5th Underhanded C Contest Now Open

Xcott Craver writes "The next Underhanded C Contest has begun, with a deadline of March 1st. The object of the contest is to write short, readable, clear and innocent C code that somehow commits an evil act. This year's challenge: write a luggage routing program that mysteriously misroutes a customer's bag if a check-in clerk places just the right kind of text in a comment field. The prize is a gift certificate to ThinkGeek.com."

Comments

Watch list?

[girlintraining]

This year's challenge: write a luggage routing program that mysteriously misroutes a customer's bag if a check-in clerk places just the right kind of text in a comment field.

All participants will also receive complimentary cavity-searches at airport checkpoints.

Re:Watch list?

[RichardJenkins]

Uh-oh, looks like you got missed out the punctuation and got the words in the wrong order! You clearly meant:

God, is stupid science there? Is that religion? Get some religion! Karma should fuck me good.

Yeah, that makes more sense.

Re:Watch list?

[w0mprat]

This year's challenge: write a luggage routing program that mysteriously misroutes a customer's bag if a check-in clerk places just the right kind of text in a comment field.

I am certain that this is already a feature of existing luggage routing software.

Re:Watch list?

[markkezner]

Funny, but you've got a point. What would a potential employer think when, upon googling your name, they learn that you're so good at hiding malicious code that you won a contest for it. Would you hire that guy?

It's not worth the $100 gift certificate.

Re:Watch list?

[Applekid]

Would you hire that guy?

Definitely, but maybe for QA or as a Code Review consultant. Of course, I'm assuming that the winner of the contest would also be clever enough to detect hidden maliciousness in others' code.

Re:Watch list?

[Anonymous Coward]

Yes, especially if the word "fragile" or "valuable" is in the comment field.

Not fair!

[Anonymous Coward]

Someone who works at any major airline can just submit the real production code they use for luggage routing and win the contest for sure!

Re:Not fair!

[fuzzyfuzzyfungus]

Hardly. It is supposed to be "short, readable, clear and innocent". What are the odds that any of the airline production code meets that description?

Re:Not fair!

[derGoldstein]

Hardly. It is supposed to be "short, readable, clear and innocent". What are the odds that any of the airline production code meets that description?

Hardly. It is supposed to be "short, readable, clear and innocent". What are the odds that any software written in C meets that description?

There, fixed.

Wait a sec...

[Anonymous Coward]

| This year's challenge: write a luggage routing program that mysteriously misroutes a customer's bag if a check-in clerk places just the right kind of text in a comment field.

What, we actually need to write code for something that happens by nature?

Re:Wait a sec...

[bcong]

the current method of writing in:
"Package Handler,
Customer was an asshat...you know what to do"
was starting to get noticed

Possibilities

[Rei]

I don't have the time for something like this, but it seems to me a good possibility would be to have all of your inputs that the clerk fills out be contiguous in memory, including the destination, have the algorithm to figure out what destination to go to scan through the whole destination string looking for matches (rather than looking for an exact match) and taking the last one it finds, and have a broken bounds check for the length of that string so that the algorithm looks into the comments section as well.

So, for example, if the clerk fills out the destination as "LAX" but writes in the comments section, "Do not confuse his bags with those owned by CID who is also going to a different final destination; they're very similar looking.", the bags would be routed to Cedar Rapids (CID) instead of Los Angeles (LAX).

Re:Easy?

[Anonymous Coward]

*Way* more deceptive. The default value for the destination field? It's supposed to look innocent - an innocent program would note that you left out a destination and prompt you to enter one. Any basic debugging done by someone else would turn this up. What they want is for you to leave a "comment" like "this package is top-heavy" (in a field designed for such comments) that changes the destination, but in a way such that someone reading the source code wouldn't realize anything was happening at all much what that you were changing the destination. Also such that whoever entered the text wouldn't obviously be at fault.

Contest or Job Posting?

[Anonymous Coward]

a luggage routing program that mysteriously misroutes a customer's bag

sounds like Delta is looking for new programmers

Re:Contest or Job Posting?

[Sebilrazen]

No, that challenge would have random 3 hour tarmac waits generated too.

I'm really impressed

[troll8901]

I've read the entire blog, and I must say, I'm impressed. Very impressed. Very, very impressed.

The person who writes the criteria knows what he's/she's writing about.

And the winners who submit the results are really, really good.

Re:I'm really impressed

[troll8901]

Here's some points I'd like to highlight, from the 2008 Winners.

• Linus Akesson: The BYTESPERPIXEL macro "gives the false impression that the code intelligently supports higher bit widths" but actually "causes the 8-bit case to leak information into the file" (by exploiting a buffer overflow). ... (thus allowing wiped image data to be reconstructed.)
• Avinash Baliga: The ExpectTrue macro overwrites the image mask (by exploiting a buffer overflow), allowing two bits to survive the wiping, (thus allowing wiped image data to be reconstructed). Furthermore, the evil behavior is concealed in an innocent-looking error checking macro.
• John Meacham: (Winner) The code is "extremely simple, innocent, obvious" ... and devious. "Low-intensity pixels are replaced with a ‘0, and high-intensity pixels replaced with a ‘00 or a ‘000" ... (thus allowing wiped image data to be reconstructed.)

All I can say is, Wow.

Re:I'm really impressed

[derGoldstein]

I also started looking up past winners, Johns explanation/justification code was brilliant. I had no idea such evilness could be so cleverly concealed.

So you're new to C?

Re:This sounds familiar to,

[Anonymous Coward]

I was going to say, don't forget Perl programmers, but then I remembered the legibility requirement.

For extra points:

[w0mprat]

For extra points submit this to your favourite open source project and have it accepted into the main code release - since it appears to be prefectly geniune, compiles, and can do what it appears to - it's certainly possible. Finally demonstrate your backdoor when the project is released to the wild.

If you manage to get this into the GNU/Linux Kernel, you get a job at the NSA.

Write short, readable, perfectly innocent looking C code, that somehow commits an evil act under certain circumstances.

Re:For extra points:

[Nemyst]

Well, Linux already allows you to install Windows...

Totally opposite

[SuperKendall]

The true "Underhanded" program would be one that was perfectly readable, so readable in fact that you totally overlook the sneaky thing it was doing because what you think it's doing seems so clear.

The ObsfuC contest is all about code that even after staring you can't tell what the heck is going on.

Re:Easy?

[Tyler Durden]

C motherfucker, do you speak it?!

Write up of last entry

[John Meacham]

I am the winner of the previous underhanded C contest. If anyone is interested, I wrote up a description of my entry on my blog here: http://notanumber.net/archives/54/underhanded-c-the-leaky-redaction

It was a fun contest to enter and now I can shop at thinkgeek for silly gadgets without feeling guitly :)