e3o de senha esquecido, especificando no formul\u00e1rio um endere\u00e7o que inclui um caractere Unicode que causa uma colis\u00e3o (por exemplo, em vez de mike@example.org, o email mı<\/b>ke@example.org). O endere\u00e7o passou na verifica\u00e7\u00e3o, pois foi convertido para mai\u00fasculas e coincidiu com o endere\u00e7o original (mike@example.org), mas ao enviar o email, foi inserido como estava e o c\u00f3digo de recupera\u00e7\u00e3o foi enviado para o endere\u00e7o falso (mı<\/b>ke@example.org).<\/p>\n

Alguns dos caracteres<\/a><\/noindex>, que causam colis\u00f5es na convers\u00e3o de casos:<\/p>\n

ß \\t0x00DF \\tSS
\n ı \\t0x0131 \\tI
\n ſ \\t0x017F \\tS
\n ff \\t0xFB00 \\tFF
\n fi \\t0xFB01 \\tFI
\n fl \\t0xFB02 \\tFL
\n ffi \\t0xFB03 \\tFFI
\n ffl \\t0xFB04 \\tFFL
\n ſt \\t0xFB05 \\tST
\n st \\t0xFB06 \\tST
\n K \\t0x212A \\tk<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u0430\u0442\u0430\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 Unicode-\u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438 \u0432 email. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u044b Unicode \u043f\u0440\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043d\u0438\u0436\u043d\u0438\u0439 \u0438\u043b\u0438 \u0432\u0435\u0440\u0445\u043d\u0438\u0439 \u0440\u0435\u0433\u0438\u0441\u0442\u0440 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u043e\u0431\u044b\u0447\u043d\u044b\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u044b, \u0431\u043b\u0438\u0437\u043a\u0438\u0435 \u043f\u043e \u043d\u0430\u0447\u0435\u0440\u0442\u0430\u043d\u0438\u044e (\u043a\u043e\u0433\u0434\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u043e\u0434\u0438\u043d \u0441\u0438\u043c\u0432\u043e\u043b — \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0442\u0443\u0440\u0435\u0446\u043a\u0438\u0439 \u0441\u0438\u043c\u0432\u043e\u043b «ı» \u0438 «i» […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54102","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uso de caracteres Unicode semelhantes para contornar a autentica\u00e7\u00e3o | ProHoster","description":"O GitHub se tornou vulner\u00e1vel a um ataque que permite o acesso \u00e0 conta atrav\u00e9s da manipula\u00e7\u00e3o de.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 Unicode-\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"GitHub \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u0430\u0442\u0430\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-17T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54102","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 10:02:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:12:23","updated":"2026-01-24 10:02:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/54102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=54102"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/54102\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=54102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=54102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=54102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}