Hi all,
In early 2023, malware researchers disclosed a phishing attack that was
targeted at people running Linux workstations. The attack vector
involved the use of filenames containing what looked like a file
extension but instead contained a lookalike for the full stop (".")
and a common extension ("pdf"). Enhance xfs_scrub phase 5 to detect
these types of attacks and warn the system administrator.
If you're going to start using this code, I strongly recommend pulling
from my git trees, which are linked below.
This has been running on the djcloud for months with no problems. Enjoy!
Comments and questions are, as always, welcome.
--D
xfsprogs git tree:
https://git.kernel.org/cgit/linux/kernel/git/djwong/xfsprogs-dev.git/log/?h=scrub-detect-deceptive-extensions
fstests git tree:
https://git.kernel.org/cgit/linux/kernel/git/djwong/xfstests-dev.git/log/?h=scrub-detect-deceptive-extensions
---
Commits in this patchset:
* xfs_scrub: use proper UChar string iterators
* xfs_scrub: hoist code that removes ignorable characters
* xfs_scrub: add a couple of omitted invisible code points
* xfs_scrub: avoid potential UAF after freeing a duplicate name entry
* xfs_scrub: guard against libicu returning negative buffer lengths
* xfs_scrub: hoist non-rendering character predicate
* xfs_scrub: store bad flags with the name entry
* xfs_scrub: rename UNICRASH_ZERO_WIDTH to UNICRASH_INVISIBLE
* xfs_scrub: type-coerce the UNICRASH_* flags
* xfs_scrub: reduce size of struct name_entry
* xfs_scrub: rename struct unicrash.normalizer
* xfs_scrub: report deceptive file extensions
* xfs_scrub: dump unicode points
---
scrub/unicrash.c | 530 +++++++++++++++++++++++++++++++++++++++++++-----------
1 file changed, 424 insertions(+), 106 deletions(-)
