Slashdot Mirror
Students vs. Hackers
sethfogie wrote to mention Informit.com's coverage of the Mid-Atlantic Regional Collegiate Cyber Defense Competition. Students put their skills to the test, trying to lock down systems against intrusion from an invading hacker team. All in the name of learning. From the article: "When the three hour grace period was over, the Red Team slowly worked their way into attack mode. One member started to sort through the information they gleaned from their scans and investigated each possible exploit. Another member fired up a MySQL database client and started to poke around the students databases looking for sensitive data. The two others were adding/changing accounts to routers, firewalls, and systems. However, for the most part, the students were not being pelted with attacks. And this continued for the next several hours."
Way to contribute nothing to the discussion. Yay.
yee haw
I don't know about you, but I always hurt people for info. From TFA:
The rules were fairly simple -- at least at first glance. Basically, the Red Team could do anything but hurt someone or perform a denial of service attack (network flood). The student teams were a bit restricted, with regard to changing IP addresses and messing with the infrastructure.
Communication was allowed between team members, but only the team leader could talk to the white cell members about problems, etc. The feds could be called over for an investigation and the Red Team was allowed to try to talk to the teams to put a social engineering twist on the games. Finally, all business objectives and administrative requests are sent to the CEO via email.
FTFA: "Oh, and of interest, [the winners were] the same team that had only a week to prepare and were all programmers" Priceless!
I'm all for this and from TFA, this sounds like a great thing (and lots of fun!) However, using the information gleaned here to apply to real-world situations is lacking in one MAJOR area: They neglect the aspect of social hacking. That is to say, attempting to gain access to a computer system through it's weakest link: THE USERS!
It's one thing to pit technical skill againt the threat of hacking, but it's been done over and over, all that technical skill accounts for nothing if you have a user that has his/her password written down on a sticky - on thier MONITOR!
Users must be educated and kept up to task on things like this, and it's my opinion that the IT/Security industry does not place enough emphasis in that arena, And to thier detriment...
In other words, it's a trivial matter to get into somebody's system; it takes a whole 'nother skill set to convince that person to hand you the keys to their data.
I wonder if tech-savvy folks (the students referred to in TFA fior example) are as good at "locking themselves down" as they are at securing their computers. Have any studies been done on the credulosity of geeks?
The difference between stupidity and genius is that genius has its limits.
I go to this school and am friends with one of the guys that is on the team. From how they tell it, they prety much owned the other teams (or at least got the least owned by the red team). Hopefully one of them will log on and give you their perspective. I really wish I had heard about this before it happened, but I missed it. Oh well. The entire CS department here at Millersville will be pulling for them when they go onto Texas.
and another to not pay attention because you think you are safe...
Sounds like fun though, kinda like the CS programming competitions I went to in high school
"Something's wrong with you...and I hope we never do meet again." - Deftones When Girls Telephone Boys
The stub title says Students vs. Hackers, but the article seams to imply that students were divided into a red team and a blue team and had to hack each others systems. Notable events include the red team attempting to secure their router firmware and accidentally killing their router and one team got into the other team's mailbox.
Exciting stuff...*yawn*
Big apple, new Yorik, undig it, something's unrotting in Edenmark.
Actually, this was allowed. As the article notes they were highly suspicious of the press, because they thought he could actually be a member of the opposing team. You are right though, with the teams sitting in front of the computers the whole time, the chances of any social engineering hacks were pretty limited and real systems admins can't be at every computer all the time.
Big apple, new Yorik, undig it, something's unrotting in Edenmark.
Isn't students vs hackers like blue vs cyan?
~= scwizard =~
Why doesn't the article link to the official website for The Center for Infrastructure Assurance and Security (CIAS)?
I also find it funny that one could summarize the Slashdot summary as "big hacker showdown, nothing happens". Where's the blatent political slant and blind Linux enthusiasm that we've all grown to know and love? Oh, and I see you trying to hack me !
Wow, an AJAX browser implementation running inside a ...... browser. How useless.
BTW, the OS still matters (You see a lotta people running Windows 95?).
A school competition to hack and slash against harden servers? Wow! That's interesting. Considering that most schools discourage any form of hacking on the school network, and my local community college had called in the FBI on a few occasions. I didn't know that some schools taught "Script Kiddies 101", much less even mention hacking in the regular programming courses.
it's not really fair that the students were given the task to secure lunix servers in three hours, Windows I understand because of the ease and efficiency of it but lunix requires too much work and recompiling and editing files..
For those who read French here is a press release about a team of Scheme hackers headed by Marc Feeley participating in a Quebec security competition who won both the first prize for keeping the other nine teams out and the second prize for finding the most security problems in the other teams's servers.
The easiest way to defeat the attackers would be to lock them out at the firewall or router. Then all the sql-injection vulnerabilities wouldn't matter.
And when your database app has those vulnerabilities, there isn't much the average network admin can do.
Let Google Fight handle this one.
Students:
2,890,000,000 results
Hackers:
87,700,000 results
No contest.
Don't trust a bull's horn, a doberman's tooth, a runaway horse or me.
;-1
I was at the competition (on the winning team).
It was very fun. We really expected the hackers to be exploiting vulnerabilities much more than social engineering and such. Our downfalls were a) not changing the passwords of the users fast enough b) forgetting to configure the obscure mail server software. It was called "post.office"; never heard of it. By the time we remembered about it, the hackers had changed the password on it, although we (naively) assumed it had just been locked down somehow.
Since you were in the contest, what was your background? Did you have any experience with that router and firewall? Any professional/vendor certifications or training?
Seriously, aside from the physical entry (extremely uncommon in the Real World), a quick class on firewall/router configuration would have stopped the attackers.
I think you guys were setup to fail on this. You gave an impressive performance, but the skills needed weren't what you were going to school for and, in the Real World, you wouldn't be limited to those "rules".
Congrats!
Start reading from the description of what actually happened, that is the interesting part of the article.
Rule Zero: There is no security without physical security. The other team learned that.
... patching. Not easy with only one machine connected to the Internet. And not much use if your app had the same sql-injection vulnerability that the other team's did. Patching only works if there is a patch available.
The first rule of security is to restrict the avenues of attack. You weren't allowed to do that.
The second rule is to run only what you absolutely need. But without the install media, that's not very easy to do.
The third rule is
If they had allowed you to follow basic security practices, you'd have had the time to dig into the systems and correctly configure them, change the default passwords, disable junk accounts, etc.
Also, it doesn't appear that they let you go outside your firewall/router to scan your network the way the Red Team did. Did they? If not, that's another stupid rule they had which is 100% the opposite of the Real World.
Congrats on the work, though. Even with the stupid rules and such, it looks like you gave an impressive showing.
1. Obtain an OpenVMS Alpha system.
2. Read the docs.
3. Install the patches.
4. Let 'em try their damnedest to break in.
5. TEH WIN!!!!!1111
Gamingmuseum.com: Give your 3D accelerator a rest.
Basically, I'm unimpressed with the Red Team. They stacked the competition in their favor by setting up systems so misconfigured they could not be secured in the three hours alotted, and broke into the room to install rootkits knowing the "victims" could not possibly physically secure their computers in this location. One must always assume that access to the console equals access to the entire system-- so this line of attack did nothing but pump up the egos of the Red team and teach the other teams nothing. If the other teams had been allowed to install motion sensors, cameras, trip wires, steel doors, keycards, etc., this would have been a fair attack.
Gamingmuseum.com: Give your 3D accelerator a rest.
A little clarification from someone who participated.
This wasn't a competition to spawn a generation of script-kiddies.
Social engineering played a part in the competition.
When the article says "restrictions," it's not saying we weren't allowed to change shit. The "no changing ip's" business was that we had to have services on a certain IP for the duration of the competition.
"The easiest way to defeat the attackers would be to lock them out at the firewall or router. Then all the sql-injection vulnerabilities wouldn't matter."
No dice. Our main "network guy" knows about as much about Cisco gear as anybody else, but our router still got fuzzed. At the time, it was a little disheartening. However, later on I overheard a conversation between a contestant on another team and the Windows girl on the red team. While this guy was going on and on about his "invincible" router and switch configs, she said "access lists are nothing." He tried to elaborate, and that he did this and that, but no. You can deny all outside traffic at the router, and they'll get in. The specific red team folks we had at ours (Midwest regional) were fucking good...as in writing 0-day exploits while sitting there good. $4000 a day security auditors good. At the end of it all, we all realized that the level of skill from the red team was high enough that they could have destroyed any team there in a heartbeat, but it was more fun to play around with them. I asked on the hackers how big name companies like Google and Visa don't get hacked to shit, and his response was along the lines of "You just have a backup plan for when you get hacked because it will happen eventually." The main point of the competition is mostly educational. I learned more in the month before our regional security-wise than I have in the last few years. We won, so we must have done something right, but at the same time, I'm convinced that the only secure computer is one that's not plugged in.
I see that flooding was disallowed, but how about red-herring attacks to get caught in packet sniffers used by the good guys, for the purpose of distraction from the real attack?