Attackers typically use masquerading to either trick users into running a malicious file, confuse defenders, or attempt to blend into a target environment. Today, we will take a look at the MITRE TTP "Masquerading: Right-to-Left Override" (T1036.002) and will see, how an attacker can use this feature to their advantage.
First things first: What is "Right-to-Left Override" (RTLO) anyway? As we all know, there are languages that are written from left to right and others that are written from right to left. In computers, the RTLO Unicode character U+202E makes this possible. This character can be used to force a right-to-left direction for text. As an example, let's look at the string "LutraSecurity" and see what happens when we insert the RTLO character in the middle: "Lutra[U+202E]Security" (where [U+202E] is the RTLO character). This string will then be displayed as "LutraytiruceS", because the RTLO character reverts everything after it, in this case the "Security".
So what can an attacker do with this? In filenames, they can abuse RTLO to conceal the true extension of a file. For example, let's say you find the following file somewhere on a network drive:
Salaries-And-Benefits-Annexe.pdf
You know that a PDF is mostly harmless, so you double-click it to see what's inside. But your PDF viewer will not open. This is because you have actually just run an .exe file.
Why? Because the filename of the file is not really "Salaries-And-Benefits-Annexe.pdf". The attacker has added the RTLO character to reverse the last characters of the filename to make it look like a PDF ("exe.pdf" instead of "fdp.exe"). So the actual filename is "Salaries-And-Benefits-Ann[U+202E]fdp.exe".
Bad news is: There isn’t much that can be done about that. The only thing possible is to look out for files that have the inherently benign RTLO character within their filename. This can be done with a filesystem minifilter. But of course, this only works if right-to-left languages are rarely used in your organization. Otherwise there will be too many false positives.