connectorZONE Archive of engeniusBLOG

Match Fists For Worms

Mar 17, 2008 at 00:00
While RF engineers literally interpret the term CW to mean continuous wave, or an unmodulated RF signal, radio operators associate it with Morse Code.

Since the earliest days of radio communications, individual CW Morse operators could often be distinguished by their singular way of sending. Radio operators, commercial and amateur, used various types of manual radiotelegraph keys. These keys contributed to unique habits that affected sending speed, timing, and dit-dah character spacing. Operators would often reach stride while sending at speed, and this contributed to a unique rhythm or swing.

Even today, seasoned CW receiving operators can often tell who is at the key at a distant transmitter just by listening to the remote operator style or fist. An operator’s fist can give away his or her identity just as surely as a government assigned callsign.

As an FCC-licensed Amateur Radio operator, I frequently use CW and I'm actually a member of the First Class CW Operator's Club. Now FOC is decidedly not an organization comprised of hams transmitting continuous unmodulated signals. Club members use telegraphy keys of all descriptions to "talk with their fingers" on the shortwave bands. While listening on my shortwave receiver, I can often tell who a fellow FOC operator is by his or her music-like fist.

Recently, while surfing the Web, I came across David Litchfield's blog. Litchfield is an Internet security authority. He was first to discover that buffer overruns in Microsoft’s SQL Server 2000 Resolution Service could enable remote code execution, which is precisely the vulnerability the infamous Sapphire worm (aka Slammer) exploited.

In his analysis of network worms, Litchfield uses the term fist, which immediately caught my eye. Litchfield's use of fist refers to the unique peculiarities a malicious software author might use to write computer code, of course, but it's interesting that he specifically refers to the telegraphic sending swing of WW-II Morse Code operators in his blog.

While I'm not much of a computer hacker, and haven't advanced beyond writing a few unimportant programs in QBASIC, I do understand a few coding tradeoffs and tricks that result in either speed or memory utilization. These are the kinds of things that make programs unique. Programmer A can achieve the same end result as programmer B, using entirely different coding. Some results are better than others.

In his blog, Litchfield mentions his analysis of the Slammer worm that targeted SQL Server 2000 computers back in 2003. He concludes that the Slammer code may have been written by two people. "There are two distinctive styles at play," he writes.

"If an exploit (worm) is released and the author isn't silly enough to put a signature in it, then their coding style may give them away,” notes Litchfield. “If we have known exploits attributable to a specific person, and the coding styles match, then this may point to them being the author."

What's old is new, eh?

Comments? Questions? Do you have any experiences or opinions about software programming or Morse CW operating you'd like to share? Write me at amm at en-genius dot net, or post your comments on the blog.
Leave a Comment

Anti-Spam Security Image
Security Image
If you are unable to read the code, please
click here to load a new code.
Please enter the code in the above image
into the text box below.