Slashdot Mirror

← Back to Stories (view on slashdot.org)

Network Computing Editor Wins RSA Hacking Contest

Posted by Zonk on from the hack-on-hack-off dept.

richkarpi writes "Network Computing's security editor won the recent RSA Interactive Testing Challenge. He has up a blow-by-blow description of the events at their site: 'The most important factor in the contest besides basic web exploitation skills (cross site scripting (XSS), SQL injection, cross site request forgeries (CSRF), etc.) was speed ... I squeaked out a win in the tie-breaking challenge the first day with only a few seconds to spare as my opponent was right behind in the hunt to combine three injectable fields into one long javascript function.'"

13 of 65 comments (clear)

  1. Meh by DavidHOzAu · · Score: 5, Funny

    A real hacker would've cracked open the server the day before and gotten the answers before entering the competition.

    1. Re:Meh by CrazyJim1 · · Score: 4, Funny

      A real hacker wouldn't have participated, but let's not get into a "definition of hacker" debate..

      You're right because real hackers are banned from the internet. You're not a real hacker til you get charged as one.

      --
      God spoke to me.
    2. Re:Meh by numatrix · · Score: 5, Insightful

      Actually, last year HD Moore did exactly that -- cracked the vmware image using the metasploit framework and won that way. According to the conference organizers anyway.

      Besides, I never claimed that I was a "real hacker". :-)

      (yes, that's me. Holy crap, I've been slashdotted!)

    3. Re:Meh by Spikeles · · Score: 4, Funny

      A real hacker would've cracked open the server the day before and gotten the answers before entering the competition.
      So James T Kirk is the ultimate hacker? He not only cracked the server, he modified the challenge so he would win!
      --
      I don't need to test my programs.. I have an error correcting modem.
    4. Re:Meh by MikePikeFL · · Score: 4, Informative

      Well, HD Moore didn't win for doing that. While he did use the Framework to break into the machine in a way we didn't expect, he wasn't available to participate in the finals so he was disqualified.

      He did ask permission to use the Framework before doing so, which he "happened" to have on a USB stick. The point of the exercise was application testing, not rooting the Windows 2000 server that we forgot to install a firewall on. Whoops, our bad!

      Having never seen him before, we didn't know he really was HD Moore until we used images.google.com to find out. :-)

      Congrats again Jordan, hope to see you next year since you won a free pass!

      --
      "Never underestimate the bandwidth of a station wagon full of tapes hurtling down the highway" -Andrew Tanenbaum
  2. Time victory = valid? by glittalogik · · Score: 5, Funny

    Because typing speed is everything when you and your buddies are hacking the Gibson via a payphone.

    1. Re:Time victory = valid? by MarkRose · · Score: 4, Funny

      Fool! Real hackers sing baud straight into the mouth piece, bypassing the keyboard entirely.

      --
      Be relentless!
  3. Re:Wonder what the expense report looks like by Gazzonyx · · Score: 3, Funny
    • New keyboard - $23

    • Visine - $5

    • XSS'ing a site seconds before competitor - Priceless.
    --

    If I mod you up, it doesn't necessarily mean I agree with what you've said, sorry.

  4. 1m a 1337 h4x0r!!!!!1 by Anonymous Coward · · Score: 4, Funny

    I know this to be true because my friend in junior high said I am. Also I have this CD with Linux on it which when I put it in the CDROM drive and start one of the school's Dells it tells me how to reset the admin password and then I have r007!!!!!1 OMG p0n13zzzz!!!!111

    1. Re:1m a 1337 h4x0r!!!!!1 by Korin43 · · Score: 4, Funny

      If only you could rate posts +1 1337z0rz..

  5. Re:Wonder what the expense report looks like by numatrix · · Score: 4, Funny

    You forgot the most important line item of all: mountain dew!

    And yes, I was drinking dew for the finals:

    http://www.rsaconference.com/2007/US/press/photos/ feb8/images/2007-02-08_12-41-10.jpg (hiding behind the monitor)

  6. Yeah, sure.... by d474 · · Score: 5, Funny

    "He has up a blow-by-blow description of the events at their site..."
    Ha Ha...I'm not falling for that one. One minute your innocently reading a post on Slashdot about some 1337 web hacker asking you to check out his website, the next minute he's robbing your grandma's bank account...

    Mitnick warned me about hacker tricks like that... I for one am not going to RTFA!
    --
    Authority questions you. Return the favor.
  7. Re:Ugh by numatrix · · Score: 3, Informative

    I would have written the exact same sentence if my opponent was in a similar position at a Catholic, Baptist, Buddhist, etc, organization, or was technical staff for Seven-eleven, Sears, or pretty much any non-security company.

    Read it again and you'll notice I also included myself in the category of "people you wouldn't expect in the finals of a web hacking competition". So unless you think I was also calling myself stupid, I wasn't belittling anyone. Merely pointing out that neither of us were the first folks you'd expect to see in the semi-finals.