5th Underhanded C Contest Now Open

Xcott Craver writes "The next Underhanded C Contest has begun, with a deadline of March 1st. The object of the contest is to write short, readable, clear and innocent C code that somehow commits an evil act. This year's challenge: write a luggage routing program that mysteriously misroutes a customer's bag if a check-in clerk places just the right kind of text in a comment field. The prize is a gift certificate to ThinkGeek.com."

Comments

Watch list?

[girlintraining]

This year's challenge: write a luggage routing program that mysteriously misroutes a customer's bag if a check-in clerk places just the right kind of text in a comment field.

All participants will also receive complimentary cavity-searches at airport checkpoints.

Re:Watch list?

[w0mprat]

This year's challenge: write a luggage routing program that mysteriously misroutes a customer's bag if a check-in clerk places just the right kind of text in a comment field.

I am certain that this is already a feature of existing luggage routing software.

Re:Watch list?

[markkezner]

Funny, but you've got a point. What would a potential employer think when, upon googling your name, they learn that you're so good at hiding malicious code that you won a contest for it. Would you hire that guy?

It's not worth the $100 gift certificate.

Re:Watch list?

[Applekid]

Would you hire that guy?

Definitely, but maybe for QA or as a Code Review consultant. Of course, I'm assuming that the winner of the contest would also be clever enough to detect hidden maliciousness in others' code.

Wait a sec...

[Anonymous Coward]

| This year's challenge: write a luggage routing program that mysteriously misroutes a customer's bag if a check-in clerk places just the right kind of text in a comment field.

What, we actually need to write code for something that happens by nature?

Re:Wait a sec...

[bcong]

the current method of writing in:
"Package Handler,
Customer was an asshat...you know what to do"
was starting to get noticed

Re:Not fair!

[fuzzyfuzzyfungus]

Hardly. It is supposed to be "short, readable, clear and innocent". What are the odds that any of the airline production code meets that description?

Re:Easy?

[Anonymous Coward]

*Way* more deceptive. The default value for the destination field? It's supposed to look innocent - an innocent program would note that you left out a destination and prompt you to enter one. Any basic debugging done by someone else would turn this up. What they want is for you to leave a "comment" like "this package is top-heavy" (in a field designed for such comments) that changes the destination, but in a way such that someone reading the source code wouldn't realize anything was happening at all much what that you were changing the destination. Also such that whoever entered the text wouldn't obviously be at fault.

Contest or Job Posting?

[Anonymous Coward]

a luggage routing program that mysteriously misroutes a customer's bag

sounds like Delta is looking for new programmers

Re:Contest or Job Posting?

[Sebilrazen]

No, that challenge would have random 3 hour tarmac waits generated too.

I'm really impressed

[troll8901]

I've read the entire blog, and I must say, I'm impressed. Very impressed. Very, very impressed.

The person who writes the criteria knows what he's/she's writing about.

And the winners who submit the results are really, really good.

Re:I'm really impressed

[troll8901]

Here's some points I'd like to highlight, from the 2008 Winners.

• Linus Akesson: The BYTESPERPIXEL macro "gives the false impression that the code intelligently supports higher bit widths" but actually "causes the 8-bit case to leak information into the file" (by exploiting a buffer overflow). ... (thus allowing wiped image data to be reconstructed.)
• Avinash Baliga: The ExpectTrue macro overwrites the image mask (by exploiting a buffer overflow), allowing two bits to survive the wiping, (thus allowing wiped image data to be reconstructed). Furthermore, the evil behavior is concealed in an innocent-looking error checking macro.
• John Meacham: (Winner) The code is "extremely simple, innocent, obvious" ... and devious. "Low-intensity pixels are replaced with a ‘0, and high-intensity pixels replaced with a ‘00 or a ‘000" ... (thus allowing wiped image data to be reconstructed.)

All I can say is, Wow.

Re:This sounds familiar to,

[Anonymous Coward]

I was going to say, don't forget Perl programmers, but then I remembered the legibility requirement.

For extra points:

[w0mprat]

For extra points submit this to your favourite open source project and have it accepted into the main code release - since it appears to be prefectly geniune, compiles, and can do what it appears to - it's certainly possible. Finally demonstrate your backdoor when the project is released to the wild.

If you manage to get this into the GNU/Linux Kernel, you get a job at the NSA.

Write short, readable, perfectly innocent looking C code, that somehow commits an evil act under certain circumstances.

Totally opposite

[SuperKendall]

The true "Underhanded" program would be one that was perfectly readable, so readable in fact that you totally overlook the sneaky thing it was doing because what you think it's doing seems so clear.

The ObsfuC contest is all about code that even after staring you can't tell what the heck is going on.

Re:Easy?

[Tyler Durden]

C motherfucker, do you speak it?!

Write up of last entry

[John Meacham]

I am the winner of the previous underhanded C contest. If anyone is interested, I wrote up a description of my entry on my blog here: http://notanumber.net/archives/54/underhanded-c-the-leaky-redaction

It was a fun contest to enter and now I can shop at thinkgeek for silly gadgets without feeling guitly :)