{"id":304,"date":"2011-08-30T10:47:37","date_gmt":"2011-08-30T17:47:37","guid":{"rendered":"http:\/\/daryllafferty.com\/blog\/2011\/08\/30\/rlo-right-to-left-override\/"},"modified":"2011-08-30T10:58:51","modified_gmt":"2011-08-30T17:58:51","slug":"rlo-right-to-left-override","status":"publish","type":"post","link":"https:\/\/daryllafferty.com\/blog\/2011\/08\/30\/rlo-right-to-left-override\/","title":{"rendered":"RLO (Right to Left Override)"},"content":{"rendered":"<p>I received an email this morning that looked like spam &#8212; Xerox_Document.zip.  Looking inside the zip file was a file like this:<br \/>\n&nbsp;&nbsp;Xerox_Scan_phyexe.doc<\/p>\n<p>Looks like a Word document, right?  NOT!  The sender used something called &#8220;Right to Left Override&#8221;.  It was originally implemented to support languages such as Arabic that write right to left.  If the code is inserted in the middle of a string, the following letters are reversed.  So if you could see the RLO character, it would look like this:<\/p>\n<p>&nbsp;&nbsp;Xerox_Scan_phy[RLO]exe.doc<\/p>\n<p>and if you removed the RLO, you would see the real name like this:<\/p>\n<p>&nbsp;&nbsp;Xerox_Scan_phycod.exe<\/p>\n<p>Clearly an executable program, and that&#8217;s how Windows would interpret it if you tried to open it.  It would then install trojans, viruses or other malware on your computer and you would have a mess.<\/p>\n<p><a href=\"http:\/\/blog.commtouch.com\/cafe\/email-security-news\/using-unicode-to-trick-users-to-install-malware\/\">Here&#8217;s<\/a> another example.<\/p>\n<p>So that&#8217;s a warning.  If you get a file you aren&#8217;t expecting, even if it looks like a harmless Word document, an Excel spreadsheet, a .jpg picture, or even a .txt text file, don&#8217;t willy-nilly open it.   The bad guys are getting better at hiding their evil intent.  Check with the sender first to make sure they really did send you something, and that it is safe.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I received an email this morning that looked like spam &#8212; Xerox_Document.zip. Looking inside the zip file was a file like this: &nbsp;&nbsp;Xerox_Scan_phyexe.doc Looks like a Word document, right? NOT! The sender used something called &#8220;Right to Left Override&#8221;. It was originally implemented to support languages such as Arabic that write right to left. If [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-304","post","type-post","status-publish","format-standard","hentry","category-computers"],"_links":{"self":[{"href":"https:\/\/daryllafferty.com\/blog\/wp-json\/wp\/v2\/posts\/304","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/daryllafferty.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/daryllafferty.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/daryllafferty.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/daryllafferty.com\/blog\/wp-json\/wp\/v2\/comments?post=304"}],"version-history":[{"count":0,"href":"https:\/\/daryllafferty.com\/blog\/wp-json\/wp\/v2\/posts\/304\/revisions"}],"wp:attachment":[{"href":"https:\/\/daryllafferty.com\/blog\/wp-json\/wp\/v2\/media?parent=304"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/daryllafferty.com\/blog\/wp-json\/wp\/v2\/categories?post=304"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/daryllafferty.com\/blog\/wp-json\/wp\/v2\/tags?post=304"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}