Matasano Chargen - Latest Comments in Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

dog — Thu, 12 Jul 2007 16:58:14 -0000

Joanna made a claim so loud that Blue Pill is invisible. This has gained her reputation and money. Now comes Thomas and gang, they found that they can detect any hardware virtualiztion.

The posted the challenge. Joanna said it is a "funny" challenge. Ok why is it funny? Then she asks for money @ 200$/hr. Ok is that not greed? 350K is not greed? Ok may be it isn't. But if she needs 350K to make her rootkit undetectable, then why the F she claimed it is undetectable right now. First make it undetectable and then claim.

She is good in communication and I would give her that. Due to her communication she sounds more genuine or less arrogant. But i don't think she is that genuine. If she was truly, she would accept the challenge and test it. If her rootkit is detectable then she should openly accept that bluepill is not invisible and come back when she makes it fully invisible.

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

kokanin — Sat, 07 Jul 2007 07:41:35 -0000

who the fuck makes $200 an hour

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

one.miguel — Thu, 05 Jul 2007 19:50:15 -0000

Oops, I should have added:

Today at lunch:
1300 Singapore time
Title of Talk: Detecting BluePill
Speaker: Edgar Barbosa (COSEINC)

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

one.miguel — Thu, 05 Jul 2007 19:38:10 -0000

From Daily Dave:
http://lists.immunitysec.com/pipermail/dailydave/2007-July/004446.html

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

Thomas Ptacek — Thu, 05 Jul 2007 15:24:04 -0000

I call "Ruby Slippers".

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

Jeremiah Blatz — Thu, 05 Jul 2007 10:20:38 -0000

@ivan: I don't see how the competition could have no value. We have here what are claimed to be two best-of-breed VM rootkit systems, one rootkit, and one detector. But we don't actually get to see either of them (unless Ferrie, Dai Zovi and Ptacek release theirs, but I'm under the impression that BluePill won't be released). So, we've got approaches and high-level overviews, but we don't actually get to see how they stack up.

Many security decisions are tradeoffs made based on the state of the art. How long should my encryption keys be? How much do I need to worry about network security vs application security? How much effort should vendors put into detection of virtualized rootkits vs conventional ones? If Lawson, Ferrie, Dai Zovi and Ptacek are correct, then that last question has a fairly easy answer. If they just stand up their and make unsubstantiated claims, then we really don't know.

P.S. Lawson, Ferrie, Dai Zovi and Ptacek, please come up with a snappy name for your detector, so I don't have to copy-paste your names every time I want to refer to it. "kthxbai"

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

Zion — Thu, 05 Jul 2007 02:03:47 -0000

Why cant you just run the detection on the older BluePill which JoANna claims to be better than the present dev version.

JoANna : if you are reading this blog to see what is happing why cant you arrange for the previous prod BluePill to be put to the test at least people who paied for it would know that it was money well spent

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

ivan — Wed, 04 Jul 2007 13:43:18 -0000

@Jeremiah: Agreed, hopefully the presentations will indeed be good data points for some analysis but the challenge itself is not. Incidentally, here's what Steven Lipner said back in 1975 with regards to the "VM confinment problem" in the context of Bell-LaPadula's model:
Closing the covert channels seems at a minimum very difficult, and may very well be impossible in a system where physical resources are shared. Ad hoc measures can probably be of value here
This came out as his conclusion of the attempt to address the theoretical imposibility of effective VM isolation due to covert channels that Butler Lampson pointed out in short paper in Communications of the ACM in 1973.

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

Jeremiah Blatz — Wed, 04 Jul 2007 10:32:46 -0000

People should care about the proposed challenge because it's a data point in the rootkit vs rootkit detection space. This is, you know, important, so that people can properly allocate resources.

As to the specifics of the rules and structure, well, I'm just enjoying the show!

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

ivan — Tue, 03 Jul 2007 22:31:02 -0000

you said weaponized! aha! frankly i have nothing productive to do with either Vitriol or BluePill so I'll admit my previous blog comment was purely rhetorical but I still fail to see why anybody (except maybe you and Joanna) should care about the proposed challenge

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

Thomas Ptacek — Tue, 03 Jul 2007 17:18:24 -0000

We haven't made any claims about Vitriol; in fact, in the very first talk we gave about it, we allocated a good chunk of the talk to how we COULD detect it.

Other researchers outside of Matasano have seen Vitriol. You are also welcome to see it. We'd be willing to entertain requests from other researchers if there was something productive they wanted to do with it. We're unlikely to publish weaponized malware; these aren't vulnerabilities that people need to patch.

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

ivan — Tue, 03 Jul 2007 03:03:55 -0000

ohh btw, i haven't seen Vitriol's code either... where is it?

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

ivan — Tue, 03 Jul 2007 03:01:01 -0000

I could throw some hypothesis but I'd rather wait for the show. What I criticize is the whole "challenge" charade tho. it is just tech media (and blog) fodder, whether you detect Bluepill or not (either current or the uber-developed one) would not *prove* anything. Or maybe you're all just having fun...

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

Thomas Ptacek — Tue, 03 Jul 2007 02:20:28 -0000

Ivan: come on. Explain to me how we give a talk about how well we can detect Blue Pill if Joanna won't make Blue Pill available to researchers.

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

ivan — Mon, 02 Jul 2007 23:41:51 -0000

what up with the marketing circus? can't you both just do your presentations in a way that lets the audience derive their own conclusions instead of trying to spoon feed those covering the event in a media-whoring frenzy? what's next? the month of the ridiculously useless security challenges? Blah, I miss the Scriptors of Doom but I never thought I would miss the cDc "shows"

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

Dr. Dicky Dub — Mon, 02 Jul 2007 13:54:29 -0000

I personally appreciate the work Ptacek, et al, are doing. I actually think this type of challenge is extremely beneficial to the security community. There has been a growing trend among security conferences to allow a small group of security researchers to make sensational claims without releasing the code to back up those claims. As a result, people are simply left speculating. This same group of researchers are constantly seeking the press attention but are unwilling to accept the responsibility for their actions or their words.

In her blog, JoANna has mentioned that the previous version of BluePill is owned by COSEINC. She has also implied that the previous version is far more mature than the current version. Ptacek: If Thomas Lim is willing, would you be willing to open up the challenge to the previous version of BluePill as well? This would also allow us to have a BluePill Bakeoff!!

It is interesting to me that people are attacking Ptacek, et al, for giving JoANna the opportunity to prove her claims. I didn't notice the same people complaining when JoANna was attacking the hardware acquisition researchers. She claimed in her blog, in her BlackHat presentation, and in the press that three different research groups were unwilling to give her access to their PCI card implementations. When she contacted these groups did she tell them what she was attempting to subvirt their systems? Did she give them the opportunity to verify her claims in an unbiased evaluation?

If you are going to get up on stage and criticize others or make sensational claims, you better make sure that your shit don't stink! Researchers need to decide if they are willing to put up or shut up!

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

tom — Mon, 02 Jul 2007 13:50:11 -0000

Ptacek you're coward!!!

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

Thomas Ptacek — Sun, 01 Jul 2007 23:24:11 -0000

h0nk, do you have anything at all to say about virtualized malware? I'm really interested in what you have to say. Here's what I said, several months ago: http://www.matasano.com/log/680/detecting-virtu....

Do you have anything to say about anti-aliasing? I'm really interested in what you have to say. Here's what John Gruber said about anti-aliasing several years ago: http://daringfireball.net/2003/03/antiantialiasing.

John Gruber has something in the neighborhood of 19 billion times more readers than I do, which likely puts the unit of measurement between his readership and yours into AU's. Did you know people --- normal people --- actually wear t-shirts with his blog logo on it? And that's, like, all he does! I'm pretty impressed.

So yeah, a bit tricky for me to figure out what you meant by "the Gruber of security blags". I thought you might have meant, "among the best ever". I liked your xkcd joke, though. I thought it was witty. And I think you're witty. Which is why I'm waiting for what you think about virtualized malware. Or anti-aliasing. Your call!

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

h0nk — Sun, 01 Jul 2007 23:11:59 -0000

It's totally an insult, but you, of all people, would take it as a compliment.

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

Chris_B — Sun, 01 Jul 2007 22:55:49 -0000

TP,

"I don’t think “blog” and “shame” are acronyms."

I thought they were synonyms.

Anyways looking forward to seeing how this one plays out.

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

Fionnbharr Davies — Sun, 01 Jul 2007 22:25:02 -0000

I think a lot of people are mistaking their playfulness for hubris.

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

Thomas Ptacek — Sun, 01 Jul 2007 00:54:02 -0000

(Because you know the best insults --- or compliments --- always leave you wondering)

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

Thomas Ptacek — Sun, 01 Jul 2007 00:53:42 -0000

Is that an insult or a compliment?

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

h0nk — Sat, 30 Jun 2007 19:50:40 -0000

Ptacek == the Gruber of security blags

Re: Joanna’s Shocking Confession: There Exists Some Amount Of Money For Which I Would Agree To See BluePill Detected By Lawson, Ferrie, Dai Zovi and Ptacek.

Justin — Sat, 30 Jun 2007 15:28:42 -0000

Knuth:

Joanna Rutkowska says she has an undetectable rootkit. Thomas and his team detecting another rootkit similar to blue pill would prove that their detector could detect rootkits, but it wouldn't test Joanna Rutkowska's claim that Blue Pill is an undetectable rootkit.