Program Hides Secret Messages in Executables

Program Hides Secret Messages in Executables
Kevin Poulsen, SecurityFocus 2003-02-24

Program Hides Secret Messages in Executables 2003-02-24
Anonymous (1 replies)

While many may see this as a good thing being, having security concerns I wonder about malicious code or spyware. Could big Brother use this to invade our privacy?...

[ more ] [ reply ]

Program Hides Secret Messages in Executables 2003-02-25
anonymous (1 replies)

> Could big Brother use this to invade our privacy?

yes. in this case big brother would use this technique to hide

a hash of your identity in the program, so it can find pirated copies.

something like the audio watermarking we've been hearing about a few months ago.

fortunately now that we know ...

[ more ] [ reply ]

In-place Tripwire 2003-03-06
Jens N.

Hi everybody,

I think that this technique is good to be used for tripwire-like purposes - imagine to patch gcc, so that it builds your system with a unique digital signature - the need for an additional tripwire-db would disapear.

(You also could "patch" every existing file but including the fun...

[ more ] [ reply ]

Virus programs should freak... 2003-02-24
Snowdog

As I understand it, virus programs will use MD5 hashes as well as other types of program fingerprinting to verify programs. This method would undoubtedly set off alarms on these programs despite not changing the file size. The binary "signature" would still look different.

It seems like a cool...

[ more ] [ reply ]

Program Hides Secret Messages in Executables 2003-02-28
Anonymous (1 replies)

It is not that new. The evalutation version of the A86 assembler for M$-DOS used the redundancy in the x86 instructionset to watermark generated object files. Or at least, that is what the manual told. I thought it was a neat idea, that has applications to licence management etc....

[ more ] [ reply ]

Program Hides Secret Messages in Executables 2003-02-28
Anonymous

Indeed A86 did actually do this, as the MOV instructions had not only a source and a destination, but also a direction (which was a bit of overkill on Intel's part). I subsequently used the technique to obfuscate my code so .EXE unpackers didn't recognise what the program had been compressed with.

...

[ more ] [ reply ]

Re: Program Hides Secret Messages in Executables 2003-03-02
Paul Hsieh

The following two instructions:

Add REG, CONST

Sub REG, -CONST

are *NOT* equivalent! They set the carry flag in opposite directions. I think this guy is just getting lucky in that most programs don't check the carry flag. However, source that looks like this:

A -= 3;

if (A > 0)...

[ more ] [ reply ]

Program Hides Secret Messages in Executables 2003-03-02
Anonymous (1 replies)

This is a quote from the story on a new steganographic tool called Hydan:

"Future version of Hydan will boost that capacity by finding different places to code data, such as in the order of a program's functions, and the order in which arguments are passed to those functions."

I want somebody...

[ more ] [ reply ]

Program Hides Secret Messages in Executables 2003-03-06
Anonymous

obviously the rest of the code would have to be changed so that the function would know how to pop the correct args off of the stack in the correct order....

[ more ] [ reply ]