+ =>

t/down | g/koala | t/sparkles

Hi! I'm Katie. You may know me as 'glasnt' or That Emoji Girl

I've been doing this talk about the place called

The Power and Responsibility

of Unicode Adoption

"The power and responsibility of UNicode adoption" I first gave it at this very meetup in March last year. I know right? It sounds like a proper technical talk, but it's actually me just yelling about emoji and stuff Thing is, that's not the name

The Power and Responsibility

of Unicode Adoption

this is the name. it has emoji in the title This has caused me all sorts of fun when trying to propose and present at conferences

For example, some conferences can't get the name right, even when it's been entered into their system

Some like some characters, but not others I had to resubmit this one and remove specific characters

Some won't allow emoji in the talk title, but will in the description (sadface)

Some just get a little bit corrupted (kiwicon)

but sometimes it works! ... on the website

but not on the printed schedule

or on the AV notes. Side note, it's REALLY fun when the person introducing you on stage reads that verbatim

when you have broken unicode in the middle of glossy printed programs, that's fun

but it's not too bad when the schedule poster on the wall just leave them out

because they can be corrected

But the best part is when the digital boards work Because I can tell you exactly what operating system this is running. Windows 8

This is the emoji

Different vendors have implemented emoji differently. In this case, the 'sweat drop' face is the most easily recognisable as windows, because it looks like a face with boils all over it or something (picture of different sweat) Based on this, we can guess the operating system, down to the version, using just the emoji being displayed.

but then sometimes things break completely.

Take this signage, from RubyConf just last week in Melbourne

https://twitter.com/robjacoby/status/829474149143769088 Rob Jacoby, twitter This is what the sign was showing.

So what's this gibberish?

`ud83dude0dnn`

`\ud83d\ude0dnn`

`\ud83d \ude0d nn`

`\u1F60D nn`

`nn`

Thanks Rob

But this is a hacker conf, that's not that interesting What if we could hack with emoji. Is it possible? Well, it depends on your definition of hacking, and emoji

These are not emoji So if, for example, you were to say download an executable claiming to give you an emoji pack for your favourite chat client, that's not hacking. That's you downloading a random executable and getting what's coming to you What's also not hacking, well, technically, is a Denial of Service attack that was recently fixed by apple.

Who is familiar with the Pride Flag emoji that was just added?

it's comprised of two existing emoji, the white flag and the rainbow, but with a special character a Zero Width joiner, between them You don't normally see this because in your flag picker, you see the end result. However

You Can Crash Anyone's iPhone or iPad With A Simple Emoji Text Message (2017)

There was a bug where if you sent the two emoji with a number between them, the device would get really confused, and not know what to do

so it would crash this isn't the firts time a bug like this has happened

This has happened before in what's known as the effective power bug


effective. 
Power 
لُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ
冗

The Effective Power Bug (2015)

how this worked is that the words 'effective power' had no meaning, but the text after it, that's displaying weirdly here, would set it off When this text appeared in a notification popup, the truncation of that message would happen part way in the stuff on the third line, and the phone would get confused and restart but that's not hacking.

`http://xn--9q9h.ws`

that's the domain, but the path...

`?utf8=✓`

`google.com/test/عربي.امارات`

Google Chrome, Firefox Address Bar Spoofing Vulnerability

RTL

`عربي.امارات/google.com/test`

Google Chrome, Firefox Address Bar Spoofing Vulnerability

Anatomy of a Critical Security Bug

What is hacking is this wonderful incident I found involving mysql, not-strict tables, and wordpress With literally a bug that could set the world on fire

`STRICT_ALL_TABLES`

This could have all been avoided if STRICT TABLES had been enabled for wordpress Wordpress core used some of the ... more interesting features of mysql, so they couldn't enable this, and this is why everthing was a fire

This character could break everything.

But not this one.

YOu see, these are two different smiles

`U+263A` `U+1F642`

one dates back to Unicode 1.1, in 1991, and the latter is a newer emoji. Hence why the one of the left has a smaller unicode code point

`E2·98·BA` `F0·9F·98·8A`

The emoji the right uses four bytes And there's a small issue in mysql when strict tables is turned off. If you try and insert an emoji it'll... truncate.

`<q cite="Smile` `">`

`Be Happy</q>`

So, say if you have a Wordpress blog that allows comments, and citations, and you have something like this, which would pass javascript validation because it's a complete tag But because Mysql...

`<q cite="Smile` .

It'd drop about here

`script src="hax.ohno">`

which means that if your NEXT comment happens to be something like this because that's not a script tag, there's no opening angle bracket

`<q cite="Smile`

`...`

`script src="hax.ohno">`

you'd end up with a very large quote tag, that had a script attribute sad trombone.

`CVE-2015-3438`

So that's CVE 2015 3 4 3 8 It's been patched as of WordPress 4.2, so please PATCH YOUR THINGS Wordpress 4.2 introduced emoji natively into the system... and also removed a small issue with it breaking everything but you get new emoji! you should update your things!

MySQL

`STRICT_ALL_TABLES`

also, make sure you enable strict tables, because yowsa.

this probably isn't the only thing out there, but it's something to watch out for

glasnt.com/talks

+ => t/down | g/koala | t/sparkles