Slashdot Mirror
English Shell Code Could Make Security Harder
An anonymous reader writes to tell us that finding malicious code might have just become a little harder. Last week at the ACM Conference on Computer and Communications Security, security researchers Joshua Mason, Sam Small, Fabian Monrose, and Greg MacManus presented a method they developed to generate English shell code [PDF]. Using content from Wikipedia and other public works to train their engine, they convert arbitrary x86 shell code into sentences that read like spam, but are natively executable. "In this paper we revisit the assumption that shell code need be fundamentally different in structure than non-executable data. Specifically, we elucidate how one can use natural language generation techniques to produce shell code that is superficially similar to English prose. We argue that this new development poses significant challenges for in-line payload-based inspection (and emulation) as a defensive measure, and also highlights the need for designing more efficient techniques for preventing shell code injection attacks altogether."
...3 researchers develops their own x86-assembler.
--- Reality doesn't care about your opinions, it happens anyway and if you are in the way you'll get squished.
first. närå.
This is no different than adding any other shell...If your security is relying on an inline inspection for commands specific to a particular shell, you have already lost.
quite terrifying :(
If hackers convert arbitrary x86 shell code into sentences that read like spam, but are natively executable .. we're all screwed :(
We'll either need to tighten up how architectures execute instructions to make it harder to execute shell code in the first place.. or come up with sophisticated AI to help filter out the shell code. Of course, as soon as we do that, hackers will develop AIs which can write convincing (and even compelling) shell code.. and THEN what the hell do we do.
Now where I live you can get a pretty decent hair cut for $17 (they even trim up the beard). You can't get anything fancy.. but a decent, professional-ish type haircut is definitely no problem.
My employer is giving us a pretty generous Christmas vacation.. really looking forward to that!!
Also this time of year is great cause CHRISTMAS is everywhere :D
just formatted my hard disk and installed Windows 7 - how low can you get :(
Been there, done that, paid for the T-shirt
and didn't get it
Does TFA talk about shell code or assembler code?
http://michaelsmith.id.au
Why, this very comment prints a list of prime numbers less than one hundred!
org.slashdot.post.SignatureNotFoundException: ewg
Now your brain can catch a virus just by reading!!!1
I just have to point out how well that PDF looked from a purely graphic point of view... That is all. Interesting content to boot.
jaymz
http://www.coolforsale.com/ Dear ladies and gentlemen Hello, In order to meet Christmas, Site launched Christmas spree, welcome new and old customers come to participate in the there are unexpected surprises, look forward to your arrival. Only this site have this treatmentOur goal is "Best quality, Best reputation , Best services". Your satisfaction is our main pursue. You can find the best products from us, meeting your different needs. Ladies and Gentlemen weicome to my coolforsale.com.Here,there are the most fashion products . Pass by but don't miss it.Select your favorite clothing! Welcome to come next time ! Thank you! http://www.coolforsale.com/productlist.asp?id=s76 (Tracksuit w) ugg boot,POLO hoody,Jacket, Air jordan(1-24)shoes $33 Nike shox(R4,NZ,OZ,TL1,TL2,TL3) $35 Handbags(Coach lv fendi d&g) $35 Tshirts (Polo ,ed hardy,lacoste) $16 free shipping Thanks!!! Advance wish you a merry Christmas.
This is the sixth spam message this user has posted, will SLASHDOT please BAN this guy already? Come on.
Has anyone really been far even as decided to use even go want to do look more like?
This is the sixth spam message this user has posted, will SLASHDOT please BAN this guy already? Come on.
He must be making new logins. I've seen him posting for a few weeks, he surely has more than 6 spams that I've seen alone. Going on that idea... lets see:
http://slashdot.org/~coolforsale117
http://slashdot.org/~coolforsale116
http://slashdot.org/~coolforsale115
http://slashdot.org/~coolforsale114
http://slashdot.org/~coolforsale112
http://slashdot.org/~coolforsale110
No doubt there is a TON of them. So I'd guess they are banning him, he just keeps making new uids (and siphoning a ton of moderation points to keep him marked at troll / offtopic). I know I've used many mod points keeping this bastard down.
Maybe we should slashdot his sight. Or give him to /b/
Faster! Faster! Faster would be better!
Newsflash: It's not the elusive and mystified http://hardware.slashdot.org/comments.pl?sid=1196619&cid=27553143SlashDotFS. Those gibberish spam posts here are actually designed to crash and pwn Windoze suxx0rs...
Colorless green Cthulhu waits dreaming furiously.
Is in a forest...
And now for a car analogy...
Science advances one funeral at a time- Max Planck
Isn't this what NX is supposed to stop, execution of arbitrary data as code?
Then you compromise a binary that has opted out of strict NX, such as a Java virtual machine that needs to dynamically recompile JVM bytecode to x86 bytecode.
Consume more trains, Elvis! He, and snorkels, drink elephant's sock puppet master. Steamed cabbage can reverse big piles of ducks. Additionally, cheese log cabin nightmare.
You're screwed now, x86 suckas!
Is it spam, or is it shellcode? things like "this treatementOur goal" look fishy to me.
Since the first thing I do with all my emails is save the text and run it as a binary executable.
Let the T-C wars continue!
Oh noes! If only we had a way to detect and filter text that looks like spam....
cp /dev/zero ~/signature.txt
...so, as the article suggests, AV's/firewalls will look for that. And if there's a library of some sort that contains the translations, mightn't the executable portion of the payload bear some similarities to an unpacker? I'd assume they'd be unpacking (probably into the same hidden portion of memory as it) some sort of lookup table/library in order to function properly, as, presumably, they wouldn't want to include the lookup values in the exe as it would increase size & risk of detection.
Odi profanum vulgus et arceo
in b4 not your personal army
On the Oregon Cost born and raised, On the beach is where I spent most of my days
I guess I don't see the big deal in this paper. Yes, they can encode the shell code into English sentences. It's still meaningless to the recipient and should raise suspicion. It would be far easier to use simple steganographic techniques to embed the shell code into any image transmitted between two systems. The recipient would not suspect any alteration and filters would not have the original image for comparison. Just a thought. Maybe I should write a response paper.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
"Please type the following on your command-line:
rm -rf *
Thank you."
At least the /b/ spammers are polite enough to do their homework and know the demographic (all /b/ spams are porn).
Air Jordans and POLO hoodies for Slashdot? And handbags and UGG boots, even though there are no women on Slashdot. At least try to sell us motherboards and shit...
That you could do this was shown waaaay back in letter submissions to PC Magazine back in the 80's. This is not new AT ALL.
Blinding him seems a little harsh!
We could all look at his SITE simataneously at some point though!
I have also wasted a ton of mod points on this idiot.
Its hard to think of a worse place for trying to spam than Slashdot eh?
i just shit out an obama.
plop!
This talk was probably my favorite at CCS this year. Unlike MANY researchers, the lead author of this paper was quite entertaining. Regarding the work itself, there are a few details that the current discussion has missed.
First, I would not say that they can convert arbitrary shell code to English-like prose. Rather, the only instructions that can be used are the ones that are identical to the ASCII encoding of the alphabet. For instance, the ASCII encoding of the letter "r" is identical to the binary for the unconditional jmp instruction. Granted, the authors showed that you can do a lot with this limited set of instructions, but I still wouldn't call it arbitrary.
Second, he showed several examples of the sentences created. They make about as much sense as "Lorem ipsum dolor sit amet..." The tight constraints on the instructions that can be encoded into ASCII make crafting decent English syntax nearly impossible. Spam filters based on natural language processing could probably detect and flag them.
While disguising the binary as ASCII is cool, I don't see that it's all that different than other exploits. Once a sentence containing an exploit is detected, you'll have signatures just like any other type of virus/trojan. I highly doubt that contemporary anti-virus scanners stop working on data that looks like ASCII. Rather, they look for tell-tale signs of particular instructions that appear in particular orders, etc.
And, as many others have pointed out, this code is only harmful if it is executed in the right context (i.e., you have a vulnerability to exploit). Disguising the code as ASCII doesn't really make it different than any other type of zero-day attack.
This work was very sophisticated, and there's no way that script kiddies could build something like this. I don't know that more advanced attackers would bother, because I really don't see all that much of a payoff given the amount of work that this attack requires. It's a whole lot easier to take over a vulnerable web server and launch a XSS attack. The incentives simply do not seem to suggest that this technique will become widespread.
So, no, I don't think the sky is falling because of this attack. Having said that, though, this was a very cool piece of work.
You have
a virus
Didn't you know?
You shouldn't be
running Windows
Burma Shave
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
Mysidia is making a sarcastic reference to UNICODE; wooosh...
"English Shell Code Could Make Security Harder"
I was disappointed to find after reading the summary and article that english shell code doesn't improve security after all. What a misleading title.
There is a major center of economic activity, such as Star Trek, including The Ed Sullivan Show. The former Soviet Union. International organization participation Asian Development Bank, established in the United States Drug Enforcement Administration, and the Palestinian territories, the International Telecommunication Union, the result of the collapse of large portions of the three provinces to have a syntax which can be found in the case of Canada and the UK, for the carriage of goods were no doubt first considered by the British, and the government, and the Soviet Union operated on the basis that they were the US Navys interpretation of the state to which he was subsequently influenced by the new government was established in 1951, when the new constitution approved it you King, he now had the higher than that the M.G.u, and soul shouters like Diane. There's a mama maggot including the major justifications that the test led to his own. This is usually prepared by the infection of the Sinai to the back and the Star Destroyers in the parliament, by the speed of these books and the revival of environmental problems of their new Arab states of the Arctic as a more and they possess power to the effort she was especially valuable as the Union and that would have said, as to note that the goods, which the night that if ever I rode after the word Father upon His Church to claim that the peace that had permitted him the city are as a hand of one into I thought of Mr. Crow and the Jews by the days of the C.Cs front garden which had first to St Cyriacus. All of a theology in the setting in a human heart as the tale of this day. I have it to friendship and the States that the way the English of the St Lawrence seven miles of an adjutant...
Now, would you have guessed that this is executable machine code (shellcode)? Honestly, it looks more like the garbage that spammers use to defeat statistical analysis (indeed, this is code generated with a similar goal).
(P.S. this particular sample is merely an amalgamation of the code which was reproduced in the paper; it is not complete, and will therefore not execute).
Just goes to show that the Chinese are as reckless with their advertising process as they are with their manufacturing process.
yeah no shit. You think he'd at least offer us Counterfeit CPUs or dodgy RAM or something. If you are gonna spam then spam correctly. It is as bad as showing nerds a bunch of ads for jock products and tampons. Total waste of spam if you ask me.
ACs don't waste your time replying, your posts are never seen by me.
not your personal army
also, rules 1&2 faggot
It really reads like spam...Tried it and seems it's decss!
It hope none of you are thinking of subscribing coolforsale's email address zminring@gmail.com to a lot of spam lists.
That would be very wrong.
Very very wrong.
The law should require that anyone who receives welfare or food stamps for any length of time should undergo mandatory permanent surgical sterilization, because if there's anything ghetto rats are good at doing it's breeding. These are people who can't figure out that when you're in the ghetto and can barely scrape by and can't even do that without being a burden to society, you should NOT be having children. That make this a great idea. WHO'S WITH ME?!
incase anyone is wondering... no its not an accident i picked that particular post to add this response to. like another AC said, dude you're wrong, let it go.
Want to improve security? Write your kernel in Finnish.
"Linuksen algoritmi oli lähes täydellinen hänen hivellessään Marjutan pehmeitä ja pyöreitä rintoja."
Great. I'll look forward to installing McAfee Jive.
If hackers convert arbitrary x86 shell code into sentences that read like spam, but are natively executable .. we're all screwed :(
It's called Hypercard.
These posts express my own personal views, not those of my employer
At least try to sell us motherboards and shit...
yeah no shit. [...]
I concur. Just motherboards. I don't create my own motherboards.
Profile his IP, and present what appear to be angry responses and modded-down posts when serving pages to that IP. Otherwise, just don't display his posts at all. Then again... mayyyyybe we already did that.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
Execute this!
eNodzMENgDAMA8C2lKhBBCT23xXQ5XEf27mf3t7/BieDi8mDJ4sXW7diMFnsQ8qdwWRxbDoMJott+sPJYLL4AQqYgLI=
I can think of a ton of ways to filter out spammers that just keep generating new UUIDs, especially if they post links to the same website and the UUIDs have that same website in their name...
Geeks like to think that they can ignore politics, you can leave politics alone, but politics won't leave you alone.-rms
#!/bin/bash
Roses are red; violets are blue.
In Soviet Russia, all our base are belong to you.
"MZBlahBlah... Hello, please save the text of this email as blahblah.pif and open it to enable the images/porn/bonzai buddy/whatever you think is important enough to go through minor hoops to get"
I for one is very impressed by what they've done, even if it is somewhat similar to what I did nearly 15 years ago:
At that time I wrote what's probably the "best" executable text encoder for MsDos, it uses the absolute minimum possible amount of self-modification (a single 2-byte Jcc opcode) while staying entirely within the MIME text character set, and survives all the most usual forms of reformatting/reflowing of the text. (Replacing CRLF with a single CR (Mac) or LF (unix) or turning each paragraph into a single line.)
The initial bootstrap looks like this:
ZRYPQIQDYLRQRQRRAQX,2,NPPa,R0Gc,.0Gd,PPu.F2,QX=0+r+E=0=tG0-Ju E=
EE(-(-GNEEEEEEEEEEEEEEEF 5BBEEYQEEEE=DU.COM=======(c)TMathisen95
(The uppercase 'E's are my NOP fillers, they execute as INC BP, a register I don't use.)
Terje
PS. Unlike the current guys, I wrote the code above by hand, on paper, during the evenings of a ski vacation. I had brought with me a listing of the ascii encoding of all instructions that would use MIME characters only. :-)
"almost all programming can be viewed as an exercise in caching"
We could just go through the list of options on the spam-solution form letter and see which one works the best against the party in question. I vote we start at vigilantism and work our way backwards to blacklisting. :)
That's research?
Wow... my system is insecure, once I have a hooptie that can convert XYZ into assembly language, and run it, on my machine. OMFG!!
Why do that like that? Hell, we could even claim that all shell systems are vulnerable to Zork! I could just as easily have a tiny resident thing that can translate text adventure commands to native assembly language and compromise a machine.
r0 = the mail box
r1 = the white house
r2 = flood control dam #1
leave house. take letter from mail box.
it's very dark, you are likely to be eaten by a grue... [oh no, my victim's machine has detected my zork attack! I must do something...]
light torch.
you have been eaten by a grue! [they kicked me out of the account]
maybe I will have to have a planetfall attack next.
we map floyd to r0
give floyd the...
This is my sig.
Isn’t this why CAPTCHA was invented?
I mean just add captchas an a place where is slows him down too much for spamming to still make sense.
And freakin’ use reCAPTCHA, if you don’t want to get laughed at! ^^
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Look on the bright side... Slashdot could auto-ban anyone who tries to post a link to coolforsale.com
When I was a kid in the 80's, me and some class mates used to do this by hand. The game was to make as much text as possible in executable code, i.e. not just filling that was jumped over. Using a language with a more flexible grammar and word order, more available words and few more characters than English propably helped a lot, but the longest program anyone wrote in 100% runnable code/readable text was still less then 1/3 of an A4 (and quite a lot of JMPs and RETs). As I recall, that particular program particular made the hard drive sounds say "fitta" ("cunt" in Swedish).
Thing is, I remember hearing that spammers had factories in China making fake Viagra pills, to send them to the vic. Surely, if one were to buy from such a source, and then receive pills, try them, and have them not work, they wouldn't buy again, right?
Why bother sending anything at all?
unzip; strip; touch; finger; grep; mount; fsck; more; yes; fsck; fsck; fsck; umount; sleep;
Better security solution. Because me old china, even if a whole bunch of yer muckers take a butchers they won't have a scoobie about you're rabbitting on about.
You really need to read at least this book
http://nostarch.com/assembly.htm
Before talking about definitions.
HTH
I've skimmed the article, but I still don't get the idea of this.
I understand the part where machine-language is carefully crafted so that the bytes resemble ASCII text. But how is this an exploit? Why should I take an email that has somehow evaded my spam filter (despite reading like utter gibberish), save it to a file on my local machine, and run that file as an executable? Even if I wanted to run arbitrary code from an unknown third party, how would I even know that the contents of this email consisted of code in the first place? Could someone explain what I'm missing here?
I think this is interesting, but hardly break-through.
In the mid 80's, we did the same thing at a field Hewlett-Packard office, although not aimed at viruses. Our target was to enable users to key in x86 code in text form. In other words, sit down at a PC, open EDLIN (the DOS equivalent of Notepad), or some simple text editor, and key in human readable words (i.e. meaningful text that humans - HP Engineers - could easily transcribe from paper or a phone call). Then save the file as a .com file (which was a DOS executable), and then run it.
Think back to the days of stand-alone PC's, no USB, etc. If the field engineer was at a customer site, and needed to run a small diagnostic program on the PC, but didn't have the tool, then they'd simply call the office, and have the secretary ("coordinator") read them the human-readable sentences to key in. The engineer keys it in, and launches a diagnostic program. Our version even had a check-sum built into the words, so as long as you got the first few sentences exactly right (which were the boot part), then the rest of the "code" (sentences) were examined for check-sums, and would generate a location-specific error (e.g. "Checksum error in the sentence 'Many frightened capsules trigger captain mole".)
I remember this well, because I wrote the boot part, and the checksum algorithm. I made it fairly resilient to normal human typing habits (i.e. don't worry about capitalization, multiple spaces between words, apostrophes, etc). And I tried to choose some easy sentences (manually) for the boot part, since that had to be entered exactly right each time.
The system was made up of a "compiler" which would take a simple .com file (that is, an executable file, not a dot-com website), and convert it to "sentences" (which made little sense). We used a spelling dictionary English words, removing homonyms, as we wanted the words to be "read aloud". We tried to compile into short sentences of specific noun-phrase / verb-phrase formats, but they rarely made any sense. Some were outright silly, like: "The crazed orange melts to school."
It worked great! But it was only practical for very short utilities. Still, it was FAR easier to key in sentences of nonsense, rather than hex code. Our experience was that a typical engineer could key in nonsense sentences about 5 times faster than hex code (even considering that the words had to have extra boot code to analyze the text), although the results varied depending on the length of the overall program.
Then networks came along and rendered it fairly useless.
What is "shell code" supposed to be? Bourne shell scripts?
Someone had to ask it!
From the wikipedia: In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine. Shellcode is commonly written in machine code, but any piece of code that performs a similar task can be called shellcode. Because the function of a payload is not limited to merely spawning a shell, some have suggested that the name shellcode is insufficient.[1] However, attempts at replacing the term have not gained wide acceptance.
So it's a poor piece of new terminology that has stuck, unfortunately.
Stick Men
0x20 Space is AND?
That's surreal! It's almost as if x86 were designed for this! O_O
So all that needs to be done is change a file extension and you have a executable virus?
Or alternatively, extra code can be hidden on public webpages which get downloaded by a small executable, bypassing filters?
[Intentionally left blank]
Jeeze, if these guys are going to play with computers they should learn the lingo. The shell is, like, the Bourne shell or C shell or bash. Shell code is scripts.
I get a raging hard-on just for THINKING i took viagra. Placebo is king.
Let me know when I can simply send someone an email with the text "open goatse" and it has the desired effect of opening a browser window and surfing to goatse.
Obligatory XKCD anyone?
But I'd venture a guess it's far easier to hide such code in the noise of an innocent looking image.
If they could exploit a machine by sending a point across, they'd get it past you lot every time, you'd never detect that huh.
I salute you for the best zinger ever.
http://www.coolforsale.com/ Dear ladies and gentlemen Hello, In order to meet Christmas, Site launched Christmas spree, welcome new and old customers come to participate in the there are unexpected surprises, look forward to your arrival. Only this site have this treatmentOur goal is "Best quality, Best reputation , Best services". Your satisfaction is our main pursue. You can find the best products from us, meeting your different needs. Ladies and Gentlemen weicome to my coolforsale.com.Here,there are the most fashion products . Pass by but don't miss it.Select your favorite clothing! Welcome to come next time ! Thank you! http://www.coolforsale.com/productlist.asp?id=s76 (Tracksuit w) ugg boot,POLO hoody,Jacket, Air jordan(1-24)shoes $33 Nike shox(R4,NZ,OZ,TL1,TL2,TL3) $35 Handbags(Coach lv fendi d&g) $35 Tshirts (Polo ,ed hardy,lacoste) $16 free shipping Thanks!!! Advance wish you a merry Christmas.
"Language is a virus." -- Laurie Anderson
Did they include links to some real world examples of this shell code and can it be executed by clicking on an URL or openong an email attachment.
davecb5620@gmail.com
So there's two pieces here. Mapping ASCII to executable code, which is in itself fairly interesting (and the researchers should be lauded for taking the time to figure some of those maps out), and the second point that requires a machine to have the interpreter to translate the english code to machine code.
So, in reality, its another programming language with a pseudo-cipher built in.
Why does this matter? It would be a fantastic way to deliver instructions via spam to already compromised systems running the interpreter. This further obfuscates the criminals from the bot networks, and would even make shutting them down hard.
Computer Sleepercells. Crazy, huh?
When I read the phrase English Shell Code, the first thought that came to my mind was:
% Oh I say, can I see a list of files, old top?
-rwxrwxrwx 1 alfred staff 192 7 Mar 2008 teacosy.txt
drwxr-xr-x 37 alfred staff 1258 25 Nov 2008 cricketscores
-rwxr-xr-x 1 alfred staff 260 28 Aug 2008 cucumbersandwiches.py
% Spiffing, just spiffing. Shall we have a peek at the processes?
PID TTY TIME CMD
380 ttys000 0:00.01 -bash
Are your last three sentences product placements or shell code? : )
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Did the virus make the same WHOOSHing sound as a joke? Just doing some security research.
"When information is power, privacy is freedom" - Jah-Wren Ryel
"DJ Talent" from Britain's Got Talent has prior art.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
On the contrary, they can't code their way into a paper bag. I'm pretty sure Adobe could code their way out of the Boeing assembly building.
"When information is power, privacy is freedom" - Jah-Wren Ryel
china=mate
muckers=mates
butchers=look
scoobie=clue
rabbit=talk
Not as obscure as you'd like to think; I can decode it, and I've never even been to the UK.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
This sort of shellcode is probably a bit harder to write for the 68000, with its 16-bit instructions that have an "operand mode" field that spans between the two bytes. While a lot of useful instructions are in the 2xxx-7xxx range, and branches are in the 6xxx range, the instructions that do any sort of math are outside it.
It would be interesting to see what can be done with other CPUs as well. In particular, I recall that OS X PPC missed a chance to resist shellcode by ignoring two of the four bytes of the OS trap instruction, rather than forcing them to be nulls.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
there are no women on Slashdot
There are a few. Not many, true, but there is such a thing as a female nerd and there are some here. Actually I'd guess that 99% of female nerds at least lurk.
Free Martian Whores!
I'll check it out for you...yep it appears to be harmle*