Network defenders get stuck in to Honeynet challenge

By Rachel Lebihan, ZDNet Australia, 19 July, 2002 09:53

NEWS

In an attempt to find order in chaos, network defenders across the globe took on the Honeynet Project's Reverse Challenge -- to analyse and decipher binary code captured in the wild -- and an Australian programmer is reaping the rewards of sweet success. Unwitting hackers and crackers running amok on computer networks sometimes break into false networks, or "honeynets", designed to let hackers do their thing whilst investigators watch on, analysing their tricks of the trade. In a further attempt to enable defenders to learn from the hacking experience itself, The Honeynet Project, which was established by a group of computer security researchers, set up the Reverse Challenge. The test was to make a full analysis of an unknown program code found on a compromised honeynet system, using the reverse engineering tools and techniques used by security specialists. The Challenge, the results of which were released this month, followed in the footsteps of its predecessor, The Forensic Challenge, launched in January 2001. "The binary was downloaded over 5,000 times. The challenge required highly sophisticated skills, so we were excited to see so many people try it out," organiser of the Reverse Challenge, Lance Spitzner, told ZDNet Australia. With stringent documentation required, just 35 contestants from across the globe decoded the challenge and submitted their findings in full -- and the winner was 27-year-old Australian Dion Mendel. Mendel's involvement was out of "professional curiosity" as well as the challenge to learn something new. A computer programmer by trade, Mendel's interest in computing is that it provides a wealth of puzzles to be solved. "Unfortunately, it is also addictive," he said. "I have been told that reverse engineering and de-compiling are extremely difficult tasks. I wished to see if this were true," Mendel said. Furthermore, he added, the challenge provided an opportunity to see just what the technical capabilities of crackers are. Mendel spent 80 hours participating in the challenge, 25 of which were spent writing up the prerequisite documentation. "Technically the challenge wasn't difficult, and as stated in the competition, the documentation would decide the winner. Stereotypically, computer people have poor literacy skills, and have an intense dislike of writing documentation," Mendel pointed out. Mendel said he spent seven hours researching, and the remaining 48 hours or so split between writing custom tools to assist with the analysis, and performing the actual analysis itself. Assuming that the unknown executable given in the contest is typical of tools used by computer crackers, Mendel said the challenge provided a very disturbing insight into their world. "These people are not super geniuses. They are not even above average with their technical skills. They are at best, barely competent. So the fact that these individuals with average skills are able to cause so much havoc, says that the set-up of our computer systems is extremely lacking," he said. Mendel pointed out that 'Melissa', 'I LOVE YOU' and 'Code Red' were all further examples of technically simple programs. "When I consider how much reliance the world puts on its computer systems, especially Windows, it's beginning to make me afraid," he said. Twenty-four-year-old Australian Sean Burford was ranked twelfth in the Reverse Challenge. With a past as a programmer and Unix Systems administrator, Burford said he got involved in the challenge for several reasons; relevance, curiosity and fun. "The major reason that I competed was really curiosity. I wanted to learn how to use the reverse engineering tools and techniques that security specialists use. I also wanted to learn about this new program, which the Honeynet Reverse Challenge documentation said was previously undocumented. Finally, it was great fun making discoveries along the way," Burford said. Like Mendel, he also spent a total of 80 hours on the challenge, working at it weekends and some weeknights, with some of his discoveries made while studying printouts on the bus on the way to work. "I've faced this kind of scenario before, and understand the time pressures that often lead administrators to archive evidence of a compromise and get the computer system working again as quickly as possible, never to return and dissect the program. Working on this challenge allowed me to learn about the time requirements, costs and benefits of properly investigating binaries found on compromised machines." According to Burford, the skills he picked up during the challenge will help him to analyse evidence from compromised machines more effectively and in less time. "Those of us who performed their first security related reverse engineering in this project now have a better understanding of the time requirements and how to approach the problem. I think we were all surprised by how long it took to complete the challenge," he said. Burford pointed out that there is now a method of armouring Unix programs so that they are difficult to reverse engineer. "I think that reverse engineering is going to become more challenging over time... The race between reverse engineers and those who wish to protect the intellectual property within programs will be an interesting one to watch. I expect both sides to compete, releasing tools with ever increasing abilities, in competition to protect from each other," he said. Spitzner, the challenge organiser, said not only were submissions greater, but the quality of work and documentation far exceeded last year's Forensic Challenge. "I believe we had over 200,000 hits when we announced it, and over 300,000 hits when we announced the results. Nothing like this has ever been done before with Reverse Engineering. Now, because of the hard work of many people, others can learn," he said. According to Spitzner, if all the time the judges donated was added to the cost of the running the challenge, it would have easily have topped $30,000. Nevertheless, he said, The Honeynet Project would like to do a major challenge every year. The next plan is to have another Forensic Challenge, but one based on Windows or Solaris. With it taking five weeks for the six judges to review all the entries, each judge spent on average one hour on each entry so each entry had six hours of review, did any major discoveries come out of the challenge? "We discovered there are a lot of different ways to reverse a binary," Spitzner quipped.

For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Viruses and Hacking News Section. Have your say instantly, and see what others have said. Go to the Security forum. Let the editors know what you think in the Mailroom.

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

@kevinmchapman. OK, I acknowledge that 'most' was a gratuitous throwaway comment as an afterthought and too presumptuous. As to proof, as you...

3 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint

@BrownieBoy > Works really well for thieves.... >> Nice attempt to deflect the argument by tossing in a point that's totally >> irrelevant, even...

4 hours ago by Jack Schofield on AMD Ultrathins to challenge Intel Ultrabooks

fantastic that the so called piracy bills have been withdrawn. however, these anti-democracy supporters are still in the shadows so lets be alert...

5 hours ago by raskolnikof on SOPA, Protect IP support wavers in face of online protest

Please God no; teach them anything you like - thinking rationally, the uses and misuses of data, what data is and what it's not - but leave the...

7 hours ago by Tony Douglas via Facebook on Kids are the future. Teach ’em to code.

@Jack, > Works really well for thieves.... Nice attempt to deflect the argument by tossing in a point that's totally irrelevant, even it were...

22 hours ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

Make that 13 people now - I got refused today at Manchester airport. I thought I was up to date on this legislation - I knew of the EU ruling from...

1 day ago by bootlegger on UK airport body scans will not be opt out

Don't forget to check out apps like GoodReader or SlideShark either, they're indispensible for people on the go in presentation situations. Best...

1 day ago by tinycg on Four top iPad apps for people on the move

Well it seems there is something a number of us agree on. Why is the Ubuntu Unity launcher so ugly? I thought perhaps it was something to do with...

1 day ago by TerryRK on A tale of two distros: Ubuntu and Linux Mint

Duplicate comments are not made intentionally. Its very good to know that now you are keeping check on this problem because sometimes a commenter...

2 days ago by Freebies202 on Microsoft fixes blog comments, speeds up blogs with open source

"the very significant number of users" and "many (most) of us" - you have no evidence for these statements. It is a fact that most users are saying...

2 days ago by kevinmchapman on A tale of two distros: Ubuntu and Linux Mint