Linux Server Break-in Challenge

Sujit writes "Are you an Internet security expert at heart or by profession? Ever thought of trying your skill at a professionally set up server? If you are ready, enter. The Linux Server Break-in challenge. You will have a server available on the Internet 96 hours without interruption starting from 9 March 2005 2 AM IST. However, the server's life on the Net is in your hands."

Alternately, . . .

[Maradine]

Post the IP address here. That'll compromise it.

Re:Alternately, . . .

[dtfinch]

It's 192.168.0.103. Let the hacking begin!

Challenge accepted!

[c0l0]

Now I'll just have to find that Sub7-thingie for Linux somewhere on the net...

More Interesting

[Anonymous Coward]

That server wont have a firewall or much secuirty... so how about 69.44.61.248 - the linuxense.com webserver :)

Re:Isn't this illegal?

[Gabrill]

Possibly, but then again, SCO isn't running the contest.

FTA

[mr_z_beeblebrox]

I thought it was a nice touch that they give directions on how to stop network services for someone who gets root. Most people who root linux boxes have trouble with those advanced administrative functions

Re:Alternately, . . .

[justforaday]

It's 192.168.0.103. Let the hacking begin!

w00t!!! I got in! They used the same root password as I use on my box...What do I win???

Tin Foil Hat Contest!

[xtermin8]

If nobody can read your thoughts for 96 hours you win- a free tinfoil hat! Yay!

Social engineering

[saskboy]

Obviously the best way to crack this server is going to be to socially engineer the linux administrator at this company, and get the real root password.
It's probably something like: thislinuxis2coolforU2crax0r

Hmm, that sounds like something I should use as a root password. Forget I mentioned this.

Outsourced

[Evil W1zard]

Hey our Hacking Contests have been outsourced to India. Seriously though I am kind of wary about this because I don't know what legal implications there may be doing this since I am uneducated in Indian Cyber criminal law? Also the web site looks fairly hinkey (yes its a word and I'll use it!) It would be funny if they posted the IP address at the start of the contest and it turned out to be the IP of some major site or agency....

Re:Selling some sort of hardened Linux, perhaps?

[Anonymous Coward]

Alternatively, they could just register a Slashdot account, post "OMFG SCO rulez Linuz SUXX0Rz!!11" in every topic, and point the URL in the profile to a website saying "LOL get the facts LINUX SI FOR HIPPYS"

very handy. *cough*

[blue_adept]

yes, very handy for those real-life applications where the server will be on the internet for more than 96 hours.

Re:Alternately, . . .

[Council]

Use the credit card numbers hidden on the box to buy absolutely anything you want.

Social Engineering

[Inkieminstrel]

Dear Admin,

I am currently working on a project sponsored by you in which I need to break into your computer. In order to do this, I will need the root password. Also, my SSH signature is attached to this message. Please add me to the list of valid signatures.

Thank you,
Inkieminstrel
Social Engineer

Re:For crying out loud

[PoprocksCk]

"Altruistic intellectual pursuits are one thing, a penguin t-shirt is completely another."

I'd prefer Napoleon Dynamite's helicopter shirt. To each his own, I guess.

Limber Up

[Stanistani]

*Buys crate of Cheetos*
*Installs soda machine*
*dims lights*
*cracks knuckles*

I'm ready...

Oh the irony..

[tod_miller]

...if the admin uses Outlook (on a diff machine):

Subject: "I hax0r3d your box!11"

Dear adm1n, I hjax0red your l1nu> box, look at the attached screensh00t as pr00f!!!

h4x0r3d.vbs.exe.scr.pif.dll.bat

Look at the pic and I will hack^H^H^H^H show you!!

Yours

skr1pt k1|)|)1e

PS: I am tha l33ts7 I even misp4ll l36t words.

Take the easy way out

[tsmithnj]

All the posts thus far are technical in nature. The easiest way into that machine is through the front door. Find the server, grab it, and run. If these guys are stupid enough to allow you to break into their property-- take them up on the challenge. AFter all, they did lay down the challenge.....

Aftermath

[halleluja]

... and then I would hack along into .gov sites from their site.. try and proof I did it.

That's not what I heard...

[jhigh]

I was told that it's 127.0.0.1. Took me about five seconds to hack in. Morons didn't even have a firewall...

Re:/. Effect

['nother poster]

Come get some [userfriendly.org].

Extra Credit

[Anonymous Coward]

Options for extra credit:

1) Erase the kernel and everything else, replace with printf('Do you want to play a game?\n');

2) Break into the sniffer on the bridge, and erase the packet logs. Return a copy later.

3) Install BSD on it.

4) Install and register Win XP on it, which would really confuse the next hacker.

Re:Alternately, . . .

[tomhudson]

No it's not. It's at 216.250.128.12

a.k.a. SCO.com (after all, they claim to own all linux, so have at 'em, boys and girls)

Re:Rules

[hawk]

Nah. Zorro could leave his mark on a cdrom . . .

hawk

Re:Social Engineering

[hawk]

From [e-mail] Fri Feb 25 22:51:32 2005
From: "linuxsense"
To: [e-mail]
Subject: linuxsense Account Security Measures

Dear linuxsense root,
Your account has been randomly flagged in our system as a part of our routine security measures. This
is a must to ensure that only you have access and use of your linuxsense
account and to ensure a safe linuxsense experience. We require all flagged
accounts to verify their information on file with us. To verify your
Information at this time, please visit our secure server webform by
clicking the hyperlink below [...]

Re:Alternately, . . .

[theVP]

I can see it now. A linux geek in front of his computer, putting his pokemon hat on, and getting his pokemon cards ready for battle. Then, with much hesitation, he makes his decision. As he types in the server's IP address on Slashdot, he cries out, "Slashdot Effect, I choose YOU!!!"

Re:Alternately, . . .

[Gzip Christ]

Use the credit card numbers hidden on the box to buy absolutely anything you want.

I tried, but the loser has some pathetically low credit limit. :(

Re:Selling some sort of hardened Linux, perhaps?

[Anonymous Coward]

Or maybe they are going to post the IP address of a rival's webserver ;)

Future challenge:
"Hey guys this is Bill Gates, we are testing some new security features and want to see how effective they are. So we are posting the Microsoft Hacking challenge."

Just try to bring down the web servers, email servers, and database servers of our test website:

www.redhat.com, oops I mean 209.132.177.50, yeah, that's it.

Also, please forward this to everyone you know, and we'll give you one penny for each time it is forwarded.

Offer good anywhere except in places that steal people's kidneys and leave them in bath tubs full of ice with a message to call 911."

Re:Selling some sort of hardened Linux, perhaps?

[Anonymous Coward]

"disclaimer: if you or your organization fall victim to IP lawsuits for hacking into a linux machine, Microsoft can offer you amnesty: see www.microsoft.com/getthefacts for more information."