Slashdot Mirror
Linux Server Break-in Challenge
Sujit writes "Are you an Internet security expert at heart or by profession? Ever thought of trying your skill at a professionally set up server? If you are ready, enter.
The Linux Server Break-in challenge. You will have a server available on the Internet 96 hours without interruption starting from 9 March 2005 2 AM IST. However, the server's life on the Net is in your hands."
Post the IP address here. That'll compromise it.
trustedworlds.net - gaming, security, and the gunk that lives in between
Now I'll just have to find that Sub7-thingie for Linux somewhere on the net...
:%s/Open Source/Free Software/g
YTARY!
is there any reason to do this? you would think that the linux geeks out there wouldn't want it to be compremised. especially since there is no reward or prize of any sort. most people that are capable of doing this wouldn't want to.
It might be this company is selling some sort of very hardened Linux. If they are, this is exactly the right way to go about it. They are publicly inviiting people to attack it, meaning that if there are any holes, someone is likely to find them. And anyone who hacks on the box can do so with impunity. And if they really can build a bulletproof box then they deserve the rewards they can get by selling one which, on an open and public basis, has taken the worst anyone could throw at it and survived.
The lessons of history teach us - if they teach us anything - that nobody learns the lessons that history teaches us.
...this seems like it'd be a great way to try to take down your friend's (or enemy's) computer.
"Oh, we're putting up a box for the hacking at such and such time. We swear it's ours. No, really! Trust us. "
Few would be the wiser until it was too late.
That green slime had it coming.
I thought it was a nice touch that they give directions on how to stop network services for someone who gets root. Most people who root linux boxes have trouble with those advanced administrative functions
The root partition could be on a read only media such as a CD-ROM, right? In which case nobody could ever win.
The Internet is full. Go Away!!!
I would like to see a challenge like this with vanilla installs of the top 10 Linux distros.
As Linux gets closer to mainstream more and more people are installing without tweaks or recompiles. How well does Linux stand up without the expertise of a professional?
Break into a Linux server that has no services running presumably with some heretofore-unannounced buffer overflow in Linux's implementation of the ICMP protocol, all the while having every single packet sent to the system sniffed so that the sponsors of the challenge can know exactly how you did it.
Such a feat and sharing of knowledge should be worth about $1,000,000. I'm sure they'll get a lot of contenders with their offer of $0.
I'm a big tall mofo.
I wonder if somebody could break into Windows 2003 in the same amount of time?
There are likely hidden exploits in both OSes, but these things take time to find. Stumbling upon something by luck is quite common.
Obviously the best way to crack this server is going to be to socially engineer the linux administrator at this company, and get the real root password.
It's probably something like: thislinuxis2coolforU2crax0r
Hmm, that sounds like something I should use as a root password. Forget I mentioned this.
Saskboy's blog is good. 9 out of 10 dentists agree.
Hey our Hacking Contests have been outsourced to India. Seriously though I am kind of wary about this because I don't know what legal implications there may be doing this since I am uneducated in Indian Cyber criminal law? Also the web site looks fairly hinkey (yes its a word and I'll use it!) It would be funny if they posted the IP address at the start of the contest and it turned out to be the IP of some major site or agency....
News Reporters Make Tasty Polar Bear Treats!
So, this is just another hacking challenge. Like the hundreds of others out there (many/most of which are on Linux). What qualifies this to make it to slashdot?
Hacking isn't illegal. Hacking without permission is illegal. The distinction is unauthorized access. The owner of the box is giving free license to everyone to attack it.
Its just like corporations hiring security experts to attack their systems in order to find flaws (and strengthen their defenses)
Dear Admin,
I am currently working on a project sponsored by you in which I need to break into your computer. In order to do this, I will need the root password. Also, my SSH signature is attached to this message. Please add me to the list of valid signatures.
Thank you,
Inkieminstrel
Social Engineer
The Fallacy of Cracking Contests (Bruce Schneier)
Contests are a terrible way to demonstrate security. A product/system/protocol/algorithm that has survived a contest unbroken is not obviously more trustworthy than one that has not been the subject of a contest. The best products/systems/protocols/algorithms available today have not been the subjects of any contests, and probably never will be. Contests generally don't produce useful data. There are three basic
reasons why this is so. [see link for explanations]
xkcd.com - a webcomic of mathematics, love, and language.
From my experience, hacking attempts often end up with crashed OS. Double power supply and stable Internet won't help. Somebody is going to ping/reboot the system for 48 hours?
First time they did something similar, they appearently got hacked in 45 seconds
But as the old slashdot article also states the 2nd generation was able to stay afloat.
Seems like a great way to learn how to secure a system though - let the best hackers/crackers out there have a go, and learn what went wrong.
All the posts thus far are technical in nature. The easiest way into that machine is through the front door. Find the server, grab it, and run. If these guys are stupid enough to allow you to break into their property-- take them up on the challenge. AFter all, they did lay down the challenge.....
I was told that it's 127.0.0.1. Took me about five seconds to hack in. Morons didn't even have a firewall...
Social Engineering Expert: Because there is no patch for stupidity.
Come get some.
No. While I am not a lawyer, the statute on computer trespass are clear that access without permission and beyond one's authorization are illegal. If the access is within one's authorization or owner grants permission for access, it is not illegal.
Permission can be implied. Anyone who puts up a website gives implied permission to access it (since the whole idea of posting a website is to get people to access it, presumably either to give them information - or get information from them - or to sell them something (or buy something from them).) If that were not the case, every person who accessed a website could be charged with the crime of computer trespass since they were not explicitly given permission to access that computer!
If you go to a car dealer, ask to take a test drive, some will simply photocopy your license and hand you the keys, and it's reasonable you can borrow it for 5 minutes or so to drive around the block. (Some will send a salesperson along for the ride; depends on the dealer and the probability of theft.) But if you walked in, took the keys and did the same thing, they could prosecute you for grand theft auto.
Where the owner has publicly given permission and in fact, has encouraged people to access the system as root, this would constitute explicit permission and thus no crime could occur for hacking their box.
Paul Robinson
The lessons of history teach us - if they teach us anything - that nobody learns the lessons that history teaches us.
Options for extra credit:
1) Erase the kernel and everything else, replace with printf('Do you want to play a game?\n');
2) Break into the sniffer on the bridge, and erase the packet logs. Return a copy later.
3) Install BSD on it.
4) Install and register Win XP on it, which would really confuse the next hacker.
1. White hats. Why would they do it? If they're any good, it'll just be a waste of time, and you can always set up your own server to practice with. There's not even any prize!
2. Black hats (I mean real ones, not script kiddies). They wouldn't bother either. Why expose the contents of your secret toolbox for no good reason? Any hack attempts (and successes) will be fully logged, revealing your secret exploits. That's no good, is it?
3. Script kiddies. Maybe they'll try, but they won't get in, unless the server is embarrassingly badly configured. If they do manage to crack it, what does that prove? That it's possible to set up a Linux box with terrible security if you happen to be incompetent?
I'm having a hard time figuring out exactly WHAT this contest is for. The only thing I can imagine (which a few other people have mentioned in this discussion) is that it's meant to enhance the image of Linux as a secure platform. So what -- so you've shown that if you do a good job configuring your box, you can keep out script kiddies. To put it bluntly, no shit.
Your quote, while partially right, is out of context. Schneier is talking about cryptographic cracking contests, especially of the form "here's a ciphertext file, tell me the plaintext." In this case, the attackers have much more access to the machine. Furthermore, there are more skilled hackers with free time than skilled cryptographers with free time.
However, a much bigger problem is that they only give 96 hours. The Hardened Gentoo server is much more rigorous, as it has no prize associated but has been available to log into for a long time.
I hereby place the above post in the public domain.