Details of Cyber Storm War Games Released

I Don't Believe in Imaginary Property writes "Apparently, the participants in the U.S. 'Cyber Storm' war games are familiar with the Kobayashi Maru, because some of them tried to cheat by hacking the games themselves. They also prepare for some very interesting scenarios. Among other things, the organizers are worried about having too many people on the 'No Fly' list show up at an airport, finding 'mystery liquids' in the subway, and having bloggers reveal the classified location of railcars with hazardous materials. The Department of Homeland Security has already analyzed the results of the games, and plans to hold 'Cyber Storm 2' in March."

Comments

Does anyone

[kcbanner]

Have any details on how these "games" are actually run? I'm interested in how they simulate everything...is it just a mock control room with a game server hooked up to everything instead of the real world, or do they actually use real world utilities and networks to do this? I read the article but it was more newspaper-speak than technical details.

Hacking the game is cheating?

[Shadow Labs]

I find it interesting that they call hacking the game itself "cheating."

Reminds me of when I was in college and us CS people used to get together and play a computerized version of capture the flag. The premise of the game was simple enough -- players were divided into 4 teams of 2-3 people each, and each team got a machine that came pre-loaded with an older unpatched version of Linux that had well known and published security vulnerabilities (something like Red Hat 7.3). Each machine had 4 services running on it -- typically SSH, Bind, Apache, and telnet (yeah...*sigh*). Each of those services came configured to return a certain string (the so-called flag) when queried by a master scoring server that ran a fairly simple Python script. The script ran once every minute and then displayed up to date team scores on a video projector. The rules of the game stated that we could not patch the machine or use IPtables to lock down the machine. Anything else was fair game. The machines and the scoring server were all networked together on small private network, and each team was given one additional network drop to do with as they pleased.

Anyway, one night we got together to play CTF and there were only enough people for 3 teams of two. Since that doesn't make for such an interesting game, one of our professors who was just supposed to be observing decided to join in and be on his own team. As soon as the game started, everyone went to work furiously trying to defend their boxen and then the real fun -- the attacking -- began.

We were all quite surprised when the first round of results came in and our professor hadn't had anyone hijack his machine. He also evidently hadn't attacked anyone else. The night went on and each of the student teams went back and forth, attacking and defending, but our professor stayed the same -- he neither had anyone successfully compromise his box, nor successfully compromised anyone elses.

The last few minutes of the game saw my team dead last, our professor in third place, and two other teams above us. 5 seconds from the end, our professor's score suddenly increased to an ungodly high (and according to the rules unattainable) score, with the rest of our scores getting set to zero. As the clock ticked down and the game came to an end, we were befuddled as to what happened.

Suddenly it dawned on us -- our professor had spent the entire time hacking the scoring server (which was supposed to have been an up to date, secure Linux install) and replacing the Python scoring script with one of his own, all to his advantage. At some point during the game, he had actually replaced the running script with his own, without any of us ever noticing. We were all in awe and amazement at his creativity -- the idea to do such a thing had not even occurred to any of us. We learned several valuable lessons that night, one of which was that the mind of a creative attacker may not be confined solely within the nice little security box that you place it in. That, and never mess with your professors!

Re:Hacking the game is cheating?

[darkmeridian]

That's a very naive view of the world. The real world is unexpectedly complicated and there's lot of room for thinking outside the box. For example, in a U.S. war game, the American forces supposedly had the benefit of a jamming operation that prevented the enemy from communicating at all. The OpFor leader in charge of attacking the American forces used clarion calls from mosques and civilian motorcycle messengers to communicate despite the hypothetical jamming operation. The observers disallowed his communication saying it was outside the rules.

Well, in the real-world in Iraq, the insurgents are hiding behind civilians and mosques. An exercise that makes you reconsider the rules of the game is very important in the real world, where you have to expect the unexpected.

Re:Hacking the game is cheating?

[Nocterro]

the American forces supposedly had the benefit of a jamming operation that prevented the enemy from communicating at all

No offence, but any criticism of the war-game after that would be just redundant, surely you give the enemy the huge advantage and make your own forces work around it? If that's a true story then there's some strange thinking in play. Able to give us a source?

Third option

[TapeCutter]

What about China's reaction to unforseen disaster? Currently they are suffering a huge week long bizzard that has stranded millions of people who were travelling home for Chinese new year. At one station alone there were several hundered thousand people waiting several days for the trains to restart.

People stuck in a blizzard is nothing new in China, what I found interesting was the government has made a rare official appology to the people for being unprepared for the magnitude of this particular storm. Politicians are turning up at train stations and adressing the massive crowds with bullhorns, appologising profusely while explaining that the trains can't run until the power lines are back up and the tracks are cleared.

Some people were complaining, but the majority were spontaneously applauding and cheering the guy with the bullhorn.

BTW: I realise that the news from China is tainted with propoganda and a poloitician with a blowhorn won't get the trains back any faster. However, since they have a million troops working on the clean up, have hailed 6 electrical workers who died trying to restore power as national heros, plus the afforementioned apology for something they could not realistically prevent, I think the applause is not entirely hollow.

Re:Third option

[jamar0303]

This blizzard also resulted in my school having its first ever snow day. Ah, the joys of Shanghai in the winter.

accident?

[zogger]

I haven't seen anything but their say so that the cut was an accident. It could have been deliberate to slow down middle eastern stock market transactions, to try and avert a meltdown...just sayin'.... or something else. Could be a lot of things. I don't know but so far ain't buying the story as advertised. It might be true, but it smells bad. We have one report that says ships got "ordered" to go anchor in an unusual place..this is a clear WTF? episode then. Why they do that? Plausible deniability excuse some "ships anchor" did it?

    Whenever there is a HUGE screwup, judging by past historical references and parallels,.... with big business or governments, it pays to reject the first official "explanation".

Re:Frightning...

[Anonymous Coward]

From the article:

Other simulated reporters were duped into spreading "believable but misleading" information that confused the public and financial markets, according to the government's documents.

From the Center for Public Integrity http://www.publicintegrity.org/WarCard/Default.aspx?src=home&context=overview&id=945

On at least 532 separate occasions (in speeches, briefings, interviews, testimony, and the like), Bush and these three key officials, along with Secretary of State Colin Powell, Deputy Defense Secretary Paul Wolfowitz, and White House press secretaries Ari Fleischer and Scott McClellan, stated unequivocally that Iraq had weapons of mass destruction (or was trying to produce or obtain them), links to Al Qaeda, or both.

False Statements by Month: http://www.publicintegrity.org/WarCard/Images/Charts/WarCardChart.jpg

Nice to know that they were simulating a plausible scenario...

Re:Frightning...

[The_reformant]

Any mass information disemination is obviously a risk during national emergencies and there is no reason to beleive that if the press isn't controlled by the government then it is uncensored and uncontrolled. There are plenty of other organisations with huge media influence and their own agenda to push so you have to consider the view that its someone else's propaganda.

Treating the media as a risk isn't the same as taking away the freedoms of the media. The media and by extension the general public doesn't have a right or need to know intimate security details during a time of crisis. I dont see a problem with controlled release of information under the assumption that there is a long term transparency.