Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security Entertainment

Code Auditing the Defcon Way 74

Posted by Zonk from the hands-on-classes dept.
An anonymous reader writes "Last weekend at Defcon, the best and brightest hackers got together to play Capture the Flag, a weekend long hacking event that is the premier event of its kind. According to the results, Shellphish won (UC Santa Barbara students led by professor Giovanni Vigna). An article at SecurityFocus states that the competition was far more technical than in previous years, focusing on reverse engineering skills and code auditing." From the article: "The game required skills that are also required by both security researchers and hackers, such as ability to analyze attack vectors, understanding and automating attacks, finding new, unpredictable ways to exploit things...It's about analyzing the security posture of a system that is given to you and about which you initially know nothing."
This discussion has been archived. No new comments can be posted.

Code Auditing the Defcon Way More

Code Auditing the Defcon Way

Comments Filter:

  • More technical? (Score:4, Insightful)

    by Alex P Keaton in da ( 882660 ) on Saturday August 06, 2005 @04:48AM (#13256990) Homepage
    Sort of like when extreme sports went mainstream... Seems like this is a better way for people to show of their skills for the ever growing, and ever more lucrative security business....

    • Re:More technical? (Score:2, Insightful)

      by xcentrics ( 903559 )
      "What it takes to be an elite hacker is to find vulnerabilities in custom software," said the Kenshoto member. "It is not code auditing per se. They have to reverse engineer, and we have made it difficult to reverse engineer."

      real-Reverse Engineering under linux ?!? forget about it.
      i mean the system is free ,98% of software is free.Therefore there are no commercial _exe_packers_ (i've never heard about it) so RE is not as hard as under Win where anything can be packed in example with Asprotect.If ther

      • Re:More technical? (Score:2, Interesting)

        by Anonymous Coward
        http://protools.reverse-engineering.net/unpackers. htm [reverse-engineering.net]

        Sorry to tell you this, because just like Shrinker, some bunch of dorks has also broken AsPack (as far as Win32 Portable Executeable format packers/compressors)...

        I use (or have used) both in the past not only to gain the faster loadtime off disk (or, even over LANS, because the decompression process only happens AFTER the read up off of the diskdrive into memory, & thus, runtime & today's modern VERY fast nearly 4ghz CPU's more than makeup for t
    • I suspect that the motivation behind changing the game was to de-emphasize the growing commercial aspect. If you've attended DefCon in the past few years and watched Capture the Flag, it felt like it was slowly being taken over by corporate teams (several teams were named after their company and/or displayed large company banners in the game area).

      This was still a "creeping" influence the last time I attended (not too long ago), but it sure felt like a trend.

      I can understand why companies are upset by the c

  • "According to the results" (Score:4, Funny)

    by Armchair Dissident ( 557503 ) * on Saturday August 06, 2005 @05:14AM (#13257038)
    "According to the results, Shellphish won"

    Who wants to be that Shellphish hacked the results...

  • Anyone parse that as professor Vagina? (Score:1, Funny)

    by Anonymous Coward
    Damn, I need to get laid.
  • Haha, he said posture! - Nope, I don't get it either - hey it's early!

    Erm on a serious note, how did the Defconhackers get an overal score of 0?

    Why are they even *on* there? Randomness.

    -Phil

  • X (Hackers) Games (Score:2, Insightful)

    by KarMax ( 720996 )
    IMHO there is nothing WRONG about this kind of "x hacker games" there is a lot of this kind of stuff, Hollywood movies, popcorn books (like Davinci Code by Dan Brown), among others.

    The problem is when begins to be a serious "news" or "event".

    The article try to remark that the event is "pro" or "serious", dont get it...

    Its just a game!
    • Actually, considering the amount of data that is collected from both wargames and the DC wireless network for research use, it is pretty "serious." Too bad next year's Defcon has been cancelled.
  • Is anybody else disturbed by the growth of meaningless, self-aggrandizing jargon in this field? Attack vectors, security posture... Give me a break. These guys do good work, they don't need to puff themselves up with this kind of fantasy verbage like some social scientist or art historian. When did people's egos get so big they need to invent cool sounding words for everything? We've got a serious arms race going on in the "my profession is cooler than yours" wars.
    • I'm glad that I'm not the only one to notice and be annoyed by it. I find the compulsion to substitute "ph" for "f" everywhere even more obnixous.

      The worst is the growth of "dark" words, darkmail, darknet, darkphish, argh... enough already!

  • I would love to see network trace logs (Score:3, Insightful)

    by abulafia ( 7826 ) on Saturday August 06, 2005 @11:32AM (#13258079)
    I haven't been to Defcon since the third one... no time (at least I have the t-shirts), and now that I don't live nearby, it is hard to justify the expense and time off. Hell, I can't even have normal vacations, let alone conference junkets. But damn, this seems like it would have been a great year to have gone.

    I'm sure someone watched the wire for this event - if TCPdump (or whatever) traces of it are available anywhere, someone post a link. It would be a fascinating thing to waste my weekend on.

  • I was there playing CTF. This year's focus is definitely very different, unless you can dream assembly, you are not going to be very effective at attacking.

    The way they setup the infrastructure also does not allow you to do a whole lot of defense against the attacks.

    In terms of this being real-world... Honestly, how many security incidents are caused by hackers reversing the binary which lead to the intrusion? I would say 95% of intrusion are done by script-kiddie method.

    I hope they will put more infrastruc
  • Just like online gaming.... Teams were not balanced. From what I heard the top 3 teams all had 20+ people. Some 30..... 4th place had 7 people. Also heard the points system was a little skewed. Basicly if you owned someone else's server then you scored points for the length of time you owned it. B ut then the team that was being hacked would take it off line and you would be out of luck. The penalties for off line boxes were less sever than the rewards for owning someone. The contest was run by a group ca
    • The penalty for off-line boxes was MORE severe than the reward for an 0wn. You could basically score two points for an 0wn per 5-10 minutes. If you managed to take down all your services for the whole game, you'd end up with 0 points, because your attack score was multiplied by your uptime percentage. Let's say that you determined that you were getting pwn3d through the Alice service about 1/2 way through the game, so you just shut the thing off. The one team would probably fail to score two points ever

Slashdot Top Deals

E = MC ** 2 +- 3db

Close