Slashdot Mirror
A New Challenge from Honeynet
cjpez writes: "The people at the Honeynet have issued another challenge on the Bugtraq mailing list. Instead of hacking into a box, though, this time your goal is to submit the best analysis of a binary file they'll post on Monday, May 6th. Think you're good at reverse engineering? Then try it out! They're even offering actual prizes, so you can get something besides the feeling of personal fulfillment for your trouble. The post hasn't quite made it to SecurityFocus' Bugtraq Archive yet, but I did find it at another Bugtraq archive in Germany (slashdottings abound!). The URL included in the email, http://project.honeynet.org/reverse/, doesn't seem to be active yet, so presumably we can assume it'll go up on Monday. The post fails to address other concerns, though: will the winner be in violation of the DMCA? :P The challenge was also issued, obviously enough, on SecurityFocus' Honeypot mailing list."" In a later note, he points out that the announcement has finally made it to the Bugtraq archive page." (And that URL is active now.)
It's "ntldr"
Karma: 0 (But I wield a mean +10 Vorpal Apathy)
Last year the Honeynet Project sponsored the Forensic Challenge,
a competition amongst the security community to study, analyze,
and report on a computer hacked in the wild. The result was a
complete forensic analysis of the hacked system. Both the analysis
from different individuals and the the images of the hacked
computer are shared and used to this day.
This year we are continuing that tradition and are announcing the
Reverse Challenge. The goal of this challenge is to develop reverse
engineering skills amongst the security community. Your mission, if
you should choose to accept, is to analyze and report on a binary
captured in the wild. Your analysis will then be judged by a panel
of experts, rated, and shared with the security community.
This year we actually have prizes. Top prizes include licensed
copies of IDA Pro, $200 Amazon gift certificate from DataRescue, and
free pass to the Black Hat Briefings. As if that was not enough, the
top 20 entries get a signed copy of the Honeynet book, Know Your Enemy
(you know, the book the guy down the hall is using as a door stopper
Judges include:
- David Dittrich
- K2
- Halvar
- Job de Haas
- Niels Provos
- Gera
The challenge officially begins Monday, 06 May when we release the
binary. You have between now and the 6th to get your tools ready,
form teams if you wish, and stock up on the caffeinated beverage of
choice. You will then have four weeks to complete your analysis and
submit your report no later the 24:00 GMT, Friday, 31 May. Submissions
will be judged and then released 01 July. You can learn more about the
challenge now, and download the binary on 06 May, at
http://project.honeynet.org/reverse/
All question, concerns, and submissions should be sent to
We hope that the community has fun with this, with the ultimate goal
of learning and sharing. Let the games begin!
--- The Honeynet Project
PS, the person who hacked our Honeynet is not eligible to submit an entry,
you know who you are. The question is, do we?
Pedro Côrte-Real.
or are they just asking what the purpose of binary is? Reading from their challenge, that pretty much summing it up..or I could just need a nap
Slashdot Hypocrisy at work?
they are going to release a binary found in the wild
in other words, a trojan, altered system binary from a rootkit, or the like
we are supposed to determine what it is, what it does, what it doesn't do, that sort of thing. then write up our findings in a nice professional package for fun, fame and prizes
Will work for paycheck.
! seineew era sreenigne tfosorciM
Not everybody serves their dot-org like slashdot. Here's the real link : WWW.honeynet.org.
:)
Or maybe they were just trying to keep it from being slashdotted!
---- Just another spud server.
a file of what? what's in it, random data? how do i know when i found it?
i hope they dont use my method of hiding data:
tar files
bzip2 tar file
xor it with my social security number
hexdump to ascii file
generate gif of the hex in the ascii file
gpg encrypt gif
gzip the gpg text (twice!)
divide file into ints, swap endien-ness, reform
uuencode the file
hide contents in id3v2 tag of my "nofx" mp3s
PS, the person who hacked our Honeynet is not eligible to submit an entry, you know who you are. The question is, do we? .... :)
ok then your [sic] infringing on my copyright! Could you as [sic] me next time before STEALING my comments for your own?
Damn, you've found out their sekrit plot to uncover the cracker!
Anyone know where I can find a newbie's guide to reverse engineering? Although I've done a bit of low level programming, I never got beyond the basics, and all I've done recently is modify the 'START' string in explorer.exe using ultraedit-32.
SpamNet - a spam blocker that really works
printf("B"); printf("E"); printf(" "); printf("S"); printf("U"); printf("R"); printf("E"); printf(" "); printf("T"); printf("O"); printf(" "); printf("D"); printf("R"); printf("I"); printf("N"); printf("K"); printf(" "); printf("Y"); printf("O"); printf("U"); printf("R"); printf("O"); printf(" "); printf("O"); printf("V"); printf("A"); printf("L"); printf("T"); printf("I"); printf("N"); printf("E"); printf("/n");
This seems like a really cool contest to raise awareness on security matters. This feels kind of like an ACM problem, except less programming and probably a lot more real-world experience. Anyway, I've never tried to figure out what binary files do...I always refer to source files. Are there many tools available for looking at or figuring out what binaries do? Any reference pages? (the one linked on the article page isn't very helpful). Can someone provide more information about forensics with binaries? Thank you.
I drink to prepare for a fight; tonight I'm very prepared. -Soda Popinksi
Wouldn't it be great if it turns out to be the newest format forIndivBox.key
Just open the file in Outlook. That will narrow down the possibilites.
This looks to be an interesting challenge; I believe the entire idea is analyizing the binary (which is a program) without actually running the thing; then, designing methods to check for network activity and such that this particular binary would generate. In addition, you get bonus points for correctly quantifying the skill level of the coder who produced said binary.
It's much the same way as anaylizing a captured worm/virii; you need to figure out what it does, how to detect it, how to block/eradicate it, and also try and establish a profile of the originator of the worm/virii.
--
I Hit the Karma Cap, and All I Got Was This Lousy
Releasing such a challenge on Monday of finals week is pure, unmitigated evil. So much for my grades. . .
If you're going to be elitist, it would help to be elite.
Rule #6: The person who hacked the box is NOT eligible
python -c "x='python -c %sx=%s; print x%%(chr(34),repr(x),chr(34))%s'; print x%(chr(34),repr(x),chr(34))"
Guess I need not waste my time ;->
Perhaps you take a look at their site and some of their previous work before you assume an ulterior motive. The Honeypot project provides some really interesting looks into the minds of the Blackhat community.
You can't get a blue screen on a black and white monitor.
I'm sure someone has noted by now that ZDNet is carrying this story. On ZDNet it was posted at 4PM. It seems quite possible to me that they picked it up because it was running on Slashdot - it's much more a geek story than an enterprise-techie one. The media getting their news from Slashdot? - a disturbing prospect, and totally circular. What shall we read, dear Liza?
> I just mv it to dev/null.
/dev/null, and you won't have a /dev/null special file anymore, which can break a LOT of stuff. (mmap(/dev/null, bunch_o_bytes) is a common way to allocate memory, for example). If you DO blow away your /dev/null, you need to know the maj/min numbers for that device and recreated it with mknod.
The file will still be there, only it will be called
Do daemons dream of electric sleep()?
Why bother?
I mean, the people from the honeynet project are going to post the complete entries of the top 20 anyway, and one of the criteria they're going to use is how well documented (i.e. "good for learning") the entry is. 'Tis better to learn that way than to stumble through hundreds of "I got this far and then quit" entries on some quickly pieced together slash site.
I for one hope that I'll actually get off my ass and enter this one; I've analyzed a few of their forensics "scan of the month" but have never gotten around to submitting a writeup. (Expository writing always seems so draining)
Read the challenge and results from last year. Great stuff!
karma capped