5 ms·

Interview with an Adware Author (2009)

54 points by ANTSANTS 12y ago

frozenport 12y ago
I find an incongruity in these two statements. >> It would have been fairly trivial for me to go spelunking for people’s credit card information or whatever... But I didn’t. To do that, by definition you have to be willing to become a criminal, and that’s a little bit rare. So I’m not too worried about that. >> It was funny. It really showed me the power of gradualism. It’s hard to get people to do something bad all in one big jump, but if you can cut it up into small enough pieces, you can get people to do almost anything.
- mattknox 12y ago
  Yeah, I can absolutely see what you mean, but I don't think there is as much incongruity as you think. Had I been working for the russian mob or whatever, that is, an organization that is comfortable with being explicitly criminal, I don't know and fear what would have happened. However, generally, most organizations are not comfortable with telling employees to break the law, most of the time. In particular, it seems to me to be really rare in the private sector-I don't have any real experience with government.
meowface 12y ago
>I said, “I know enough C that I could kick the virus off the machines,” and I did. They said “Wow, that was really cool. Why don’t you do that again?” Then I started kicking off other viruses, and they said, “That’s pretty cool that you kicked all the viruses off. Why don’t you kick the competitors off, too?” >It was funny. It really showed me the power of gradualism. It’s hard to get people to do something bad all in one big jump, but if you can cut it up into small enough pieces, you can get people to do almost anything. This rings incredibly true to me. Especially in my job field. edit: >The good news is that I’ve been on the other side of those automated script things. Their capability is incredibly dangerous, but the actuality tends not to be. >It would have been fairly trivial for me to go spelunking for people’s credit card information or whatever. I had four million nodes. I could have done it without anybody at the company even noticing. I was the guy writing Scheme, so I could have just put a text file somewhere and then made it go away, and there wouldn’t even have been an executable lying around. >But I didn’t. To do that, by definition you have to be willing to become a criminal, and that’s a little bit rare. So I’m not too worried about that. I also think this is a good point. A lot of services out there could potentially ruin your life (or at least make it difficult) if there's a rogue employee who targets you (or targets a lot of people). An ISP employee looking at web logs, a Google employee reading all your emails... The same goes for the NSA, just the power that can be abused is even larger. I think it's inevitable that human ability to access these kinds of things will never become impossible, so I hope that companies (and the NSA) are instituting controls and checks, including anomaly detection, to find rogue, malicious, or snooping employees.
- mattknox 12y ago
  It seems to me that very few organizations () have effective countermeasures against bad behavior, but very little seems to happen anyway. () google had that guy who stalked people ( http://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats http://gawker.com/5637234/gcreep-google-engineer-stalked-tee... ) and I've read that intelligence circles have a whole category called LOVINT for people spying on crushes. That said, they have hundreds of thousands of employees between them, and the incidence rate is probably really low.
cocksparrer 12y ago
I like how he used TinyScheme. s7 is also fun for hacking around with a small footprint scheme interpreter.
- mattknox 12y ago
  It seems like s7 is a descendant of tinyscheme, and probably wasn't available at the time. Very cool, though. :)
mattknox 12y ago
(Possibly) interesting aftermath to this article: I gave this interview a long time ago to a completely unknown security blogger. (I think her blog had like 10 subscribers at the time). Quite a while later, she published it, and she had gotten at least one more subscriber in the mean time, and that was Bruce Schneier. He reblogged it on his blog, and from there it took off on slashdot, reddit, news.yc, etc.. The article linked to my site, which in turn had my cell phone number on it. I figured that I would get a massive avalanche of death threats, etc., but interestingly, I was only contacted a few times by email, and those were all positive things (offers for consulting gigs that I didn't take, a few conference talks that I did and that ultimately led to me joining twitter a while later, requests for advice). It was striking to me at the time that the collective reaction of the world was so positive. I had feared that I would be stuck in an adware-developer ghetto forever. We often talk about the fact that Silicon Valley has succeeded in part due to its stance on failure, and I sense an echo of that in how it shook out for me. Feel free to ask me anything. I figure it's the ongoing part of my penance. :)
- voltagex_ 12y ago
  Did you learn anything particularly interesting about Windows internals while you were writing adware? Is there anything you learned (programming or otherwise) that you still find useful today?
  - mattknox 12y ago
    Yeah, I learned tons about Windows internals. Three standouts: 1: We never hit a limit to what you could do to the stack. It was trivial to write a function F that would fake the stack such that you would then "return from" some other function G (that had never actually been called) to yet a third function H that did something you wanted. This turned out to be useful in creating self-deleting executables. 2: There were several cases in which backward-compatibility APIs created opportunities for the clever. One example was the handling of registry strings. They are, internally, WinNT counted unicode strings, but are generally accessed by older Win32 apps, which use C strings. This means that you could create a registry key using the WinNT APIs, where the string identifier for the key had a null byte in the middle. Then Win32 apps (like some written by competitors to kill our apps, and also regedit) would be unable to do anything to that registry key, because it literally could not express the key's name. 3: windows is CRAZY hackable. It supports an API called CreateRemoteThread, which lets you start a thread in some other, random process, running arbitrary code that you specify. This means that if you can get a file down to the machine and execute it, it can load a bunch of bytes into memory, tell other processes to execute them, and terminate, using 1: above to delete itself. This made it a fairly hard target for most removal techniques-you'd have to find all the threads, out of all the threads running on the system, that were running my code, and kill them before they could replicate into another process and/or find the processes that were killing their siblings and retaliate. Windows also allows random processes to tell the OS that they are SO IMPORTANT that the OS should immediately BSOD on that process terminating. We never used that one. As far as stuff I still use today, no specific technical techniques, but lots of general things: - It's crazy how fast you can level up with a hard problem and room to run. I knew basically nothing when I started, and within a year or so, the team I ran and I had done some pretty cool stuff, and beat the hell out of a lot of other companies. For a while, I was told that installing our adware was the best way to uninstall some obscure but horrendous russian malware. -Tools trump humans. Lots of other companies were trying to clobber us at the same time we were clobbering them. We mostly won, and in several cases completely ran the table against the other company. (by which I mean we wiped them completely off the machines that had both their client and ours, without losing a significant number of machines ourselves). It wasn't that they were dumb or we were geniuses, but we would write like 10 lines of scheme and they would have to write a whole new executable, probably a few thousand lines. Probably lots of coders were faster than us, but not many were 100X faster. There were probably others, but those are the standouts.

54 points by ANTSANTS 12y ago

I find an incongruity in these two statements. >> It would have been fairly trivial for me to go spelunking for people’s credit card information or whatever... But I didn’t. To do that, by definition you have to be willing to become a criminal, and that’s a little bit rare. So I’m not too worried about that. >> It was funny. It really showed me the power of gradualism. It’s hard to get people to do something bad all in one big jump, but if you can cut it up into small enough pieces, you can get people to do almost anything.

mattknox 12y ago
Yeah, I can absolutely see what you mean, but I don't think there is as much incongruity as you think. Had I been working for the russian mob or whatever, that is, an organization that is comfortable with being explicitly criminal, I don't know and fear what would have happened. However, generally, most organizations are not comfortable with telling employees to break the law, most of the time. In particular, it seems to me to be really rare in the private sector-I don't have any real experience with government.

meowface 12y ago

>I said, “I know enough C that I could kick the virus off the machines,” and I did. They said “Wow, that was really cool. Why don’t you do that again?” Then I started kicking off other viruses, and they said, “That’s pretty cool that you kicked all the viruses off. Why don’t you kick the competitors off, too?” >It was funny. It really showed me the power of gradualism. It’s hard to get people to do something bad all in one big jump, but if you can cut it up into small enough pieces, you can get people to do almost anything. This rings incredibly true to me. Especially in my job field. edit: >The good news is that I’ve been on the other side of those automated script things. Their capability is incredibly dangerous, but the actuality tends not to be. >It would have been fairly trivial for me to go spelunking for people’s credit card information or whatever. I had four million nodes. I could have done it without anybody at the company even noticing. I was the guy writing Scheme, so I could have just put a text file somewhere and then made it go away, and there wouldn’t even have been an executable lying around. >But I didn’t. To do that, by definition you have to be willing to become a criminal, and that’s a little bit rare. So I’m not too worried about that. I also think this is a good point. A lot of services out there could potentially ruin your life (or at least make it difficult) if there's a rogue employee who targets you (or targets a lot of people). An ISP employee looking at web logs, a Google employee reading all your emails... The same goes for the NSA, just the power that can be abused is even larger. I think it's inevitable that human ability to access these kinds of things will never become impossible, so I hope that companies (and the NSA) are instituting controls and checks, including anomaly detection, to find rogue, malicious, or snooping employees.

mattknox 12y ago
It seems to me that very few organizations () have effective countermeasures against bad behavior, but very little seems to happen anyway. () google had that guy who stalked people ( http://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats http://gawker.com/5637234/gcreep-google-engineer-stalked-tee... ) and I've read that intelligence circles have a whole category called LOVINT for people spying on crushes. That said, they have hundreds of thousands of employees between them, and the incidence rate is probably really low.

cocksparrer 12y ago

I like how he used TinyScheme. s7 is also fun for hacking around with a small footprint scheme interpreter.

mattknox 12y ago
It seems like s7 is a descendant of tinyscheme, and probably wasn't available at the time. Very cool, though. :)

mattknox 12y ago

(Possibly) interesting aftermath to this article: I gave this interview a long time ago to a completely unknown security blogger. (I think her blog had like 10 subscribers at the time). Quite a while later, she published it, and she had gotten at least one more subscriber in the mean time, and that was Bruce Schneier. He reblogged it on his blog, and from there it took off on slashdot, reddit, news.yc, etc.. The article linked to my site, which in turn had my cell phone number on it. I figured that I would get a massive avalanche of death threats, etc., but interestingly, I was only contacted a few times by email, and those were all positive things (offers for consulting gigs that I didn't take, a few conference talks that I did and that ultimately led to me joining twitter a while later, requests for advice). It was striking to me at the time that the collective reaction of the world was so positive. I had feared that I would be stuck in an adware-developer ghetto forever. We often talk about the fact that Silicon Valley has succeeded in part due to its stance on failure, and I sense an echo of that in how it shook out for me. Feel free to ask me anything. I figure it's the ongoing part of my penance. :)

voltagex_ 12y ago
Did you learn anything particularly interesting about Windows internals while you were writing adware? Is there anything you learned (programming or otherwise) that you still find useful today?
- mattknox 12y ago
  Yeah, I learned tons about Windows internals. Three standouts: 1: We never hit a limit to what you could do to the stack. It was trivial to write a function F that would fake the stack such that you would then "return from" some other function G (that had never actually been called) to yet a third function H that did something you wanted. This turned out to be useful in creating self-deleting executables. 2: There were several cases in which backward-compatibility APIs created opportunities for the clever. One example was the handling of registry strings. They are, internally, WinNT counted unicode strings, but are generally accessed by older Win32 apps, which use C strings. This means that you could create a registry key using the WinNT APIs, where the string identifier for the key had a null byte in the middle. Then Win32 apps (like some written by competitors to kill our apps, and also regedit) would be unable to do anything to that registry key, because it literally could not express the key's name. 3: windows is CRAZY hackable. It supports an API called CreateRemoteThread, which lets you start a thread in some other, random process, running arbitrary code that you specify. This means that if you can get a file down to the machine and execute it, it can load a bunch of bytes into memory, tell other processes to execute them, and terminate, using 1: above to delete itself. This made it a fairly hard target for most removal techniques-you'd have to find all the threads, out of all the threads running on the system, that were running my code, and kill them before they could replicate into another process and/or find the processes that were killing their siblings and retaliate. Windows also allows random processes to tell the OS that they are SO IMPORTANT that the OS should immediately BSOD on that process terminating. We never used that one. As far as stuff I still use today, no specific technical techniques, but lots of general things: - It's crazy how fast you can level up with a hard problem and room to run. I knew basically nothing when I started, and within a year or so, the team I ran and I had done some pretty cool stuff, and beat the hell out of a lot of other companies. For a while, I was told that installing our adware was the best way to uninstall some obscure but horrendous russian malware. -Tools trump humans. Lots of other companies were trying to clobber us at the same time we were clobbering them. We mostly won, and in several cases completely ran the table against the other company. (by which I mean we wiped them completely off the machines that had both their client and ours, without losing a significant number of machines ourselves). It wasn't that they were dumb or we were geniuses, but we would write like 10 lines of scheme and they would have to write a whole new executable, probably a few thousand lines. Probably lots of coders were faster than us, but not many were 100X faster. There were probably others, but those are the standouts.