RTLO Override (Right-to-Left Override Attack).

A filename and string obfuscation technique that inserts the U+202E Unicode right-to-left override character to flip the rendered order of characters, masking executables as PDFs, images, or docs. 它属于网络安全的 攻击与威胁 分类。

A filename and string obfuscation technique that inserts the U+202E Unicode right-to-left override character to flip the rendered order of characters, masking executables as PDFs, images, or docs.

The RTLO attack abuses the Unicode bidirectional algorithm by inserting U+202E (RIGHT-TO-LEFT OVERRIDE) into a filename or string. From that point on, characters are rendered right-to-left until a paragraph break, so `invoice_U+202Efdp.exe` is displayed in Explorer, mail clients, and chat apps as `invoice_exe.pdf`. The file is still an executable — the operating system uses the raw byte order — but the user sees what looks like a harmless document. Variants substitute other bidi-control characters (U+200E, U+200F, U+2066-U+2069) and have been weaponized in phishing campaigns since at least 2011; the same family of tricks underlies the 2021 'Trojan Source' research (Boucher & Anderson) showing that BiDi controls in source code can hide back-doored logic from human reviewers while compilers see something different. Mitigations include stripping or visualizing BiDi controls in any UI that displays untrusted filenames, refusing to execute files containing control characters in their names, and linters that warn on BiDi characters inside source code.

针对 RTLO Override (Right-to-Left Override Attack) 的防御通常结合技术控制与运营实践,详见上方完整定义。

常见的别称包括: U+202E attack, Right-to-left override, Trojan Source filename。