The Hackers Who Broke Windows

Delirium

The Last Stage of Delirium, the hacking group that laid open nearly every version of the Windows operating system last week, could use a little sleep, writes Deborah Radcliff of SecurityFocus. Since going public with the RPC buffer overflow bug that some are describing as the worst Windows security hole in history, the group has been caught in a media frenzy.

The hubbub has been just as bad as when, in April, 2001, LSD broke Argus Systems' PitBull security software in a contest for $50,000 in cash. (After the media glare faded, the team was stiffed for $43,000 of the prize money.) Then, as now, the work and its media aftermath kept them up at night when they'd rather be home with their families, said Tomasz Ostwald, one of the four founders of LSD, during a phone interview at 9:00 at night, Poland time. "This has been going on for three weeks. We had to work all weekend, even Sunday," he said with his thick Polish accent. "We're still taking at least two media calls a day."

Delirium was dreamed up in 1996 by four security engineers who'd just graduated the master's of computer science program at Poznan University of Technology in Western Poland. Now all between the age of 27 and 28, they manage the security infrastructure for an academic and scientific supercomputing center in the university town of Poznan, where they all live. They also do security engineering consulting and penetration testing for other clients.

By night, they crack software.

Their day jobs are not to be confused with the work they do with LSD, says Ostwald. And even though they liken themselves to other hacking groups such as the Cult of the Dead Cow, don't call the LSD members hackers: They'd like you to call them security engineers instead.

But in the truest sense, these engineers are indeed hackers. What's different between their non-profit group and a number of earlier code cracking groups is the way they conduct themselves. Along with their technical skills, these researchers possess unusual business and media savvy, say their peers.

"The LSD team always seems to find problems in critical core technologies," says Chris Wysopal, director of research and development for @stake, Inc., in Cambridge, Mass., which also does vulnerability testing on software applications. "They handle themselves professionally with the technology community and are able to span the cultural and language barriers between Poland and the U.S."

The LSD's research is also impeccable (for example, a 50-page paper that exposed implementation vulnerabilities of Java) -- far better than anything produced by the l0pht, the hacking group that grew up to become @stake, Wysopal adds.

Exploit Controversy

But LSD hasn't completely escaped criticism. In March, the group put itself at the center of a controversy when it released exploit code for a Sendmail vulnerability discovered by Internet Security Systems.

"As a security vendor, we don't think it's good business to post exploit code because it enables bad guys to break into systems," says Chris Rouland, vice president of ISS's X-Force team in Atlanta.

Ostwald says the group decided to release the Sendmail exploit code because ISS was overstating the threat posed by the bug. "When a threat is overestimated, it makes it hard to perform appropriate risk management. So we put the exploit code out for testing and proved that the threat was not as serious as the vendors claimed," Ostwald says.

Off the record, at least one security company now criticizes LSD for not posting exploit code for the Windows RPC bug. "How do you prove the bug without the code?" the source said. But because the bug affects so many of the Windows operating systems, releasing the exploit code would not have given IT managers enough time to patch, counters Ostwald. Wysopal agrees. "If [they] released the code to the Windows buffer overflow attack too soon, we'd have another SQL Slammer on our hands," says Wysopal.

Besides, people are already developing the exploit code anyway, says Tim Mullen, CIO of AnchorIS.Com, and a SecurityFocus columnist. And Rouland says ISS had developed exploit code four hours after news of the bug was released to the public.

When they're not trapped between the proverbial rock and hard place of releasing or not releasing exploit code, LSD members are generally praised -- even by ISS -- for the way they conduct themselves professionally. The group now enjoys even-handed relationships with vendors. That wasn't always the case, says Ostwald. "In the past two years, we've observed improvements in the way software and anti-virus vendors respond to our findings."

Delirium contacted Microsoft's security response center through its [e-mail] address on June 27, says Stephen Toulouse, security program manager for Microsoft's response center.

"From our standpoint, the entire process with them [LSD] was completely professional. And we appreciate them not posting the exploit code to give our customers a fair chance to install the patch," Toulouse says.

If there's one niggling problem with the group's image, it's their name. Ostwald says he can't remember how they came up with "The Last Stage of Delirium." "But lately," he says. "We've been thinking we should change it."

©