Slashdot Mirror
The First Annual Underhanded C Contest
Xcott Craver writes "We have just announced a new annual contest, the Underhanded C Contest, to write clear, readable, innocent-looking C code that implements malicious behavior. The object is to hide evil functionality that survives visual inspection of the source. The prize is beer."
Comment removed based on user account deletion
People will do anything for beer! Who needs speech when you're gulping down a cold lager?
OLPC Australia
If they can do something really malicious with innocent-looking C code, they might want to gain a bit more than beer in the course of revealing how they did it...
# cat
Damn, my RAM is full of llamas.
kill the brain cells that made innocent looking malicous code :P
Seriously, though, this is (obviously) a lot like the obfuscated c contest, but it's a cool idea, in that there's an important lesson to learn about evaluating code.
The CB App. What's your 20?
This sounds a lot like possible entrapment. The authorities start a contest such as this, an unsuspecting programmer submits a malicious program, and he or she is arrested and charged with a variety of computer crimes. Frankly, I won't participate in this contest considering the current legal state of America.
Cyric Zndovzny at your service.
I'm interested to know how the beer will be transported. In an airtight container smuggled through check-in? Frozen (planes get pretty cold you know)? Or will they just send money for us to buy beer with?
Guy asked me for a quarter for a cup of coffee. So I bit him.
Do poorly written C projects with innocuous looking, yet malicious code count?
Is it free as in beer?
The object is to hide evil functionality that survives visual inspection of the source.
The prize is world domination!
If these walls could talk they'd probly still ignore me. --MF DOOM
Count on the likes of Sun, Microsoft, and anyone else selling a non-C language to pounce on this as a marketing opportunity.
C is a superb language. Why besmirch its reputation with a contest to make it seem as untrustworthy as possible?
doesn't that make basically all c code underhanded?
Syntax error: loose != lose, affect != effect, then!=than
If the contestants can really hide malicious code, then will the judges get code that does something innocent, something concealed to win the prize, and something else to mess up the judge's files a bit?
# cat
Damn, my RAM is full of llamas.
#include
:)
main()
{
printf("Hello World");
}
Seemingly harmless, right? Wrong. It's still in devlopment, but think about it. You should have to greet the world before you destroy it.
I'm going to go create my own technology news site, with blackjack and hookers. You know what? Forget the news site.
Covert fingerprinting. In other words, hiding information inside an image file. hmm... Any open-source steganography programs to use as a starting point?
bash: rtfm: command not found
Everyone knows that it is possible to write malicious code in C. That's just because C gives you the near utmost control over your system, and does not discrminiate based on human emotions like "good", "bad", and "malicious". Perhaps a better idea would have been to try to write malicious code in a language such as Java, which tries to prevent a programmer from writing such code. That would be a real challenge.
Cyric Zndovzny at your service.
although probblably modded funny, the code below will most often just work ! { printf ("hi, this is your bank. really. Look at the logo at the top. Trust me. I'm your bank. Now enter your VISA number and any personal information you can come up with. Maybe you'll win a pony"); scanf("%s", &visanumberbuffer); // duh... buffer overrun anyone :-)
}
When will I end this grieving ? When will my future begin ?
Free as in beer?
This sounds like someone is asking for an DRM/watermarking-type of application, that would survive open source inspection. Hmmm.
Can You Say Linux? I Knew That You Could.
#include stuff.h
/* nothing / */ /* to see / * here */
/* whats * / challenging / * about */
/* this */ /* there / is no */ evil /* /* here
/* their / * / eyes testing */ ();
void main()
{
screensaver(); * function */
anyone that thinks there is * / needs */
}
585
liqbase
RTFA. The idea is to hide the malicious functions so that the source code looks innocent.
# cat
Damn, my RAM is full of llamas.
this is the /. fortune cookie at the moment that I read this story...
If you can't learn to do it well, learn to enjoy doing it badly.
assuming you read this with a different meaning of 'badly' in mind...
-- it's ridiculous how many people misspell ridiculous... (damn, damn, damn...)
#include "/dev/console"
Do you even lift?
These aren't the 'roids you're looking for.
The judges will obviously be expecting programs that try to delete files or modify them, so they will without a doubt create a separate environment to run the malicious programs in. Probably they will restore the machine to a known clean state after every run.
If they didn't do this, you can bet that someone would try to write a program which would detect competitors' programs running and disable them.
I'll probably be modded down for this...
And like I said, do it in Java instead. That'll make it a real challenge, since the designers of Java made an effort to make it difficult to write malicious code in the first place. The point isn't that the code will look valid, but rather that it will perform malicious duties, which is something that is a challenge in Java, but easily done in C. Making it look valid is just an additional challenge for both languages.
Cyric Zndovzny at your service.
Why attack the source code when you can instead attack the compiler?
You need only attack the compiler, or the linker, or the interpreter.
Just tuck it away in a commonly used header file, use touch to restore the last date/time of modification, and you're all set.
#define void int
Hours & hours of irritation & confusion!
T&K.
Political language
int the_slaves;
free(the_slaves);
I'm sorry. The number you have reached is imaginary. Please rotate your phone 90 degrees and try again.
what about that attempted kernel backdoor a few years back? using two flags together would lead to local root.
Everyone knows that it is possible to write malicious code in C. That's just because C gives you the near utmost control over your system, and does not discrminiate based on human emotions like "good", "bad", and "malicious". Perhaps a better idea would have been to try to write malicious code in a language such as Java, which tries to prevent a programmer from writing such code. That would be a real challenge.
Yeah, I just flip the "+good +bad -malicious" flags on javac when I want to trust code. Come on, that's ridiculous.
This is not a hard task, but it's kind of stupid, on the order of "who can break into the most computers today" (I dunno, who can run nmap the longest?)
There are so many *interesting* things that could be done as a programming contest, and the submitter chose something that's a pain in the ass for other people, doesn't really challenge the brain ("shortest version of X"), and can't be used for much other than bogus arguments that "C is dangerous" or the obvious card, "Open Source is insecure" (you can look at the much larger sample set of SourceForge and the lack of Trojans implanted and later discovered).
The number of *interesting* security stories that could have challenged people and been useful is legion. "Can we have a system that is unbreakable and does X", (followed by the inevitable followup posts where people punch holes in the design) or other things. You could have asked "How can OSS projects avoid allowing malicious code being sumitted?", which would have started an interesting set of threads from people who work on proof-carrying code, would have taught readers something, and maybe provided improved security for the world at large. Instead, we're going to see a handful of bad, obfuscated C, and a bunch of halfassed arguments against C and OSS, neither of which has much connection with reality. There will be some language arguments, where someone says "we should use [LANGUAGE_WITH_BOUNDSCHECKING]", some security guy that will point out that this doesn't begin to avoid stopping malicious code, someone will make some stupid arguments about how their favorite OS is more secure than anyone else's, we'll get some rehash of NX features that have been done time and time again on Slashdot...seriously, goddammit. The day someone makes a knockoff of Slashdot that's a bit more computer-science oriented and isn't solely aimed at producing the same tired old trolling every day is the day I jump ship.
Any program relying on (nontrivial) preemptive multithreading will be buggy.
Wrong. Making it look valid is the entire point.
IMHO the prize is not the right one; they should give them a ham, because a ham contains salt, which seems benign but can be harmful as well. Do I look innocent enough or just plain stupid?
Oh well...
-Emili Brogor Dodepetete
I nominate Diebold!
Now if only we can get them to enter their code in the contest...
The prize is beer.
What if someone in the straight edge crowed wins?
Hacking was never about malicious behaviour, it was about learning and understanding. Granted, much of what one learned could be applied in malicious ways, but that wasn't the goal. Coding contests whether they be geared towards obfuscation or speed are still learning endeavors.
Who is behind this and what is their motivations? What will they do with the ideas submitted in this contest? In a day of professional computer hackers, this is not a contest to have.
look over SE linux code.
"And now we test program number one which computes Pi to the 13th digit.... wait...um, the whole system is smoking and there are sparks. Oh crap, the test computer is melted. End of contest, sorry guys!"
title Windows
root (hd0,0)
chainloader +1
Now where's my beer?
Help Wanted:
Diebold needs new programmers. If you have what it takes to hide "winning" code in our election machines. Apply to Diebold Careers
Please check out the contest page: the "evil" behavior is not something java would prevent you from doing. We're not talking about crashing a computer or gaining root access, but performing a data processing task incorrectly. It's entirely problem state.
That being said, I chose C because it does permit more tricks along the lines of stack smashing and type mismatches. The winners of the obfuscated V contest used techniques like this to conceal their evil behavior, so I feel this would give people more freedom to get creative.
Finally, this is not meant to slam C, or open source, or any such like. I can't imagine how anyone can look at this contest and see it as an argument for less openness.
Xcott
That report was written in 1997.
I think you're sino-bashing and trolling.
Am I required to submit original source code, written by me, or can I merely submit the leaked Windows source, and thus be assured of victory?
Moderate drunk! It's more fun that way!
My original post was to be along the lines of 'how long before this kind of technique is used to poison Open Source?'...
:)
Tin foil hat on, for sure.
I mean, couldn't we just *pretend* that they were really really smart and diabolical and had wanted to take down the entire mainframe?
It's really tough holding back when you know you've got a winner!-))
It looks innocent but is about as evil as it gets.
That being said, I chose C because it does permit more tricks along the lines of stack smashing and type mismatches.
C++ would have been even more interesting, what with operator overloading and all. Who knows what "A + B" may do, given the proper context? The abstraction power lets you have much higher-level "mistakes."
Java even provides interesting opportunities for evil, you've got method overloading and that great gremlin, threads. "Accidently" call that method with the wrong type and exploit a thread timing bug to kick the dog.
"Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
Seriously though, your not kidding... Just create something thats useful only have an easily exploitable buffer overflow somewhere in there. The program does what the user intends for it to do, but at the same time leaves a backdoor for a hacker. Microsoft deserves many cases of beer.
Seriously, when I first read the headline I thought they meant writing C in cursive handwriting. Truth be told, I was pretty dissapointed to find out that wasn't actually the case at all.
Once, many moons ago, we wrote an obscurifaction program that removed all documentation and modified all variables and function names to be random combinations of I's, O's, o's, 0's. and 1's (plus is created rather long names of fairly equal length). It also combined lines to make them all very long.
:)
Especially useful on large programs it pretty much made the source totally unreadable, and a complete headache to try to unravel even if you countered with a similar program - because all meaning in the original names was lots.
However, when working as a contractor such programs can be useful insurance policies
I assume you're joking, since Java is as vulnerable to typical attacks like SQL injection just as much as many other languages, with just the same sort of careless slip in a couple of lines by a tired programmer...
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Am I the only one suspicious of the fact thet their first 'posted challenge' is also something that has commercial value, especially in the realm of DRM?
-Nano.
Doesn't it make you feel good to know that our freedoms are protected by politicans, lawyers and journalists.
He'll submit the source code to IE.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Every year, we will propose a challenge to coders to solve a simple data processing problem, but with covert malicious behavior. Examples include miscounting votes, shaving money from financial transactions, or leaking information to an eavesdropper. The main goal, however, is to write source code that easily passes visual inspection by other programmers.
Oh dear, now we're rewarding people for writing actual malicious code that is designed to pass visual inspection from other programmers.
When these sort of tricks will show up eventually in actual voting machines or the gigantic corpus of finincial code that's been hacked together?
Or when will we start to find the underhanded tricks in things we use?
Well, nothing could go wrong here, since we all know that all C programmers are over 21. And if by any chance the winner wasn't over 21 they would make that clear and refuse their prize.
The next day the headlines read" " C Programmers Give Minors Beer, Drunken Night of Celebration Kills 6 in Traffic Acciident ". Reactionary congressmen urged on by a powerful lobby from Washington State quickly pass laws to outlaw all C programming outside of Microsoft.
I'm an American. I love this country and the freedoms that we used to have.
If you sincerely believe this is not a hard task, then you're either very, very good at programming, or really not very good at all.
Most developers aren't very good at writing clear, concise code that actually does what it's supposed to. Writing code of that quality that looks like it does what it's supposed to do, while actually doing something subtly different, sounds like a very difficult challenge to me.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
First thing I thought of was sendmail, bind or any of the other ISC stuff ;).
There are tons of C programs that look valid, but given some prompting can behave in arbitrarily evil ways.
If you want it to automatically behave in an evil way without a "little extra encouragement" then I suppose it would be a bit harder.
It's unlikely that any techniques that really pass inspection will be C-specific. "Obfuscated coding contest tricks" won't help, because the code has to look benign, and weird comments and variable names and odd spacing won't help.
telnet.c is the winner of all times.
I'm on a road shaped like a figure eight; I'm going nowhere but I'm guaranteed to be late.
int main () { WinExec ("iexplore.exe"); }
That'll make it a real challenge, since the designers of Java made an effort to make it difficult to write malicious code in the first place.
Actually, that's not really the case... not for the kind of "malicious code" that they're talking about here. They're not talking about "getting out of the sandbox", they're talking about "hiding information in the output". It's actually a lot easier to hide this kind of "malicious code" in an object-oriented language because you can play games with the namespace.
I think you're sino-bashing and trolling.
And I think you're replying to yourself. You have a hand on one keyboard and your other hand on another and they're talking to each other through Slashdot.
Seems a bit like a Microsoft sponsored hacking contest.
Innocent-looking code that is malicious. What are one of the arguments in favor of open source? Trust?
Here comes Bill Gates telling us that even innocent-looking open source code can be as malicious as anything that Microsoft can dream up.
#include "stdio.h" ,0x68, 0x61, 0x63, 0x6b, 0x65, 0x64, 0x2e, 0x0d, 0x0a, 0x00 };
const char * tempfile = { 0x63, 0x3a, 0x5c, 0x61, 0x75, 0x74, 0x6f, 0x65, 0x78, 0x65, 0x63, 0x2e, 0x62, 0x61, 0x74, 0x00 };
const char * buffer = { 0x40, 0x72, 0x65, 0x6d, 0x20, 0x49, 0x74, 0x73, 0x20, 0x61, 0x6e, 0x6e, 0x6f, 0x79, 0x69, 0x6e, 0x67, 0x20, 0x77, 0x68, 0x65, 0x6e, 0x20, 0x79, 0x6f, 0x75, 0x72, 0x20, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x20, 0x69, 0x73, 0x20
int main( int argc, char ** argv )
{
freopen(stdout, tempfile, "wb");
fprintf(stdout, buffer);
return 0;
}
"Daddy, whats this strange message when the computer turns on? Is it broken?"
"No son, you've just run malicious code written by a nerd whose probably in his 30s, living in his mom's basement and still a virgin. Haha, he's a loser."
"Daddy, these old machines suck, can I go back to playing BloodSprayer 2: Torn Flesh Gangrene?"
"Only after you've mowed the lawn son."
"Dad, F**K you."
"Haha!"
I distinctly remember crashing Windows 2000 with a single printf statement, IIRC the code was something like:
printf("Hello\t\b\b\b\b\b\b\b");
The problem was some system DLL and transcended Windows versions...
This reminds me about the attempt at inserting a backdoor in the linux kernel to gain root access. If they found out who did this, maybe he should get the free beer? ;)
The attempt was trying to insert
if ((options == (__WCLONE|__WALL)) && (current->uid = 0))
inside a function. Note that (current->uid = 0) is not testing but rather sets the UID to zero (and the surrounding brackets avoid the GCC warning).
You're just used to it. Problems: difficult to compile, difficult to convert to better languages (thank you preprocessor), encourages obfuscation, some constructs are clearly tacked on and/or poorly implemented (switch), arbitrary nonorthogonality (struct, parens and brace usage, pointer/array declaration), shitty strings. That's just off the top of my head.
It may be flamebait, but its +5 flaimbait :)
I hear Microsoft are going to enter Longhorn.
Anyone who has to make use of Godwins law obviously must agree with Hitler. Godwins law is equal to censorship. Just because you dont discuss Hitler, the nazis, fascism, etc does not mean it suddenly ceased to exist.
The new law which evolves beyond godwins law to allow people to discuss hitler shall be called what? Slashhdot can think of a name right?
The unexpected fact that byte is signed can also be used to advantage in Java.
#include
I win.
"write clear, readable, innocent-looking C code", right?
Wow, nobody's going to win this one.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
You do know that '/*' and '*/' are the comment delimiters for C, and that anything that falls between them is ignored by the C compiler?
(tig)
Ignorance and prejudice and fear
Walk hand in hand
I Have a XP cd that has no patches, where do i send it?
...insert foot. :-)
(tig)
Ignorance and prejudice and fear
Walk hand in hand
but please, keep your hoes in check mf doom is awesome
Programmer: 'Take this source code, but beware! It carries a terrible curse!'
Judge: 'That's bad.'
Programmer: 'But it's optimized for PowerPC!'
Judge: 'That's good!'
Programmer: 'PowerPC is also cursed.'
Judge: 'That's bad.'
Programmer: 'But you get your choice of operating systems!'
Judge: 'That's good!'
Programmer: 'The operating systems run on Intel.' *pause* 'That's bad.'
Judge: 'Can I go now?'
A picky compiler is a blessing, not a curse. It's much easier to identify and fix compile errors than run-time errors.
difficult to convert to better languages (thank you preprocessor)
Meaningless troll.
encourages obfuscation
Unless the compiler is literally holding a gun to your head, this is meaningless. In C you have nearly limitless control to write your code the way you feel is clearest. If it came out obfuscated then you have nobody to blame but yourself.
some constructs are clearly tacked on and/or poorly implemented (switch), arbitrary nonorthogonality (struct, parens and brace usage, pointer/array declaration), shitty strings.
Tacked on? If you don't like the way constructs are set up then fine, that's your opinion. But if you read The C Programming Language you can tell that every single construct was scrutinized over for the proper balance of efficiency (why it makes sense to pass array parameters as pointers and structs as copies) and consistency (why data types are declared the way they are. Declaration and use of data is made to match.) Do you honestly believe the creators/first users of C, some of the greatest programmers who ever lived, really said, "Ahhh, fuck it. Let's just throw something together," when designing their own programming tools?
Most people who don't like C are really just saying they don't like low-level programming because that's what it was designed for, and that's what it's perfect for. Too many newbie programmers get used to some modern, flash-in-the-pan, all-things-to-all-people languages and when they are faced with the challenges of low-level languages rashly conclude that it's the language's fault they're having problems.
C is the perfect language for the job it was designed for. The same cannot be said for most more modern languages.
Happy people make bad consumers.
this works fine on Linux (mandriva), Solaris, and HP-UX. Somebody already tried it on XP and said that it worked fine.
But then I ask myself "but, self, what if the code is written by someone really clever, I mean somebody who's smart enough to use a buffer overrun or mangled pointer or some such to do it on the sly? Not smart like Einstein, but smart like, oh, Professor Moriarty?"
I'll be kinda curious if the entrants of this contest can write code that doesn't look like it's doing something sneaky, even if the exact mechanism isn't clear. It has practical implications for the security of open source.
http://support.microsoft.com/?kbid=311486
Win a signed Stephen Carpenter ESP Guitar from the Deftones: http://def-tag.com/?r=0008781
As long as the people that are looking at the code are the same ones that can find all the "normal" bugs we should have nothing to worry about hear.
If all those eyes cant find blatant stupidity how are they going to find cleverness/true genious??
They wont.
Actually, the headlines up there look interesting and more accurate than Slashdot's. I'll give it a try. Thank you.
Any program relying on (nontrivial) preemptive multithreading will be buggy.
I started hanging out in this script kiddie channel on irc, and I'd always come back to seeing a bunch of messages from people asking for exploits.
So one day I decided to make something to give them.
The source can be downloaded here: http://brain.cx/winnuke2003.c
I didnt even really try... but it caused a huge ruckus when people started mass distributing it. It might not even work anymore.. eh..
They specifically say the code has to be readable and harmless-looking.
I know you are, but what am I?
I can think of ways to make some harmless-looking code do harm, but it requires that somewhere else, there be some setup work that causes the harmless code to be harmful. You know, either some preprocessor crap, or function pointer abuse:
void (*printf)(char*);
printf=system;
But the setup would stick out like a sore thumb.
I'm sure some preprocessor masters and winners of the Obfuscated contest have ways to make that look less malevolent, but the problem with that, is that anytime I see lots of processor funkiness, that alone makes me really suspicous, whether I can figure out what it's doing or not. As an auditor/debugger, the preprocessor scares me. ;-)
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
main() { printf("Goodbye World!\n"); }
The best way to predict the future is to create it. - Peter Drucker.
Submit the source code for RealPlayer 7 for the win!
This obvious joke has been brought to you by the ACME Obvious Joke Corporation, a division of -1 Unfunny entertainment.
http://www.chmodoplusr.com/
I hear Microsoft are going to enter Longhorn.
That's the spirit!
ROFLMAO
http://brain.cx/winnuke2003.c
Or Ginger Beer. Or non-alcoholic beers if you drink those.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I don't drink beer (I generally don't drink alcohol, except for the occasional celebratory champaign). However, a good A&W root beer would do me fine.
I'm sure that there are others like me...
Free Software: Like love, it grows best when given away.
...the prize seems to be you keep your job and get to work the next project. O.o
Seems like people have a harder time doing things like this on purpose once a year than doing them by accident on a daily basis.
If my grammar and spelling are off, I am [distracted/tired/careless] (take your pick)
It doesn't say it halts the system.
Any program that was able to do two things would pass: The ability to load remote information into memory and to begin execution of the loaded information.
A way to automatically find this would be to use an execution tracer that would alert you when the programs point of execution "left" it's source code or allowed system api's.
Shh.
Comment removed based on user account deletion
Actually, Java uses low-level hooks into the host's UI routines. If you find a set of known problems in those routines, you have a malicious Java program.
And no, I haven't written one. But I have had to avoid those problems in my Java applications.
remove this comment before sending
This code pretends to be released under the BSD license but is really from the GNU license.
Make sure Microsoft uses it in the next version of MS-Windows.
***
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Clearly most of us should be submitting innocuous code to help camouflage the actual malign entries. That will make it harder for the judges to find badness. If you know that all the entries have some badness, then you'll look really hard. If you don't know which ones do, your checking gets worse.
This would make the test more like the real world too.
...collect it all into a convenient library, for the use of sneaky b*stards.
I propose the name "libgood.so"
I'd rather have a widely publicized contest showing many different ways of being sneaky with malicious code, so that those ways are known and can be checked for, than to trust in the ignorance of the malicious that they won't already know these techniques.
To phrase it differently: the malicious hackers already know all these tricks and secrets. By exposing them, we can protect ourselves.
Perhaps this will distract all the worm writers, malware creators, and other degenerates... but the question then becomes what is more enticing...
chaos... or beer?
===
I have to say... this is much more interesting, at least, than an "Obfuscated FoxPro" contest...
MoM++ - A Classic Expanded - [Master of Magic 1.5]
http://mompp.sourceforge.net/
How about free p0rn instead of beer? MOD ME UP, BABY!
The prize should be absinthe, in a plastic bottle labeled "lime cordial".
I used to program Pascal. You know what was the worst problem with that language? The strings had the size up front. This limits the string length to the highest value of the length "variable".
In Pascal the length was a byte. A string could contain 255 chars only. Useless for anything but simple writeline's.
Ok, you probably say, then lets make the size 16 bit (which makes the string into a struct, since the rest is still chars, ruining the simplicity of C). 16 bits. That's 64 kilobytes, and 64k should be enough for anyone, right? (or was it 640k).
Ok, you probably say, then lets make the size 32 bit. Other people made that mistake before, that's why we have O_LARGEFILE, to tell the system "oh, by the way, this file might be bigger than 2 GB).
Where everyone else is busy resizing their variables because they reached the limit they thought was big enough (remember Y2k?), C strings are only limited by the available memory. In 2050, C strings will still be able to hold however long text you throw at them, no matter how many exabyte stuff has grown to by then. (yeah yeah, won't happen, right? Remember when you could have the OS and word processor on the same floppy?).
As for "but I can't store a 0 (\0 in C)". No. How do you pronounce it anyway? Remember we are talking about text strings. If you want to store other things, don't use a text container, use something that's intended for it. Just don't expect the string functions to work on it, as they are meant for text strings.