Linux Server Break-in Challenge

Sujit writes "Are you an Internet security expert at heart or by profession? Ever thought of trying your skill at a professionally set up server? If you are ready, enter. The Linux Server Break-in challenge. You will have a server available on the Internet 96 hours without interruption starting from 9 March 2005 2 AM IST. However, the server's life on the Net is in your hands."

Comments

Alternately, . . .

[Maradine]

Post the IP address here. That'll compromise it.

Re:Alternately, . . .

[justforaday]

It's 192.168.0.103. Let the hacking begin!

w00t!!! I got in! They used the same root password as I use on my box...What do I win???

Re:Alternately, . . .

[Council]

Use the credit card numbers hidden on the box to buy absolutely anything you want.

Re:Alternately, . . .

[tomhudson]

No it's not. It's at 216.250.128.12

a.k.a. SCO.com (after all, they claim to own all linux, so have at 'em, boys and girls)

Re:Alternately, . . .

[theVP]

I can see it now. A linux geek in front of his computer, putting his pokemon hat on, and getting his pokemon cards ready for battle. Then, with much hesitation, he makes his decision. As he types in the server's IP address on Slashdot, he cries out, "Slashdot Effect, I choose YOU!!!"

Re:Alternately, . . .

[Gzip Christ]

Use the credit card numbers hidden on the box to buy absolutely anything you want.

I tried, but the loser has some pathetically low credit limit. :(

Re:Alternately, . . .

[legirons]

For a related challenge, Maplin.co.uk is displaying a big sign labelled "Hacker safe, tested daily" on their front page. Netcraft lists it as running Microsoft-IIS/5.0 on Windows 2000, its IP address is 195.92.224.143, and the only TCP access is through HTTP and HTTPS ports.

Isn't this illegal?

[harris s newman]

Even if it's with the system owner's permission, wouldn't this be considered illegal and prosecutable?

Re:Isn't this illegal?

[Gabrill]

Possibly, but then again, SCO isn't running the contest.

Re:Isn't this illegal?

[LordEd]

Hacking isn't illegal. Hacking without permission is illegal. The distinction is unauthorized access. The owner of the box is giving free license to everyone to attack it.

Its just like corporations hiring security experts to attack their systems in order to find flaws (and strengthen their defenses)

Re:Isn't this illegal?

[rfc1394]

Even if it's with the system owner's permission, wouldn't this be considered illegal and prosecutable?

No. While I am not a lawyer, the statute on computer trespass are clear that access without permission and beyond one's authorization are illegal. If the access is within one's authorization or owner grants permission for access, it is not illegal.

Permission can be implied. Anyone who puts up a website gives implied permission to access it (since the whole idea of posting a website is to get people to access it, presumably either to give them information - or get information from them - or to sell them something (or buy something from them).) If that were not the case, every person who accessed a website could be charged with the crime of computer trespass since they were not explicitly given permission to access that computer!

If you go to a car dealer, ask to take a test drive, some will simply photocopy your license and hand you the keys, and it's reasonable you can borrow it for 5 minutes or so to drive around the block. (Some will send a salesperson along for the ride; depends on the dealer and the probability of theft.) But if you walked in, took the keys and did the same thing, they could prosecute you for grand theft auto.

Where the owner has publicly given permission and in fact, has encouraged people to access the system as root, this would constitute explicit permission and thus no crime could occur for hacking their box.

Paul Robinson

Challenge accepted!

[c0l0]

Now I'll just have to find that Sub7-thingie for Linux somewhere on the net...

Incentive?

[virex]

is there any reason to do this? you would think that the linux geeks out there wouldn't want it to be compremised. especially since there is no reward or prize of any sort. most people that are capable of doing this wouldn't want to.

Re:Incentive?

[AArnott]

most people that are capable of doing this wouldn't want to. Agreed. Microsoft has pulled this stunt with their Windows servers repeatedly. Of course bringing either of these down would result in the hack being logged and eventually corrected. Hackers don't want to give up their secrets.

Re:Incentive?

[SQLz]

Actually, they would. For a couple reasons.

1. Contests like this make Linux more secure.
2. If your looking to find a job in the security industry, this a is a nice bullet on the resume.

You don't see MS having break in challenges do you? If they did and 17 unknown holes were found and fixed that would have gone unpatched otherwise, would Windows be more secure or less secure?

Re:Incentive?

[Riddlefox]

Here's a CNet news article.

It seems that the hackers never managed to gain control of the W2K machines, but were able to launch a DOS on it.

Re:Incentive?

[andrew_0812]

that is what will happen here as well. Screensavers hosted a hackers challenge a while back too. Before they were corrupted by G4. I can't remember for sure, but I think they had a windows default install, and a mac default install. or maybe linux. Anyway, the challenge was crap because the script kiddies started DDoSsing it as soon as they released the IP. You can't get a good public challenge like this just because of that.

Re:Incentive?

[Dan Ost]

Has anyone thought of doing this just to identify IPs of compromised machines
that are used in DDoS attacks? Generating a list of IPs and alerting ISPs
might go a long way of reducing the amount of zombie machines out there.

Just a (possibly naive) thought.

More Interesting

[Anonymous Coward]

That server wont have a firewall or much secuirty... so how about 69.44.61.248 - the linuxense.com webserver :)

Selling some sort of hardened Linux, perhaps?

[rfc1394]

It might be this company is selling some sort of very hardened Linux. If they are, this is exactly the right way to go about it. They are publicly inviiting people to attack it, meaning that if there are any holes, someone is likely to find them. And anyone who hacks on the box can do so with impunity. And if they really can build a bulletproof box then they deserve the rewards they can get by selling one which, on an open and public basis, has taken the worst anyone could throw at it and survived.

Re:Selling some sort of hardened Linux, perhaps?

[sirket]

has taken the worst anyone could throw at it and survived.

Let me get this straight- 96 hours allows people to try "the worst anyone could throw at it?" In your wildest dreams perhaps. Furthermore how does this prove anything? Do you honestly think a real attacker would waste a 0-day exploit on such a lame contest? Why not wait until several banks have deployed this system and then make some money with such an attack :)

The hack contests are silly. Any admin with half a brain can set up a secure system and the only way to root it would be 0-day that no self respecting hacker would waste on this system.

If you are serious about security you pay for a full audit of the source code, professional penetration testing over a 2 week period, and you test for root exploits using a local account- on the assumption that somewhere down the line the system will be misconfigured and an attacker will gain non-root privileges.

-sirket

Re:Selling some sort of hardened Linux, perhaps?

[gowen]

and you test for root exploits using a local account

Which is exactly what will happen if no-one has found a remote hole in 48 hours.

RTFA.

Re:Selling some sort of hardened Linux, perhaps?

[ryanvm]

The hack contests are silly. Any admin with half a brain can set up a secure system and the only way to root it would be 0-day that no self respecting hacker would waste on this system.


The assumption you're making is that all "self-respecting hackers" are only interested in farming zombies or stealing data. Have you considered the possibility that there may be skilled people out there who would like to demonstrate their skills, but do so without breaking any laws?

If you are serious about security you pay for a full audit of the source code, professional penetration testing over a 2 week period, and you test for root exploits using a local account

Nice know-it-all answer. Unfortunately, that's more of a gameplan if you're serious about pissing money away. The reality is that the vast majority of Internet security companies consist of SATAN tied to a web frontend. And a "full audit of the source code"? Do you have any idea how expensive (and fruitless) that would be?

I'm sorry, but what you've suggested is not a viable solution to most organizations that actually have to generate a profit. Furthermore, the simple fact that it all comes down to humans staring bleary eyed at thousands of lines of source code means that many bugs and exploits *will be missed*.

The best security practice is to assume that your company's security systems will be compromised and to have plans in place to mitigate the damage.

Re:Selling some sort of hardened Linux, perhaps?

[twiddlingbits]

"..And a "full audit of the source code"? Do you have any idea how expensive (and fruitless) that would be?...Furthermore, the simple fact that it all comes down to humans staring bleary eyed at thousands of lines of source code means that many bugs and exploits *will be missed*."

It's not that expensive with some of the newer AUTOMATED technologies out there. The DOD and NASA are actually DOING this right now. I have a friend involved with funding advanced research in this area and products are coming. The products will likely cost in the 100-200K range and they are pretty fast. They will reveal things like buffer overflows, memory leaks, pointer problems, malformed expression problems, etc. In the not too distant future they will be able to formally prove the correctness of a system. Thats a pretty small cost to pay to KNOW your system is hack-proof. It's pretty darned expensive to have to comply with California regulations about personal data being hacked that requires notification to be sent to EVERYONE who MAY have had info stolen. Not to metion the bad press your company gets when the hacking is made public. I suspect it also lowers your business insurance premiums, and it might also be a competitive edge.

Don't accuse someone on /.of speaking too soon lest you be caught doing the same on another subject or maybe even the same subject.

Re:Selling some sort of hardened Linux, perhaps?

[sirket]

The assumption you're making is that all "self-respecting hackers" are only interested in farming zombies or stealing data. Have you considered the possibility that there may be skilled people out there who would like to demonstrate their skills, but do so without breaking any laws?

I make no such assumption. I never tried to imply that they "are only interested in farming zombies or stealing data." That comment I made regarding banks was to express the waste of time I consider hacking constests to be rather than an approval of for profit hacking (except when done legally as part of a penetration test). I consider anyone who farms zombies to be nothing more than a troll. The idea of wasting 0-day on this contest, however, is still silly. Save it for the defcon hacking contests or to impress your friends or for your job. Write a paper and become famous. But waste it here? Hell no.

Nice know-it-all answer. Unfortunately, that's more of a gameplan if you're serious about pissing money away.

Nice well reasoned response.

The reality is that the vast majority of Internet security companies consist of SATAN tied to a web frontend.


It's a fucking shame you never dealt with any of the good companies back in the day. Companies like IFSec and Breakwater before they became big and got bought out use to do everything by hand. Some companies still do. I can not help it if you do not want to find those companies for your self.

And a "full audit of the source code"? Do you have any idea how expensive (and fruitless) that would be?

It depends on the application and how critical it is. Moreover I would never call it fruitless. Look at all the holes the OpenBSD team found by a code audit. It is a viable option for some applications and it certain proves a hell of a lot more about the security of a system than one of these sham hack contests.

I'm sorry, but what you've suggested is not a viable solution to most organizations that actually have to generate a profit.


It is a viable option and I've worked for and with plenty of companies to perform code audits on critical code. Plenty of serious bugs have been found that no 4 day hack contest ever would have found.

Furthermore, the simple fact that it all comes down to humans staring bleary eyed at thousands of lines of source code means that many bugs and exploits *will be missed*.

Then develop some tools to help you. Look for commonly exploited library calls like sprintf(). Do something more useful than a "hack" contest.


The best security practice is to assume that your company's security systems will be compromised and to have plans in place to mitigate the damage.


No- the best security practice is to be so confident in your own security prowess that you do not even bother securing your systems because you know no one could break in. This works best when you have your head in the sand at the same time.

Seriously though: the best security practice is to have several layers of security coupled with stringent monitoring and strong procedures in place to ensure timely application of updates and patches. Then again that's pretty expensive too and from your post it does not sound like you care to spend any money on security.

Compared to having 1,000 customers pay a bunch of people to monitor your systems 24 hours a day 7 days a week 365 days a year for years the cost of a little up front security analysis is hardly unjustifiable.

-sirket

Re:Selling some sort of hardened Linux, perhaps?

[HiThere]

If you can represent it as a first order predicate logic, then you are correct. If it's a full second order predicate logic, then you are wrong.

Most large programs are stronger than a simple first order predicate logic, though often with sufficient constraints that you can, indeed, prove them correct (or at least it hasn't been shown that you can't), but there are a large number of programs for which this isn't true. Perhaps more recent work has extended somewhat the domain of provable programs, but there's bound to be a very large number that aren't covered.

Note that proving correctness is "even harder" than the halting problem. You've not only got to show that it always comes to an answer, you've also got to show that the answer that it comes to is the correct answer.

Every specification language that I've looked at for specifying that the answer was correct was too complicated to know that it was, itself, correct. The best answers I've seen so far have been unit testing and Eiffel's "Design by Contract". Both of these tend to be sloppily done, but both could, in principle, provide a large measure of security...note that I'm not claiming proof!!..that the correct results are being produced.

OTOH, I'm certainly not in contact with anyone working on a automated code tester...but I doubt that such a person would claim that their work was a "proof of correctness" of arbitrary code. Possibly of some restricted subset, analogous to the Ada subset SPARK which restricts Ada to using a subset of features which results in programs that can be proven correct. Such would be much harder in C, but I can't see any reason why it would be impossible in principle. (I may have slightly misunderstood Ada SPARK, as I've never used it...but that's my understanding. It's usually referred to as a "High Integrity Subset", but I think that's from a book title.)

While I'm sure they're legit...

[Xaroth]

...this seems like it'd be a great way to try to take down your friend's (or enemy's) computer.

"Oh, we're putting up a box for the hacking at such and such time. We swear it's ours. No, really! Trust us. "

Few would be the wiser until it was too late.

FTA

[mr_z_beeblebrox]

I thought it was a nice touch that they give directions on how to stop network services for someone who gets root. Most people who root linux boxes have trouble with those advanced administrative functions

Rules

[3770]

The rules say:

You need to leave your mark at ``/''. It could be your email address, GPG public key or something else with which we can verify your identity.

The root partition could be on a read only media such as a CD-ROM, right? In which case nobody could ever win.

Re:Rules

[espo812]

Physical attacks are just as valid as network attacks. Now where did I put my Dell technician uniform...

Re:Rules

[hawk]

Nah. Zorro could leave his mark on a cdrom . . .

hawk

vanilla

[jest3r]

I would like to see a challenge like this with vanilla installs of the top 10 Linux distros.

As Linux gets closer to mainstream more and more people are installing without tweaks or recompiles. How well does Linux stand up without the expertise of a professional?

What's the point?

[sirket]

The server is not being set up as a production system so what is the point to a successful compromise. Furthermore- anyone with any sysadmin experience should be able to set up a server that can not be compromised except by 0-day - and honestly- who would waste 0-day on a lame contest?

-sirket

Time zone?

[KD7JZ]

What time zone is IST?

Uh, ok.

[bigtallmofo]

Break into a Linux server that has no services running presumably with some heretofore-unannounced buffer overflow in Linux's implementation of the ICMP protocol, all the while having every single packet sent to the system sniffed so that the sponsors of the challenge can know exactly how you did it.

Such a feat and sharing of knowledge should be worth about $1,000,000. I'm sure they'll get a lot of contenders with their offer of $0.

Re:Uh, ok.

[spectrokid]

Break into a Linux server that has no services running[...]
From TFA: This server won't be protected by firewall. There won't be any fake demons or honeypots as well. It will be running all the services normally found in a regular Linux distribution and more.

Re:Uh, ok.

[bill_mcgonigle]

See also Bruce Schneier's The Fallacy of Cracking Contests.

Now there's probably a Marketing Department that put them up to it, and some PHB's may be impressed, but it sure announces to the security community, "Hey, we have no idea how to think about security - buy our stuff!"

Windows 2003 breakin challenge

[mrm677]

I wonder if somebody could break into Windows 2003 in the same amount of time?

There are likely hidden exploits in both OSes, but these things take time to find. Stumbling upon something by luck is quite common.

Social engineering

[saskboy]

Obviously the best way to crack this server is going to be to socially engineer the linux administrator at this company, and get the real root password.
It's probably something like: thislinuxis2coolforU2crax0r

Hmm, that sounds like something I should use as a root password. Forget I mentioned this.

Re:Social Engineering

[hawk]

From service@linuxsense.com Fri Feb 25 22:51:32 2005
From: "linuxsense"
To: root@linuxsense.com
Subject: linuxsense Account Security Measures

Dear linuxsense root,
Your account has been randomly flagged in our system as a part of our routine security measures. This
is a must to ensure that only you have access and use of your linuxsense
account and to ensure a safe linuxsense experience. We require all flagged
accounts to verify their information on file with us. To verify your
Information at this time, please visit our secure server webform by
clicking the hyperlink below [...]

Honeypots?

[utlemming]

Are honeypots legal? I mean if I put up a honey pot and the root system isn't compromised, do I win?

Outsourced

[Evil W1zard]

Hey our Hacking Contests have been outsourced to India. Seriously though I am kind of wary about this because I don't know what legal implications there may be doing this since I am uneducated in Indian Cyber criminal law? Also the web site looks fairly hinkey (yes its a word and I'll use it!) It would be funny if they posted the IP address at the start of the contest and it turned out to be the IP of some major site or agency....

Just a hacking challenge

[northcat]

So, this is just another hacking challenge. Like the hundreds of others out there (many/most of which are on Linux). What qualifies this to make it to slashdot?

Re:Just a hacking challenge

[tech_guru5182]

What would make a great challenge is to create a system and make a shell account public via telnet or ssh, to simulate an employee's account being obtained via social engineering, then having it tested. The system should have a typical set of programs runing that would be found on a production system. This would make for a great test of the system. You must remember taht at an orginization of any reasonable size there will be at least one or two accounts that can be accessed via social engineering the appropriate luser.

Re:Just a hacking challenge

[Jonboy X]

So, this is just another hacking challenge. Like the hundreds of others out there (many/most of which are on Linux). What qualifies this to make it to slashdot?

The main difference is that this one was announced on a slow news day.

very handy. *cough*

[blue_adept]

yes, very handy for those real-life applications where the server will be on the internet for more than 96 hours.

Social Engineering

[Inkieminstrel]

Dear Admin,

I am currently working on a project sponsored by you in which I need to break into your computer. In order to do this, I will need the root password. Also, my SSH signature is attached to this message. Please add me to the list of valid signatures.

Thank you,
Inkieminstrel
Social Engineer

Re:very handy. *cough*

[Council]

The Fallacy of Cracking Contests (Bruce Schneier)

Contests are a terrible way to demonstrate security. A product/system/protocol/algorithm that has survived a contest unbroken is not obviously more trustworthy than one that has not been the subject of a contest. The best products/systems/protocols/algorithms available today have not been the subjects of any contests, and probably never will be. Contests generally don't produce useful data. There are three basic
reasons why this is so. [see link for explanations]

What about system crashes?

[Begemot]

From my experience, hacking attempts often end up with crashed OS. Double power supply and stable Internet won't help. Somebody is going to ping/reboot the system for 48 hours?

Lemee guess the "Catch"

[Creepy Crawler]

Its running Zen and using NSA security modules with USB rootplug.

Then they hand out root ;P and laugh.

Re:For crying out loud

[PoprocksCk]

"Altruistic intellectual pursuits are one thing, a penguin t-shirt is completely another."

I'd prefer Napoleon Dynamite's helicopter shirt. To each his own, I guess.

Limber Up

[Stanistani]

*Buys crate of Cheetos*
*Installs soda machine*
*dims lights*
*cracks knuckles*

I'm ready...

Reminds me of Red Hat EL

[svin]

First time they did something similar, they appearently got hacked in 45 seconds

But as the old slashdot article also states the 2nd generation was able to stay afloat.

Seems like a great way to learn how to secure a system though - let the best hackers/crackers out there have a go, and learn what went wrong.

Oh the irony..

[tod_miller]

...if the admin uses Outlook (on a diff machine):

Subject: "I hax0r3d your box!11"

Dear adm1n, I hjax0red your l1nu> box, look at the attached screensh00t as pr00f!!!

h4x0r3d.vbs.exe.scr.pif.dll.bat

Look at the pic and I will hack^H^H^H^H show you!!

Yours

skr1pt k1|)|)1e

PS: I am tha l33ts7 I even misp4ll l36t words.

Take the easy way out

[tsmithnj]

All the posts thus far are technical in nature. The easiest way into that machine is through the front door. Find the server, grab it, and run. If these guys are stupid enough to allow you to break into their property-- take them up on the challenge. AFter all, they did lay down the challenge.....

give away valuable skills

[slartibart]

Apparently, linuxense is saying, "Hey we don't have enough resources to test our OS's security. Let's stroke the egos of the hacker community and maybe we can trick them into working for us, for free. Free labor, woohoo!"

They know damn well that the expertise they're looking for is very valuable, and yet they're not even offering a token prize. Pathetic.

I hope they don't even get a single packet. "Hey everyone! Try to break into our server! It'll be FUN!!!" "...."

Re:give away valuable skills

[vasqzr]

Apparently, linuxense is saying, "Hey we don't have enough resources to test our OS's security. Let's stroke the egos of the hacker community and maybe we can trick them into working for us, for free. Free labor, woohoo!"

I disagree. How is this different than releasing a beta test to the Internet?

As far as not having enough resources...having someone OTHER than the people who developed the system test it only makes sense.

Aftermath

[halleluja]

... and then I would hack along into .gov sites from their site.. try and proof I did it.

Re:Windows Server Break-in Counter-Challenge

[codepunk]

Sounds great same rules apply no firewall, I say it gets owned in under 30 seconds. Hell I say go ahead you can even apply the 300+ security patches...

That's not what I heard...

[jhigh]

I was told that it's 127.0.0.1. Took me about five seconds to hack in. Morons didn't even have a firewall...

Re:/. Effect

['nother poster]

Come get some.

You got it!

[Blitzenn]

It is specifically intended that the contest not attract those who are capable of breaking the server. All they want is some feeble attempts so that they can finish and say that they have the most secure distro out there, because nobody could break in when the posted the distro on a public server and invited attacks.

I have to agree that this is a lame ploy at getting publicity. Hopefully others can see through it too.

Extra Credit

[Anonymous Coward]

Options for extra credit:

1) Erase the kernel and everything else, replace with printf('Do you want to play a game?\n');

2) Break into the sniffer on the bridge, and erase the packet logs. Return a copy later.

3) Install BSD on it.

4) Install and register Win XP on it, which would really confuse the next hacker.

Re:Swiss?

[NemosomeN]

Swatch Harmonious Internet Time

If you don't understand, don't mod.

Re:very handy. *cough*

[Halo-]

I totally agree that "cracking contests" are a bad way to demonstrate "security", but I don't think that is the purpose of this event. (It's a little hard to say because TFA is a bit sparse...)

The experts and auditors who actually can evaluate a system for "security" have to come from somewhere. Usually these people start off as tinkers, hobbists, and other amateurs. The big problem is how does an amateur gain experience without breaking the law? When I was in college I had to go to great lengths to get approved access to a SunOS box I could poke at with the owner's permission. I wanted to explore things, but didn't want to break any laws or ethical principles.

I think this is just for fun. Breaking into your own system that you know how you secured is boring. The chance to have a third party set up a system and openly invite you to try and break it is rare, and for some people probably very welcome. This sort of event helps ethical people hone their skills and nutures the next generation of experts and auditors.

And finally, I don't want to disagree with Bruce Schneier (because he could crush me with his mind) but these contests do produce useful data if someone tries something which wasn't previously known. I beleive the context of the quote you provided makes that clear.

Why bother

[FyberOptic]

These kinds of things never work. I've seen many of them pop up over the years, from Windows boxes to Macs to Linux, and they all fail. The reasons of course, are:

a.) So many people will be trying, that the bandwidth available to do anything with the machine at all will be practically zero.

b.) Some "hax0r" will decide to just packet the machine to death, thereby making it impossible to even do anything to.

c.) The software will be up to date, limiting any vulnerabilities that can be taken advantage of, compared to your average server out there.

d.) The time limit to do it is never long enough, especially because of the above problems.

I've seen contests where they even turn on a firewall. Obviously whoever was in charge of those had no idea how anything works. Once that firewall goes up, there's not much of anything that can be done to the system solely from a remote position. It was even a default Windows install on the particular one I'm thinking of, and despite the vulnerabilities in a bare Windows XP install, nobody was ever able to do anything to it.

I know the Linux machine in this contest is said to have no firewall, but like I said, the software will be mostly up to date. Most servers that are broken into are done so because they're running older versions of things with known vulnerabilities. Many of these machines are also on the web, running vulnerable versions of PHP and forums and whatnot, which allow one to take advantage of flaws from there, not necessarily via direct TCP connections.

So while it's entirely possible to break into this particular Linux machine, I just don't think many "real hackers" will bother, for the reasons I mentioned above. It's fun to have challenges and all, but they're just not realistically implemented.

Sl45hd0773d!

[Bud]

However, the server's life on the Net is in your hands.

Ye-e-esss... just post the news on Slashdot, that ought to take care of the server's life on the net. Good idea!

On the other hand, it could be that the 37 different rootkits are so busy 0wnz0ring each other, that the web service just MIGHT get enough peace to run for the required 96 hours. ;-)

--Bud

Re:very handy. *cough*

[MikeBabcock]

One thing worth pointing out is that in real-life situations, the box isn't usually set aside as "the box to be hacked" ... its an active machine doing normal things with real people logging into it one way or another regularly.

This contest makes no sense.

[pclminion]

And neither do any contests of this sort. Break it down by the types of people who might enter the contest:

1. White hats. Why would they do it? If they're any good, it'll just be a waste of time, and you can always set up your own server to practice with. There's not even any prize!

2. Black hats (I mean real ones, not script kiddies). They wouldn't bother either. Why expose the contents of your secret toolbox for no good reason? Any hack attempts (and successes) will be fully logged, revealing your secret exploits. That's no good, is it?

3. Script kiddies. Maybe they'll try, but they won't get in, unless the server is embarrassingly badly configured. If they do manage to crack it, what does that prove? That it's possible to set up a Linux box with terrible security if you happen to be incompetent?

I'm having a hard time figuring out exactly WHAT this contest is for. The only thing I can imagine (which a few other people have mentioned in this discussion) is that it's meant to enhance the image of Linux as a secure platform. So what -- so you've shown that if you do a good job configuring your box, you can keep out script kiddies. To put it bluntly, no shit.

Re:This contest makes no sense.

[Geoffreyerffoeg]

People who like breaking into other people's stuff because it's wrong, but they would never do so without permission, because it's wrong.

That roughly describes me. I'd give it a try if I had any free time.

Re:very handy. *cough*

[wirelessbuzzers]

Your quote, while partially right, is out of context. Schneier is talking about cryptographic cracking contests, especially of the form "here's a ciphertext file, tell me the plaintext." In this case, the attackers have much more access to the machine. Furthermore, there are more skilled hackers with free time than skilled cryptographers with free time.

However, a much bigger problem is that they only give 96 hours. The Hardened Gentoo server is much more rigorous, as it has no prize associated but has been available to log into for a long time.

!pwned. Connection Refused?

[gfolkert]

Whoa, every time I try to get there, I get connection refused.

I have even done a *LOUD* NMap scan. I only get port: 22 (filtered)

And that is it. Hmmm.

Boy they MUST have a really well setup system. Either that or you are an Idiot.

Harsher tests

[bluefoxlucid]

I'd love to get the resources to do this with some old software. Particularly, I'd like to set up a system with software all about 3 months behind on patches, SSP protected, PaX protected, PIE binaries, with the only up-to-date component being the kernel.

I'd also need to allow for user simulation by giving a Web interface to control a Web browser; and by setting x-chat and gaim connected to everything.

Basic outline:

• x86 architecture
  • Most vulnerable architecture by nature of the horrible design of the CPU itself
  • Most common architecture, most attacks are focused here anyway; using PPC or sparc64 or such would be security by obscurity in essence, and we want a real test
• 3 month old software, no security patches
• Links to all published exploits for the software
  • Second honeypot has exploits we know we can't protect against fixed, MAYBE
• GrSecurity kernel
  • Add chrooted shell
  • Let users shell in and try to break out of chroot
• Kernel is up to date
• Everything built with ProPolice
• Remote Web access to control a root Web browser
• X-chat connected to an IRC server
• GAIM connected to IRC, AIM, MSN, and Yahoo
• Remote Web access to make XMMS, Xine, mplayer, Rhythmbox, and totem play any file at any URL

That would be my setup. And yes I'd use 2.6.11 GrSecurity with the fixed PaX.

Man, now I want to find people to sponser me some lines to run 3 or 4 honeypots. . . .