, SecurityFocus 2003-07-24
The Last Stage of Delirium, the hacking group that laid open nearly every version of the Windows operating system last week, could use a little sleep. Since going public with the RPC buffer overflow bug that some are describing as the worst Windows security hole in history, the group has been caught in a media frenzy.The hubub has been just as bad as when, in April, 2001, LSD broke Argus Systems' PitBull security software in a contest for $50,000 in cash. (After the media glare faded, the team was
By night, they crack software.
Their day jobs are not to be confused with the work they do with LSD, says Ostwald. And even though they liken themselves to other hacking groups such as the Cult of the Dead Cow, don't call the LSD members hackers: They'd like you to call them security engineers instead.
But in the truest sense, these engineers are indeed hackers. What's different between their non-profit group and a number of earlier code cracking groups is the way they conduct themselves. Along with their technical skills, these researchers possess unusual business and media savvy, say their peers.
"The LSD team always seems to find problems in critical core technologies," says Chris Wysopal, director of research and development for @stake, Inc., in Cambridge, Mass., which also does vulnerability testing on software applications. "They handle themselves professionally with the technology community and are able to span the cultural and language barriers between Poland and the U.S."
The LSD's research is also impeccable (for example, a 50-page paper that exposed implementation vulnerabilities of Java) -- far better than anything produced by the l0pht, the hacking group that grew up to become @stake, Wysopal adds.
But LSD hasn't completely escaped criticism. In March, the group put itself at the center of a controversy when it
"As a security vendor, we don't think it's good business to post exploit code because it enables bad guys to break into systems," says Chris Rouland, vice president of ISS's X-Force team in Atlanta.
Ostwald says the group decided to release the Sendmail exploit code because ISS was overstating the threat posed by the bug. "When a threat is overestimated, it makes it hard to perform appropriate risk management. So we put the exploit code out for testing and proved that the threat was not as serious as the vendors claimed," Ostwald says.
Off the record, at least one security company now criticizes LSD for not posting exploit code for the
Besides, people are already developing the exploit code anyway, says Tim Mullen, CIO of AnchorIS.Com, and a SecurityFocus columnist. And Rouland says ISS had developed exploit code four hours after news of the bug was released to the public.
When they're not trapped between the proverbial rock and hard place of releasing or not releasing exploit code, LSD members are generally praised -- even by ISS -- for the way they conduct themselves professionally. The group now enjoys even-handed relationships with vendors. That wasn't always the case, says Ostwald. "In the past two years, we've observed improvements in the way software and anti-virus vendors respond to our findings."
Delirium contacted Microsoft's security response center through its Secure@Microsoft.com address on June 27, says Stephen Toulouse, security program manager for Microsoft's response center.
"From our standpoint, the entire process with them [LSD] was completely professional. And we appreciate them not posting the exploit code to give our customers a fair chance to install the patch," Toulouse says.
If there's one niggling problem with the group's image, it's their name. Ostwald says he can't remember how they came up with "The Last Stage of Delirium." "But lately," he says. "We've been thinking we should change it."