Network defenders get stuck in to Honeynet challenge

In an attempt to find order in chaos, network defenders across the globe took on the Honeynet Project's Reverse Challenge -- to analyse and decipher binary code captured in the wild -- and an Australian programmer is reaping the rewards of sweet success.

Unwitting hackers and crackers running amok on computer networks sometimes break into false networks, or "honeynets", designed to let hackers do their thing whilst investigators watch on, analysing their tricks of the trade.

In a further attempt to enable defenders to learn from the hacking experience itself, The Honeynet Project, which was established by a group of computer security researchers, set up the Reverse Challenge. The test was to make a full analysis of an unknown program code found on a compromised honeynet system, using the reverse engineering tools and techniques used by security specialists.

The Challenge, the results of which were released this month, followed in the footsteps of its predecessor, The Forensic Challenge, launched in January 2001.

"The binary was downloaded over 5,000 times. The challenge required highly sophisticated skills, so we were excited to see so many people try it out," organiser of the Reverse Challenge, Lance Spitzner, told ZDNet Australia.

With stringent documentation required, just 35 contestants from across the globe decoded the challenge and submitted their findings in full -- and the winner was 27-year-old Australian Dion Mendel.

Mendel's involvement was out of "professional curiosity" as well as the challenge to learn something new. A computer programmer by trade, Mendel's interest in computing is that it provides a wealth of puzzles to be solved. "Unfortunately, it is also addictive," he said.

"I have been told that reverse engineering and de-compiling are extremely difficult tasks. I wished to see if this were true," Mendel said. Furthermore, he added, the challenge provided an opportunity to see just what the technical capabilities of crackers are.

Mendel spent 80 hours participating in the challenge, 25 of which were spent writing up the prerequisite documentation.

"Technically the challenge wasn't difficult, and as stated in the competition, the documentation would decide the winner. Stereotypically, computer people have poor literacy skills, and have an intense dislike of writing documentation," Mendel pointed out.

Mendel said he spent seven hours researching, and the remaining 48 hours or so split between writing custom tools to assist with the analysis, and performing the actual analysis itself.

Assuming that the unknown executable given in the contest is typical of tools used by computer crackers, Mendel said the challenge provided a very disturbing insight into their world.

"These people are not super geniuses. They are not even above average with their technical skills. They are at best, barely competent. So the fact that these individuals with average skills are able to cause so much havoc, says that the set-up of our computer systems is extremely lacking," he said.

Mendel pointed out that 'Melissa', 'I LOVE YOU' and 'Code Red' were all further examples of technically simple programs. "When I consider how much reliance the world puts on its computer systems, especially Windows, it's beginning to make me afraid," he said.

Twenty-four-year-old Australian Sean Burford was ranked twelfth in the Reverse Challenge. With a past as a programmer and Unix Systems administrator, Burford said he got involved in the challenge for several reasons; relevance, curiosity and fun.

"The major reason that I competed was really curiosity. I wanted to learn how to use the reverse engineering tools and techniques that security specialists use. I also wanted to learn about this new program, which the Honeynet Reverse Challenge documentation said was previously undocumented. Finally, it was great fun making discoveries along the way," Burford said.

Like Mendel, he also spent a total of 80 hours on the challenge, working at it weekends and some weeknights, with some of his discoveries made while studying printouts on the bus on the way to work.

"I've faced this kind of scenario before, and understand the time pressures that often lead administrators to archive evidence of a compromise and get the computer system working again as quickly as possible, never to return and dissect the program. Working on this challenge allowed me to learn about the time requirements, costs and benefits of properly investigating binaries found on compromised machines."

According to Burford, the skills he picked up during the challenge will help him to analyse evidence from compromised machines more effectively and in less time. "Those of us who performed their first security related reverse engineering in this project now have a better understanding of the time requirements and how to approach the problem. I think we were all surprised by how long it took to complete the challenge," he said.

Burford pointed out that there is now a method of armouring Unix programs so that they are difficult to reverse engineer.

"I think that reverse engineering is going to become more challenging over time... The race between reverse engineers and those who wish to protect the intellectual property within programs will be an interesting one to watch. I expect both sides to compete, releasing tools with ever increasing abilities, in competition to protect from each other," he said.

Spitzner, the challenge organiser, said not only were submissions greater, but the quality of work and documentation far exceeded last year's Forensic Challenge.

"I believe we had over 200,000 hits when we announced it, and over 300,000 hits when we announced the results. Nothing like this has ever been done before with Reverse Engineering. Now, because of the hard work of many people, others can learn," he said.

According to Spitzner, if all the time the judges donated was added to the cost of the running the challenge, it would have easily have topped $30,000. Nevertheless, he said, The Honeynet Project would like to do a major challenge every year. The next plan is to have another Forensic Challenge, but one based on Windows or Solaris.

With it taking five weeks for the six judges to review all the entries, each judge spent on average one hour on each entry so each entry had six hours of review, did any major discoveries come out of the challenge? "We discovered there are a lot of different ways to reverse a binary," Spitzner quipped.

Have your say instantly, and see what others have said. Go to the Security forum.

Let the editors know what you think in the Mailroom.