1080
especially of potentially-dangerous conditions or operations. This can be broken down into
several different subtypes.
• Overlay: an area of the display is intended to give critical information, but another process
can modify the display by overlaying another element on top of it. The user is not interacting
with the expected portion of the user interface. This is the problem that enables clickjacking
attacks, although many other types of attacks exist that involve overlay.
• Icon manipulation: the wrong icon, or the wrong color indicator, can be influenced (such as
making a dangerous .EXE executable look like a harmless .GIF)
• Timing: the product is performing a state transition or context switch that is presented to the
user with an indicator, but a race condition can cause the wrong indicator to be used before
the product has fully switched context. The race window could be extended indefinitely if the
attacker can trigger an error.
• Visual truncation: important information could be truncated from the display, such as a long
filename with a dangerous extension that is not displayed in the GUI because the malicious
portion is truncated. The use of excessive whitespace can also cause truncation, or place the
potentially-dangerous indicator outside of the user's field of view (e.g. "filename.txt .exe").
A different type of truncation can occur when a portion of the information is removed due to
reasons other than length, such as the accidental insertion of an end-of-input marker in the
middle of an input, such as a NUL byte in a C-style string.
• Visual distinction: visual information might be presented in a way that makes it difficult for the
user to quickly and correctly distinguish between critical and unimportant segments of the
display.
• Homographs: letters from different character sets, fonts, or languages can appear very similar
(i.e. may be visually equivalent) in a way that causes the human user to misread the text (for
example, to conduct phishing attacks to trick a user into visiting a malicious web site with a
visually-similar name as a trusted site). This can be regarded as a type of visual distinction
issue.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 221 Information Loss or Omission 556
ChildOf 684 Incorrect Provision of Specified Functionality 1505
ParentOf 1007 Insufficient Visual Distinction of Homoglyphs Presented to
User