RTLO Override (Right-to-Left Override Attack).

A filename and string obfuscation technique that inserts the U+202E Unicode right-to-left override character to flip the rendered order of characters, masking executables as PDFs, images, or docs. Cette notion relève de la catégorie Attaques et menaces en cybersécurité.

A filename and string obfuscation technique that inserts the U+202E Unicode right-to-left override character to flip the rendered order of characters, masking executables as PDFs, images, or docs.

The RTLO attack abuses the Unicode bidirectional algorithm by inserting U+202E (RIGHT-TO-LEFT OVERRIDE) into a filename or string. From that point on, characters are rendered right-to-left until a paragraph break, so `invoice_U+202Efdp.exe` is displayed in Explorer, mail clients, and chat apps as `invoice_exe.pdf`. The file is still an executable — the operating system uses the raw byte order — but the user sees what looks like a harmless document. Variants substitute other bidi-control characters (U+200E, U+200F, U+2066-U+2069) and have been weaponized in phishing campaigns since at least 2011; the same family of tricks underlies the 2021 'Trojan Source' research (Boucher & Anderson) showing that BiDi controls in source code can hide back-doored logic from human reviewers while compilers see something different. Mitigations include stripping or visualizing BiDi controls in any UI that displays untrusted filenames, refusing to execute files containing control characters in their names, and linters that warn on BiDi characters inside source code.

Les défenses contre RTLO Override (Right-to-Left Override Attack) combinent habituellement des contrôles techniques et des pratiques opérationnelles, comme détaillé dans la définition ci-dessus.

Noms alternatifs courants : U+202E attack, Right-to-left override, Trojan Source filename.