4 ms·

This is Intro to Systems homework at UChicago (the course is heavily based on CMU's equivalent.) You're given a personalized binary that asks for a series of pa

This is Intro to Systems homework at UChicago (the course is heavily based on CMU's equivalent.) You're given a personalized binary that asks for a series of passwords to complete each level. If you get a password wrong, it phones home to a server run by the professor and decrements your grade. The point is to teach you to reason about assembly using GDB. You can pretty trivially set a breakpoint at the phoning-home routine so that you never actually lose any points; then it's just a question of thinking and reading hard enough before the deadline arrives. Levels range from very simple string comparison, to arithmetic, to pretty weird tricks. It was about the most memorable homework assignment I've ever done.

TheCapn 12y ago
How did it identify you as a student? Couldn't you alter the routine to bomb someone else's grade?
- D5AA96 12y ago
  That's how you get extra credit.
- superuser2 12y ago
  You get a customized binary tied in a server-side database to your campus single-sign-on identity. Everyone gets different passwords, and the passwords are validated server-side to make sure you didn't just GOTO the success reporting routine. There could easily have been a secret embedded in each bomb, reported on defusal or detonation, to prevent people from detonating each other. The project was graded on an absolute rather than relative scale, so there was little incentive to spend time on something other than defusing your own bomb. (The project was called "the binary bomb." We all had a great time telling our friends that we were up all night at the library defusing a bomb.)
  - x1798DE 12y ago
    Do you know if they did anything to mitigate replay attacks? If not, you could potentially capture someone's first call-hope and replay it until they fail. Presumably no one would want to, but people still like messing with one another for fun. Also, if you discover a vulnerability like that, you could plausibly claim that someone exploited it to bomb your grade, particularly if you used it against a bunch of people.
    - superuser2 12y ago
      You would have to be in a position to pcap another person's attempt, which would itself be a fairly intense project on a WPA2-EAP network. Definitely worthy of glory, but probably harder than just doing the project.
- eva1984 12y ago
  The binary is tailored, in the beginning it does some identity check. In CMU, as I remembered, you have to login to the school's cluster using your own account to actually diffusing the bomb.
FLUX-YOU 12y ago
That's clever, although I would have just pulled the plug. Server handshake so you can't run the program while offline? Well, that can be analyzed.
- alexbecker 12y ago
  The server handshake was pretty clever. I looked into that method briefly, but it was obfuscated and using breakpoints was just easier.
alexbecker 12y ago
That program was not nearly as devious as the one discussed in the blog post. It made no efforts to stop us from using gdb, and the password encoding was never as reflective as xor-ing with the program bytecode.
- doktrin 12y ago
  Well, yeah, since learning to use GDB is almost literally the entire point of the binary bomb assignment.
trecomar 12y ago
That's really cool

TheCapn 12y ago

How did it identify you as a student? Couldn't you alter the routine to bomb someone else's grade?

D5AA96 12y ago
That's how you get extra credit.
superuser2 12y ago
You get a customized binary tied in a server-side database to your campus single-sign-on identity. Everyone gets different passwords, and the passwords are validated server-side to make sure you didn't just GOTO the success reporting routine. There could easily have been a secret embedded in each bomb, reported on defusal or detonation, to prevent people from detonating each other. The project was graded on an absolute rather than relative scale, so there was little incentive to spend time on something other than defusing your own bomb. (The project was called "the binary bomb." We all had a great time telling our friends that we were up all night at the library defusing a bomb.)
- x1798DE 12y ago
  Do you know if they did anything to mitigate replay attacks? If not, you could potentially capture someone's first call-hope and replay it until they fail. Presumably no one would want to, but people still like messing with one another for fun. Also, if you discover a vulnerability like that, you could plausibly claim that someone exploited it to bomb your grade, particularly if you used it against a bunch of people.
  - superuser2 12y ago
    You would have to be in a position to pcap another person's attempt, which would itself be a fairly intense project on a WPA2-EAP network. Definitely worthy of glory, but probably harder than just doing the project.
eva1984 12y ago
The binary is tailored, in the beginning it does some identity check. In CMU, as I remembered, you have to login to the school's cluster using your own account to actually diffusing the bomb.

FLUX-YOU 12y ago

That's clever, although I would have just pulled the plug. Server handshake so you can't run the program while offline? Well, that can be analyzed.

alexbecker 12y ago
The server handshake was pretty clever. I looked into that method briefly, but it was obfuscated and using breakpoints was just easier.

alexbecker 12y ago

That program was not nearly as devious as the one discussed in the blog post. It made no efforts to stop us from using gdb, and the password encoding was never as reflective as xor-ing with the program bytecode.

doktrin 12y ago
Well, yeah, since learning to use GDB is almost literally the entire point of the binary bomb assignment.

trecomar 12y ago

That's really cool