Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Network Computing Editor Wins RSA Hacking Contest

Posted by Zonk on Sun Feb 18, 2007 08:28 PM
from the hack-on-hack-off dept.
Security
richkarpi writes "Network Computing's security editor won the recent RSA Interactive Testing Challenge. He has up a blow-by-blow description of the events at their site: 'The most important factor in the contest besides basic web exploitation skills (cross site scripting (XSS), SQL injection, cross site request forgeries (CSRF), etc.) was speed ... I squeaked out a win in the tie-breaking challenge the first day with only a few seconds to spare as my opponent was right behind in the hunt to combine three injectable fields into one long javascript function.'"
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Network Computing Editor Wins RSA Hacking Contest 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Meh (Score:5, Funny)

    by DavidHOzAu (925585) on Sunday February 18 2007, @08:36PM (#18063470) Homepage
    A real hacker would've cracked open the server the day before and gotten the answers before entering the competition.

    • Re: (Score:1, Funny)

      by Anonymous Coward
      I guess the biggest challenge is trying to keep the 'cheats' out :S
    • A real hacker wouldn't have participated, but let's not get into a "definition of hacker" debate..

    • Re:Meh (Score:5, Insightful)

      by numatrix (242325) on Sunday February 18 2007, @09:33PM (#18063744)
      Actually, last year HD Moore did exactly that -- cracked the vmware image using the metasploit framework and won that way. According to the conference organizers anyway.

      Besides, I never claimed that I was a "real hacker". :-)

      (yes, that's me. Holy crap, I've been slashdotted!)
      • Congratulations, on the win, Jordan.

        • Re: (Score:3, Interesting)

          by numatrix (242325)
          Thanks much. I was serious in the original post -- almost all the competitions were down to the wire, a number of folks could have easily won. I got pretty lucky.

      • Re:Meh (Score:4, Informative)

        by MikePikeFL (303907) on Monday February 19 2007, @10:24AM (#18067490)
        Well, HD Moore didn't win for doing that. While he did use the Framework to break into the machine in a way we didn't expect, he wasn't available to participate in the finals so he was disqualified.

        He did ask permission to use the Framework before doing so, which he "happened" to have on a USB stick. The point of the exercise was application testing, not rooting the Windows 2000 server that we forgot to install a firewall on. Whoops, our bad!

        Having never seen him before, we didn't know he really was HD Moore until we used images.google.com to find out. :-)

        Congrats again Jordan, hope to see you next year since you won a free pass!
        • Whoops, sorry to mis-quote you, thanks for the correction.

          Thanks again for doing such a great job with the contest, it was a lot of fun.

          Scheduling permitting, I'll be there next year too now that I have a title to defend. ;-)

      • Re: (Score:1, Informative)

        by Anonymous Coward
        Last year's winner was not HDMore, it was Ralf Hoelzer.

        http://2006.rsaconference.com/us/media/news.aspx [rsaconference.com]

    • Re:Meh (Score:5, Funny)

      by Spikeles (972972) on Sunday February 18 2007, @10:09PM (#18063894)

      A real hacker would've cracked open the server the day before and gotten the answers before entering the competition.
      So James T Kirk is the ultimate hacker? He not only cracked the server, he modified the challenge so he would win!
      • If you can't find a solution, redefine the problem. :)
      • "He has up a blow-by-blow description of the events at their site"

        Not entirely related to parent comment, but a movie related one at least: anyone ever see 'Swordfish'? Crap film but this story and quote reminds me of it.
  • Elite Hackorz just keep quiet about these kind of things!
  • After all, this is job related, but I bet the expense report is probably funny

  • Time victory = valid? (Score:5, Funny)

    by glittalogik (837604) on Sunday February 18 2007, @09:10PM (#18063642)
    Because typing speed is everything when you and your buddies are hacking the Gibson via a payphone.

  • That's Nothing (Score:2, Funny)

    by Anonymous Coward

    The most important factor in the contest besides basic web exploitation skills (cross site scripting (XSS), SQL injection, cross site request forgeries (CSRF), etc.) was speed ... I squeaked out a win in the tie-breaking challenge the first day with only a few seconds to spare as my opponent was right behind in the hunt to combine three injectable fields into one long javascript function.

    That's nothing.

    This one time, I was hacking this really locked-up-the-wazoo Gibson. I'd set up a couple of IDS/IPS evasio

  • It's good to see he won the contest on that one facet of security, web security.
  • if he'd actually told us a little more detail. As it stands this is a "What I Did On My Summer Holidays" and it gets a D- for information.

  • Yeah, sure.... (Score:5, Funny)

    by d474 (695126) on Sunday February 18 2007, @10:09PM (#18063892)

    "He has up a blow-by-blow description of the events at their site..."
    Ha Ha...I'm not falling for that one. One minute your innocently reading a post on Slashdot about some 1337 web hacker asking you to check out his website, the next minute he's robbing your grandma's bank account...

    Mitnick warned me about hacker tricks like that... I for one am not going to RTFA!

  • The CSRF and XSS FAQ (Score:3, Informative)

    by mrkitty (584915) on Sunday February 18 2007, @10:13PM (#18063914) Homepage

    The XSS FAQ [cgisecurity.com]
    The Cross-site Request Forgery FAQ [cgisecurity.com]
  • This all is precisely why I have the NoScript extension installed in Firefox, and javascript is only turned on if the site requires it; the regular sites I use that DO require it, are whitelisted. I also have firefox set to dump all cookies on quitting; only sites that NEED to set permanent cookies are allowed to do so via the exception list.
    • Do you have any idea what you're talking about? This article is talking about hacking a server, not your personal box, and servers generally don't run javascript anyway. Good luck trying to install NoScript as an apache module.
      • I was under the impression that if site X wants to take advantage of your account on site Y(hence XSS right?) that it needs javascript to be turned on in your browser. Or is that not what the article is talking about when it says XSS?

        Maybe I went wrong reading the summary.
        • Disabling the javascript by default would still be pointless because the original site needs javascript for something that would be exploitable..

        • site X wants to take advantage of your account on site Y(hence XSS right?


          XSS is called "Cross Site Scripting" because CSS was taken by Cascading Style Sheets so they went with X. If I wanted to steal your Slashdot password (site Y), I would put some javascript in this message (that _you_ would read in your browser) that would sent your cookie to my server (site X). Fortunately, this part of Slashdot is not vulnerable to XSS (to my knowledge).
      • I don't know what the parameters of the competition are, but for XSS/CSRF to work, there would almost certainly have to be simulated user-input to allow these sorts of vulnerabilities to be exploited.

        It could also be that the quote is somehow out of context, or that the winner was spouting off. But from what I infer, Javascript could very likely have been involved.
    • And you have no clue what "precisely this" is.
  • Hacking Contest Eh? 14 year old Finnish kids armed with Generalized Quadratic Sieves need not apply?
  • This is half in jest, half wondering if any "pros" (ie NSA types) were in the competition? They definitely weren't listed in the TFA and I wonder if they'd be allowed to compete.

    Of course, their cover could be working for the Mormons...

    myke
    • Relax. You need to work on your reading comprehension.

      He wasn't insulting the intelligence of Mormons. He was just remarking on how odd it is that an employee of a *church* was so talented. And it is odd. You would expect that someone so skilled would be more likely to be working for a "tech" company.

    • Re:Ugh (Score:4, Informative)

      by numatrix (242325) on Sunday February 18 2007, @10:25PM (#18063960)
      I would have written the exact same sentence if my opponent was in a similar position at a Catholic, Baptist, Buddhist, etc, organization, or was technical staff for Seven-eleven, Sears, or pretty much any non-security company.

      Read it again and you'll notice I also included myself in the category of "people you wouldn't expect in the finals of a web hacking competition". So unless you think I was also calling myself stupid, I wasn't belittling anyone. Merely pointing out that neither of us were the first folks you'd expect to see in the semi-finals.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.