Slashdot Mirror
The Student vs Hacker Security Showdown Rematch
monkeyboy44 writes "Following up on last year's entertaining hacker vs. student showdown, InformIT.com once again covered the annual Mid-Atlantic Regional Collegiate Cyber Defense Competition where college students are put to the test. During the three day event, small teams from eight of the areas colleges are handed insecure networks that they have to lockdown and keep running — all while a team of hackers attempt to gain access any way they can. To keep it interesting, the teams also had to perform various tasks, such as program web applications, install IDS systems and more — and if hacked, the US Secret Service was on hand to determine if there was enough data to start an investigation. Once again, the hackers dominated — but not without a few surprises."
Not to mention that the students were not trained in network security.
... give him an unsecured network ... with default passwords and such ... and a time limit of less than a week ... with the restriction that he cannot just unhook his network ... and his network gets cracked.
So, you give someone who isn't trained in network security
Big fucking surprise.
However, what you can't see is the rough access point that was installed behind the firewall in the 10.10.20.x range. You also can't see the pre-installed rootkit/keylogger that resides on the server.
Okay, so they have a pre-installed rootkits on the machines, and 2/3rd of the boxen they are given are windows machines running fundamentally insecure protocols. ( such as ms's infamous technique of sending cleartext LM hashes over the local network) It also seems the machines are setup with easily guessable passwords to boot.
Furthermore, they seemed to stress the "firewall" as if it was some sort of solution rather than just a roadbump as it is in reality. Disabling all blocking rules and simply serving as a router should have more than enough, since firewalls only ever provide the illusion of security anyway.
As the red team clearly illustrated, it only takes a few minutes to gain access to a Linux box via single user mode, bypass BIOS passwords by shorting out the motherboard,
This also has nothing to do with a sysadmins job. If you put your servers physically in the hands of an attacker, there is nothing you can do to stop them quite by definition.
It seems that the only way to win this competition on the defensive would have been to re-install the latest fedora core on all four machines, and setup services that you trust instead of MS services, then hunker down and physically guard the boxes.
It takes significant experience to walk into a network blind and secure it in hours. I have 2 decades of experience, and I've walked into places where it took days just to figure out w.t.f. they're running. It would take a day or more to figure out what all is going on in the network in my house -- and there's only 4 computers on at the moment.
And if you're dealing with Windows(tm), it can take hours to download and install all the freakin' patches. (unless you happen to wander around with a fully populated WSUS/SMS server.)
The problem with this is that they gave the teams securing the network 3 hours to prep.
As someone who had to take over company's network, exactly what this exercise is meant to simulate, I can say it does take more than 3 hours to secure the services and appliances they were given without taking things offline. What's more, you usually don't have four seasoned hackers banging on your network's doorstep in your first three hours of employment. Also consider that most businesses don't keep a 10k record CC# database on a machine behind an unsecured perimeter appliance with a bunch of hokey other services running on them, accessible from outside the lan. The expectations of the whole process are a bit ridiculous to begin with, but if you gave them a day or so to secure their network and services, I'm sure they'd have done much better.
Judging by the brief accounts of each teams actions, I'd guess that in more realistic scenarios they would make reasonably effective admins.
Meant for this story, obviously. Sorry about that.
Elite Network Counter Strike Force pwn Teens
(translated version)
In the annual Mid-Atlantic Regional Collegiate Cyber Defense Competition (CCDC), held at a secret location, a Network Counter Strike Force Team, consisting of seasoned veterans from several security technology firms and academia, PWNed several teams of IT students in a stunning display of 1337-ness.
In summary, the students are handed a small network with various services, most of which are outdated, vulnerable, and pre-exploited (rigged).
They, the students, then, have a few hours to get everything patched and secure, at which point the RED Team (a.k.a. the haxorz) are set loose to pwn them all.
However, as IT professionals know very well, it isn't just the hacker you have to deal with!
The Secret Service was on hand to make sure the competition went a lot like last year, as well as many other unplanned events ("interviews"). Welcome to the "Real World" -- CCDC style!!!
The students' goal: lock down rigged Windows and Linux systems and secure their networks. The Hackers' goal: to pwn the students' networks, steal important data and embarrass them in front of their Mothers.
Hylas Ipsum (not_hylas( )) read about the 2007 real-world competition and reported on the event from the perspectives of Slashdotters and first year Umpires everywhere.
Last Year's Event
This was the second year for the CCDC. I wasn't invited to last year's event, like this year, which turned out to be a very amusing experience for the haxorz. As with any first time adventures, unexpected "anomalies" played a very big role in the outcome of the event.
Despite minor hiccups, the Secret Service benefited most by walking away with all the chicks.
This Year
Prior to attending the 2007 event, we were fairly certain the RED Team was going to have a more difficult time gaining access to the students systems.
Perhaps the most amusing and educational aspect to this years Mid-Atlantic CCDC was how the RED Team managed to surprise everyone involved by cheating again, with no one saying a thing. Since the Prize Cups' disappearance the night before, this contest was for "sport".
With the air of sportsmanship renewed, the game was afoot.
As previously mentioned, each network contained a wide range of operating systems and services. In summary, the core network contained three computers:
A Windows 2003 computer running an Exchange Server, telnet, DNS, and Active Directory
A Fedora Core 4 server on a DMZ running Apache, telnet, PHP, MySQL, and osCommerce
A Windows XP workstation running syslog, VNC and telnet
In addition, two of the teams had a PIX firewall w/telnet and the other six had a Linux-based system running telnet on Smoothwall.
Prior to the physical intrusion, the RED Team had the most success by exploiting default configurations and default accounts. Once they were let loose, the team members quickly found and "pwned" routers, osCommerce sites, and Linux servers simply because the systems were still using default accounts. Unfortunately, this is a "real world" problem that has turned more than one company into a victim. Or to put it another way, why attempt to locate and exploit a DCOMRPC vulnerability when the password to the Administrator account is blank!
Why indeed?
The RED Team then commenced to "trash talking" the students, seeing blood in the water.
All this said, the event is much more than just a competition. It is a test of how well a person can perform under serious pressure. In fact, there was an unofficial "bonus" to the first hacker who could make a student cry.
Default configurations and accounts were bound to be located and fixed within minutes. The RED Team would not be able to simply walk in, connect to a system, and login. However, CCDC predicted this and provided a few "unknowns" to assist the red team with their work.
Since the "corporate network" was not truly connected to the internet for "security reasons", all patches and updates ha
~hylas
It wasn't to inspire awe in the hackers, many people don't seem to realize this. The whole point of the excercise, indeed, it appears, was to give the hackers the advantage, and see how the admins coped.
Further, the point of the whole thing was to expose people who might one day face challenges such as those posed by the hacker teams some real world experience, and understanding of how much vigilance it really does take to secure a given system.
In other words, it was sort of DESIGNED as a scare-tactic to the admins. In the long term some of them may indeed become overly security-paranoid, but in fact the point of the challenge was to cause a greater level of anxiety, hopefully to insure that companies who chose to hire individuals from the admin team would be better protected from loss, and that those individuals would hopefully enjoy imporved job security.
The whole thing was setup to attempt to reverse the standard, day-to-day lackluster security practices employed by the majority of the IT industry.
-taosk8r
So where does one go to learn about this kind of security work?
A work that expires before its copyright never enters the public domain and thus enjoys eternal copyright protection.
I was a member of one of the (losing) student teams.
First, none of the members of my team are majors in network security (just "IT"), linux gerus, and we did not recieve any advice from the previous team that went last year (what fags).
Second, two of the four boxes were Linux. Three monitors. The firewall box and the windows xp workstation box was KVM'd together.
8 people trying to work on 3 machines = not cool.
Third, oh god all of the systems were basically pre-fucked up. Rootkit/keyloggers on the 2003 server box, there was a wireless access point that was PLUGGED INTO our switch, broadcasting all internal traffic to the red team and allowing them DIRECT access to the internal network.
Fourth, it wasn't clear to my team that we had to have THREE external IP addresses mapped to THREE internal IP addresses, so our firewall/router solution didn't work at all. Business inject on the first day? ha? none of the e-mails could get to us because they were sending it to another ip! At the end of day 1, they also said that they would reimage the firewall box to Fedora Core 4 and give us control over it. So, everyone crammed as much about configuring fedora core 4 and learning iptables... we walk in day 2 and the guy says that he locked us out of our firewall box and that we aren't allowed to change it. (because 7/8 teams fucked up the firewall on the first day). Awesome, three direct ip mapping into our private network!
Fifth, there was a misunderstanding about what kinds of software we could use. We thought we were able to use ANY (non-pirated) software that was available on the Internet, including free trials. Turns out, we were only allowed to use commercial software ONLY if it was released as a beta version and had the appropriate enterprise use license. Hurray windows firewall? It's not like we could download zone-alarm.
Sixth, there was just too much stuff that was already on the machines that no one on my team had any experience with. osCommerce? hah.
Seventh, 70% of all the business injects are related to the website. When the red team broke into our Linux (fedora core 4) box, they completely fucked Apache and MySQL up (how to backup Linux? nothing to backup TO). So much for all those business injects.
Eighth, we only had one laptop to use to download stuff from the Internet or to research free software alternatives. Granted, our team probably needed more people that knew how to use Linux, but still...
Ninth, the network diagram was incorrect. How the hell do they expect us to configure a router if they provide the wrong DNS/default gateway information?
Yeah, we got owned hard... but there's also the saying... you learn from your mistakes... I believe I learned more in those 3 days then my entire 3 and 1/2 years in my university.