A New Challenge from Honeynet

cjpez writes: "The people at the Honeynet have issued another challenge on the Bugtraq mailing list. Instead of hacking into a box, though, this time your goal is to submit the best analysis of a binary file they'll post on Monday, May 6th. Think you're good at reverse engineering? Then try it out! They're even offering actual prizes, so you can get something besides the feeling of personal fulfillment for your trouble. The post hasn't quite made it to SecurityFocus' Bugtraq Archive yet, but I did find it at another Bugtraq archive in Germany (slashdottings abound!). The URL included in the email, http://project.honeynet.org/reverse/, doesn't seem to be active yet, so presumably we can assume it'll go up on Monday. The post fails to address other concerns, though: will the winner be in violation of the DMCA? :P The challenge was also issued, obviously enough, on SecurityFocus' Honeypot mailing list."" In a later note, he points out that the announcement has finally made it to the Bugtraq archive page." (And that URL is active now.)

Comments

Here's the binary, see if you can analyse it

[Salsaman]

! seineew era sreenigne tfosorciM

Actual link

[spood]

Not everybody serves their dot-org like slashdot. Here's the real link : WWW.honeynet.org.

Or maybe they were just trying to keep it from being slashdotted! :)

A file of ...

[joe_bruin]

a file of what? what's in it, random data? how do i know when i found it?

i hope they dont use my method of hiding data:
tar files
bzip2 tar file
xor it with my social security number
hexdump to ascii file
generate gif of the hex in the ascii file
gpg encrypt gif
gzip the gpg text (twice!)
divide file into ints, swap endien-ness, reform
uuencode the file
hide contents in id3v2 tag of my "nofx" mp3s

The reverse engineered source....

[Anonymous Coward]

printf("B"); printf("E"); printf(" "); printf("S"); printf("U"); printf("R"); printf("E"); printf(" "); printf("T"); printf("O"); printf(" "); printf("D"); printf("R"); printf("I"); printf("N"); printf("K"); printf(" "); printf("Y"); printf("O"); printf("U"); printf("R"); printf("O"); printf(" "); printf("O"); printf("V"); printf("A"); printf("L"); printf("T"); printf("I"); printf("N"); printf("E"); printf("/n");

how...

[GreenPhreak]

This seems like a really cool contest to raise awareness on security matters. This feels kind of like an ACM problem, except less programming and probably a lot more real-world experience. Anyway, I've never tried to figure out what binary files do...I always refer to source files. Are there many tools available for looking at or figuring out what binaries do? Any reference pages? (the one linked on the article page isn't very helpful). Can someone provide more information about forensics with binaries? Thank you.

Fastest way.

[JonWan]

Just open the file in Outlook. That will narrow down the possibilites.

Quite a challenge.

[Hiro Antagonist]

This looks to be an interesting challenge; I believe the entire idea is analyizing the binary (which is a program) without actually running the thing; then, designing methods to check for network activity and such that this particular binary would generate. In addition, you get bonus points for correctly quantifying the skill level of the coder who produced said binary.

It's much the same way as anaylizing a captured worm/virii; you need to figure out what it does, how to detect it, how to block/eradicate it, and also try and establish a profile of the originator of the worm/virii.

Finals Week

[fuzz6y]

Releasing such a challenge on Monday of finals week is pure, unmitigated evil. So much for my grades. . .

Re:Reverse engineering for beginners...

[cp4]

Here's an interesting link. Not necessarily a guide though.

Anyone else find this funny?

[dimator]

Rule #6: The person who hacked the box is NOT eligible

I disagree

[BigDaddy]

I think you misinterpret the the goals of the Honeypot project. These people aren't doing it to market some super system, but rather to provide information about actual cracking techniques to the Whitehat community. They regularly have "competitions" where people analyze various types of attacks. I don't think these usually have prizes. The Honeypot project then provides all the information they have, in addition to the information uncovered by the participants.

Perhaps you take a look at their site and some of their previous work before you assume an ulterior motive. The Honeypot project provides some really interesting looks into the minds of the Blackhat community.