Clementson's Blog

Black Hat and White Hat Hacking with Lisp

Sunday, November 19, 2006

Years ago, I used to have a really strong interest in issues related to secure computing and "cracking". In fact, in 1995, I wrote an article for NEWS/400 Magazine titled "Hackers, Viruses, and Your AS/400" (still available online in the SystemiNetwork archives, although you have to pay for it) which exposed a number of security gaps in the IBM AS/400, a computer that was being advertised as being fairly secure from crackers. At the time, the article was one of the most controversial articles that the magazine had ever published. In addition, I was once contracted to set up a security system and security standards for several banks and financial organizations and, in the process, was involved in detecting/catching a number of "unauthorized" intrusions and transactions. However, I've also been very interested in the technical challenges of both setting up secure systems and compromising secure systems. So, in the past, I had spent a fair bit of time looking at security from a number of different angles and I still occasionally look around at what's happening in this field.

There's often a fine line between being a person with an interest in cracking and being a cracker. And, usually, the best security professionals are using the same tools that the better crackers are using. So, when I heard about Ephemeral Security's new lisp-based mosref product, I was really intrigued. Mosref is a "secure remote execution framework" (security-speak that means "tool for embedding bad stuff on another computer"). It was recently demo'ed at defcon 14 (the slides are available online) and has quite a few interesting features (the following was taken from Ephemeral Security's web site):

• combines high-grade cryptography and a small efficient virtual machine on both ends
• presents a dynamic environment on a target host that can be reprogrammed on the fly over a secure communications channel to fit the current situation
• cross-platform using ANSI C and GCC, currently running on OpenBSD, Darwin, Linux, and Win32 (compiled bytecode is portable between these platforms)
• has an in-memory database (included in the Mosquito VM) that allows developers to work with complex data models without using a relational database.
• uses Mosquito Lisp (a lisp dialect that combines features of Scheme, CL, and Erlang) for scripting with the following characteristics:
  • Designed for network applications, Mosquito is highly concurrent and provides simple and efficient network and process APIs.
  • Mosquito is highly portable, written in ANSI C, and is currently in active use on Darwin/PPC, Linux/x86, Windows 2000/XP, and OpenBSD/x86.
  • Mosquito is compact, with the virtual machine weighing in at close to 128k on some platforms. (Note: when I generated a drone on my Mac PPC PowerBook, the object was about 1MB in size; however, this obviously differs depending on the target platform)
  • Mosquito can be self-contained, applications may be linked on any Mosquito platform to run stand-alone on any other Mosquito platform.
  • Bytecode generated by Mosquito's compiler may be employed on any host platform without recompilation.
  • The Mosquito environment is rich, with over 300 primitive functions and 200 library functions in the standard library. (Not including additional libraries specific to MOSREF.)
  • The Mosquito environment is available under the LPGL, and is obtainable from Sourceforge.

• There is a short Flash demo, an introduction to Mosquito Lisp, some Mosquito Lisp articles, a mosref how-to, a short history of mosref/Mosquito, and a mailing list on the Ephemeral Security site.
• Lispmeister's post on the book The Shockwave Rider has a link to mosref and to other related material.
• There is a post on the #scheme IRC channel where Wes Brown (the founder of Ephemeral Security) posts a link to some code that provides a demonstration (using Mosquito Lisp) of a "Semi-Trivial Mosquito Lisp Application Server".
• A discussion on digg about mosref.
• Another blog post had a good summary of mosref.