Slashdot Mirror

← Back to Stories (view on slashdot.org)

Linux Server Break-in Challenge

Posted by CmdrTaco on from the g3t-r3ady-to-p3wn3z0rzasdkja dept.

Sujit writes "Are you an Internet security expert at heart or by profession? Ever thought of trying your skill at a professionally set up server? If you are ready, enter. The Linux Server Break-in challenge. You will have a server available on the Internet 96 hours without interruption starting from 9 March 2005 2 AM IST. However, the server's life on the Net is in your hands."

12 of 327 comments (clear)

  1. Rules by 3770 · · Score: 5, Insightful
    The rules say:

    You need to leave your mark at ``/''. It could be your email address, GPG public key or something else with which we can verify your identity.


    The root partition could be on a read only media such as a CD-ROM, right? In which case nobody could ever win.
    --
    The Internet is full. Go Away!!!
    1. Re:Rules by espo812 · · Score: 5, Insightful

      Physical attacks are just as valid as network attacks. Now where did I put my Dell technician uniform...

      --

      espo
  2. vanilla by jest3r · · Score: 5, Interesting

    I would like to see a challenge like this with vanilla installs of the top 10 Linux distros.

    As Linux gets closer to mainstream more and more people are installing without tweaks or recompiles. How well does Linux stand up without the expertise of a professional?

  3. Re:Alternately, . . . by justforaday · · Score: 5, Funny

    It's 192.168.0.103. Let the hacking begin!

    w00t!!! I got in! They used the same root password as I use on my box...What do I win???

    --
    I'll turn into a supernova and burn up everything. Well I'll turn into a black little hole and you'll turn into string.
  4. Re:Isn't this illegal? by LordEd · · Score: 5, Informative

    Hacking isn't illegal. Hacking without permission is illegal. The distinction is unauthorized access. The owner of the box is giving free license to everyone to attack it.

    Its just like corporations hiring security experts to attack their systems in order to find flaws (and strengthen their defenses)

  5. Social Engineering by Inkieminstrel · · Score: 5, Funny

    Dear Admin,

    I am currently working on a project sponsored by you in which I need to break into your computer. In order to do this, I will need the root password. Also, my SSH signature is attached to this message. Please add me to the list of valid signatures.

    Thank you,
    Inkieminstrel
    Social Engineer

  6. Re:very handy. *cough* by Council · · Score: 5, Informative

    The Fallacy of Cracking Contests (Bruce Schneier)

    Contests are a terrible way to demonstrate security. A product/system/protocol/algorithm that has survived a contest unbroken is not obviously more trustworthy than one that has not been the subject of a contest. The best products/systems/protocols/algorithms available today have not been the subjects of any contests, and probably never will be. Contests generally don't produce useful data. There are three basic
    reasons why this is so.     [see link for explanations]

    --
    xkcd.com - a webcomic of mathematics, love, and language.
  7. Take the easy way out by tsmithnj · · Score: 5, Funny

    All the posts thus far are technical in nature. The easiest way into that machine is through the front door. Find the server, grab it, and run. If these guys are stupid enough to allow you to break into their property-- take them up on the challenge. AFter all, they did lay down the challenge.....

  8. That's not what I heard... by jhigh · · Score: 5, Funny

    I was told that it's 127.0.0.1. Took me about five seconds to hack in. Morons didn't even have a firewall...

    --
    Social Engineering Expert: Because there is no patch for stupidity.
  9. Re:Uh, ok. by bill_mcgonigle · · Score: 5, Informative

    See also Bruce Schneier's The Fallacy of Cracking Contests.

    Now there's probably a Marketing Department that put them up to it, and some PHB's may be impressed, but it sure announces to the security community, "Hey, we have no idea how to think about security - buy our stuff!"

    --
    My God, it's Full of Source!
    OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
  10. Re:Alternately, . . . by theVP · · Score: 5, Funny

    I can see it now. A linux geek in front of his computer, putting his pokemon hat on, and getting his pokemon cards ready for battle. Then, with much hesitation, he makes his decision. As he types in the server's IP address on Slashdot, he cries out, "Slashdot Effect, I choose YOU!!!"

    --
    "No one is more miserable than the person who wills everything and can do nothing." -Emperor Claudius 10 BC - AD 54
  11. This contest makes no sense. by pclminion · · Score: 5, Insightful
    And neither do any contests of this sort. Break it down by the types of people who might enter the contest:

    1. White hats. Why would they do it? If they're any good, it'll just be a waste of time, and you can always set up your own server to practice with. There's not even any prize!

    2. Black hats (I mean real ones, not script kiddies). They wouldn't bother either. Why expose the contents of your secret toolbox for no good reason? Any hack attempts (and successes) will be fully logged, revealing your secret exploits. That's no good, is it?

    3. Script kiddies. Maybe they'll try, but they won't get in, unless the server is embarrassingly badly configured. If they do manage to crack it, what does that prove? That it's possible to set up a Linux box with terrible security if you happen to be incompetent?

    I'm having a hard time figuring out exactly WHAT this contest is for. The only thing I can imagine (which a few other people have mentioned in this discussion) is that it's meant to enhance the image of Linux as a secure platform. So what -- so you've shown that if you do a good job configuring your box, you can keep out script kiddies. To put it bluntly, no shit.