Slashdot Mirror
Capture The Capture The Flag
bgp4 writes: "During DefCon 8, the Shmoo Group sniffed all the Capture the Flag network traffic. For those that don't know, Capture the Flag is weekend long hacking contest held at DefCon each year. The network dumps have now been posted and are available here. Hopefully by making this data available to the public, software developers will become more aware of how vulnerable their software really is and fix the root of the problem. Better intrusion detection isn't the answer ... Secure software is. We're looking for mirrors, so if you'd like to host the data, please let me know."
The human body disagrees somewhat. The immune system detects intruders and stops them before they can cause damage. This allows security to be designed once and well, rather than requiring the additional overhead for each component. This becomes more important as programs get more complex and have more components. (more complex = less secure, but we can't mandate that all programs be simple, so we have to find another way).
Granted, there are other layers of security such as cell walls and nose hair, but the body still uses intrusion detection as a large part of its defense.
All you can do is manage the risks. There is no security.
This is music to my ears! I agree with your adept comment that altruism sucks, yet one can never sing the security song loud enough to management, with their semi-focus on the real issues in a product -- they salivate on profit and unachieved success while the deadlines they push are forcibly unreasonable.
Good management listens, and better managers do best to respect the lowly designers, who all tend to respect the job at hand. (Orwell, "Napoleon was a sturdy pig.")
The problem with society is that society has problems.
Management almost always is the root of all evil when it comes to product safety. While you can package security in your product, to whom you sell security depends on what you have to sell. We can sit here like a gaggle of winos, contemplating if a product is going to be secure, or we can push back deadlines and make things work correctly before D-Day.
Buddha said it best; "The gatherings of your neighbor are not meant for your jealousy!"
Management stiffs are often jealous. They often forget the reality of what's going on in the day-to-day because they are stuck looking at how good the new office rep has it.
Tell that to Mohammed. /d
I would also enjoy seeing the shell histories of the people who participated in this event.
When I seen intrusion detection and honeypot articles, the most interesting thing IMO is seeing the shell history of the intruder. Shell history is one of the best ways to actually see an intruder's train of thought step by step, uncensored. Getting in, obtaining root, cleaning the logs, setting up rootkits and trojans, etc.
The other thing I take much joy in reading is IRC logs of hackers (posted in some honeypot articles). I feel the IRC logs are the best insight as to which hackers are the real thing, and which ones are just script kiddies begging new spl0its off of the veterans and innovators.
The immune system detects intruders and stops them before they can cause damage. This allows security to be designed once and well, rather than requiring the additional overhead for each component.
Some of the most successful viruses (e.g. AIDS) attack the intrusion detection system directly.
<O
( \
XGNOME vs. KDE: the game!
Will I retire or break 10K?
The problem is, insecure products work just fine as far as the user can tell. In fact, insecure products often work "better" (easier to setup and use) than secure ones.
Also, security is something that can only be proven in the negative (with very few exceptions). So a company can boast about how seriously they take security even when they don't have a clue how to write secure code. After all, they don't know that they are not secure, right? When holes are found they fix them while continuing to boast about how seriously they take security. For most people, software companies' claims of security are all they have to go on.
The programmers responsible may not even know that they are doing anything wrong. I've spoken with some application developers who think security consists of "passwords and stuff" even after I've shown them how to exploit bugs in their own code. And these are people who've written security-sensitive apps for some large corporations.
Maybe this will teach software companies to put less pressure overworked programmers trying desperately to meet unrealistic deadlines. They don't realize that people don't work well when they don't have time to do their jobs properly. Many of these companies will never learn their lesson, if you doubt me, look at he number of known security holes in a certain operating system fittingly named after a hole in a wall.
Rule 1: It's not secure unless it's encrypted.
Rule 2: It's not secure unless it's encrypted.
.
.
Rule 47: It's not secure unless it's encrypted.
.
etc
Rule 0: Encryption (on it's own) does not give you security. Sorry.
And, now, the important rules:
It's not secure "Because thay told me it was secure". The people at the other end of the link know less about security than you do. And that's scary.
It's not secure because "Nobody cares what I do online." Wrong. somebody might care. If it's online gaming, I will happily snoop your packets for an advantage.
I hate to spout the truism again, but here I go anyway: "Security is not a product. It's a process"
All you can do is manage the risks. There is no security.
We've been planning this for a while now.. I think since April or so. It wasn't based on the MacHack thing at all... the group just came up with the idea.
;)
As far as the "decency" thing... The capture the flag network at DefCon is a LOT different than the public network at MacHack. There was only one purpose of the data on those wires; attempted compromises of remote systems. This data has real value to the security community, not random artistic value like the machack data
I'm down with that, as it were
"Hopefully by making this data available to the public, software developers will become more aware of how vulnerable their software really is and fix the root of the problem."
Get it?? the ROOT of the problem? hehe...
-j
-sigs of the world unite
The open source ethereal network analyser Ethereal at zing.org has a large number of protocols defined.
Another good analysis package is the SNORT intrusion detection system at snort.org
Don't they have anything better to do?
Obviously not.
Tis a shame that one downside of the internet is that the average lamer is protected from what would get him beaten to a pulp in real life by the same actions.
Whats truely sad is, when I was the age that most of these idiots probably are, I don't recall knowing anyone that would need to resort to such action to entertain their pathetic lives. Those of us who didn't fit in generally found other more rewarding activities to participate in. Trolling certainly wasn't among them.
-Restil
Play with my webcams and lights here
Better intrusion detection isn't the answer ... Secure software is.
You're completely wrong.
"Secure" isn't an object, it's a process. There is no such thing as "secure" in the sense you seem to imply.
In meatspace, we can't make a house that can't be broken into; it would no longer be a house.
The same is true of computer security. Secure software only keeps out the lamers, which is an admirable goal in itself, but is only part of the picture.
Intrusion Detection is about accountability, which combines with the law and the courts to result in deterrance; kind of like the way most people won't break into your house because they might be seen by your neighbors, they might leave fingerprints or other evidence, and you might have alarms or cameras, with all of that meaning that they might go to jail and/or get their ass kicked.
We know how to build good software, although we often don't do it. Intrusion Detection is where all the hot research is going to be for the next few years.
-