Slashdot Mirror
English Shell Code Could Make Security Harder
An anonymous reader writes to tell us that finding malicious code might have just become a little harder. Last week at the ACM Conference on Computer and Communications Security, security researchers Joshua Mason, Sam Small, Fabian Monrose, and Greg MacManus presented a method they developed to generate English shell code [PDF]. Using content from Wikipedia and other public works to train their engine, they convert arbitrary x86 shell code into sentences that read like spam, but are natively executable. "In this paper we revisit the assumption that shell code need be fundamentally different in structure than non-executable data. Specifically, we elucidate how one can use natural language generation techniques to produce shell code that is superficially similar to English prose. We argue that this new development poses significant challenges for in-line payload-based inspection (and emulation) as a defensive measure, and also highlights the need for designing more efficient techniques for preventing shell code injection attacks altogether."
quite terrifying :(
If hackers convert arbitrary x86 shell code into sentences that read like spam, but are natively executable .. we're all screwed :(
We'll either need to tighten up how architectures execute instructions to make it harder to execute shell code in the first place.. or come up with sophisticated AI to help filter out the shell code. Of course, as soon as we do that, hackers will develop AIs which can write convincing (and even compelling) shell code.. and THEN what the hell do we do.
Now where I live you can get a pretty decent hair cut for $17 (they even trim up the beard). You can't get anything fancy.. but a decent, professional-ish type haircut is definitely no problem.
My employer is giving us a pretty generous Christmas vacation.. really looking forward to that!!
Also this time of year is great cause CHRISTMAS is everywhere :D
just formatted my hard disk and installed Windows 7 - how low can you get :(
Been there, done that, paid for the T-shirt
and didn't get it
They don't mean shell commands. They mean code that exploits a vulnerability in order to start a shell.
"I assumed blithely that there were no elves out there in the darkness"
Does TFA talk about shell code or assembler code?
http://michaelsmith.id.au
Indeed, colour and shape should be irrevelant to the toxicity of our shells!
Btw, I, for one, welcome our new incisive literary overlords!
Good job not reading the article.
It's not that shellcode can be written in text and then compiled to an executable form. It's not that shellcode can be compiled to an intermediary form, translated or compiled into machine instructions by a piece of code (this is common in malware now, to pass input restrictions -- as the article says). It's that the executed machine instructions themselves -- the compiled binary data that can be run raw on an x86 processor -- looks like English text.
Why, this very comment prints a list of prime numbers less than one hundred!
org.slashdot.post.SignatureNotFoundException: ewg
Now your brain can catch a virus just by reading!!!1
Thanks, I read the article after I posted. So they discovered a way to attack machines that have already been compromised..If your security is relying on an inline inspection for specific commands, you have already lost. All that reading to change three words.
I just have to point out how well that PDF looked from a purely graphic point of view... That is all. Interesting content to boot.
jaymz
And how do you suppose they generate the text then? They have a system they train with text pulled from various sources, then they use it to generate an innocent looking text that can be executed with a predicted result, no? In other words, an assembler/compiler....
See, I did read the pdf....
Btw, I missed that there where 4 researchers, not 3...
--- Reality doesn't care about your opinions, it happens anyway and if you are in the way you'll get squished.
Yes, but if a machine on your network has "already lost", you'd probably like to know that.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
And nothing in their article is helping with that. They assume they are exploiting a software vulnerability. If I know there is a software vulnerability, there are 1 million and 1 less complex ways for me to blow right by any inline scanner. (One stupid enough not to look and see what the actual bytes were anyway)
No, an assembler or compiler takes as input text in a high-level language and generates executable machine code.
This takes as input executable machine code and generates executable machine code with a very narrowly-defined statistical property. (Simpler, but important, statistical properties have been done previously -- e.g., the Metasploit filters.)
This is the sixth spam message this user has posted, will SLASHDOT please BAN this guy already? Come on.
Has anyone really been far even as decided to use even go want to do look more like?
An assembler/compiler doesn't necessarily use a high-level language input.
In this instance they (as you say) 'takes as input executable machine code and generates executable machine code with a very narrowly-defined statistical property' which tells me they have an assembler that reads executable code and assembles executable code that looks like English text, in other words an assembler.
--- Reality doesn't care about your opinions, it happens anyway and if you are in the way you'll get squished.
This is the sixth spam message this user has posted, will SLASHDOT please BAN this guy already? Come on.
He must be making new logins. I've seen him posting for a few weeks, he surely has more than 6 spams that I've seen alone. Going on that idea... lets see:
http://slashdot.org/~coolforsale117
http://slashdot.org/~coolforsale116
http://slashdot.org/~coolforsale115
http://slashdot.org/~coolforsale114
http://slashdot.org/~coolforsale112
http://slashdot.org/~coolforsale110
No doubt there is a TON of them. So I'd guess they are banning him, he just keeps making new uids (and siphoning a ton of moderation points to keep him marked at troll / offtopic). I know I've used many mod points keeping this bastard down.
Maybe we should slashdot his sight. Or give him to /b/
Faster! Faster! Faster would be better!
No, it translates assembly to different assembly that's also English. This is actually a rather interesting piece of work. They didn't just write a program that converts assembly to English assembly, they wrote one in English assembly.
93rd rule of Slashdot: No matter how obvious my sarcasm is, my comment will be taken seriously by someone.
Newsflash: It's not the elusive and mystified http://hardware.slashdot.org/comments.pl?sid=1196619&cid=27553143SlashDotFS. Those gibberish spam posts here are actually designed to crash and pwn Windoze suxx0rs...
Colorless green Cthulhu waits dreaming furiously.
FAIL. It cannot be an assembler if the input is not assembly.
It's a translator.
Technically, machine code -- assembly is the pseudo-English text version of machine code.
But otherwise, yes.
It is indeed a translator.
It doesn't translate assembler code.. it translates x86 machine code.
(Which also implies that it cannot be an assembler, since assemblers only accept Assembly code as input)
Is in a forest...
And now for a car analogy...
Science advances one funeral at a time- Max Planck
Isn't this what NX is supposed to stop, execution of arbitrary data as code?
Then you compromise a binary that has opted out of strict NX, such as a Java virtual machine that needs to dynamically recompile JVM bytecode to x86 bytecode.
Consume more trains, Elvis! He, and snorkels, drink elephant's sock puppet master. Steamed cabbage can reverse big piles of ducks. Additionally, cheese log cabin nightmare.
You're screwed now, x86 suckas!
Is it spam, or is it shellcode? things like "this treatementOur goal" look fishy to me.
Since the first thing I do with all my emails is save the text and run it as a binary executable.
It's a research paper, not an exploit, not instructions on how to make an exploit, not recommendations on how to make an exploit. God what's with you people on this site, you can't just see something for what it is, you have to see it for how it serves no purpose to you or how you can do it so much better.
If they could exploit a machine by sending a point across, they'd get it past you lot every time, you'd never detect that huh.
The revolution will not be televised... but it will have a page on Wikipedia
There are indeed times when I think that we built the Internet, and that it taught us only one lesson:
I'm right and you're wrong.
This is not quite as concise as "42". Also, a second Internet will have to be built to determine who is "I" and who is "you".
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
If they could exploit a machine by sending a point across, they'd get it past you lot every time, you'd never detect that huh.
Haha. I love this. Spot on.
It's a translator that takes any arbitrary x86 machine code as input, and produces as output functionally equivalent self-modifying machine code that starts off looking like English text. The same approach also works with other non-x86 machine codes, and other languages, such as Russian, French, etc... Very interesting work. It goes to show that for an OS to allow any code to self-modify can produce results that are very difficult to predict. Self-modifying code has an almost biological nature.
Let the T-C wars continue!
Oh noes! If only we had a way to detect and filter text that looks like spam....
cp /dev/zero ~/signature.txt
And how do you suppose they generate the text then? They have a system they train with text pulled from various sources, then they use it to generate an innocent looking text that can be executed with a predicted result, no? In other words, an assembler/compiler....See, I did read the pdf....
You really see nothng noteworthy about this? (Or are you just trying to cover up from getting called out in not reading TFA with a hasty skim and blasé attitude - I've done that myself a time or two...)
...so, as the article suggests, AV's/firewalls will look for that. And if there's a library of some sort that contains the translations, mightn't the executable portion of the payload bear some similarities to an unpacker? I'd assume they'd be unpacking (probably into the same hidden portion of memory as it) some sort of lookup table/library in order to function properly, as, presumably, they wouldn't want to include the lookup values in the exe as it would increase size & risk of detection.
Odi profanum vulgus et arceo
in b4 not your personal army
On the Oregon Cost born and raised, On the beach is where I spent most of my days
I guess I don't see the big deal in this paper. Yes, they can encode the shell code into English sentences. It's still meaningless to the recipient and should raise suspicion. It would be far easier to use simple steganographic techniques to embed the shell code into any image transmitted between two systems. The recipient would not suspect any alteration and filters would not have the original image for comparison. Just a thought. Maybe I should write a response paper.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
"Please type the following on your command-line:
rm -rf *
Thank you."
At least the /b/ spammers are polite enough to do their homework and know the demographic (all /b/ spams are porn).
Air Jordans and POLO hoodies for Slashdot? And handbags and UGG boots, even though there are no women on Slashdot. At least try to sell us motherboards and shit...
That you could do this was shown waaaay back in letter submissions to PC Magazine back in the 80's. This is not new AT ALL.
Blinding him seems a little harsh!
We could all look at his SITE simataneously at some point though!
I have also wasted a ton of mod points on this idiot.
Its hard to think of a worse place for trying to spam than Slashdot eh?
This talk was probably my favorite at CCS this year. Unlike MANY researchers, the lead author of this paper was quite entertaining. Regarding the work itself, there are a few details that the current discussion has missed.
First, I would not say that they can convert arbitrary shell code to English-like prose. Rather, the only instructions that can be used are the ones that are identical to the ASCII encoding of the alphabet. For instance, the ASCII encoding of the letter "r" is identical to the binary for the unconditional jmp instruction. Granted, the authors showed that you can do a lot with this limited set of instructions, but I still wouldn't call it arbitrary.
Second, he showed several examples of the sentences created. They make about as much sense as "Lorem ipsum dolor sit amet..." The tight constraints on the instructions that can be encoded into ASCII make crafting decent English syntax nearly impossible. Spam filters based on natural language processing could probably detect and flag them.
While disguising the binary as ASCII is cool, I don't see that it's all that different than other exploits. Once a sentence containing an exploit is detected, you'll have signatures just like any other type of virus/trojan. I highly doubt that contemporary anti-virus scanners stop working on data that looks like ASCII. Rather, they look for tell-tale signs of particular instructions that appear in particular orders, etc.
And, as many others have pointed out, this code is only harmful if it is executed in the right context (i.e., you have a vulnerability to exploit). Disguising the code as ASCII doesn't really make it different than any other type of zero-day attack.
This work was very sophisticated, and there's no way that script kiddies could build something like this. I don't know that more advanced attackers would bother, because I really don't see all that much of a payoff given the amount of work that this attack requires. It's a whole lot easier to take over a vulnerable web server and launch a XSS attack. The incentives simply do not seem to suggest that this technique will become widespread.
So, no, I don't think the sky is falling because of this attack. Having said that, though, this was a very cool piece of work.
You have
a virus
Didn't you know?
You shouldn't be
running Windows
Burma Shave
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
Mysidia is making a sarcastic reference to UNICODE; wooosh...
Also, a second Internet
will have to be built to determine who is "I" and who is "you".
In which case you will need Prolog to solve that query. ;-)
"English Shell Code Could Make Security Harder"
I was disappointed to find after reading the summary and article that english shell code doesn't improve security after all. What a misleading title.
There is a major center of economic activity, such as Star Trek, including The Ed Sullivan Show. The former Soviet Union. International organization participation Asian Development Bank, established in the United States Drug Enforcement Administration, and the Palestinian territories, the International Telecommunication Union, the result of the collapse of large portions of the three provinces to have a syntax which can be found in the case of Canada and the UK, for the carriage of goods were no doubt first considered by the British, and the government, and the Soviet Union operated on the basis that they were the US Navys interpretation of the state to which he was subsequently influenced by the new government was established in 1951, when the new constitution approved it you King, he now had the higher than that the M.G.u, and soul shouters like Diane. There's a mama maggot including the major justifications that the test led to his own. This is usually prepared by the infection of the Sinai to the back and the Star Destroyers in the parliament, by the speed of these books and the revival of environmental problems of their new Arab states of the Arctic as a more and they possess power to the effort she was especially valuable as the Union and that would have said, as to note that the goods, which the night that if ever I rode after the word Father upon His Church to claim that the peace that had permitted him the city are as a hand of one into I thought of Mr. Crow and the Jews by the days of the C.Cs front garden which had first to St Cyriacus. All of a theology in the setting in a human heart as the tale of this day. I have it to friendship and the States that the way the English of the St Lawrence seven miles of an adjutant...
Now, would you have guessed that this is executable machine code (shellcode)? Honestly, it looks more like the garbage that spammers use to defeat statistical analysis (indeed, this is code generated with a similar goal).
(P.S. this particular sample is merely an amalgamation of the code which was reproduced in the paper; it is not complete, and will therefore not execute).
Just goes to show that the Chinese are as reckless with their advertising process as they are with their manufacturing process.
Your sig: I think you mean "for all intents and purposes" *lol* intensive purposes haha "I REALLY REALLY MEAN TO DO THIS!!!!!!!!!" with eyes bulging out and raised veins... that would be a pretty intensive purpose...
Anyway... what were you saying about the "I'm right/you're wrong" attitude of the internet? :-p
The revolution will not be televised... but it will have a page on Wikipedia
yeah no shit. You think he'd at least offer us Counterfeit CPUs or dodgy RAM or something. If you are gonna spam then spam correctly. It is as bad as showing nerds a bunch of ads for jock products and tampons. Total waste of spam if you ask me.
ACs don't waste your time replying, your posts are never seen by me.
not your personal army
also, rules 1&2 faggot
But it still does not do what they try to fearmonger...
A page of text will run on your Computer! OMG! just scanning an infected page will infect your PC! a randomly worded email can infect your computer!!!!
Well only if Outlook add's a compile and execute all text in the email function, I' am sure Microsoft is adding that.
Do not look at laser with remaining good eye.
Dude, you're wrong. Let it go.
It really reads like spam...Tried it and seems it's decss!
It hope none of you are thinking of subscribing coolforsale's email address zminring@gmail.com to a lot of spam lists.
That would be very wrong.
Very very wrong.
I had brought something like this up during an after-work, Friday night beer session back in the late '80s when a co-worker mentioned the odd snippets of text that one would see while examining programs using the debugger. (No... we weren't talking about strings of text defined in the source code.) I wondered whether it was possible to come up with a program whose machine code formed English text that actually performed a useful function; like some bizaare entry in an Obfuscated Assembly Language contest. Looks like it was possible though I still am not sure that malware actually meets my definition of "useful". Eye of the beholder, I guess.
CUR ALLOC 20195.....5804M
There's a difference, an assembly language representative of a machine code program doesn't normally execute on the target machine. It has to be "assembled" to the object code before it can be executed.
;)
What these bunch have done is created a program that "massages" (which could include expanding and alteration) source machine code to a new arrangement of _machine_code_ that can execute on the target as is. That new arrangement happens to resemble English text (in a computer format).
It's only an assembler if you're thinking of machine code as the "assembly language" and the "english looking" machine code as the assembled object code.
But that's stretching things a lot. Like saying you've actually been right all along, that is if wrong is right.
And who defines what the assembly is? The ones writing the assembler. Sheesh..
Sheesh indeed.
A compiler traditionally takes a high-level set of instructions and translates them into a lower-level set of instructions. What they have done is take a low-level set of instructions and found a way to make them high-level... looking... but still able to execute at a low level.
So technically this is more of an obfuscator than a compiler. I'm not saying you're entirely wrong, but to try and sum it up as just another x86 assembler is glossing it over a good bit. As well as missing the underlying point that this type of thing could be used for some pretty nasty purposes in the right scenario.
While your language detector seems to be working, I'd suggest taking your sarcasm detector in for a lube/oil/filter before Winter.
Great. I'll look forward to installing McAfee Jive.
If hackers convert arbitrary x86 shell code into sentences that read like spam, but are natively executable .. we're all screwed :(
It's called Hypercard.
These posts express my own personal views, not those of my employer
At least try to sell us motherboards and shit...
yeah no shit. [...]
I concur. Just motherboards. I don't create my own motherboards.
Profile his IP, and present what appear to be angry responses and modded-down posts when serving pages to that IP. Otherwise, just don't display his posts at all. Then again... mayyyyybe we already did that.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
you can't just see something for what it is,
Kinda tough with all the hype.
This is my sig.
With a little practice I'm sure you'll get it nailed, I don't find it that difficult and I'm sure I'm not particularly special, and it's a very useful skill to have if you're interested in reality. If you're not, then follow the hype, maybe it's exciting, but if you are, it's very easy to seperate the two, and it will serve you well, because there is always somebody who would love to share their biases with you... which perhaps wouldn't serve you so well.
The revolution will not be televised... but it will have a page on Wikipedia
Execute this!
eNodzMENgDAMA8C2lKhBBCT23xXQ5XEf27mf3t7/BieDi8mDJ4sXW7diMFnsQ8qdwWRxbDoMJott+sPJYLL4AQqYgLI=
it's a very useful skill to have if you're interested in reality
See, I'm not really all that interested in it. Our obsession with reality is overrated because it is culturally acidic. Reality is all about looking down and sometimes humanity needs to be looking up.
This is my sig.
I can think of a ton of ways to filter out spammers that just keep generating new UUIDs, especially if they post links to the same website and the UUIDs have that same website in their name...
Geeks like to think that they can ignore politics, you can leave politics alone, but politics won't leave you alone.-rms
Perhaps you could tell me where you take your :-p detector in for its workover, ya know... so I can make sure I avoid the same place?
The revolution will not be televised... but it will have a page on Wikipedia
"Reality is all about looking down and sometimes humanity needs to be looking up"
In your non-reality world that may be true, but in reality it's not.
The revolution will not be televised... but it will have a page on Wikipedia
Feeding the trolls here.
To answer your question: An assembler has a (mostly) 1:1 mapping between the source and the output. They do perform some additional tasks, like calculating addresses for jumps and such, and they usually have some form of macro support, but at the end of the day, the assembler can't decide to change the order in which you execute the machine instructions. aka "I define what the assembly is"
#!/bin/bash
Roses are red; violets are blue.
In Soviet Russia, all our base are belong to you.
"MZBlahBlah... Hello, please save the text of this email as blahblah.pif and open it to enable the images/porn/bonzai buddy/whatever you think is important enough to go through minor hoops to get"
Well, since an assembler would be a special case of compiler (compiles machine code from assembly) and a compiler would be a special case of interpreter (interprets source by compiling something), why don't we just call this thing they made an interpreter? Sure, it probably qualifies as some sort of compiler, but surely it must qualify as an interpreter.
In your non-reality world that may be true, but in reality it's not.In your non-reality world that may be true, but in reality it's not.
No, in the objective world, I'm right, and I can prove it by pointing at any number of reduced human aspirations in recent generations. Ever since the 1960s, humanity has gone south.
This is my sig.
I for one is very impressed by what they've done, even if it is somewhat similar to what I did nearly 15 years ago:
At that time I wrote what's probably the "best" executable text encoder for MsDos, it uses the absolute minimum possible amount of self-modification (a single 2-byte Jcc opcode) while staying entirely within the MIME text character set, and survives all the most usual forms of reformatting/reflowing of the text. (Replacing CRLF with a single CR (Mac) or LF (unix) or turning each paragraph into a single line.)
The initial bootstrap looks like this:
ZRYPQIQDYLRQRQRRAQX,2,NPPa,R0Gc,.0Gd,PPu.F2,QX=0+r+E=0=tG0-Ju E=
EE(-(-GNEEEEEEEEEEEEEEEF 5BBEEYQEEEE=DU.COM=======(c)TMathisen95
(The uppercase 'E's are my NOP fillers, they execute as INC BP, a register I don't use.)
Terje
PS. Unlike the current guys, I wrote the code above by hand, on paper, during the evenings of a ski vacation. I had brought with me a listing of the ascii encoding of all instructions that would use MIME characters only. :-)
"almost all programming can be viewed as an exercise in caching"
We could just go through the list of options on the spam-solution form letter and see which one works the best against the party in question. I vote we start at vigilantism and work our way backwards to blacklisting. :)
That's research?
Wow... my system is insecure, once I have a hooptie that can convert XYZ into assembly language, and run it, on my machine. OMFG!!
Why do that like that? Hell, we could even claim that all shell systems are vulnerable to Zork! I could just as easily have a tiny resident thing that can translate text adventure commands to native assembly language and compromise a machine.
r0 = the mail box
r1 = the white house
r2 = flood control dam #1
leave house. take letter from mail box.
it's very dark, you are likely to be eaten by a grue... [oh no, my victim's machine has detected my zork attack! I must do something...]
light torch.
you have been eaten by a grue! [they kicked me out of the account]
maybe I will have to have a planetfall attack next.
we map floyd to r0
give floyd the...
This is my sig.
Isn’t this why CAPTCHA was invented?
I mean just add captchas an a place where is slows him down too much for spamming to still make sense.
And freakin’ use reCAPTCHA, if you don’t want to get laughed at! ^^
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Look on the bright side... Slashdot could auto-ban anyone who tries to post a link to coolforsale.com
Ever since the 60s? And that's when reality was invented was it?
Dude I'm from a country where people were hung, drawn and quartered, as much as nostalgia can paint a picture of a rose tinted past, I can find you so many things that show the oposite. But, you cherry pick to support your opinion all you want, using facts "in reality" to prove how "not reality" is somehow better... if it was that much better you wouldn't need this "objective world" but the fact of the matter is you do, truth matters, and playing your platinum denial card will get you nowhere fast, and that's certainly not the humanity I wish to subscribe to. Thankfully, I'm not alone, because reality can be shared :-)
The revolution will not be televised... but it will have a page on Wikipedia
When I was a kid in the 80's, me and some class mates used to do this by hand. The game was to make as much text as possible in executable code, i.e. not just filling that was jumped over. Using a language with a more flexible grammar and word order, more available words and few more characters than English propably helped a lot, but the longest program anyone wrote in 100% runnable code/readable text was still less then 1/3 of an A4 (and quite a lot of JMPs and RETs). As I recall, that particular program particular made the hard drive sounds say "fitta" ("cunt" in Swedish).
Thing is, I remember hearing that spammers had factories in China making fake Viagra pills, to send them to the vic. Surely, if one were to buy from such a source, and then receive pills, try them, and have them not work, they wouldn't buy again, right?
Why bother sending anything at all?
Good job not reading the article.
Welcome to Slashdot!
I hope that you find your stay here while not informative at least enjoyable!
The whole point is that the compilation step isn't necessary, you could attach it to an email and it'd get clean through most filters. All you need to do then is socially engineer a person into running it by first renaming it to .exe.
Of course, this will fail horribly against anyone who's set up their email system with the aid of more than two or three brain cells. Any sensible system will look directly at the file, not its extension.
unzip; strip; touch; finger; grep; mount; fsck; more; yes; fsck; fsck; fsck; umount; sleep;
Better security solution. Because me old china, even if a whole bunch of yer muckers take a butchers they won't have a scoobie about you're rabbitting on about.
You really need to read at least this book
http://nostarch.com/assembly.htm
Before talking about definitions.
HTH
Of course, this will fail horribly against anyone who's set up their email system with the aid of more than two or three brain cells. Any sensible system will look directly at the file, not its extension.
This will be very worrying to governments then
Actually it will fail because the text is executable code, not executable file
I've skimmed the article, but I still don't get the idea of this.
I understand the part where machine-language is carefully crafted so that the bytes resemble ASCII text. But how is this an exploit? Why should I take an email that has somehow evaded my spam filter (despite reading like utter gibberish), save it to a file on my local machine, and run that file as an executable? Even if I wanted to run arbitrary code from an unknown third party, how would I even know that the contents of this email consisted of code in the first place? Could someone explain what I'm missing here?
I think this is interesting, but hardly break-through.
In the mid 80's, we did the same thing at a field Hewlett-Packard office, although not aimed at viruses. Our target was to enable users to key in x86 code in text form. In other words, sit down at a PC, open EDLIN (the DOS equivalent of Notepad), or some simple text editor, and key in human readable words (i.e. meaningful text that humans - HP Engineers - could easily transcribe from paper or a phone call). Then save the file as a .com file (which was a DOS executable), and then run it.
Think back to the days of stand-alone PC's, no USB, etc. If the field engineer was at a customer site, and needed to run a small diagnostic program on the PC, but didn't have the tool, then they'd simply call the office, and have the secretary ("coordinator") read them the human-readable sentences to key in. The engineer keys it in, and launches a diagnostic program. Our version even had a check-sum built into the words, so as long as you got the first few sentences exactly right (which were the boot part), then the rest of the "code" (sentences) were examined for check-sums, and would generate a location-specific error (e.g. "Checksum error in the sentence 'Many frightened capsules trigger captain mole".)
I remember this well, because I wrote the boot part, and the checksum algorithm. I made it fairly resilient to normal human typing habits (i.e. don't worry about capitalization, multiple spaces between words, apostrophes, etc). And I tried to choose some easy sentences (manually) for the boot part, since that had to be entered exactly right each time.
The system was made up of a "compiler" which would take a simple .com file (that is, an executable file, not a dot-com website), and convert it to "sentences" (which made little sense). We used a spelling dictionary English words, removing homonyms, as we wanted the words to be "read aloud". We tried to compile into short sentences of specific noun-phrase / verb-phrase formats, but they rarely made any sense. Some were outright silly, like: "The crazed orange melts to school."
It worked great! But it was only practical for very short utilities. Still, it was FAR easier to key in sentences of nonsense, rather than hex code. Our experience was that a typical engineer could key in nonsense sentences about 5 times faster than hex code (even considering that the words had to have extra boot code to analyze the text), although the results varied depending on the length of the overall program.
Then networks came along and rendered it fairly useless.
What is "shell code" supposed to be? Bourne shell scripts?
Someone had to ask it!
From the wikipedia: In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine. Shellcode is commonly written in machine code, but any piece of code that performs a similar task can be called shellcode. Because the function of a payload is not limited to merely spawning a shell, some have suggested that the name shellcode is insufficient.[1] However, attempts at replacing the term have not gained wide acceptance.
So it's a poor piece of new terminology that has stuck, unfortunately.
Stick Men
0x20 Space is AND?
That's surreal! It's almost as if x86 were designed for this! O_O
Note, the above post will decode the latest BlueRay DRM. But you didn't know that until it was pointed out.
(No, not really, but that's one possible application).
That only becomes an issue if someone finds a way of persuading the email client to attempt to execute the text of the message.
Which is not to say there isn't some obscure bug somewhere which does this, but I don't think this is the end of the world.
So all that needs to be done is change a file extension and you have a executable virus?
Or alternatively, extra code can be hidden on public webpages which get downloaded by a small executable, bypassing filters?
[Intentionally left blank]
Jeeze, if these guys are going to play with computers they should learn the lingo. The shell is, like, the Bourne shell or C shell or bash. Shell code is scripts.
I get a raging hard-on just for THINKING i took viagra. Placebo is king.
Let me know when I can simply send someone an email with the text "open goatse" and it has the desired effect of opening a browser window and surfing to goatse.
The same approach also works with other non-x86 machine codes, and other languages, such as Russian, French, etc... Very interesting work.
Especially since you can only do French with ARM binaries. It's very strange.
May contain traces of nut.
Made from the freshest electrons.
Obligatory XKCD anyone?
But I'd venture a guess it's far easier to hide such code in the noise of an innocent looking image.
If they could exploit a machine by sending a point across, they'd get it past you lot every time, you'd never detect that huh.
I salute you for the best zinger ever.
That's how pretty much every single remote exploit works, you know. Tricking a client to execute part of the sent data as code. That's the whole point of exploits.
"Language is a virus." -- Laurie Anderson
You're confusing their paper with things you're imagining their paper might say.
All this demonstrates is that input sanitization that checks for statistical properties (looks like English) is insufficient to prevent executing useful code when there is a buffer overflow vulnerability: the payload can be made to conform to the sanitization requirements while still containing arbitrary code.
I hope that you find your stay here while not Informative at least Funny!
ftfy
Did they include links to some real world examples of this shell code and can it be executed by clicking on an URL or openong an email attachment.
davecb5620@gmail.com
So there's two pieces here. Mapping ASCII to executable code, which is in itself fairly interesting (and the researchers should be lauded for taking the time to figure some of those maps out), and the second point that requires a machine to have the interpreter to translate the english code to machine code.
So, in reality, its another programming language with a pseudo-cipher built in.
Why does this matter? It would be a fantastic way to deliver instructions via spam to already compromised systems running the interpreter. This further obfuscates the criminals from the bot networks, and would even make shutting them down hard.
Computer Sleepercells. Crazy, huh?
I don't buy that it will work on non-x86. Or at least not PowerPC, which is the only instruction set I'm familiar with at the machine code level. I only skimmed the article, but I didn't see the authors drawing any such conclusions.
For PPC at least, IIRC most of the useful instructions like stack manipulation involve some byte sequences that are non-ASCII. OTOH, ARM and x86 are the only platforms worth targeting, given their prevalence.
Terrorist, bomb, al Qaeda, nuclear, yellowcake, kill, assassinate. Carnivore is dead... long live Echelon.
When I read the phrase English Shell Code, the first thought that came to my mind was:
% Oh I say, can I see a list of files, old top?
-rwxrwxrwx 1 alfred staff 192 7 Mar 2008 teacosy.txt
drwxr-xr-x 37 alfred staff 1258 25 Nov 2008 cricketscores
-rwxr-xr-x 1 alfred staff 260 28 Aug 2008 cucumbersandwiches.py
% Spiffing, just spiffing. Shall we have a peek at the processes?
PID TTY TIME CMD
380 ttys000 0:00.01 -bash
Are your last three sentences product placements or shell code? : )
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Did the virus make the same WHOOSHing sound as a joke? Just doing some security research.
"When information is power, privacy is freedom" - Jah-Wren Ryel
"DJ Talent" from Britain's Got Talent has prior art.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
On the contrary, they can't code their way into a paper bag. I'm pretty sure Adobe could code their way out of the Boeing assembly building.
"When information is power, privacy is freedom" - Jah-Wren Ryel
china=mate
muckers=mates
butchers=look
scoobie=clue
rabbit=talk
Not as obscure as you'd like to think; I can decode it, and I've never even been to the UK.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
This sort of shellcode is probably a bit harder to write for the 68000, with its 16-bit instructions that have an "operand mode" field that spans between the two bytes. While a lot of useful instructions are in the 2xxx-7xxx range, and branches are in the 6xxx range, the instructions that do any sort of math are outside it.
It would be interesting to see what can be done with other CPUs as well. In particular, I recall that OS X PPC missed a chance to resist shellcode by ignoring two of the four bytes of the OS trap instruction, rather than forcing them to be nulls.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
there are no women on Slashdot
There are a few. Not many, true, but there is such a thing as a female nerd and there are some here. Actually I'd guess that 99% of female nerds at least lurk.
Free Martian Whores!
I'll check it out for you...yep it appears to be harmle*
So, not most major corporations?
I work for a roughly Fortune 200 firm. My peers at other companies and I routinely email "forbidden" file types by changing the file extension.
MDB forbidden? That's OK, MP3 is allowed.
EXE forbidden? Eh, just call it .TXT. Nothing checks.
The preferred solution is to not have a problem.
He obviously won if you suddenly can't reason back anymore.
I am not devoid of humor.