The Student vs Hacker Security Showdown Rematch 83
monkeyboy44 writes "Following up on last year's entertaining hacker vs. student showdown, InformIT.com once again covered the annual Mid-Atlantic Regional Collegiate Cyber Defense Competition where college students are put to the test. During the three day event, small teams from eight of the areas colleges are handed insecure networks that they have to lockdown and keep running — all while a team of hackers attempt to gain access any way they can. To keep it interesting, the teams also had to perform various tasks, such as program web applications, install IDS systems and more — and if hacked, the US Secret Service was on hand to determine if there was enough data to start an investigation. Once again, the hackers dominated — but not without a few surprises."
Re: (Score:1)
Re: (Score:2, Insightful)
It seems like the most reasonable step when someone is starting with a totally messed up system is to disconnect it from the network. Obviously, it's less than ideal, but it seems better than letting secure data get taken or allowing the hacker to get a stronger foothold. Obviously, you can't always bring down all IT systems in order to fix them, but, then, you probably also would have fixed these problems before the machines were attacked...
Strange that they don't allow that, eh? (Score:5, Interesting)
So, you give someone who isn't trained in network security
Big fucking surprise.
Re: (Score:2, Interesting)
Re: (Score:2, Insightful)
Re:Strange that they don't allow that, eh? (Score:5, Interesting)
Re:Strange that they don't allow that, eh? (Score:4, Interesting)
Back in the 1980's there was no division. The *nix Admin was the Network Admin as well.
Re:Strange that they don't allow that, eh? (Score:4, Interesting)
This just seems like a completely pointless exercise. Taking a group of college students, giving them an unrealistically short time, and then turning some experienced hackers on them just seems like a waste of time. It's like taking a high school football team, having them play the New England Patriots, and then saying "You can make a lot of money in a year playing football, but it's not as easy as it sounds." Duh.
Re: (Score:2)
What? You think most sys admins are trained in network security? Think again. :)
One would think that they at least were taught enough to set up an iptables/ipfilter ruleset that refuses all inbound connections except the services that are actually being used by a given server...
My big contention though is on the part that read like 'oh NOES! teh Linucks boxen were hax0red when the BIOS pw wuz reset at the mobo!" well... no shit. I'll try and remember that bit of golden discovery the next time I leave my servers running just outside, in some dark corner of the loading dock somewher
You are completely missing the point.. (Score:4, Insightful)
Further, the point of the whole thing was to expose people who might one day face challenges such as those posed by the hacker teams some real world experience, and understanding of how much vigilance it really does take to secure a given system.
In other words, it was sort of DESIGNED as a scare-tactic to the admins. In the long term some of them may indeed become overly security-paranoid, but in fact the point of the challenge was to cause a greater level of anxiety, hopefully to insure that companies who chose to hire individuals from the admin team would be better protected from loss, and that those individuals would hopefully enjoy imporved job security.
The whole thing was setup to attempt to reverse the standard, day-to-day lackluster security practices employed by the majority of the IT industry.
Re: (Score:1, Interesting)
Re: (Score:1)
Re: (Score:3, Funny)
Re: (Score:1)
How could they spell it wrong? (Score:2)
I mean--really.
Hack yourself (Score:2, Interesting)
The days of careful analysis and investigation are over. Why not learn a thing or two from the rapid fire, spray and pray, script kiddies?
Re: (Score:1)
Re: (Score:1)
Well, there you go. You certainly wont find zero-day exploits in the featureset for nessus or metasploit.
Re: (Score:2, Insightful)
Re:Hack yourself (Score:5, Insightful)
As someone who had to take over company's network, exactly what this exercise is meant to simulate, I can say it does take more than 3 hours to secure the services and appliances they were given without taking things offline. What's more, you usually don't have four seasoned hackers banging on your network's doorstep in your first three hours of employment. Also consider that most businesses don't keep a 10k record CC# database on a machine behind an unsecured perimeter appliance with a bunch of hokey other services running on them, accessible from outside the lan. The expectations of the whole process are a bit ridiculous to begin with, but if you gave them a day or so to secure their network and services, I'm sure they'd have done much better.
Judging by the brief accounts of each teams actions, I'd guess that in more realistic scenarios they would make reasonably effective admins.
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
Re: (Score:2)
Veterans not as good as students? (Score:3, Informative)
Knowing how to secure both Linux and Windows, plus understanding Cisco firewall configurations (or Shorewall/iptables) -- not to mention having a firm grasp of web application security -- is not a realistic expectation of any newly graduated employee, much less a seasoned veteran.
What? I'm guessing that maybe this is because a seasoned veteran would expect for the network to be maintained correctly? Especially the firewall?
Really, this doesn't sound like a level playing field at all. My company support *three* services - IMap, HTTP, and ssh. We keep the programs that offer these services completely updated. There's not a lot to keeping those updated. There's one major player for ssh, two for web, and four or so for mail. Even the minor ones take less than an hour to figure out.
We expect that the routers will handle almost everything else. Flaws coming out in IP stacks are a pretty major thing, and get fixed pretty quick, so it should mostly be a nonissue.
If these guys only had to support features that people actually use and lock down everything else, things would be very different.
Re: (Score:3, Interesting)
Clearly you've never been a contractor.
Starting a contract to "upgrade and secure our network" for a small company who doesn't have any IT staff, and only brings in contractors on a one-off basis a couple of times a year.
The competition scenario sounds fairly plausible to me.
Re: (Score:2, Interesting)
Your scenario is quite realistic, but then, scoring should be based on time to secure the network, not how many times the hackers can break in.
In that game, they were being scored for how many times they could get hacked, in the real world, if you did enter a hacked office, time would be critical, but over the course of a long weekend the office would be locked down and cleaned up.
So in my mind, if this was supposed to be realistic, the scoring would be between teams of sysadmins, see who can com
Re: (Score:1)
In the end, I don't think the game is supposed to be realistic. I think it's more about
Re: (Score:3, Insightful)
In the competition, the organizers phrased the removal of "illegal" tools as being the result of a BSA style audit. I expect companies who have been the subjects/victims of such an audit care greatly about the legality of the tools their admins (even contracted ones) are using.
I think it's more about making a point: security is not simple;
I expect the contestants came away with a heightened respect for just how much work it is to implement
Re: (Score:1)
Re: (Score:2)
I'm guessing that someone did a poor job of proofing that article, or just has th
Re: (Score:2, Informative)
"You also can't see the pre-installed rootkit/keylogger that resides on the server. These are the types of real world issues that IT professionals have to deal with..."
thats not a real world scenario, you build your servers off the network, you have cd's with all the latest patches, you install antivirus. and you have trusted people do this. By the time a server hits the network its got antivirus, patches, and is totally locked down.
Next absurdi
Completely Rigged (Score:4, Informative)
However, what you can't see is the rough access point that was installed behind the firewall in the 10.10.20.x range. You also can't see the pre-installed rootkit/keylogger that resides on the server.
Okay, so they have a pre-installed rootkits on the machines, and 2/3rd of the boxen they are given are windows machines running fundamentally insecure protocols. ( such as ms's infamous technique of sending cleartext LM hashes over the local network) It also seems the machines are setup with easily guessable passwords to boot.
Furthermore, they seemed to stress the "firewall" as if it was some sort of solution rather than just a roadbump as it is in reality. Disabling all blocking rules and simply serving as a router should have more than enough, since firewalls only ever provide the illusion of security anyway.
As the red team clearly illustrated, it only takes a few minutes to gain access to a Linux box via single user mode, bypass BIOS passwords by shorting out the motherboard,
This also has nothing to do with a sysadmins job. If you put your servers physically in the hands of an attacker, there is nothing you can do to stop them quite by definition.
It seems that the only way to win this competition on the defensive would have been to re-install the latest fedora core on all four machines, and setup services that you trust instead of MS services, then hunker down and physically guard the boxes.
Re: (Score:2)
Having an encrypted filesystem stops anyone who's after your data even if they have local access.
Assuming, of course, a perfect implementation.
Re:with single user mode access, all bets are off (Score:1)
Re: (Score:2)
Well, yes, that would kind of be the point, wouldn't it?
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re:Completely Rigged (Score:4, Insightful)
Of course there is. You can encrypt drives, encrypt information, use secure Mobos, etc.
As responsible for the integrity of your network, you're also responsible to let people know the level of physical security your network requires. As the article mentions, the servers were password-protected and expected to be secure. With physical access, the hackers got a suprisingly high level of penetration into the system without actually breaking it.
It seems that the only way to win this competition on the defensive would have been to re-install the latest fedora core on all four machines, and setup services that you trust instead of MS services, then hunker down and physically guard the boxes.
There was no way to "win" on the offensive. The offense wasn't being tested. The test was to see, basically, which group of sysadmins could outsurvive the rest. It wasn't an unfair competition between hackers and defenders. It was a task guaranteed to take out boxes, to see which team could best slow down the inevitable onslaught.
In a production environment you don't necessarily get to set the policy on what servers you are running, and off of what boxes. You inherit a messed up pile of old systems, legacy software that nobody can update anymore, buggy drivers, and Windows users installing trojans and giving their passwords away to the first person who comes along with a YourCompanySecurity username on AIM. The fact that they took the end users out of the equation was a huge blessing to the sysadmins.
Notice that they made damned sure that none of these computers were attached to the internet at the time of the task. These weren't the best of the best hackers the competition could find. These were a small pool of good hackers vs a small pool of sysadmins. If they had actually put these things on the internet, like production environments face every day, they would not have survived.
Hence, the pre-installed keyloggers.
Re: (Score:2)
Re:Completely Rigged (Score:5, Insightful)
Of course there is. You can encrypt drives, encrypt information, use secure Mobos, etc.
In a production environment you don't necessarily get to set the policy on what servers you are running, and off of what boxes.
Those two assumptions are somewhat conflicting I would say.
On the first point
The performance tradeoff for encrypted filesystems is seldom worth it on servers when you can physically secure them fairly trivially. If your building is regularly invaded, you have bigger problems. In any case, even if you can stop data loss with disk encryption, the guy could just take a hammer to your server and cause a DoS at the very least, and there is nothing you can do if you allow him physical access.
On the second point: if you are such a low level peon in the a company that you are forced to accept bug ridden systems, then security is a forgone conclusion. Heck- acheiving it might compromise job security. I might suggest looking for a better job. Instead, if you are in a position to offer "services" to the company, such as email, DNS, or NAS then YOU (The IT dept) get to decide how to provide them, and then you can make decisions with security in mind. Before we get too separated from reality, we have to remember that the point of computers is to offer data services to the users, not to offer brand names. The rest of the company shouldnt even have to know whats behind the curtain, just that everything is up and running smoothly.
Being asked to secure pre-owned windows servers is like being asked to levitate. Just give it up and re-install something else. The entirety of the O/S is analogous to trojan horse malware to start with, being that you do not get the source code. Trying to hold back the tide with a spoon and a colander is not my idea of security.
It was a task guaranteed to take out boxes, to see which team could best slow down the inevitable onslaught.
That would be uninteresting. Why even try.
I think it should be not only possible, but fairly easy to setup a network that would provide service and not be penetratable over the network. You could even go for extra points by detecting unwanted probing or intrusions and blackholing the attacker's traffic so that you don't even suffer from a degradation of service. But assuming you will
lose is the wrong mindset, imo. You have to play to win.
Re: (Score:2)
If you put your servers physically in the hands of an attacker, there is nothing you can do to stop them quite by definition.
Of course there is. You can encrypt drives, encrypt information, use secure Mobos, etc.
Eh?
Seriously... I've never heard of a "secure mobo" in a production server - ever. Sure, you can password-protect the BIOS, rig up the handy physical intrusion alarm on the box (if there is one) and whatnot... but, umm, I don't see that as fitting your definition as used.
Encrypted drives? Cool... until you have to restore the things from backup a couple of years later and no one has the password, because the admin who installed it never wrote it down anywhere, and he left the company a long time ago.
Mod parent up (Score:1)
This seems like a dumb competition - of course the hackers are going to win. I highly doubt any of the hackers would win if the roles were reversed. Why not give the students several days to set up a system to spec, then let the hackers at it?
Re: (Score:1)
Student != Professional (Score:5, Informative)
And if you're dealing with Windows(tm), it can take hours to download and install all the freakin' patches. (unless you happen to wander around with a fully populated WSUS/SMS server.)
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
(Honestly, it wouldn't be much of a learning experience if it weren't tipped in favor of the hackers.)
Re: (Score:1)
Re: (Score:3, Insightful)
Not really arguing the point, but the first step is to unplug all the network cables. That doesn't take very long. Then you can take your time securing it before letting it back on the net.
If you don't know what's on it, and there's a cable attached, you pretty much have to assume it's already rooted.
If you don't know what's on it, and there's a cabl (Score:1)
Well said.
Re: (Score:1)
I've had to do this repeatedly everywhere I've ever worked. (even had to make a bellsouth tech literally do this to find a loop plug.)
Re: (Score:2)
Re: (Score:1)
Ignore please (Score:3, Informative)
Elite Network Counter Strike Force pwn Teens (Score:5, Funny)
(translated version)
In the annual Mid-Atlantic Regional Collegiate Cyber Defense Competition (CCDC), held at a secret location, a Network Counter Strike Force Team, consisting of seasoned veterans from several security technology firms and academia, PWNed several teams of IT students in a stunning display of 1337-ness.
In summary, the students are handed a small network with various services, most of which are outdated, vulnerable, and pre-exploited (rigged).
They, the students, then, have a few hours to get everything patched and secure, at which point the RED Team (a.k.a. the haxorz) are set loose to pwn them all.
However, as IT professionals know very well, it isn't just the hacker you have to deal with!
The Secret Service was on hand to make sure the competition went a lot like last year, as well as many other unplanned events ("interviews"). Welcome to the "Real World" -- CCDC style!!!
The students' goal: lock down rigged Windows and Linux systems and secure their networks. The Hackers' goal: to pwn the students' networks, steal important data and embarrass them in front of their Mothers.
Hylas Ipsum (not_hylas( )) read about the 2007 real-world competition and reported on the event from the perspectives of Slashdotters and first year Umpires everywhere.
Last Year's Event
This was the second year for the CCDC. I wasn't invited to last year's event, like this year, which turned out to be a very amusing experience for the haxorz. As with any first time adventures, unexpected "anomalies" played a very big role in the outcome of the event.
Despite minor hiccups, the Secret Service benefited most by walking away with all the chicks.
This Year
Prior to attending the 2007 event, we were fairly certain the RED Team was going to have a more difficult time gaining access to the students systems.
Perhaps the most amusing and educational aspect to this years Mid-Atlantic CCDC was how the RED Team managed to surprise everyone involved by cheating again, with no one saying a thing. Since the Prize Cups' disappearance the night before, this contest was for "sport".
With the air of sportsmanship renewed, the game was afoot.
As previously mentioned, each network contained a wide range of operating systems and services. In summary, the core network contained three computers:
A Windows 2003 computer running an Exchange Server, telnet, DNS, and Active Directory
A Fedora Core 4 server on a DMZ running Apache, telnet, PHP, MySQL, and osCommerce
A Windows XP workstation running syslog, VNC and telnet
In addition, two of the teams had a PIX firewall w/telnet and the other six had a Linux-based system running telnet on Smoothwall.
Prior to the physical intrusion, the RED Team had the most success by exploiting default configurations and default accounts. Once they were let loose, the team members quickly found and "pwned" routers, osCommerce sites, and Linux servers simply because the systems were still using default accounts. Unfortunately, this is a "real world" problem that has turned more than one company into a victim. Or to put it another way, why attempt to locate and exploit a DCOMRPC vulnerability when the password to the Administrator account is blank!
Why indeed?
The RED Team then commenced to "trash talking" the students, seeing blood in the water.
All this said, the event is much more than just a competition. It is a test of how well a person can perform under serious pressure. In fact, there was an unofficial "bonus" to the first hacker who could make a student cry.
Default configurations and accounts were bound to be located and fixed within minutes. The RED Team would not be able to simply walk in, connect to a system, and login. However, CCDC predicted this and provided a few "unknowns" to assist the red team with their work.
Since the "corporate network" was not truly connected to the internet for "security reasons", all patches and updates ha
Re: (Score:1)
Where do you go to learn this stuff? (Score:4, Interesting)
Re: (Score:3, Informative)
I was at the competition in Maryland (Score:5, Interesting)
First, none of the members of my team are majors in network security (just "IT"), linux gerus, and we did not recieve any advice from the previous team that went last year (what fags).
Second, two of the four boxes were Linux. Three monitors. The firewall box and the windows xp workstation box was KVM'd together.
8 people trying to work on 3 machines = not cool.
Third, oh god all of the systems were basically pre-fucked up. Rootkit/keyloggers on the 2003 server box, there was a wireless access point that was PLUGGED INTO our switch, broadcasting all internal traffic to the red team and allowing them DIRECT access to the internal network.
Fourth, it wasn't clear to my team that we had to have THREE external IP addresses mapped to THREE internal IP addresses, so our firewall/router solution didn't work at all. Business inject on the first day? ha? none of the e-mails could get to us because they were sending it to another ip! At the end of day 1, they also said that they would reimage the firewall box to Fedora Core 4 and give us control over it. So, everyone crammed as much about configuring fedora core 4 and learning iptables... we walk in day 2 and the guy says that he locked us out of our firewall box and that we aren't allowed to change it. (because 7/8 teams fucked up the firewall on the first day). Awesome, three direct ip mapping into our private network!
Fifth, there was a misunderstanding about what kinds of software we could use. We thought we were able to use ANY (non-pirated) software that was available on the Internet, including free trials. Turns out, we were only allowed to use commercial software ONLY if it was released as a beta version and had the appropriate enterprise use license. Hurray windows firewall? It's not like we could download zone-alarm.
Sixth, there was just too much stuff that was already on the machines that no one on my team had any experience with. osCommerce? hah.
Seventh, 70% of all the business injects are related to the website. When the red team broke into our Linux (fedora core 4) box, they completely fucked Apache and MySQL up (how to backup Linux? nothing to backup TO). So much for all those business injects.
Eighth, we only had one laptop to use to download stuff from the Internet or to research free software alternatives. Granted, our team probably needed more people that knew how to use Linux, but still...
Ninth, the network diagram was incorrect. How the hell do they expect us to configure a router if they provide the wrong DNS/default gateway information?
Yeah, we got owned hard... but there's also the saying... you learn from your mistakes... I believe I learned more in those 3 days then my entire 3 and 1/2 years in my university.
Re: (Score:1)
don't blame the network (Score:2, Insightful)
Good lesson for everyone! (Score:2, Informative)
student preparation (Score:1)
Re: (Score:1)
Thoughts (Score:2)
However, there are several things that could be improved. If you think the 3 hours of "prep time" could be used to secure our systems, you are mistaken. The three hours were actually used to complete business injects. Obviously, the systems were very "pre fuck