3 ms·

Not adhering to style guides is now a privacy issue.

busterarm 12y ago
Is it odd that I've been thinking about this one for a while now. I don't really talk to blackhat folks on the regular anymore, but given how important OpSec is, it's really sad how easily identifiable most of their code ends up being. Malware authors brag like crazy ("oh, let me just go ahead and encrypt this payload with my handle as the key...") and I wouldn't be surprised if you found some of the same from the state-sponsored folks. I'd really love to see someone like grugq weigh in with some thoughts here. The idea of having tools to parse and rewrite my code to be as generic as possible came to me years ago.
- na85 12y ago
  >The idea of having tools to parse and rewrite my code to be as generic as possible came to me years ago. I feel like awk could do this quite handily, as far as homogenizing spacing, cases, underscoring, etc.
- ObviousScience 12y ago
  > The idea of having tools to parse and rewrite my code to be as generic as possible came to me years ago. You basically want an obfuscator that replaces all the names of things with generics, and then randomly permutes blocks of code without changing the code paths possible in the final binary. (Perhaps some optimized-for-performance version of this, but that might identify the tool you use.) It sounds relatively easy to write if you stick to certain coding guidelines (like using techniques amenable to static analysis). However, this still won't work in some cases, because you'd need more advanced tools to handle profiling of what sized functions and such you ended up writing. It would be interesting to try and write a tool which defeated any analysis of author patterns in the code, but would require understanding the program across the boundary of function calls, which is a difficult problem. (You probably couldn't write Turing complete code, for example.)
benten10 12y ago
I'm two weeks late, but this is the topic of my research! Not with code, but with text that follows a given style guide. Even after the standardization of text, it's actually quite remarkable how much you can distinguish authors.

Is it odd that I've been thinking about this one for a while now. I don't really talk to blackhat folks on the regular anymore, but given how important OpSec is, it's really sad how easily identifiable most of their code ends up being. Malware authors brag like crazy ("oh, let me just go ahead and encrypt this payload with my handle as the key...") and I wouldn't be surprised if you found some of the same from the state-sponsored folks. I'd really love to see someone like grugq weigh in with some thoughts here. The idea of having tools to parse and rewrite my code to be as generic as possible came to me years ago.

na85 12y ago
>The idea of having tools to parse and rewrite my code to be as generic as possible came to me years ago. I feel like awk could do this quite handily, as far as homogenizing spacing, cases, underscoring, etc.
ObviousScience 12y ago
> The idea of having tools to parse and rewrite my code to be as generic as possible came to me years ago. You basically want an obfuscator that replaces all the names of things with generics, and then randomly permutes blocks of code without changing the code paths possible in the final binary. (Perhaps some optimized-for-performance version of this, but that might identify the tool you use.) It sounds relatively easy to write if you stick to certain coding guidelines (like using techniques amenable to static analysis). However, this still won't work in some cases, because you'd need more advanced tools to handle profiling of what sized functions and such you ended up writing. It would be interesting to try and write a tool which defeated any analysis of author patterns in the code, but would require understanding the program across the boundary of function calls, which is a difficult problem. (You probably couldn't write Turing complete code, for example.)

benten10 12y ago

I'm two weeks late, but this is the topic of my research! Not with code, but with text that follows a given style guide. Even after the standardization of text, it's actually quite remarkable how much you can distinguish authors.