Reverse Honeynet Project

MiCr0

yoiinked from an email and byte.com

You've probably heard of the Honeynet Project, the nonprofit security
research group that sets up decoy networks in order to study the methods
and tools of hackers in the wild. In its Phase I operation, which lasted
from 1999-2000, the Honeynet Project gathered enough information to fuel
a series of "Know Your Enemy" papers, and later a book of the same name.
Now into Phase II of their project, the Honeynet operators are focusing
both on improving the honeynets and on analyzing their existing data.
The project sponsored a fascinating forensic challenge a year ago, in
which an image reproduction of a compromised Linux server was released
on the Internet, and entrants were challenged to determine as much as
possible about the intruder's identity and methods. The 13 analyses
submitted clearly demonstrate just how much time and effort it takes to
understand an intrusion -- and how helpful multiple viewpoints into the
data can be. Almost all of the investigators each caught some detail
that the others had missed.
Now the Honeynet Project has announced a new contest: The Reverse
Challenge ( http://project.honeynet.org/reverse/ ). A binary described
only as "a unique tool captured in the wild" has been posted on the
project website, and security enthusiasts are given a month to reverse
engineer the malicious code; identify as much as they can about how it
works, what it does, and how it can be stopped; and draw conclusions
about the tool's author and possible future threats. Prizes include
copies of Know Your Enemy as well as licensed versions of the reverse-
engineering tool IDA Pro, a free pass to Black Hat Briefings, and a $200
gift certificate to Amazon.
The Honeynet Project, and those who take the time to contribute their
efforts in these challenges, represents the best of the security
community. Practical analysis and the free exchange of research leads to
better and safer software. In these kinds of contests, everybody's a winner.
Shannon Cochran Associate Editor scochran@byte.com

Martyr

Has anyone here reversed and analysed the binary yet?