- cypherpunks-legacy - lists.cpunks.org

Hydan: Information Hiding in Program Binaries
by R. A. Hettinga 12 Aug '04

12 Aug '04

<http://crazyboy.com/hydan/> Hydan [hI-dn]: Old english, to hide or conceal. Intro: Hydan steganographically conceals a message into an application. It exploits redundancy in the i386 instruction set by defining sets of functionally equivalent instructions. It then encodes information in machine code by using the appropriate instructions from each set. Features: - Application filesize remains unchanged - Message is blowfish encrypted with a user-supplied passphrase before being embedded - Encoding rate: 1/110 Primary uses for Hydan: - Covert Communication: embedding data into binaries creates a covert channel that can be used to exchange secret messages. - Signing: a program's cryptographic signature can be embedded into itself. The recipient of the binary can then verify that it has not been tampered with (virus or trojan), and is really from who it claims to be from. This check can be built into the OS for user transparency. - Watermarking: a watermark can be embedded to uniquely identify binaries for copyright purposes, or as part of a DRM scheme. Note: this usage is not recommended as Hydan implements fragile watermarks. If you think of anything else, do let me know :) Platforms Supported: - {Net, Free}BSD i386 ELF - Linux i386 ELF - Windows XP PE/COFF Download: Version 0.13 News: Update: I've finally updated the hydan code, after a long time off. The encoding rate has been improved to 1/110 (thanks to a tip from sandeep!), and the code is now much cleaner too. In the mean time, hydan has been presented at: CansecWest 04 BlackHat Vegas 04 DefCon 04 A paper is to be published soon as well: Hydan: Hiding Information in Program Binaries Rakan El-Khalil and Angelos D. Keromytis. Which is to appear in the proceedings of the 6th International Conference on Information and Communications Security (ICICS), Malaga, Spain. To be published in Springer Verlag's LNCS. Hydan was initially presented at CodeCon on 02/23/2003. The following is a list of articles online from that presentation: - The Register: Hydan Seek (same article at BusinessWeek, and SecurityFocus) - Slashdot: Program Hides Secret Messages in Executables (could it be? crazyboy survived slashdotting?) - Punto-Informatico: Un tool cela segreti nei programmi (intl coverage! been getting a lot of hits from them) - Bruce Schneier's Crypto-Gram: March 15, 2003 Issue (and not in the snake-oil section either ;) Like my Work? Buy me books! Contact: Rakan El-Khalil <rfe3 at columbia dot edu> -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

2+2=5 and mention of cryptome
by Sunder 12 Aug '04

12 Aug '04

Original URL: http://www.theregister.co.uk/2004/08/11/al_q_geek_us_overthrow_plot/ Al-Qaeda computer geek nearly overthrew US By Thomas C Greene (thomas.greene at theregister.co.uk) Published Wednesday 11th August 2004 16:45 GMT Update A White House with a clear determination to draw paranoid conclusions from ambiguous data has finally gone over the top. It has now implied that the al-Qaeda computer geek arrested last month in Pakistan was involved in a plot to destabilize the USA around election time. Two and two is five As we reported here (http://www.theregister.co.uk/2004/08/03/us_terror_alert_political_football) and here (http://www.theregister.co.uk/2004/08/02/al_qaeda_cyber_terror_panic) so-called al-Qaeda "computer expert" Muhammad Naeem Noor Khan, a Pakistani, was arrested on 13 July in possession of detailed but rather old surveillance documents related to major financial institutions in New York, Newark, and Washington. Since that time, other intelligence has led the US security apparatus to imagine that a plot to attack the USA might be in the works. (No doubt there are scores of plots in the works, but we digress.) Therefore, last week, the ever-paranoid Bush Administration decided that Khan's building surveillance documents, and the hints of imminent danger, had to be connected. Indeed, if al Qaeda is to strike at all, it is most likely to strike the targets mentioned in Khan's documents, as opposed to thousands of others, the Bushies reasoned. New York, Newark and Washington were immediately put on high alert, at great expense, and to the inconvenience of millions of residents. <SNIP> ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"Our enemies are innovative and resourceful, and so are we. /|\ \|/ :They never stop thinking about new ways to harm our country /\|/\ <--*-->:and our people, and neither do we." -G. W. Bush, 2004.08.05 \/|\/ /|\ : \|/ + v + : War is Peace, freedom is slavery, Bush is President. -------------------------------------------------------------------------

1 0

Re: A Billion for Bin Laden
by Major Variola (ret) 12 Aug '04

12 Aug '04

>>With the possibility of earning a $1 billion bounty, however, professional Bin Laden hunting firms would form, allowing the U.S. to enlist the efficiency and creativity of the free market in our fight against Osama.<< This is brilliant, worthy of being called channelling Tim M. As it relies entirely on free association and the rational marketplace. Nevermind that the reward is stolen from the sheeple. What the DC future-corpses don't grok is that the Sheik's network is not financially or career motivated, unlike themselves. And xianity (or even amerikan patriotism which sometimes substitutes) is too neutered to counter it. Get your filthy hands off my desert, indeed, or else. See you in Athens.

4 4

ABC News: Internet and Terrorism
by John Young 12 Aug '04

12 Aug '04

ABC News is offering a report this evening on how the Internet may be helping terrorism. For it Cryptome was grilled and taped yesterday for aiding and abetting. We confessed it's due to brain-liberating by the manchurian cypherpunks.

1 0

[ISN] Hack . . . hack back . . . repeat
by R. A. Hettinga 12 Aug '04

12 Aug '04

--- begin forwarded text

1 0

Hackers download College's Patriot database
by R. A. Hettinga 12 Aug '04

12 Aug '04

--- begin forwarded text

1 0

[ISN] Hackers download SIUE data, police say
by InfoSec News 12 Aug '04

12 Aug '04

http://www.stltoday.com/stltoday/news/stories.nsf/News/Metro+East/A3F75AB9C… By Trisha Howard Of the Post-Dispatch 08/11/2004 The names and passport information of more than 500 foreign students at Southern Illinois University Edwardsville was illegally downloaded last week by a fellow student at the school, according to a search warrant filed Wednesday by university police. Greg Conroy, an SIUE spokesman, said Wednesday that three students had been questioned Friday after university officials discovered the security breach. Conroy said he expected the university to seek criminal charges in the case. The search warrant, filed in Madison County Circuit Court, said that the hacker downloaded the information from a special database set up to comply with provisions of the federal Patriot Act. The data included names, dates of birth, Social Security numbers and visa information, Sgt. Marty Tieman of the SIUE Police Department said in his affidavit. Conroy said that employees in the university's Office of Information Technology found out about the breach on Friday while doing their daily check of activity logs. The log showed that someone had downloaded the information early that morning. Computer experts then tracked the computer to one of three students who share an apartment at Cougar Village, Conroy said. On Friday afternoon, police seized three computers from the apartment and questioned the three students, Conroy said. Tieman said in his affidavit that police were greeted at the door by one of the three students, who admitted that he had seen his roommate access the server and download the information. Conroy said that officials had not yet determined a motive. "For all I know, these students could have been doing this as a prank," Conroy said. "At this point, I don't know what they wanted to do with the information." Conroy said investigators from a Metro East law enforcement computer task force were examining all three computers for evidence. He emphasized that the system does not allow hackers to change vital information. But he said that the breach was possible because an employee had failed to disable a feature that gives people access to the system without a password. "The students were scanning the system, they found the flaw, and they started downloading files," Conroy said. "It's an unfortunate mistake, but it happened." _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Hackers download SIUE data, police say
by InfoSec News 12 Aug '04

12 Aug '04

http://www.stltoday.com/stltoday/news/stories.nsf/News/Metro+East/A3F75AB9C… By Trisha Howard Of the Post-Dispatch 08/11/2004 The names and passport information of more than 500 foreign students at Southern Illinois University Edwardsville was illegally downloaded last week by a fellow student at the school, according to a search warrant filed Wednesday by university police. Greg Conroy, an SIUE spokesman, said Wednesday that three students had been questioned Friday after university officials discovered the security breach. Conroy said he expected the university to seek criminal charges in the case. The search warrant, filed in Madison County Circuit Court, said that the hacker downloaded the information from a special database set up to comply with provisions of the federal Patriot Act. The data included names, dates of birth, Social Security numbers and visa information, Sgt. Marty Tieman of the SIUE Police Department said in his affidavit. Conroy said that employees in the university's Office of Information Technology found out about the breach on Friday while doing their daily check of activity logs. The log showed that someone had downloaded the information early that morning. Computer experts then tracked the computer to one of three students who share an apartment at Cougar Village, Conroy said. On Friday afternoon, police seized three computers from the apartment and questioned the three students, Conroy said. Tieman said in his affidavit that police were greeted at the door by one of the three students, who admitted that he had seen his roommate access the server and download the information. Conroy said that officials had not yet determined a motive. "For all I know, these students could have been doing this as a prank," Conroy said. "At this point, I don't know what they wanted to do with the information." Conroy said investigators from a Metro East law enforcement computer task force were examining all three computers for evidence. He emphasized that the system does not allow hackers to change vital information. But he said that the breach was possible because an employee had failed to disable a feature that gives people access to the system without a password. "The students were scanning the system, they found the flaw, and they started downloading files," Conroy said. "It's an unfortunate mistake, but it happened." _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Hack . . . hack back . . . repeat
by InfoSec News 12 Aug '04

12 Aug '04

http://www.nwfusion.com/news/2004/080904defcon.html By Rodney Thayer Network World 08/09/04 LAS VEGAS - Capture the flag might be only a game, but it was serious business at DefCon, the world's largest annual computer hacker convention. For 36 straight hours, eight teams of experienced hackers and serious security professionals played predator and prey as they tried to hack into competitors' networks while defending their own. From my front-row seat as a member of the winning team, Sk3wl of R00t (hacker slang for "School of Root," where "root" refers to gaining administrator access to a system), I got a bird's-eye view of how new - and not so new - attacks could be launched and thwarted. Each qualified team playing the game - organized by a Seattle security community group called the Ghetto Hackers - controlled a pair of Windows machines running a variety of network and Web-based services that were connected to each other and a central scoring mechanism called the Scorebot via a Gigabit Ethernet network. Rest assured, this hacker network was not connected to the Internet. As soon as the doors to the secluded hacker playground disguised as a hotel ballroom were opened at 10 a.m. July 30, the air was tense in this crowded room. The game scenario and the legitimately purchased Windows images were presented to participants two hours before the official noon start time. How would you like to have to lock down two Windows boxes in just two hours as you started to recognize that there were world-class exploit developers in the room - and on your network? A team scored by attacking rivals' servers and stealing flags (data strings stored within the servers). The successful hacker then presented the stolen flags to the scoring system for credit. The overall score was a combination of credit for attacking other teams' servers and successfully defending your own services. Penalties were issued for excessive consumption of bandwidth, so simple port scans and brute force attacks were not used, and denial-of-service attacks were forbidden. In the middle of the room sat the Ghetto Hackers' gear, necessary for keeping the game within bounds and blasting loud techno music for the entire 36-hour ride. We'd trained for the competition in small conference rooms with similar tunes blaring as white noise to desensitize. But by the time it was 2 a.m., and you were staring at a network trace flying by on a screen, you noticed that your heartbeat and your breathing synchronized with the music and the packet traffic. At that point, it was time to take a walk. At the beginning everyone was organized with their supplies. Our cooler was stocked with ice and Coke. As time dragged on, people started bringing in food and drinks. At first we were organized and sent out someone for bread and cold cuts. But by the middle of Day Two we gave up and started ordering pizza. We stuck with soda for the most part, but as the contest wore on, a beer or two appeared. As we scanned the room (discreetly, of course) we saw the other teams behaving the same way if not more so. One team had a steadily draining bottle of Southern Comfort on top of its server. The Ghetto Hackers' full-length equipment rack was ornamented by a large, red, wooden arch in the style of a Japanese archway complete with Asian script. Our Japanese language expert slunk over for a closer look and determined the writing on the wall to be complete gibberish, with no hidden message to help us crack the code. Each team carefully arranged its equipment - everything from laptop Macs to Cisco switches, some piled 3 feet high on the allotted two tables - around the periphery of the room. Teams were supposed to have a maximum of 15 members, but no one stuck to that upper limit as the flow in and out of the room easily boosted each roster to more than 20 people. The ground rules I agreed to dictate that I not divulge individuals' identities. But in general terms I can say the teams included at least two CTOs; security professionals from Ernst & Young, AOL and the University of California at Santa Barbara; and well-known and unknown hackers. Additionally, at least four teams had members hailing from the U.S. Department of Defense. We mostly kept to ourselves and minimized visible screen space to avoid becoming vulnerable to "shoulder surfing" or other forms of spying. You also had to do some reconnaissance to sniff out any secret deals being cut to share or trade information among teams. Think "Survivor," when it was good. There wasn't exactly a book on how to organize your team or set strategy for this sort of thing. But our winning strategy as a team was organization. We organized everything from a rotating "cat nap" schedule to divvying up jobs along lines of expertise. Because offense was 80% of the overall score, you had to maintain support for your front-line attackers. The trick was to not ignore your defenses. If your defenses slipped, other teams could get in and score. As the Ghetto Hackers pointed out at the awards ceremony, we were solid attackers - not significantly better than other teams - but we had very good defense and were able to keep other teams from stealing flags from us. Most attacks we saw were levied against information in the database. Someone would figure out how to run the Wiki (a piece of server software that lets users freely create and edit Web page content using any Web browser) and do some obscure set of queries that would reveal flag data. Or someone would go into the Multi-User Dungeon, online game environments that use a great deal of bandwidth, and figure out if you walked north through the forest just the right way you'd be able to pick up a flag. We saw many failed attacks. Someone tried to buffer overflow the Web server with 800,000-byte null packets. Someone else tried to go after SNMP services to gain entry. Teams even attempted to capture their incoming Scorebot traffic and replay that same traffic in the direction of our machines in the hopes that our services would mistake them for the actual Scorebot and give up flags to them. If I were to apply my experiences to a more everyday situation than what was taking place at the off-the-strip Alexis Park hotel, five points would bubble to the top of the security cauldron: Unsecure, unnecessary services - such as terminal services and SNMP - are running on most Windows machines. You've got to take care to shut down or firewall all unnecessary ports used by these services. * Passwords are revealed frequently. To defend against this, periodically change all passwords, including those that give access to Web services and databases. * Customized Web applications typically leak critical information. To defend against this, applications must be modified so they do not have commands that give too much information without proper authorization or let users modify objects out of turn. * Unmonitored services are dangerously open to attack. Watch your logs like a hawk. * Hack attacks happen. Be very, very afraid. Thayer is principal investigator with Canola & Jones, a security research firm in Mountain View, Calif. He can be reached at rodney(a)canola-jones.com. Acknowledgements Thanks to the Ghetto Hackers for running a great contest. They put together a complex game and made it run under very stressful conditions and it worked great. Thanks also to Sk3wl of R00t for letting me join in. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

[ISN] Hack . . . hack back . . . repeat
by InfoSec News 12 Aug '04

12 Aug '04

http://www.nwfusion.com/news/2004/080904defcon.html By Rodney Thayer Network World 08/09/04 LAS VEGAS - Capture the flag might be only a game, but it was serious business at DefCon, the world's largest annual computer hacker convention. For 36 straight hours, eight teams of experienced hackers and serious security professionals played predator and prey as they tried to hack into competitors' networks while defending their own. From my front-row seat as a member of the winning team, Sk3wl of R00t (hacker slang for "School of Root," where "root" refers to gaining administrator access to a system), I got a bird's-eye view of how new - and not so new - attacks could be launched and thwarted. Each qualified team playing the game - organized by a Seattle security community group called the Ghetto Hackers - controlled a pair of Windows machines running a variety of network and Web-based services that were connected to each other and a central scoring mechanism called the Scorebot via a Gigabit Ethernet network. Rest assured, this hacker network was not connected to the Internet. As soon as the doors to the secluded hacker playground disguised as a hotel ballroom were opened at 10 a.m. July 30, the air was tense in this crowded room. The game scenario and the legitimately purchased Windows images were presented to participants two hours before the official noon start time. How would you like to have to lock down two Windows boxes in just two hours as you started to recognize that there were world-class exploit developers in the room - and on your network? A team scored by attacking rivals' servers and stealing flags (data strings stored within the servers). The successful hacker then presented the stolen flags to the scoring system for credit. The overall score was a combination of credit for attacking other teams' servers and successfully defending your own services. Penalties were issued for excessive consumption of bandwidth, so simple port scans and brute force attacks were not used, and denial-of-service attacks were forbidden. In the middle of the room sat the Ghetto Hackers' gear, necessary for keeping the game within bounds and blasting loud techno music for the entire 36-hour ride. We'd trained for the competition in small conference rooms with similar tunes blaring as white noise to desensitize. But by the time it was 2 a.m., and you were staring at a network trace flying by on a screen, you noticed that your heartbeat and your breathing synchronized with the music and the packet traffic. At that point, it was time to take a walk. At the beginning everyone was organized with their supplies. Our cooler was stocked with ice and Coke. As time dragged on, people started bringing in food and drinks. At first we were organized and sent out someone for bread and cold cuts. But by the middle of Day Two we gave up and started ordering pizza. We stuck with soda for the most part, but as the contest wore on, a beer or two appeared. As we scanned the room (discreetly, of course) we saw the other teams behaving the same way if not more so. One team had a steadily draining bottle of Southern Comfort on top of its server. The Ghetto Hackers' full-length equipment rack was ornamented by a large, red, wooden arch in the style of a Japanese archway complete with Asian script. Our Japanese language expert slunk over for a closer look and determined the writing on the wall to be complete gibberish, with no hidden message to help us crack the code. Each team carefully arranged its equipment - everything from laptop Macs to Cisco switches, some piled 3 feet high on the allotted two tables - around the periphery of the room. Teams were supposed to have a maximum of 15 members, but no one stuck to that upper limit as the flow in and out of the room easily boosted each roster to more than 20 people. The ground rules I agreed to dictate that I not divulge individuals' identities. But in general terms I can say the teams included at least two CTOs; security professionals from Ernst & Young, AOL and the University of California at Santa Barbara; and well-known and unknown hackers. Additionally, at least four teams had members hailing from the U.S. Department of Defense. We mostly kept to ourselves and minimized visible screen space to avoid becoming vulnerable to "shoulder surfing" or other forms of spying. You also had to do some reconnaissance to sniff out any secret deals being cut to share or trade information among teams. Think "Survivor," when it was good. There wasn't exactly a book on how to organize your team or set strategy for this sort of thing. But our winning strategy as a team was organization. We organized everything from a rotating "cat nap" schedule to divvying up jobs along lines of expertise. Because offense was 80% of the overall score, you had to maintain support for your front-line attackers. The trick was to not ignore your defenses. If your defenses slipped, other teams could get in and score. As the Ghetto Hackers pointed out at the awards ceremony, we were solid attackers - not significantly better than other teams - but we had very good defense and were able to keep other teams from stealing flags from us. Most attacks we saw were levied against information in the database. Someone would figure out how to run the Wiki (a piece of server software that lets users freely create and edit Web page content using any Web browser) and do some obscure set of queries that would reveal flag data. Or someone would go into the Multi-User Dungeon, online game environments that use a great deal of bandwidth, and figure out if you walked north through the forest just the right way you'd be able to pick up a flag. We saw many failed attacks. Someone tried to buffer overflow the Web server with 800,000-byte null packets. Someone else tried to go after SNMP services to gain entry. Teams even attempted to capture their incoming Scorebot traffic and replay that same traffic in the direction of our machines in the hopes that our services would mistake them for the actual Scorebot and give up flags to them. If I were to apply my experiences to a more everyday situation than what was taking place at the off-the-strip Alexis Park hotel, five points would bubble to the top of the security cauldron: Unsecure, unnecessary services - such as terminal services and SNMP - are running on most Windows machines. You've got to take care to shut down or firewall all unnecessary ports used by these services. * Passwords are revealed frequently. To defend against this, periodically change all passwords, including those that give access to Web services and databases. * Customized Web applications typically leak critical information. To defend against this, applications must be modified so they do not have commands that give too much information without proper authorization or let users modify objects out of turn. * Unmonitored services are dangerously open to attack. Watch your logs like a hawk. * Hack attacks happen. Be very, very afraid. Thayer is principal investigator with Canola & Jones, a security research firm in Mountain View, Calif. He can be reached at rodney(a)canola-jones.com. Acknowledgements Thanks to the Ghetto Hackers for running a great contest. They put together a complex game and made it run under very stressful conditions and it worked great. Thanks also to Sk3wl of R00t for letting me join in. _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/ --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0