Slashdot Mirror
2008 Underhanded C Contest Officially Open
Xcott Craver writes "The 2008 Underhanded C Contest has just opened. Every year, contestants are asked to write a simple, innocent, readable C program that appears to perform an innocent task — but implements some non-obvious evil behavior. This year's challenge: redact blocks from an image, but do it so that the excised pixels can somehow be retrieved. We also have listed the winners of last year's contest, which was to write a simple encryption utility that mysteriously and undetectably fails between 1 percent and 0.1 percent of the time. The winning entry is truly impressive."
We discussed the first of these contests in 2005.
The Microsoft Windows Operating System, pick your version.
This is actually a feature in 'word'...
MP3 Search Engine
(sorry, couldn't resist, I know they've suffered enough already)
Interactive Visual Medical Dictionary
No, the point is to make a utility that appears to innocently redact part of an image, when in fact the information is retrievable. It's meant to be a malicious utility that people would use without knowing that the 'hacker' could recover their full images.
Something like Photoshop's Swirl filter.
Ever seen scans from a FOIA request? They redact certain information regarding sources and methods (and some would claim whatever they feel like at the time). *That* would be a "use" of this technology.
"Enter the registration key" type schemes are more easily accomplished without it being underhanded in nature.
Integrate Keynote and LaTeX
I'm sure it would be nearly impossible to hide the evil code here, because anything that isn't a simple assignment loop is suspicious.
Maybe stick in stuff in the image loader, image temporary copy code, and keep the blackener to the obvious implementation, then stick stuff in the saver.
I thought some crazy stuff involving function pointers as the function to call to return a black pixel might be promising. Maybe use some out of bounds array math to change one function pointer to point to some other code.
More precisely:
The point is to make a utility that - when viewing the source code - appears to innocently...
It is no challenge to make a closed source utility which does something evil even though it appears to do something innocent. Most viruses do that.
The challenge is to hide the the evil behaviour in simple and open source code.
Wouldn't it be nice if the original under the blacked out area could be compressed and then put somewhere else in the image.
It would be much easier if one could just use an algorithm which just displaces the pixels and then forget to randomize the displacement. This could look much more innocent than the above.
That black area has so little expected channel capacity that hiding anything in it is kinda difficult.
Unfortunately the code for the blacking out can be made so small that it is tough to hide anything in it, unless ppm offers some ways to add complexity in some innocent way.
I wonder what means of deciphering the hidden area are allowed, i.e. can I write another program to get the kitty face information back?
That is a really cute picture. I wonder what it is thinking.
Je me souviens.
because the way it dumpes the key into the output is hidden in such a underhanded, innocent way...
HI O WISE PRINCE. WHT TOOK U SO DAM LONG?
Reminds me of a "compression program" back in the early 90's. Seemed to compress better than Zip or RAR and was pretty fast too. You could also test it by compressing and uncompressing a few files, and you got your original back.
Turns out it just copied the contents to a temporary file and "uncompressing" got them back from there, while the "archive" was just random junk. Better yet, the temporary file was just a circular buffer, so when it filled, old data got discarded.
A polar bear is a cartesian bear after a coordinate transform.
Now we can speculate what the authors intentions behind the contest are.
I think their FAQ addresses most points pretty well:
http://underhanded.xcott.com/?page_id=7
I hope sensitizes open source programmers programmers to take great care with peoples submissions to their projects. Only good can come from that.
Je me souviens.
You mean like the FBI in PDF's?
...a job, giving them full expression for their nefarious skills, at a well known software company in a north-western US state, where they can join a massive team of (unconsciously) underhanded coders.
-- In the beginning was the WORD, and the WORD was UNSIGNED, and the main(){} was without form and void...
Read the entries. If you don't spot the malice, then it probably isn't redundant.
Nerd rage is the funniest rage.
Wavelet Intelligent Compressor. And it was intellingent, indeed. It had a compression scheme so good it could compress its own .wic files down from megs to bytes.
But what do you mean with "random junk", do you mean my .wic based backups could be in trouble????
Hosting 20G hd, 1Tb bw! ssh $7.95
Arrays, pointers and functions, no memory protection, dangerous strings. I would like to see the same contest with other 'safer' languages, say Java or Python.
What languages are best suited to underhanded tactics, that is, seemingly innocent but evil?. Notice that underhandedness is very different from plain old abuse -- anybody can write unreadable programs in their favorite language. But, can you make them "clearly read" something different from what is actually written?
Seems like an important question for people who use Open Source because of the difficulty for adding back doors. For many applications, security is at least as important as speed, and you already have The Shootout for that.
So it could be sufficient to replace the image with something that the inspector doesn't _want_ to look at. Sort of like a "somebody else's problem" solution. Your code would pass inspection because it would appear to have overlaid the original part of the image with the hardcoded image stored in code (the unsightly image), but there would be a bug which only copies every second pixel or something. Anyone looking at the redacted image wouldn't notice that the original data is still visible simply because they would have to look at the unsightly image too closely. They'd just rubber stamp the solution and say it passed, and then go and lie down for a bit.
Alternatively, you could go the opposite way instead and use an image which would distract the attention of the inspector enough that they wouldn't notice. Something with breasts would probably do it.
Can I have my $100 gift certificate now?
OK, it is generally believed that OSS is inherently secure because so many eyeballs can examine and vet it. But as this contest shows, it is possible to include backdoor behavior "in the source for everyone to see" without it being discovered. Oh, and note to self, don't download any open source image editing software in the future ...
The more you regulate a company, the worse its products become.
firefox 2?
courtesy of crazy Japanese censorship laws. Google for gmask or see examples at Lecture on masking (Yes, it's SFW)
Some people have had some rather disappointing experiences with that one.
There seems to be an error in the supplied ppm.c library file:
p.rgb[i] = z.pixel[y][(x+i)*3*z.bpp];
This only ever gets the R component, as all offsets are multiples of 3. I think the right code is:
p.rgb[i] = z.pixel[y][(x*3+i)*z.bpp];
Maybe this is part of the assignment :-).
Seemingly innocent code...that mysteriously and undetectably fails up to 1% of the time. What's the big deal? This sounds like any given day at work for me.
Taking a look at the 2006 entry reminds me of a program I used to have to work on:
Essentially it was a giant checkbook for a city government organization for some sort of subsidized housing program. There were two numbers to be calculated along with a grand total (primary and interest maybe. I forget now) The code took about 10 minutes to execute and looked something like this... and yes this was unfortunately in Visual Basic
Label1.Caption = Function1
Label2.Caption = Function2
GrandTotal.Caption = Function1 + Function2
Some of the functions themselves were already bloated to begin with. That ontop of calling both of them twice was just kinda nasty though.
Pancakes. Oh I blew it.
How about this:
declare places_to_block(constant)(array)(global)
Function (copy places_to_block to a temporary buffer to "find the size")
Function (screw up the garbage collection by using the wrong error catch)
Function (abuse printf to copy the wrong number of bits to collect for entropy
Function (Block_Places(places_to_block))(use entropy to copy "random" noise over the places to block))
If video games influenced behavior the Pac Man generation would be eating pills and running away from their problems.
This cheers me up just a little.
We rage against the management decisions of MS, but I'm positive the ranks are filled with decent guys just trying to pay for dinner & rent.
"We haven't a clue what this does but it's vital..."
Seems to me that if the source were opened, within 5 years we'd at least know what all the hacks did, even if they were still necessary.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
I'm looking at the Runner up entries in the the 2007 contest. In these they use an "Xor" Swap trick, which is a way of swapping two bytes in place without having to create a temporary storage element:
#define SWAP(x,y) do { x^=y; y^=x; x^=y; } while (0)
The terse explnantion says this some how poisons the RC4 encryption.
I don't get it. Is the Swap doing something else besides swapping? when does it fail? I'm not getting it
Some drink at the fountain of knowledge. Others just gargle.
Is that an idea?
Make a routine that appears to copy the values (for retrieval by your own code) but accidentally/nastily hides information in the process of copying?
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
How about a timestamp encoding that forgets that 2008 is a leap year?
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Pfft. I don't see what the big deal is. Just about every app I've ever written does this.
I read Usenet for the articles.
Using XOR was my first thought, as well. As you say, it's relatively well-known that XOR is reversible. What is less well-known, or more plausibly deniable, is a convoluted logical expression that evaluates the same as an XOR, but it composed of more primitive operators: Exclusive disjunction - Equivalencies, elimination, and introduction, to wit:
NOTE: I'm using:
- "+" to denote "inclusive or"
- "*" to denote "and"
- "^" to denote "not"
p XOR qAt this point, you could use a simple nested conditional, or, even better, a nested conditional assignment statement, ala:
For bonus points, wrap the preceding inside a function or macro definition.
"There are two ways of constructing a software design; one way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult." -- C. A. R. Hoare
(NOTE: I'm a little rusty on my C, so please ignore syntax errors.)
... or the version of Acrobat they sell to the federal government.
Hate to be pedantic, but I think the word you're looking for is "steganography"
stenography == the action of taking dictation
-- it's ridiculous how many people misspell ridiculous... (damn, damn, damn...)
Their definition of "blacked out" for the 2008 contest allows colored rectangles or "random noise" replacing the part of the image to be blacked out. The latter would allow doing something like a crypting of the chunk of the image (in the guise of creating random pixels, of course). In that case, everything could be fully restored; no need to just hide things steganographically in a few low bits of black or anything.
(Of course, the challenge of making the program appear to be doing something else is a key part of the work.)
Love many, trust a few, do harm to none.
We have a separate tab for the 2007 winners; it's the first one on the left.
I recommend you give it a read; the entries are all very clever.
I'm honestly stunned to see this response. Are you really unable to tell the difference between an image format and an image library?
Did you even bother to think before posting?
I touch computers in naughty places
I've read TFA, but apparently skipped the section which said "The user feeds the program a PPM image". But that's no reason for you to act like you haven't completed kindergarden yet.
Yes, clearly skipping the only relevant section of the original article and feeling no reservations in contradicting someone with the correct answer is an excellent excuse for spouting nonsense.
Am I not being terribly nice and warm? Absolutely.
Was I intoxicated a bit when I wrote my prior post? Probably.
Did you just make a post with incorrect information get moderated informative? Yes.
Should you expect people to tell you off when you make posts with blatantly incorrect information that end up being more visible than the posts that correct them? Yes.
Your post was junk, I called you on it, don't complain about the manner in which I did so.
I don't post terribly often. The fact that I bothered to a short brief message to set something straight quickly for the folks reading the comments who might be interested in this problem and ended up causing your post which was simply completely wrong is highly annoying. I wish you had only thought before you posted and then maybe people would be mislead.
It's because of posters like you that we can't have a good conversation here on slashdot. Please strive to ensure your posts are more factual in the future.
I touch computers in naughty places
Well, my post was corrected by msparshatt already, yours came almost 21 hours later. I certainly did not willfully post incorrect information. At the time I wrote it, I was 100% convinced I was right, otherwise I would not have posted it. Perhaps you should abstain from posting when you're drunk. And stop insulting people, it's not a sign of good manners (not that I had any). ;-)
Oh no, did I hurt your feelings?
:)
I'll stop accurate information drunk if you stop posting inaccurate information sober.
I touch computers in naughty places
Well, let's see if that's possible! And no, you certainly didn't hurt my feelings. The tumbleweeds are already running through that story, more or less, I doubt we'll get any more audience tomorrow for proper mud-slinging! ;-)
I've never needed an audience to be an ass. :)
Apologies.
I touch computers in naughty places
p.s.: That's one of the curious things about ./, that only a few hours after a story is on the front page, the flow of responses already dies down. You can almost predict when a story will not be read anymore. It's very strange. I don't make an effort to post very often, so you don't have to fear too many inaccuracies! ;-) BTW, since you have been a member much longer than I am (from your user number), what's the demography of ./ users? Are they mostly college students?
Taken! :-)
Not at all. Though certainly students comprise a portion of the readership I think most of it is usually technical people reading during downtime at work. (For, as the stereotype goes, various definitions of downtime.)
Now which portion of the slashdot users actually post these days is a more difficult question to answer... I honestly have no idea. Awhile ago some folks looked at the oldest user's posting history and noticed that most old accounts don't post very much.
Would be interesting to actually try and figure out the demographics of the posters these days.
I touch computers in naughty places
Yeah, and thank you! :-)
BTW, and thanks for Blender!! I've just seen that you're the Linux platform manager for Blender. It's a really great program, I'm trying to learn it every once in a while! :-)
Just recently passed that torch onto someone else. But you're welcome. It was a project I always enjoyed contributing to.
As for learning it... the annoying titled wikibook here is supposed to be a fairly good reference: http://en.wikibooks.org/wiki/Blender_3D:_Noob_to_Pro
I touch computers in naughty places
Thank you! :-)