1. © 2001 By Default! A Free sample background from www.pptbackgrounds.fsnet.co.uk Slide 1 Eggs have the potential to cause catastrophic damage to private users, corporations and government systems. By Stephen Greenberg CS 725fc © 14/05/2002, Shareef I. Mostafa Easter Egg Insertion, Detection & Deletion in Commercial Software

2. © 2001 By Default! A Free sample background from www.pptbackgrounds.fsnet.co.uk Slide 2 Outline Easter Eggs Defined Egg Threats and their Creators Software Development Process Easter Egg Insertion Easter Egg Detection Easter Egg Recommendations

3. © 2001 By Default! A Free sample background from www.pptbackgrounds.fsnet.co.uk Slide 3 So what is an Easter Egg? Easter Egg – Code inserted into a commercial software product, which is not documented and not meant to be part of the product. Trojan Horse – a program that, when activated, performs some undesirable action not anticipated by the person running it. Prof Denning, GeorgeTown Trojan Horse – a program that, when activated, performs some undesirable action not anticipated by the person running it. Prof Denning, GeorgeTown Time Bomb – Executes at a specific date and time Logic Bomb – Triggered by some user action So an Easter Egg is really just a Trojan Horse!

4. © 2001 By Default! A Free sample background from www.pptbackgrounds.fsnet.co.uk Slide 4 Egg Threats and Creators Potential Threats Consumer – Steal Passwords, Credit Card details… Corporations - Crash Computers, Financial Loss… Government Agencies - Breach National Security Egg Creators Elites - Pay homage to development team. Not necessarily malicious. Not necessarily malicious. Dark Siders - Write malicious eggs for profit. (coined by author I think) (coined by author I think) But how real are these threats?

5. © 2001 By Default! A Free sample background from www.pptbackgrounds.fsnet.co.uk Slide 5 Software Development Process Software Testing Hardware Integration Independent Testing Product Assembly & Shipping Software Developmen t Product Configuratio n Customers Every bug results in code returning to Software Development process for correction Every bug results in code returning to Software Development process for correction Eggs usually inserted after first 4 stages when product is in binary form Eggs usually inserted after first 4 stages when product is in binary form

6. © 2001 By Default! A Free sample background from www.pptbackgrounds.fsnet.co.uk Slide 6 Easter Egg Insertion Improved Insertion Method by George Kalb 1) Obtain executable file you wish to backdoor 2) Identify function or symbol to backdoor (hexEditor) 3) Insert compiled Egg code into executable (hexEditor) 4) Change the address of the backdoored function to the new address of the egg code. (backdooring) 5) Recompute the Checksum

7. © 2001 By Default! A Free sample background from www.pptbackgrounds.fsnet.co.uk Slide 7 Easter Egg Code Example Function B { Detect triggering event; if (triggering event) { Egg Code goes here; } Call Function A; Return; } Function B Main Function Function A Call Function A to maintain all existing functionality Call Function A to maintain all existing functionality

8. © 2001 By Default! A Free sample background from www.pptbackgrounds.fsnet.co.uk Slide 8 Detection & Recommendations Recommendations Protect File Format – Insider wont understand file format and so cant insert any Egg. Encrypt Symbol Table – Insider cant backdoor any function in symbol table. Detection of Eggs Emulator – Run program with every documented function and have it capture all instruction fetches. Locations in memory that should not have been called. (ie. Possilby the result of an Egg) Also gaps in memory accesses, possibly from backdooring, may hint at Egg code.

9. © 2001 By Default! A Free sample background from www.pptbackgrounds.fsnet.co.uk Slide 9 Conclusion Easter Eggs…should we be worried? - There have been no documented cases of malicious Eggs to date. - Easter Egg threats need to viewed relative to all other security threats. (They aren't at the top of the list) So what have we learned? So what have we learned? - What are and Who creates Eggs? - How do they actually get into Software? - The general idea of how to backdoor an object. - An overview of Egg Insertion, Detection, & Solutions

10. © 2001 By Default! A Free sample background from www.pptbackgrounds.fsnet.co.uk Slide 10 Sites (for those interested) www.eeggs.com - Very thorough listing of Eggs www.wotsit.org - Executable File Format Definitions www.gnu.org - Info on BFD and GNU phrack.org/phrack/56/p56-0x09 – Backdooring Binary Objects

11. © 2001 By Default! A Free sample background from www.pptbackgrounds.fsnet.co.uk Slide 11 Easter Eggs MS Word 97 Egg MS Excel 97 Egg www.eeggs.com For thousands more check out