Slashdot Mirror
Network Computing Editor Wins RSA Hacking Contest
richkarpi writes "Network Computing's security editor won the recent RSA Interactive Testing Challenge. He has up a blow-by-blow description of the events at their site: 'The most important factor in the contest besides basic web exploitation skills (cross site scripting (XSS), SQL injection, cross site request forgeries (CSRF), etc.) was speed ... I squeaked out a win in the tie-breaking challenge the first day with only a few seconds to spare as my opponent was right behind in the hunt to combine three injectable fields into one long javascript function.'"
A real hacker would've cracked open the server the day before and gotten the answers before entering the competition.
Elite Hackorz just keep quiet about these kind of things!
AT&ROFLMAO
After all, this is job related, but I bet the expense report is probably funny
Support NYCountryLawyer RIAA vs People
Because typing speed is everything when you and your buddies are hacking the Gibson via a payphone.
I know this to be true because my friend in junior high said I am. Also I have this CD with Linux on it which when I put it in the CDROM drive and start one of the school's Dells it tells me how to reset the admin password and then I have r007!!!!!1 OMG p0n13zzzz!!!!111
Jeremiah Grossman has a write up as well, his includes pictures.
This one time, I was hacking this really locked-up-the-wazoo Gibson. I'd set up a couple of IDS/IPS evasion bots, perimeter scanning came up clean. Small SQL injection issue merged with XSS showed that the backend database may have been either 768-bit encrypted or a simple 3DES matter, but I was running low on time and didn't get to check. Once the tables were writable to sa, I was able to jump in and jump out with no problem. One of their systems caught an early sniff, but was shut down with a smurf. Everything was PERFECT until their night noc ran a reverse udp traceroute back to one of the hosts I had set up after that, straight DOWNHILL. I got called twice by my isp asking about unusual activity, some other shit about access attempts to a federally monitored system, and they had everything in logs including the Schneier-level, rot-26 I thought would hide me. Fortunately I managed to find a reverse-folding routepath on their IIS Apache and I got out just in time while erasing the incriminating forum posts.
Posted anonymously for obvious reasons.
It's good to see he won the contest on that one facet of security, web security.
FLR
if he'd actually told us a little more detail. As it stands this is a "What I Did On My Summer Holidays" and it gets a D- for information.
Mitnick warned me about hacker tricks like that... I for one am not going to RTFA!
Authority questions you. Return the favor.
The XSS FAQ
The Cross-site Request Forgery FAQ
Believe me, if I started murdering people, there would be none of you left.
This all is precisely why I have the NoScript extension installed in Firefox, and javascript is only turned on if the site requires it; the regular sites I use that DO require it, are whitelisted. I also have firefox set to dump all cookies on quitting; only sites that NEED to set permanent cookies are allowed to do so via the exception list.
Please help metamoderate.
Hacking Contest Eh? 14 year old Finnish kids armed with Generalized Quadratic Sieves need not apply?
Relax. You need to work on your reading comprehension.
He wasn't insulting the intelligence of Mormons. He was just remarking on how odd it is that an employee of a *church* was so talented. And it is odd. You would expect that someone so skilled would be more likely to be working for a "tech" company.
This is half in jest, half wondering if any "pros" (ie NSA types) were in the competition? They definitely weren't listed in the TFA and I wonder if they'd be allowed to compete.
Of course, their cover could be working for the Mormons...
myke
Mimetics Inc. Twitter
I would have written the exact same sentence if my opponent was in a similar position at a Catholic, Baptist, Buddhist, etc, organization, or was technical staff for Seven-eleven, Sears, or pretty much any non-security company.
Read it again and you'll notice I also included myself in the category of "people you wouldn't expect in the finals of a web hacking competition". So unless you think I was also calling myself stupid, I wasn't belittling anyone. Merely pointing out that neither of us were the first folks you'd expect to see in the semi-finals.
Uh, Mormons wake people up on Saturday mornings to tell them about a glorified fairy tale character. They're not the brightest people in the world. I wouldn't have dissed them if it were my article, but the author has a point.
He was just remarking on how odd it is that an employee of a *church* was so talented. And it is odd. You would expect that someone so skilled would be more likely to be working for a "tech" company.
Actually, it makes a lot of sense. If he can't go out chasing girls, what else will he do? He probably can't bike like Floyd Landis, so hacking it is.
Leave it to JavaScript--the hacker's best friend. How funny that this all came down to a race to see who could assemble the injectable fields fast enough. Not only do you need to be a skilled hacker--but a quick one to boot.
To quote Homer Simpson...
"NERDS!!!!"
Is that you?
The latest Slashdot meme.
The Mormons keep a huge genealogy database, perhaps the individual in question was involved with securing that?
Nerds at their nerdiest.
Please please tell me you now give business cards with the line
1337 h4x0r1
appearing underneath 'Security magazine editor'
because you have soooo earned the right. Congratulations!
WARNING: Smartphones have side effects--most of them undocumented.