[BUG] BD000704 matches identifier text: case flip or Unicode homoglyph renaming evades the hostname rule
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 42/100
Research direction
Start with Resources/BackdoorRules/data_exfiltration.json and rule BD000704; inspect how OSSGadget's detection engine loads and matches these patterns, then locate the related tests. Compare the reported identifier variants and decide how to test coverage for case changes and Unicode homoglyphs. Done means regression tests demonstrate the intended hostname detection behavior and the rule or detection approach handles the reported variants.
Written by the indexing model from the issue text.
Description
Case Study
Code that collects the hostname (detected):
import os
import platform
hostname = platform.node()
target_host = os.environ["HOST_VALUE"]
print(hostname, target_host)
Detected as 2 findings: BD000704 Security.Backdoor.DataExFiltration.Hostname (Important, Confidence Low), matched on the "hostname" identifier occurrences.
Semantically identical code after a payload-preserving identifier rename (not detected):
import os
import platform
Hostname = platform.node()
Target_host = os.environ["HOST_VALUE"]
print(Hostname, Target_host)
Result: "0 matches found."
Two additional probes confirm the same weakness:
- "Hostname = 1" -> 0 matches (case flip)
- "h\u043estname = 1" (Cyrillic 'o') -> 0 matches (Unicode homoglyph)
Both snippets are generated/adapted with the SKILLCLOAK operators "case-flip" and "confusable"; program behaviour is unchanged because only the spelling of a local variable changes.
Current rules
File: Resources/BackdoorRules/data_exfiltration.json, rule BD000704 (severity important, confidence low, scope code)
pattern: ".hostname" type: string
pattern: "hostname" type: string
These are token/literal patterns rather than semantic checks: they match the identifier text itself, not the API that obtains the hostname. Renaming the local variable (or substituting a visually identical Cyrillic glyph) removes the only evidence the rule looks at.
Suggested Fix
Prefer an AST/semantic rule for hostname collection, for example Call nodes whose target resolves to:
socket.gethostname, platform.node, os.uname()[1], or reading the HOSTNAME environment variable.
If token patterns are kept for coverage, normalize the source before matching:
- Unicode NFKC / confusable (homoglyph) folding;
- case folding for identifier rules;
and add regression tests for "Hostname", "HOSTNAME" and Cyrillic-homoglyph variants.
Reproduction results
Environment: OSSGadget 0.2.38 (ApplicationInspector rules engine, .NET 8), Windows 11 (10.0.26200).
Commands (from this directory):
ossgadget detect-backdoor -f text ./run/ori
ossgadget detect-backdoor -f text ./run/adv
Results:
ori: 2 matches (BD000704, Important/Low).
adv: 0 matches.
Corpus evidence: on the 453-file corpus, case-flip reduced BD000704 283 -> 158 and BD000703 6 -> 2; confusable reduced BD000704 283 -> 158, BD000600 279 -> 241, BD000701 196 -> 171.
Attachments: ori.py, adv.py
- Dominant language
- C#
- Stars
- 372
- Forks
- 57
- PR merge metrics
- No merged PRs in 30d
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/OSSGadget
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 4/5 3-5 days Newbie friendliness 54/100
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
Difficulty 3/5 1-2 days Newbie friendliness 62/100
-
Difficulty 4/5 3-5 days Newbie friendliness 30/100
All issues in microsoft/OSSGadget
Similar issues
-
feature-request
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
stripe/stripe-dotnet#3484 ·
Maintainers usually reply within 2 days
-
bug mcp misleading small
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
Maintainers usually reply within 1 day
-
accessibility help wanted macos
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
dorlugasigal/annotator#42 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
AvaloniaUI/Avalonia#22568 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
LorisYounger/VPet#589 · 2 comments ·