Feeds

The Hackers Who Broke Windows

Delirium

  • alert
  • submit to reddit

SANS - Survey on application security programs

The Last Stage of Delirium, the hacking group that laid open nearly every version of the Windows operating system last week, could use a little sleep, writes Deborah Radcliff of SecurityFocus. Since going public with the RPC buffer overflow bug that some are describing as the worst Windows security hole in history, the group has been caught in a media frenzy.

The hubbub has been just as bad as when, in April, 2001, LSD broke Argus Systems' PitBull security software in a contest for $50,000 in cash. (After the media glare faded, the team was stiffed for $43,000 of the prize money.) Then, as now, the work and its media aftermath kept them up at night when they'd rather be home with their families, said Tomasz Ostwald, one of the four founders of LSD, during a phone interview at 9:00 at night, Poland time. "This has been going on for three weeks. We had to work all weekend, even Sunday," he said with his thick Polish accent. "We're still taking at least two media calls a day."

Delirium was dreamed up in 1996 by four security engineers who'd just graduated the master's of computer science program at Poznan University of Technology in Western Poland. Now all between the age of 27 and 28, they manage the security infrastructure for an academic and scientific supercomputing center in the university town of Poznan, where they all live. They also do security engineering consulting and penetration testing for other clients.

By night, they crack software.

Their day jobs are not to be confused with the work they do with LSD, says Ostwald. And even though they liken themselves to other hacking groups such as the Cult of the Dead Cow, don't call the LSD members hackers: They'd like you to call them security engineers instead.

But in the truest sense, these engineers are indeed hackers. What's different between their non-profit group and a number of earlier code cracking groups is the way they conduct themselves. Along with their technical skills, these researchers possess unusual business and media savvy, say their peers.

"The LSD team always seems to find problems in critical core technologies," says Chris Wysopal, director of research and development for @stake, Inc., in Cambridge, Mass., which also does vulnerability testing on software applications. "They handle themselves professionally with the technology community and are able to span the cultural and language barriers between Poland and the U.S."

The LSD's research is also impeccable (for example, a 50-page paper that exposed implementation vulnerabilities of Java) -- far better than anything produced by the l0pht, the hacking group that grew up to become @stake, Wysopal adds.

Exploit Controversy

But LSD hasn't completely escaped criticism. In March, the group put itself at the center of a controversy when it released exploit code for a Sendmail vulnerability discovered by Internet Security Systems.

"As a security vendor, we don't think it's good business to post exploit code because it enables bad guys to break into systems," says Chris Rouland, vice president of ISS's X-Force team in Atlanta.

Ostwald says the group decided to release the Sendmail exploit code because ISS was overstating the threat posed by the bug. "When a threat is overestimated, it makes it hard to perform appropriate risk management. So we put the exploit code out for testing and proved that the threat was not as serious as the vendors claimed," Ostwald says.

Off the record, at least one security company now criticizes LSD for not posting exploit code for the Windows RPC bug. "How do you prove the bug without the code?" the source said. But because the bug affects so many of the Windows operating systems, releasing the exploit code would not have given IT managers enough time to patch, counters Ostwald. Wysopal agrees. "If [they] released the code to the Windows buffer overflow attack too soon, we'd have another SQL Slammer on our hands," says Wysopal.

Besides, people are already developing the exploit code anyway, says Tim Mullen, CIO of AnchorIS.Com, and a SecurityFocus columnist. And Rouland says ISS had developed exploit code four hours after news of the bug was released to the public.

When they're not trapped between the proverbial rock and hard place of releasing or not releasing exploit code, LSD members are generally praised -- even by ISS -- for the way they conduct themselves professionally. The group now enjoys even-handed relationships with vendors. That wasn't always the case, says Ostwald. "In the past two years, we've observed improvements in the way software and anti-virus vendors respond to our findings."

Delirium contacted Microsoft's security response center through its Secure@Microsoft.com address on June 27, says Stephen Toulouse, security program manager for Microsoft's response center.

"From our standpoint, the entire process with them [LSD] was completely professional. And we appreciate them not posting the exploit code to give our customers a fair chance to install the patch," Toulouse says.

If there's one niggling problem with the group's image, it's their name. Ostwald says he can't remember how they came up with "The Last Stage of Delirium." "But lately," he says. "We've been thinking we should change it."

© SecurityFocus logo

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.