Bremsstrahlung

My university has recently decided to make its residential network harder to use, and has enlisted the help of Bradford Networks to do so. In particular they are using a piece of software name 'Bradford Dissolvable Agent', which they force users to download and run to examine their computers¹.

On the grounds that my hardware is for my use only, or to be used as I direct, I consider it my prerogative to examine the workings of any piece of software which is to be executed on it². I therefore made some examination of the software before running it. While I didn't do a particularly thorough job (in part since my access to reference materials was significantly curtailed) I did make some observations.

• The program is written in C++, and uses the Xerces XML parser to read configuration information. It also uses a custom library to interpret or carry the configuration once read. Several boost libraries are used, including thread, datetime, signals and filesystem.
• Most of the configuration is not encapsulated in the software; it carries with it a dictionary with three keys: 'policy', 'uid', and 'url', whose corresponding values are encoded (see next point).
• The encoding used looks likely to be trivial. The code uses only capital roman letters and the decimal digits in its output. While the encoding is in some sense useless due to the fact that the decoded value of any encoded string can be learned by examining the process's memory as it runs, it also does not appear to use any passwords or keys³. In particular the software cannot (as it could if asymmetric key cryptography were used) verify that the data it is reading actually originates from a trusted source. ⁴
• The system is predicated on using falsified DNS results to misdirect requests for www.youtube.com to go to the registration server. This appears to be done on the grounds that no one will set a personal firewall to block youtube.com, but the fear that a student will have blocked the website of his or her own institution is rather dubious, after all, if this were the case it would have been impossible for them to see the registration page and download the agent program. ⁵

At some point I would like to do a more complete job including understanding the encoding being used and in what ways the agent actually examines the system on which it runs. Unfortunately, I really can't read x86 assembly (or PPC assembly either, for that matter) so some studying would first be required.