Update (July 26th, 2015 4:00pm): So looks like I’ve finally got an answer regarding this issue. A representative from the Export Control Organization responded back saying that, as some of you have pointed out, by releasing my research publicly I would not be subject to the terms of the arrangement due to the public domain exception clause. Futhermore, they also do not consider exploits or intrusion software itself to be controlled by the new ‘intrusion software’ related controls for export from the UK or EU. Therefore it looks like I should be clear to release the full report to the public. I have attached a screenshot of the email below as proof of evidence and so you can read the details and full and make your own interpretation in case I have misread anything:

Update (July 20th, 2015 7:20 pm): Sorry for the delay regarding this issue. I have received another update from the Department for Business, Innovation and Skills regarding my questions. They have apparently decided to forward my question on to the Export Control Organization who deal with export licenses and any conflict with the Wassenaar Arrangement. The email was sent on July 17th, as you can see below. I will await a response.

Update (July 15th, 2015 2:04 pm): So I have received an update from the HMRC government regarding what they think about this issue as well as a minor update from my university. Starting with the university (since that is simpler), they are still working on getting things organized but are looking to try push the issue past the ethics board after I have stated my case as to why I believe the exploits, and subsequently the whole research, should be published in full.

You can see the email response that I got from the uni below. For reference Julie Horton is the head of all of the final year dissertation projects at Northumbria University and also acts as a mediator of sorts to ensure that projects fall within the university’s ethical guidelines. Martin Wonders, who you may see cc in the email above this one, was my project supervisor:

With that being said and done, I have received a final answer from HMRC. Unfortunately despite my persistance regarding the matter and repeated questioning of whether or not the paper was within the export restrictions guidelines, all I got as an answer was “look at the export guidelines”. Here is the full chat log that I had with HMRC for reference:

In summary, the gist of the email is that the HMRC (who are one of two bodies responsible for enforcing export controls over here) referred me to the Department for Business, Innovation and Skills regarding my original export question, at which point they have then repetitively told me that I need to align my research with regards to the export control lists without stating whether or not my research actually falls within the tolerances of the export control lists or not. Therefore at the moment, until I get a response back from my uni I can’t really do anything. I’ve heard a lot of people state that the research should be ok to release publicly and provided the export controls in the UK are indeed in line with what I think they are it shouldn’t be an issue but still working on getting the university side of things sorted out. Hopefully this will all become clear sometime soon.

Update (July 5th, 2015 23:47 pm): In light of the attention this post and the associated paper has been getting I would like to discuss my current plan of action. Many of you have said that I should just release the code publicly and get it over and done with. Whilst I would like to do this, I do not believe this to be the best of course of action.

Instead I have decided to talk to my supervisor and the uni’s ethics board again to see what can be done about releasing the code. As far as I am aware (this is from my main project supervisor) it should be possible to get the uni’s ethics board to review and possibly change their decision to allow the code to be released but obviously this will take time.

The other thing that I have done is contacted the HMRC, one of the enforcing boards of the Wassenaar Arrangement here in the UK, to get their official opinion on this situation. I believe this is necessary to prevent such situations from happening in the future and at least get the UK government’s opinion on such matters, which will hopefully help others who wish to release similar research in the future.

Please be patient with me whilst I continue with this process. I know you guys think I’m being naive/silly/w.e but at the end of the day this is my decision and this is what I believe is the best course of action for all involved.

This post has been in the works for a long time, however I wasn’t able to release it until my official results came out due to concern about collusion which could have resulted in my university changing the results of my grade. However now that the grades have been published and results are final, I can share with you guys something I have been meaning to share for quite a while: my final year dissertation paper.

My paper covers three separate exploits that I converted to try bypass EMET 5.1’s protections as best I could and the techniques that I used to do so as well as how successful EMET 5.1 was at preventing me from exploiting the vulnerable programs.

Before proceeding, please note a couple of very important points:

Update (July 26, 2015): Paper has now been released in full.

  • I am aware there are a few conceptual issues the approach I used for this paper. In particular, the technique that I used to bypass EAF and locate the functions needed to create the final exploit does not work consistently across different patch versions of the same operating system (aka a clean, unpatched version of Windows 7 will need different offsets than a fully patched version of Windows 7). Whilst further research did find that only a very limited number of core kernel updates affect this issue, it still is a huge limitation and is something that I would look to fix if I had more time in the future.
  • There may still be spelling or grammatical issues within this document, for which I apologize in advance. I have looked through the paper several times so most issues should be resolved but please let me know if you find anything.
  • There are a couple of sections within the paper that were purely for the university. Please feel free to skip these as they are not relevant to the paper’s content :)

With all that being said, please do enjoy the paper :) I hope you manage to learn something from it.

Download (full, uncensored version): https://drive.google.com/file/d/0B5pT4hU_yYUWLXVZVTlBa05La1E/view?usp=sharing

Download (old censored version): https://drive.google.com/file/d/0B5pT4hU_yYUWcUtsUWxxcFJjOVU/view?usp=sharing