Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security

DEF CON "Capture the Capture The Flag" Data 107

Posted by Hemos from the come-and-analyze dept.
pablos writes "Each year DEF CON hosts the famed Capture The Flag contest. Hackers from all over the world duke it out on the network for 72 hours, hacking for the title. The Shmoo Group diligently logs every packet for posterity, we "Capture the Capture The Flag." Now is your chance to download by far the most interesting, 'sploit ridden, 5.8GB of intrusion collusion ever published. Free for the bandwidth endowed, this is the ultimate IDS testbed."
This discussion has been archived. No new comments can be posted.

DEF CON "Capture the Capture The Flag" Data More

DEF CON "Capture the Capture The Flag" Data

Comments Filter:

  • Making waves... (Score:3, Funny)

    by hyrdra ( 260687 ) on Tuesday October 30, 2001 @05:48AM (#2496233) Homepage Journal
    Hmm...my favorite was the sinusoidal IP address spoofing. Anyone else?

  • They cheated us. (Score:5, Interesting)

    by vulgarDPS ( 525551 ) on Tuesday October 30, 2001 @05:57AM (#2496247)
    At defcon 8 DPS was at defcon and Burrows straight up social engineered his way into the server room and rooted the main box. So technically we had just won but they disqualified him cuase they wouldn't acknowledge social engineering as valid. Before defcon 8 DPS (dead [protocol] society) had pretty much dominated the social engineering contests but defcon 8 was the first year they decided to stop doing the social engineering contests so we were forced to improvise.

    • Re:They cheated us. (Score:5, Funny)

      by Effugas ( 2378 ) on Tuesday October 30, 2001 @08:03AM (#2496422) Homepage
      Ghettohackers quite brutally owned my laptop. One of 'em started chatting with me, asked if he could check his email...though I watched the screen, it's always polite to look away when someone types in their password.

      Except when that password is

      notepad c:\flag.txt
      ghi

      Now, at the time I damn near killed someone over that...but I realized pretty quickly it was a damn slick hack. Ask, and ye shall receive. Even from me.

      --Dan
      • ahahahaahahahahaaah!

        Wait, wtf are you talking about?

      • Dan... (Score:2, Funny)

        by evenprime ( 324363 )
        Microsoft's email client caused some people on the wireless network almost as much grief during blackhat this year. ;-)

        -Joey
      • Yeah it pissed us off too, that you were dumb enough to give away that many points to GH. However, since Digital Revelation merged with Ghetto Hackers, those turned out to be our points anyway. Since we only won by something like 10 points, thanks for the freebie. :)

        Ghetto Hackers + Digial Revelation = 0wned CTF 2001
      • What morons would ever check their e-mail on someone else's computer at a "hacker" convention?
        1:9 there is a keystroke logger in place.

        Granted, you were asking for it by not having /flag.txt be -rw------- 1 root root

        Oh, wait. Was that a C: ? };->
        • *laughs*

          "But...but...it's the client pool...you're not supposed to be attacking the client pool...whine whine...bitch bitch...goddamn fuckers that was a good hack...whine whine..."

          I did some serious penance for bringing a WinXP beta laptop to hack against Ghettohackers. Lets just say *my* Caesar's Challenge involved swimming on the bathroom floor and puking off of balconies the night before my big talk.

          Man, that night was fun.

          --Dan
    • This year there was a guy inside a server cabinet waiting to come out in the middle of the night to own all the machines in the server room. A last minute change in server locations blew it for them. Sadly, I've forgotten who did it.
      • Actually, that was us (Ghettohackers). Under our interpretation of the previous year's rules, Physical penetration of the NOC was allowable. In fact, we managed a capture at DC8 by SE'ing a guard into letting one of our members in (CIR), who then rooted from the console. Unfortunately, with the rule change this past year, that went right out the window.
  • ...The .pak files?

    *ducks*

  • Site is slashdotted (almost), so here are mirrors. (Score:5, Informative)

    by thesolo ( 131008 ) <slap@fighttheriaa.org> on Tuesday October 30, 2001 @06:14AM (#2496266) Homepage
    Well, since the site is getting hit pretty hard, here is a direct link to all the mirrors:

    Capture the Capture The Flag Mirrors

    If you have a mirror up, please let me [mailto] know.

    If you're using wget to pull the data, please use the following command:
    &nbspwget -r -nd --no-parent -R "=A","=D" http://site/path/

    US - Wisconsin (100Mbit):
    http://www.wi2600.org/mediawhore/mirrors/shmoo/cct f-defcon9 [wi2600.org]

    US - Colorado (100Mbit):
    http://www.ucar.edu/temp/shmoo-defcon9-ctf/ [ucar.edu]

    US - Pennsylvania (T1):
    http://www.bitsend.com/defcon9-cctf [bitsend.com]

    US - Alaska (DSL):
    http://cctf1.shmoo.com [shmoo.com]

    Please be sure to read the license [slashdot.org].
  • 'sploit ridden, 5.8GB of intrusion collusion ever published. Free for the bandwidth endowed'

    You would need alot of and bandwidth and evan more time on your hand to evan start on.

    Now , let my see ... on a 56k modem ,(if my math is correct) , then thats about 10 days...

  • Well I hope they Capture the Slashdot Effect. (Score:3, Funny)

    by Raindeer ( 104129 ) on Tuesday October 30, 2001 @06:17AM (#2496271) Homepage Journal
    Putting a couple of Gigs data on the net and then having the bad luck to be posted on Slashdot is going to mean that their link will be unreachable for most of the day. :-) But hey it will probably make for neat graphs.

  • Bandwidth Cost (Score:2, Interesting)

    by JohnHegarty ( 453016 )
    How are they going to pay for the bandwidth cos on this...if evan just 1000 people download it (and it has been slashdotted) then it will 5.8 Terabytes of information to be downloaded.

    This won't exaclty be payed for by a banner ad.
  • In the dim and distant past, before I became 'respectable' I used to be a hacker wannabe. I used to use my 1200 baud modem to dial into various systems, and lets just say, that had the law been the same then as it is now, I could have been arrested.

    But after I became involved in tech support for major financial institutions, I realised that although security there was reasonably good, you could almost always circumvent it via social engineering.

    My favorite trick to get into the server room was to put on an old hard-hat and a fluorescent jacket. I would stand outside the door until someone came along, then I would simply ask them to let me in. Which about 70% of the time, they did. At which point, I would point out to them that I could have been anyone, usually got an embarassed apology.

    I was using social engineering to raise the security awareness of staff, but it was a real eye-opener to me just how easy it was to control people.

  • Mirror in the making (Score:3, Informative)

    by siliconincdotnet ( 525118 ) on Tuesday October 30, 2001 @06:42AM (#2496304) Homepage
    Mirror in the making at http://deimos.siliconinc.net/cctf

    Its currently chugging away at about 250 kbps, so it should be done within a few hours. There is already 1+ gig of data up there for your browsing pleasure, and its chugging away at around 250kbps. Enjoy. If it breaks email me or something.
  • Tcpdump? or what else?
  • from what I hear, n-ctf SUCKED this year...

    From a friend whom was on one of the teams:

    We set up some 'reflectors', using the MIRROR target of the Linux netfilter and almost got booted of the net by the judges for this unique solution.

    Bleh.
  • The Shmoo Group diligently logs
    every[*] packet for posterity

    I don't know about defcon 9 (2001), but I seem to recall them only being able to get part of the traffic at defcon 8 (2000).

    [*] my emphasis, not theirs

    • True, the entropy of the CTF network architecture each year, is roughly equal to that of the entire internet. We had a tough time getting everything at DEF CON 8. The DEF CON 9 capture is certainly much better, but we're bound to have missed some bits here and there. Also, as other posts have pointed out, the contest had a very strange design which allowed flag hosts to come up and down faster than an MTV weened script kiddie's attention span could track. We're expecting the DEF CON 10 CTF, hosted by the Ghetto Hackers will improve capture possibilities a great dea. - pablos.

  • even better (Score:5, Insightful)

    by evenprime ( 324363 ) on Tuesday October 30, 2001 @07:43AM (#2496395) Homepage Journal
    the shmoo group's data gives an idea of the type of attack tools that are most commonly used in intrusion attempts, but if you want to know the tools and techniques that are the most likely to succeed, it would be good to talk to Caezar [caezarschallenge.org] or some other member of the ghettohackers [ghettohackers.net]. After all, they are the ones who win at capture the flag year after year....

    • Re:even better (Score:2, Informative)

      by BasharTeg ( 71923 )
      Don't forget this year it wasn't just GH. I certainly had my share of points in the final score. This year I was running under the flag of Digital Revelation, although that's not my group. The final team was Ghetto Hackers merged with Digital Revelation, and without our admin points, GH wouldn't have won. It was a real team effort.


      Here's some pics:


      My speech on behalf of Digital Revelation [irev.net]
      Ceazar's speech on behalf of GH [irev.net]


      And damn it was alot of fun this year.

  • Call me lazy (I am) is there a summary or commentary on all that raw information that can show us hacks attempted, both successful and unsuccessful. It even gives some hacker some reflected flame at deciphering and commenting on the information. If I was considerably less lazy I might do it myself.

    Greed is Good - 1980's
    Lazy is Good - 2001
  • <P>I suppose that would then be "Metacapturing the Flag".
    <P><H3>This useless comment was generated by a Cockpitful of Suicidal Fanatics for you</H3>

  • CTF Rules (Score:5, Interesting)

    by Rizz0 ( 101760 ) on Tuesday October 30, 2001 @12:47PM (#2497657) Homepage
    The rules for CTF at DC9 were, unfortunately, not well tested prior to the actual event. The intent of the rules were to provide more targets to attack, by shifting the burden of providing targets to the competitors. However, with the rules as written at the beginning of the contest, it turned out to be (pointwise) not worth attempting to hack. The net effect of the rules were that most groups were simply putting up a server, getting the points and pulling it down. While this is a valid strategy for that ruleset, it doesn't make for much of a hacking competition. This constant churning of servers also made hacking difficult, with targets disappearing by the time you could identify them through the standard CTF network instability.

    We (the GhettoHackers, with the much appreciated help of Jennifer Grannick) managed to slowly, over the course of the competition, convince Miles to change the rules to a set more conductive to an actual hacking competition. When teams began merging due to the rule changes, we merged with Digital Revelation, to both group's benefit. We gained their server points, and they gained our capture points.

    Besides winning CTF, the GhettoHackers / Digital Revelation team also had the highest average Blood Alcohol Level of any group (check out http://cow.pasture.com/~tcroc for more details). As announced at the awards ceremony, we, the GhettoHackers, have retired from CTF after DC9. To help foster more competiton, and for a different application of our expertise, the GhettoHackers will be helping to run CTF at DC10.

  • Defcon 9 was my first time with CTF and I must say, it's not exactly what I expected. My buddy Thalakan got recruited to Digital Revelation and he recruited me over there. 90% of the time, everyone hacked systems that were difficult to hack. All the servers on the server segment (x.x.x.250-254) had either chrooted systems, patched servers and for a day and a half, nothing happened. During that time, the most exciting thing was when Dan got social engineered (see above link). However, 2 hacks did happen. I think it was prophet on digital revelation who rooted a win2k box with the unicode exploit. Then, the most exciting hack was the obsd 2.9 local exploit. Someone from the grey team finally setup a server with local access (he gave out login/password) and the race was on to apply the exploit. By this time, we were already merged with ghetto and everyone watched in anticipation. Eugene, from the ghetto hackers worked ferverntly and a bunch of us watched in anticipation. Because of the race condtion, two teams simultaneously rooted the server at the same time and split the points.

    Since there was physical access to the box (they were located right next to the operator), I heard that people yanked network cables when they were about to be rooted.

    There were many interesting systems and different programs that ran on the network but without source, 2 days is simply not enough time to do anything substantial. I hope next year, Caesar and the Ghetto Hackers will run a better job of providing more interesting hacks. I'm hoping the judges will put up servers that arent locked down. Those roots will be for maybe 10 points. Roots in servers with no known vulnerability (with source provided) will give 100 points. Something like that would provide with more hacks than the 3-5 roots we had. Having each team provide servers that are locked down is plain stupid.

    -Nouveaux

Slashdot Top Deals

For God's sake, stop researching for a while and begin to think!

Close