Feeds

The Hackers Who Broke Windows

Delirium

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

The Last Stage of Delirium, the hacking group that laid open nearly every version of the Windows operating system last week, could use a little sleep, writes Deborah Radcliff of SecurityFocus. Since going public with the RPC buffer overflow bug that some are describing as the worst Windows security hole in history, the group has been caught in a media frenzy.

The hubbub has been just as bad as when, in April, 2001, LSD broke Argus Systems' PitBull security software in a contest for $50,000 in cash. (After the media glare faded, the team was stiffed for $43,000 of the prize money.) Then, as now, the work and its media aftermath kept them up at night when they'd rather be home with their families, said Tomasz Ostwald, one of the four founders of LSD, during a phone interview at 9:00 at night, Poland time. "This has been going on for three weeks. We had to work all weekend, even Sunday," he said with his thick Polish accent. "We're still taking at least two media calls a day."

Delirium was dreamed up in 1996 by four security engineers who'd just graduated the master's of computer science program at Poznan University of Technology in Western Poland. Now all between the age of 27 and 28, they manage the security infrastructure for an academic and scientific supercomputing center in the university town of Poznan, where they all live. They also do security engineering consulting and penetration testing for other clients.

By night, they crack software.

Their day jobs are not to be confused with the work they do with LSD, says Ostwald. And even though they liken themselves to other hacking groups such as the Cult of the Dead Cow, don't call the LSD members hackers: They'd like you to call them security engineers instead.

But in the truest sense, these engineers are indeed hackers. What's different between their non-profit group and a number of earlier code cracking groups is the way they conduct themselves. Along with their technical skills, these researchers possess unusual business and media savvy, say their peers.

"The LSD team always seems to find problems in critical core technologies," says Chris Wysopal, director of research and development for @stake, Inc., in Cambridge, Mass., which also does vulnerability testing on software applications. "They handle themselves professionally with the technology community and are able to span the cultural and language barriers between Poland and the U.S."

The LSD's research is also impeccable (for example, a 50-page paper that exposed implementation vulnerabilities of Java) -- far better than anything produced by the l0pht, the hacking group that grew up to become @stake, Wysopal adds.

Exploit Controversy

But LSD hasn't completely escaped criticism. In March, the group put itself at the center of a controversy when it released exploit code for a Sendmail vulnerability discovered by Internet Security Systems.

"As a security vendor, we don't think it's good business to post exploit code because it enables bad guys to break into systems," says Chris Rouland, vice president of ISS's X-Force team in Atlanta.

Ostwald says the group decided to release the Sendmail exploit code because ISS was overstating the threat posed by the bug. "When a threat is overestimated, it makes it hard to perform appropriate risk management. So we put the exploit code out for testing and proved that the threat was not as serious as the vendors claimed," Ostwald says.

Off the record, at least one security company now criticizes LSD for not posting exploit code for the Windows RPC bug. "How do you prove the bug without the code?" the source said. But because the bug affects so many of the Windows operating systems, releasing the exploit code would not have given IT managers enough time to patch, counters Ostwald. Wysopal agrees. "If [they] released the code to the Windows buffer overflow attack too soon, we'd have another SQL Slammer on our hands," says Wysopal.

Besides, people are already developing the exploit code anyway, says Tim Mullen, CIO of AnchorIS.Com, and a SecurityFocus columnist. And Rouland says ISS had developed exploit code four hours after news of the bug was released to the public.

When they're not trapped between the proverbial rock and hard place of releasing or not releasing exploit code, LSD members are generally praised -- even by ISS -- for the way they conduct themselves professionally. The group now enjoys even-handed relationships with vendors. That wasn't always the case, says Ostwald. "In the past two years, we've observed improvements in the way software and anti-virus vendors respond to our findings."

Delirium contacted Microsoft's security response center through its Secure@Microsoft.com address on June 27, says Stephen Toulouse, security program manager for Microsoft's response center.

"From our standpoint, the entire process with them [LSD] was completely professional. And we appreciate them not posting the exploit code to give our customers a fair chance to install the patch," Toulouse says.

If there's one niggling problem with the group's image, it's their name. Ostwald says he can't remember how they came up with "The Last Stage of Delirium." "But lately," he says. "We've been thinking we should change it."

© SecurityFocus logo

Beginner's guide to SSL certificates

More from The Register

next story
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.