2008 Underhanded C Contest Officially Open

Xcott Craver writes "The 2008 Underhanded C Contest has just opened. Every year, contestants are asked to write a simple, innocent, readable C program that appears to perform an innocent task — but implements some non-obvious evil behavior. This year's challenge: redact blocks from an image, but do it so that the excised pixels can somehow be retrieved. We also have listed the winners of last year's contest, which was to write a simple encryption utility that mysteriously and undetectably fails between 1 percent and 0.1 percent of the time. The winning entry is truly impressive." We discussed the first of these contests in 2005.

Comments

Re:Hmm...

[Llywelyn]

Ever seen scans from a FOIA request? They redact certain information regarding sources and methods (and some would claim whatever they feel like at the time). *That* would be a "use" of this technology.

"Enter the registration key" type schemes are more easily accomplished without it being underhanded in nature.

Re:Hmm...

[Gnavpot]

No, the point is to make a utility that appears to innocently redact part of an image

More precisely:
The point is to make a utility that - when viewing the source code - appears to innocently...

It is no challenge to make a closed source utility which does something evil even though it appears to do something innocent. Most viruses do that.

The challenge is to hide the the evil behaviour in simple and open source code.

Re:Hide the evil code?

[Ethan Allison]

That's what makes this so interesting.

Re:Hide the evil code?

[amRadioHed]

One possible option for this contest is to hide information in the lower bounds of each pixel (stenography like) Sure that's easy without the source code, but how do you make setting black to something other than 0 look innocent in your source code? There's the rub.

Re:I submit

[setagllib]

Microsoft has already released a fair part of Windows' source as the "Research kernel". Surprisingly enough it's not bad, but it takes more than clean code to make a clean operating system.

Re:Where are past year's results?

[niceone]

http://underhanded.xcott.com/?page_id=9

This is scary

[LaughingCoder]

OK, it is generally believed that OSS is inherently secure because so many eyeballs can examine and vet it. But as this contest shows, it is possible to include backdoor behavior "in the source for everyone to see" without it being discovered. Oh, and note to self, don't download any open source image editing software in the future ...

Re:This is scary

[Haeleth]

OK, it is generally believed that OSS is inherently secure

No, that's a popular strawman argument used by opponents of OSS. There have been enough vulnerabilities found in OSS that it is trivially obvious that any such claim is false, and no serious OSS proponent would dream of saying any such thing.

It's been done for years .. .

[Stavr0]

courtesy of crazy Japanese censorship laws. Google for gmask or see examples at Lecture on masking (Yes, it's SFW)

Re:Compression would be nice

[RKThoadan]

The real challenge isn't how to do it, but how to do it so that someone who is reading your code doesn't realize the data is still available. That's the really tricky part.

Re:2007 winners not found

[Xcott Craver]

We have a separate tab for the 2007 winners; it's the first one on the left.

I recommend you give it a read; the entries are all very clever.