<?xml version="1.0" encoding="UTF-8"?><xml><records><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>47</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Veneta Yosifova</style></author><author><style face="normal" font="default" size="100%">Vesselin Bontchev</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Possible Instant Messaging Malware Attack Using Right-to-Left Unicode Overriding Characters</style></title><secondary-title><style face="normal" font="default" size="100%">DIGILIENCE 2019</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">file name obfuscation</style></keyword><keyword><style  face="normal" font="default" size="100%">Instant messaging malware attack</style></keyword><keyword><style  face="normal" font="default" size="100%">Microsoft Skype for Linux</style></keyword><keyword><style  face="normal" font="default" size="100%">right-to-left Unicode override</style></keyword><keyword><style  face="normal" font="default" size="100%">Wine</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2019</style></year><pub-dates><date><style  face="normal" font="default" size="100%">2-4 October</style></date></pub-dates></dates><pub-location><style face="normal" font="default" size="100%">Sofia, Bulgaria</style></pub-location><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">&lt;p&gt;The right-to-left special Unicode character has a legitimate use for languages that are transcribed in a right-to-left direction or in an environment that combines both right-to-left and left-to-right languages, like web pages, emails, desktop documents and text messages. These writing systems include right-to-left languages such as Persian, Arabic and Hebrew. The &amp;ldquo;right-to-left&amp;rdquo; attacks have been used for many years for malicious purposes, mostly in email communications. Early in 2018, Kaspersky Lab published an article described a vulnerability in the Windows client of the popular instant messenger Telegram. This vulnerability uses the Unicode &amp;ldquo;right-to-left&amp;rdquo; character to obfuscate the name of the malware file. This paper describes a possible attack that we discovered. It uses a combination of the &amp;ldquo;right-to-left&amp;rdquo; override attack and instant messaging malware attack and presents a realistic threat for another widely used messenger - Microsoft&amp;rsquo;s Skype for Linux. The purpose for conducting this research was to describe an exploit that we discovered and to warn the people who use this communication application about it, as well as to appeal to the producer for fixing it. Additionally, it is important to emphasize that the attack scenario developed by us also impacts other applications that allow file transfer (e.g., e-mail clients) and run on Linux systems with Wine installed.&lt;/p&gt;&lt;p&gt;This paper is included in the program of &lt;a href=&quot;https://digilience.org&quot;&gt;DIGILIENCE 2019&lt;/a&gt; and will be published in the post-conference volume.&lt;/p&gt;</style></abstract></record></records></xml>