sethfogie wrote to mention Informit.com's coverage of the Mid-Atlantic Regional Collegiate Cyber Defense Competition. Students put their skills to the test, trying to lock down systems against intrusion from an invading hacker team. All in the name of learning. From the article: "When the three hour grace period was over, the Red Team slowly worked their way into attack mode. One member started to sort through the information they gleaned from their scans and investigated each possible exploit. Another member fired up a MySQL database client and started to poke around the students databases looking for sensitive data. The two others were adding/changing accounts to routers, firewalls, and systems. However, for the most part, the students were not being pelted with attacks. And this continued for the next several hours."
I don't know about you, but I always hurt people for info. From TFA: The rules were fairly simple -- at least at first glance. Basically, the Red Team could do anything but hurt someone or perform a denial of service attack (network flood). The student teams were a bit restricted, with regard to changing IP addresses and messing with the infrastructure.
Communication was allowed between team members, but only the team leader could talk to the white cell members about problems, etc. The feds could be called o
Restricting the student teams from messing with the infrastructure was the first mistake, since the hackers had somehow stolen the details of the entire system.
First thing the students should have done was change EVERYTHING - the subnets, the IPs, maybe even the software being used. That would have forced the hackers to have to relearn everything they thought they knew.
I'm all for this and from TFA, this sounds like a great thing (and lots of fun!) However, using the information gleaned here to apply to real-world situations is lacking in one MAJOR area: They neglect the aspect of social hacking. That is to say, attempting to gain access to a computer system through it's weakest link: THE USERS!
It's one thing to pit technical skill againt the threat of hacking, but it's been done over and over, all that technical skill accounts for nothing if you have a user that has his/her password written down on a sticky - on thier MONITOR!
Users must be educated and kept up to task on things like this, and it's my opinion that the IT/Security industry does not place enough emphasis in that arena, And to thier detriment...
This is so true. User *are* the weakest part of any system, and unless you eliminate 90% of your user base, you will never have a secure system. Enter restricted accounts.
using the information gleaned here to apply to real-world situations is lacking in one MAJOR area: They neglect the aspect of social hacking.
i think you missed the vignette about the little tidbit obtained before the contest even started: the stat sheet on the systems the defendors had been issued, that the Red Team conned off someone. seems sorta equivalent of pulling a sales receipt out of a dumpster to me...
Social Engineering was part of the competition. I took part in the Southeast competition, although social engineering wasn't defined as being part of it, we thought it would happen and it did.
Turns out the RED team (ISS Xforce & PWC @ our competition), got bored after they destroyed everyone's setup... so they went out and walked into rooms and some folks they were able to sit down and plug in the network.
I actually participated at this contest for Millersville University. Social engineering was allowed. I must admit, I have not yet read the article but members of the Hacker/Red team would often walk around the room and try and to watch what people were doing. A few times they even stopped and tried to get information out of us. However, they had to leave our team area when asked. Our team actually left sheets with the wrong passwords on the tables in hopes that they would waste their time.
Not only is the end user normally the weak point there is also the complacency factor that hits the security team itself. But that only happens over time, usually an extended period of time. The longer a collection of systems are in place the more likely that one of the administrators will short cut procedures and leave a system exposed.
In a similulation as described in the article everyone is hyper vigilant and actively looking at all aspects of security. In the normal world it is rare that the enti
Not for nothing, but I participated in the Midwest regional (we won, w00ty w00t), and social engineering actually played a huge part. Our team (SIU) spent multiple nights in the bar and the hotel getting drunk with the red team. At the end of it all, one of the hackers said that the entire red team voted us as the best. Unfortunately, the red team's vote was never used for scoring as was originally intended, but hearing that was one of the highlights of the weekend. Since then, one of the hackers pointe
Poking around on other people's machines is all well and good, but in the most pervasive and damaging "hacks" (sic), there is usually a major social engineering component.
In other words, it's a trivial matter to get into somebody's system; it takes a whole 'nother skill set to convince that person to hand you the keys to their data.
I wonder if tech-savvy folks (the students referred to in TFA fior example) are as good at "locking themselves down" as they are at securing their computers. Have any studies been done on the credulosity of geeks?
Actually, this was allowed. As the article notes they were highly suspicious of the press, because they thought he could actually be a member of the opposing team. You are right though, with the teams sitting in front of the computers the whole time, the chances of any social engineering hacks were pretty limited and real systems admins can't be at every computer all the time.
> sitting in front of the computers the whole time, the chances of any social engineering hacks were pretty limited and real systems admins can't be at every computer all the time.
every collegiate social event I attended served alcahol, were they allowed to buy drinks? (having a a little nip now, thanks for noticing my great spelling.)
I don't think the social engineering aspect was absent from this setup. FTA:
He next reached inside his bag and pulled out a complete description of the student's setup, including all operating systems, services, web applications, and IP addresses he had obtained from an anonymous source. Everyone in the room immediately got a slightly evil grin on their face as they realized the results of this social engineering reward.
Polygraph Technician: This is a control question, really. How would you say would be the easiest way to take a weapon away from a Grammaton Cleric? Brandt: [speaks into Preston's ear.] You ask him for it.
In the social engineering context, I guess you give him chocolate for it.
I go to this school and am friends with one of the guys that is on the team. From how they tell it, they prety much owned the other teams (or at least got the least owned by the red team). Hopefully one of them will log on and give you their perspective.
I really wish I had heard about this before it happened, but I missed it. Oh well. The entire CS department here at Millersville will be pulling for them when they go onto Texas.
A school competition to hack and slash against harden servers? Wow! That's interesting. Considering that most schools discourage any form of hacking on the school network, and my local community college had called in the FBI on a few occasions. I didn't know that some schools taught "Script Kiddies 101", much less even mention hacking in the regular programming courses.
A. The students weren't hacking, they were trying to protect their server and keep it running.
B. The hackers were intrusion specialists in the private sector. One used to work at the DEA and another was in the military.
At City College of San Francisco, one of our teachers sort of teaches "Script Kiddies 101". His computer security courses teaches how various simple tricks can be used to trick a sys admin into giving you root access (e.g., tricking him into running a standard command with root privilege which you have tricked out as a script that copies a shell with his privilege and then runs the command he thought he was running before erasing itself - stuff like that. It's very introductory, but it's better than the Wind
For those who read French here is a press release [web.crim.ca] about a team of Scheme hackers headed by Marc Feeley [umontreal.ca] participating in a Quebec security competition who won both the first prize for keeping the other nine teams out and the second prize for finding the most security problems in the other teams's servers.
Unless those students were specifically chosen because they have CCNA's or better and MCSE's or better, etc. Why pick "students" for this "challenge"?
The student teams were a bit restricted, with regard to changing IP addresses and messing with the infrastructure.
The easiest way to defeat the attackers would be to lock them out at the firewall or router. Then all the sql-injection vulnerabilities wouldn't matter.
And when your database app has those vulnerabilities, there isn't much the average network admin can do.
It was very fun. We really expected the hackers to be exploiting vulnerabilities much more than social engineering and such. Our downfalls were a) not changing the passwords of the users fast enough b) forgetting to configure the obscure mail server software. It was called "post.office"; never heard of it. By the time we remembered about it, the hackers had changed the password on it, although we (naively) assumed it had just been locked down somehow.
Since you were in the contest, what was your background? Did you have any experience with that router and firewall? Any professional/vendor certifications or training?
We are all computer science majors. So, basically we learn to code.
All of our knowledge from this competition is from experience outside of school. A little hands-on knowledge can go a long way. I worked primarily on the Linux servers (but also the e-commerce site on Windows). My knowledge of that is just through personal experience. I've been using Linux for a long time.
I know at least one person on the team has a lot of certifications (Microsoft). Another person was trained on routers by the national guard. Although I have experience from a Cisco class in highschool, I let other guys who knew it better handle it. As a funny note, we locked ourselves out of our firewall almost immediately (due to mistyping the new password). We didn't attempt to reset it while we were in first place.
So, our backgrounds are all pretty unique to answer your question. As a side note, we do have a security class offered at our school, but it is heavily based on theory.
We are all computer science majors. So, basically we learn to code.
I'm impressed that you lasted that long.
Seriously, aside from the physical entry (extremely uncommon in the Real World), a quick class on firewall/router configuration would have stopped the attackers.
I think you guys were setup to fail on this. You gave an impressive performance, but the skills needed weren't what you were going to school for and, in the Real World, you wouldn't be limited to those "rules".
at our competition (southeast) they even said we were setup to fail and the deck was stacked so high against us it was ridiculous.
We didn't have most of the CDs to reinstall/install OS's or Applications. We also didn't have access to the internet except for a few proxied sites and it wasn't working so hot.
Rule Zero: There is no security without physical security. The other team learned that. The first rule of security is to restrict the avenues of attack. You weren't allowed to do that.
The second rule is to run only what you absolutely need. But without the install media, that's not very easy to do.
The third rule is... patching. Not easy with only one machine connected to the Internet. And not much use if your app had the same sql-injection vulnerability that the other team's did. Patching only works if ther
One of the caveats of the firewall is that we couldn't block by source ip -- so, while it sounds like you can just stop any attack at will, that is not the case. Someone came up with the suggestion of blocking by destination ip... but I don't think the white team would have been very amused.
I agree - since the red team had access to the entire infrastructure setup, the first thing the students should have done was change everything - subnets, IPs, passwords, even what software was being run in some cases.
That would have forced the hacker team back into information gathering mode for a longer time, and it's clear from the story that even though the students had three hours without attacks, they needed more time.
Heh, we used Post.Office in 98-99 because our VP decided Windows NT was the future. It sucked. No surprise that you've never heard of it and I'm frankly surprised it's still around.
Ours was fairly organized. The machines were mostly in working condition. They didn't take too much effort to get the services running. However, it did seem like people went out of their way to make them insecure. One thing I found amusing was on one webserver there were about 5 files like "debug.php", "index.php" (although it didn't load by default), and such with blatant vulnerabilities or phpinfo()'s in them. My only real complaint is that we didn't see anything the scorebot was doing. For a while, t
A little clarification from someone who participated. This wasn't a competition to spawn a generation of script-kiddies.
Social engineering played a part in the competition.
When the article says "restrictions," it's not saying we weren't allowed to change shit. The "no changing ip's" business was that we had to have services on a certain IP for the duration of the competition.
"The easiest way to defeat the attackers would be to lock them out at the firewall or router. Then all the sql-injection vulnerabiliti
"The "no changing ip's" business was that we had to have services on a certain IP for the duration of the competition." Oh, okay - if it had to be a public accessible service such as the Web server - but could you change the ports? No reason to use the standard ports for services if you don't have to and clobber the banners, too.
"I'm convinced that the only secure computer is one that's not plugged in."
That's about right. And the only secure computer that is running is the one that doesn't have anything on i
I see that flooding was disallowed, but how about red-herring attacks to get caught in packet sniffers used by the good guys, for the purpose of distraction from the real attack?
... but the article seams to imply that students were divided into a red team and a blue team and had to hack each others systems
Only if you didn't, like, read it. The red team were not students.
Red Team:
Joe Harwell: Joe is a Security Specialist for Nortel Government Solutions. He currently is responsible for design, integration and testing of many of the "three letter agencies" security systems, and has over 15 years of experience in the field. He was CERT penetration tester for the US Army in a previous life.
Ryan Trost: Ryan is a Senior Security Engineer for Criterion Systems, currently working on a DHS contract. When not overseeing the security architecture of his team, he spends his free time developing a Network Security Snap-on Application that involves IDS Geocoding (patent pending). Ryan will be graduating from George Washington University this May with a Masters in Computer Science.
Adam Meyers, CCE, IAM, IEM: As an information security professional and consultant, Adam Meyers provides clients with complete security expertise, ranging from assessments, forensics, incident response, penetration testing, and security architecture. Additionally he provides physical security assessments and threat analysis. Mr. Meyers is a Certified Computer Examiner (CCE). Prior to joining SRA, he worked with the George Washington University Security Team, as the Network Manager for the 2000 National Democratic Convention, and as a private security consultant, all while pursuing a degree in political science with specific attention to inter-state information warfare.
Tom Parker: Tom is a computer security analyst who, alongside his work providing integral security services for some of the world's largest organizations, is widely known for his vulnerability research on a wide range of platforms and commercial products. Tom regularly presents at closed-door and public security conferences, including the Blackhat briefings, and is often referenced by the world's media on matters relating to computer security.
it was pretty rough. We had 4 hours in the southeast competition. BUT we did not have the debian CDs, the linux boxes were full of backdoors and lots of misconfigurations on purpose. We thought we would have a fully functioning network going in, and for us it seemed to be more of a disaster recovery competition. The hard drive on our static web server (linux) died after the 1st hour, we finally got a replacement the next morning for the 2nd day but it was too late. We had 2 windows servers running on MS virtual server 2005 & 1 Debian mail server VM... for whatever insane reason on the 2nd day our mail server wouldn't recognize the virtual network card and we were SOL.
The Red Team aren't the ones who were responsible for setting up the boxes.
Though, for reasons even they can't comprehend, they were constantly consulted on what to install on them, and even were asked for *binary* install packages.... If you want to blame someone, blame the organizers, not the red team. I mean, c'mon, what would *you* do?
Yeah, one of the Red Team members is a friend/co-worker of mine.
Actually, they did use a 0-day at our competition. They found a flaw in our sony network camera that enabled them to bypass the authentication. That doesn't sound useful, until you realize it has a built-in microphone.
Nice rules (Score:1, Informative)
The rules were fairly simple -- at least at first glance. Basically, the Red Team could do anything but hurt someone or perform a denial of service attack (network flood). The student teams were a bit restricted, with regard to changing IP addresses and messing with the infrastructure.
Communication was allowed between team members, but only the team leader could talk to the white cell members about problems, etc. The feds could be called o
Re:Nice rules (Score:2)
First thing the students should have done was change EVERYTHING - the subnets, the IPs, maybe even the software being used. That would have forced the hackers to have to relearn everything they thought they knew.
And the winners are... (Score:1)
Simulations are lacking, here's why (Score:5, Insightful)
It's one thing to pit technical skill againt the threat of hacking, but it's been done over and over, all that technical skill accounts for nothing if you have a user that has his/her password written down on a sticky - on thier MONITOR!
Users must be educated and kept up to task on things like this, and it's my opinion that the IT/Security industry does not place enough emphasis in that arena, And to thier detriment...
Re:Simulations are lacking, here's why (Score:1)
Re:Simulations are lacking, here's why (Score:3, Interesting)
Re:Simulations are lacking, here's why (Score:1)
"Another member fired up a MySQL database client and started to poke around the students databases looking for sensitive data."
This looks like social engineering to me.
Re:Simulations are lacking, here's why (Score:2, Informative)
Re:Simulations are lacking, here's why (Score:1)
Turns out the RED team (ISS Xforce & PWC @ our competition), got bored after they destroyed everyone's setup... so they went out and walked into rooms and some folks they were able to sit down and plug in the network.
Re:Simulations are lacking, here's why (Score:4, Interesting)
Parent
Re:Simulations are lacking, here's why (Score:3, Insightful)
In a similulation as described in the article everyone is hyper vigilant and actively looking at all aspects of security. In the normal world it is rare that the enti
Re:Simulations are lacking, here's why (Score:2, Interesting)
The user is the weak point! (Score:5, Informative)
In other words, it's a trivial matter to get into somebody's system; it takes a whole 'nother skill set to convince that person to hand you the keys to their data.
I wonder if tech-savvy folks (the students referred to in TFA fior example) are as good at "locking themselves down" as they are at securing their computers. Have any studies been done on the credulosity of geeks?
Actually, this was allowed. (Score:3, Informative)
Re:Actually, this was allowed. (Score:3, Interesting)
Re:Actually, this was allowed. (Score:2)
every collegiate social event I attended served alcahol, were they allowed to buy drinks? (having a a little nip now, thanks for noticing my great spelling.)
Re:The user is the weak point! (Score:2)
He next reached inside his bag and pulled out a complete description of the student's setup, including all operating systems, services, web applications, and IP addresses he had obtained from an anonymous source. Everyone in the room immediately got a slightly evil grin on their face as they realized the results of this social engineering reward.
Re:The user is the weak point! (Score:2)
Ratio of people who visit slashdot to people who take slashdot seriously?
Re:The user is the weak point! (Score:2)
Brandt: [speaks into Preston's ear.] You ask him for it.
In the social engineering context, I guess you give him chocolate for it.
GO MILLERSVILLE! (Score:1, Interesting)
Re:GO MILLERSVILLE! (Score:2)
It is one thing to know it is coming... (Score:5, Insightful)
Sounds like fun though, kinda like the CS programming competitions I went to in high school
Hacking at school... (Score:5, Insightful)
Re:Hacking at school... (Score:2, Informative)
Re:Hacking at school... (Score:2)
At City College of San Francisco, one of our teachers sort of teaches "Script Kiddies 101". His computer security courses teaches how various simple tricks can be used to trick a sys admin into giving you root access (e.g., tricking him into running a standard command with root privilege which you have tricked out as a script that copies a shell with his privilege and then runs the command he thought he was running before erasing itself - stuff like that.
It's very introductory, but it's better than the Wind
Other recent security competition (Score:1)
Not exactly fair, was it? (Score:3, Insightful)
The easiest way to defeat the attackers would be to lock them out at the firewall or router. Then all the sql-injection vulnerabilities wouldn't matter.
And when your database app has those vulnerabilities, there isn't much the average network admin can do.
This calls for... (Score:2)
Students:
2,890,000,000 results
Hackers:
87,700,000 results
No contest.
Finally did something slashdot-worthy! (Score:5, Insightful)
It was very fun. We really expected the hackers to be exploiting vulnerabilities much more than social engineering and such. Our downfalls were a) not changing the passwords of the users fast enough b) forgetting to configure the obscure mail server software. It was called "post.office"; never heard of it. By the time we remembered about it, the hackers had changed the password on it, although we (naively) assumed it had just been locked down somehow.
What's your background? (Score:3, Interesting)
Re:What's your background? (Score:5, Interesting)
All of our knowledge from this competition is from experience outside of school. A little hands-on knowledge can go a long way. I worked primarily on the Linux servers (but also the e-commerce site on Windows). My knowledge of that is just through personal experience. I've been using Linux for a long time.
I know at least one person on the team has a lot of certifications (Microsoft). Another person was trained on routers by the national guard. Although I have experience from a Cisco class in highschool, I let other guys who knew it better handle it. As a funny note, we locked ourselves out of our firewall almost immediately (due to mistyping the new password). We didn't attempt to reset it while we were in first place.
So, our backgrounds are all pretty unique to answer your question. As a side note, we do have a security class offered at our school, but it is heavily based on theory.
Parent
That makes me want to smack people. (Score:2)
I'm impressed that you lasted that long.
Seriously, aside from the physical entry (extremely uncommon in the Real World), a quick class on firewall/router configuration would have stopped the attackers.
I think you guys were setup to fail on this. You gave an impressive performance, but the skills needed weren't what you were going to school for and, in the Real World, you wouldn't be limited to those "rules".
Congrats!
Re:That makes me want to smack people. (Score:2, Interesting)
Re:That makes me want to smack people. (Score:2)
That's just wrong. (Score:2)
The first rule of security is to restrict the avenues of attack. You weren't allowed to do that.
The second rule is to run only what you absolutely need. But without the install media, that's not very easy to do.
The third rule is
Re:That makes me want to smack people. (Score:2)
One of the caveats of the firewall is that we couldn't block by source ip -- so, while it sounds like you can just stop any attack at will, that is not the case. Someone came up with the suggestion of blocking by destination ip... but I don't think the white team would have been very amused.
Re:That makes me want to smack people. (Score:2)
That would have forced the hacker team back into information gathering mode for a longer time, and it's clear from the story that even though the students had three hours without attacks, they needed more time.
Re:What's your background? (Score:3, Funny)
As a funny note, we locked ourselves out of our firewall almost immediately
Are you sure you don't work for my company? They call this a security feature where I work,
Re:Finally did something slashdot-worthy! (Score:2)
kashani
Re:Finally did something slashdot-worthy! (Score:2)
My only real complaint is that we didn't see anything the scorebot was doing. For a while, t
Start Reading From the Description (Score:2)
RTFA? (Score:2, Insightful)
This wasn't a competition to spawn a generation of script-kiddies.
Social engineering played a part in the competition.
When the article says "restrictions," it's not saying we weren't allowed to change shit. The "no changing ip's" business was that we had to have services on a certain IP for the duration of the competition.
"The easiest way to defeat the attackers would be to lock them out at the firewall or router. Then all the sql-injection vulnerabiliti
Re:RTFA? (Score:2)
Oh, okay - if it had to be a public accessible service such as the Web server - but could you change the ports? No reason to use the standard ports for services if you don't have to and clobber the banners, too.
"I'm convinced that the only secure computer is one that's not plugged in."
That's about right. And the only secure computer that is running is the one that doesn't have anything on i
red herrings? (Score:2)
Re:red herrings? (Score:2)
Re:Students vs. Hackers? (Score:5, Informative)
Only if you didn't, like, read it. The red team were not students.
Red Team:
Joe Harwell: Joe is a Security Specialist for Nortel Government Solutions. He currently is responsible for design, integration and testing of many of the "three letter agencies" security systems, and has over 15 years of experience in the field. He was CERT penetration tester for the US Army in a previous life.
Ryan Trost: Ryan is a Senior Security Engineer for Criterion Systems, currently working on a DHS contract. When not overseeing the security architecture of his team, he spends his free time developing a Network Security Snap-on Application that involves IDS Geocoding (patent pending). Ryan will be graduating from George Washington University this May with a Masters in Computer Science.
Adam Meyers, CCE, IAM, IEM: As an information security professional and consultant, Adam Meyers provides clients with complete security expertise, ranging from assessments, forensics, incident response, penetration testing, and security architecture. Additionally he provides physical security assessments and threat analysis. Mr. Meyers is a Certified Computer Examiner (CCE). Prior to joining SRA, he worked with the George Washington University Security Team, as the Network Manager for the 2000 National Democratic Convention, and as a private security consultant, all while pursuing a degree in political science with specific attention to inter-state information warfare.
Tom Parker: Tom is a computer security analyst who, alongside his work providing integral security services for some of the world's largest organizations, is widely known for his vulnerability research on a wide range of platforms and commercial products. Tom regularly presents at closed-door and public security conferences, including the Blackhat briefings, and is often referenced by the world's media on matters relating to computer security.
Parent
Re:Students vs. Hackers? (Score:2)
Re:Lunix servers (Score:4, Interesting)
Parent
Re:Not impressed (Score:2, Informative)
Though, for reasons even they can't comprehend, they were constantly consulted on what to install on them, and even were asked for *binary* install packages.... If you want to blame someone, blame the organizers, not the red team. I mean, c'mon, what would *you* do?
Yeah, one of the Red Team members is a friend/co-worker of mine.
Re:Not impressed (Score:2)