Learn, hack!

URL

http://dewy.fem.tu-ilmenau.de/CCC/22C3/video/22C3-428-en-hacking_challenge.mp4

File name

22C3-428-en-hacking_challenge.mp4

File size

345.9 MB

MD5

b2f03dd21234ecc30fb287512c6a1e14

SHA1

1253e7f1102e7b66bbb0628a05fd2e82bdc386a2

The talk will give a deep view behing the scenes of creating a CTF-hacking challenge. Starting from a short analysis of requirements for such an event, the organizational work to be done, to the main topic: designing the actual contest and choosing the software to be hacked. This years CIPHER event was a larger hacking event for students from international universities. 14 teams gathered from four continents and fourteen countries to hack the other team's server and defend their own. The exercise is about hosting a server that initially runs multiple services, i.e. a webserver, a mail server and customized services. These have typical security vulnerabilities that allow to compromise the server. The goal is to maintain the services up and uncompromised for the duration of the game, scores are also given for exploiting weaknesses and gaining access to other team's servers. The contest was held within a VPN, to authenticate the teams and ensure that the contest will not leak 'surprises' on the remainder of the internet. The services were hosted on VMWare- images, so that the memory layout and starting conditions for each team were controlled and known to all participants. We will give an overview of the services used in the contest, how we build them and demonstrate the tools we used to run the contest. The main goal of the exercise was to teach students how to act in situations of constant pressure and ubiqituous insecurity. The skills to actively participate not only include programming languages but also system administration and knowledge about offensive techniques.