Linux Top Gun Hacker Contest Report 179
We heard about this from a slashdot article ("Computer Attack and Defense As Spectator Sport").
Tough Audience
The event was held at the Alamo Drafthouse, a movie house with tables and a wireless network. The theatre was packed, and there was a waiting line going out the door. I talked to an admin who had driven in from Brownsville (South Texas) for this event, so obviously there was a lot of interest, although we didnt know what to expect. Many attendees, maybe 10%, had computers with them.The event was supposed to start at 7 p.m., but because of technical difficulties, it didnt start until 9 p.m. In the outer lobby were vendors selling metal bras and edgy political/sex books. Very Austinesque.
The Event Itself
When the Top Gun event itself started, it went like this: there are a few registered teams; each team is given the 'target' box, and has ten minutes to secure it. After that, everyone in the room has thirty minutes to try to hack into the box. A few services had to be enabled -- http, https, ssh, smtp, and ftp. The defenders start with 100 points, and points are deducted if any of the services seemed unavailable, or if judges determined the box was compromised. DoS attacks are not allowed.Already the idea sounded weak. On the big screen, they were running a homebrew GUI app that showed the score, time, IP addresses, and the services on the target. The services were being polled by a monitoring machine, and the response time was displayed. If the response time increased, i.e. the service was laggy, then points were automatically deducted from the defender's score. Laggy web server performance? That's a strange definition of 'hacked', but it is (or should have been) easy to monitor, which is probably why they did it.
Part of the draw to this event was that they were going to use "video animation" to "show how network attacks happen." I didn't have my hopes up for this, but I was still disapointed. They used their (Linux-based) homebrew GUI, which looked like it just used some libraries from etherape to draw lines from ips to the services on the target they attach to. That was it for the visualizations. The list of services was supposed to turn from green to red when they went slow, but for most of the night they stayed red and displayed just zeros, no readings. Their software appeared very buggy, hardly ever working, and windows in the background showed them fixing it as they went.
The commentary was sparse and uninformative. "Yes, that line shows connections to http, and it is taking a beating!" There was no discussion of exploits, security, concepts, attacks, what is currently happening, etc. After the attack session ended, the defenders were brought up for a brief Q&A, which reminded me of a post-fight boxing interview. "Uh, yeah, we felt good, we had a plan. A lot of things happened, and we applied patches."
Before, during, and after the attack session, no one knew what was happening. It seems that despite hours of trying by different teams, the target box was NEVER compromised. During the second Q&A session I stood up and asked, "Was the box hacked in any way whatsoever?" The reply? "Probably." But no one knew. If it had been hacked, I believe the person doing it would have said something, or at least bragged on the irc channel for the contest.
The entire operation seemed very amateurish. Technical difficulties occured during the event, giving one team a higher score becuase the monitoring software wasnt working to remove points. Most attendees left early, and a highlight of the evening was when someone posted ascii porn to the irc channel.
On the upside, the DJ had a good stream of music, there were more women than you'd expect, and some in small metal bras. And it was a gathering of a lot of smart geeks, a great opp to meet people.
Room for improvement.
The longest topic of conversation in the audience was how to fix this mess. We came up with some ideas:
Visuals
They should have used proven, off-the-shelf network visualization and monitoring tools for the event. We were _dying_ for some snort output, to see what exploits were being attempted. A tool like Demarc would have been perfect to show the events as they happened. Or at least snortsnarf or acid. The screen should have rotated between different monitoring tools to give an idea of what was happening.
Contest Format
The format of the event was flawed. The truth is most hackers take advantage of easy targets. Defending a box is not that hard. Simply applying the latest patches and configuring a basic iptables firewall about does it. After those steps are taken by the defending team, only truely leet hax0rs with 0day exploits are going to get root in thirty minutes.
A better format would be this: Bring an unpatched or lightly patched Linux server for everyone to attack. As soon as someone gets in, stop the show. The hacker gets a prize, and has to explain/show what they did. Then that vulnerability is patched, and the contest starts up again.
All in all, the event was a let down. Austin is a cool town, and lots of smart geeks came out. There is obviously interest in an event like this, but the execution didn't result in any entertainment or learning. If this is a PR event to generate publicity for the sponsors, I think it failed, because if this is an example of their organizational and technical skills, I would not hire them myself. But then, they're probably better at security than they are at public events.
Slashdot welcomes reader-submitted features; thanks to marc for this one.
Dead Link? (Score:1, Funny)
Re:Dead Link? (Score:1)
Somehow I find the idea of showing the video" of http connections right now strangely enticing.
Re:Dead Link? (Score:1)
Overall impression? (Score:5, Funny)
Re:Overall impression? (Score:1)
Re:Overall impression? (Score:2)
Its Funny! Laugh;-)
a resounding success then? (Score:2, Funny)
I can't help but wonder though. Are the metal bras protection against the aliens beaming messages to their "assets"?
KFG
Re:Overall impression? (Score:3, Funny)
Willie Nelson: "Man, I remember when a dime bag cost a dime. You know what I mean? You know how much condoms used to cost back in them days?"
Thurgood: "How much?"
Willie Nelson: "I don't know. We never used them."
Re:Overall impression? (Score:2)
I was there, and I'd call it a failure. The music wasn't very good, it was way too loud, and the metal bras didn't have to be big to cover the models. I left about 8:50 PM in disgust. Overall, it sounds like I made a good decision.
The whole thing was a good idea, just poorly implemented. From the discussion of the people there, this was apparently a second attempt at this sort of thing. I heard that 2 weeks after the first attempt, they still didn't figure out who won.
lol (Score:1, Funny)
"Everyone join #ltg on efnet for some Paco bashing, and to witness Dick Hunter in full rantitude.
What are you expecting?!
Hacking (Score:5, Insightful)
After the excitement of all of those hacker movies and TV shows, I'm suprised at this result.
Re:Hacking (Score:3, Funny)
Just remember, you look at the screen intently, type really fast for 20 seconds or so, then shout "I'm in!"
Or try the Russian variation: type really fast with one hand while clicking a ballpoint pen with the other, just so James Bond can give you an exploding pen later in the movie.
You're forgetting the ironic exclamation: (Score:2)
Best shouted just before being doused in liquid nitrogen.
Re:Hacking (Score:1)
Don't forget standing up, after the big shoot-out/movie climax, shouting "I am invincible!" just before having hundreds of gallons of LN2 poured over you.
Kent
Re:Hacking (Score:5, Funny)
Male Voice: "Iron Hacker Ginsburg is opening another xterm. I wonder what's going on?"
Female Voice: "Is that kshell?"
Male Voice: "Hrm. Well, I don't know...."
Male Voice (from floor): "Sysop!"
Male Voice: "Yes?"
Male Voice (from floor): "Ginsburg is indeed opening another xterm, and it's not kshell, it's a special shell he's written himself. When I asked about it, he told me it has a custom completion tool and command substitution algorithm."
Female Voice: "Oooh.."
Male Voice: "Very unusual. Let's see what challenger Fordham has up his sleeve...."
Re:Hacking (Score:2)
"Nice use of folding-chair!"
Re:Hacking (Score:2)
Like the movie Hackers, or Swordfish... (Score:5, Insightful)
Re:Like the movie Hackers, or Swordfish... (Score:3, Insightful)
But Defcon is slipping. This year they did some wardriving stuff and a friend of mine had his antenna snapped off of his truck. Fuckers.
Re:Like the movie Hackers, or Swordfish... (Score:2)
There's enough wankers (literally *and* metaphorically)in the world already.
hey (Score:5, Funny)
pics plz
Re:hey (Score:2, Informative)
Call that secure? (Score:1)
Re:Call that secure? (Score:1)
Re:hey (Score:1)
Kent
Re:hey (Score:5, Funny)
Re:hey (Score:2)
Re:hey (Score:2)
Re:hey (Score:2)
Uh HUH (Score:2, Funny)
You say that as if the highlight of ANY geekfest ISNT pr0n???? Just where are your priorities man!!
Austin humour (Score:5, Funny)
One of the women was probably Leslie.
Re:Austin humour (Score:1, Funny)
Re:Austin humour (Score:2, Informative)
Okay, for those who don't know who Leslie is or what makes this comment hilarious as all get out, I'll try to explain.
Leslie is a real person, a very well known of person. Washington, DC has Bush, Austin has Leslie.
Leslie is a crossdresser, often seen on 6th street on a friday night banging a bucket in a non-rythmetic way and other popular venues. Which the parent poster is stating here.
There was a mayoral race a while ago, I've been told, that Leslie got his name on the ballot to be voted in, as a joke, I presume. I don't know how well he did, though.
Re:Austin humour (Score:2)
Leslie is the dude that rides a bicycle that pulls a cardboard and metal contraption he calls a home. He does indeed cross-dress, usually in a bikini top and thong. Just another example that in Austin, there is always someone weirder than you.
Re:Austin humour (Score:2, Funny)
Re:Austin humour (Score:2)
Re:Austin humour (Score:2)
Yeah, but how much do you want to bet that many of the, uh, affection starved attendees still hit on him/her/it anyway
Re:Austin humour (Score:1, Funny)
Re:Austin humour (Score:3, Interesting)
Re:Austin humour (Score:2)
and the real hackers... (Score:5, Insightful)
Personally, the idea of a hacking competition is interesting, but it would have to be done over a long period of time, and set up more like a war game than a boxing match.
Skr1p7 k1dd13s treat hacking as a boxing match. Real hackers are far more efficient and skilled at it.
An idea for a real hacking competition (Almost like capture the flag): Two sides to the fight, different locations for both. One side will have multiple targets, the other side will have multiple attackers.
The goal of the attackers will be to get specific files from the targets, using any technique desired. (Including Social Engineering) The goal of the defenders will be to catch/name/etc the attackers, and thus completely neutralize them.
Do this over a course of a month or a year, and make a TV show with the highlights of battle. Now that would be excellent viewing.
** NOTE: the term hacker above can also be translated as cracker for those who are offended by this use of the term hacker, thank you **
Re:and the real hackers... (Score:2)
Re:and the real hackers... (Score:2)
Re:and the real hackers... (Score:2)
How does everyone know what "real" hackers do? (Score:1)
I assume that all of the people that posted something about "what real hackers do" must be the real thing. How else would they have insight into such an elite and presitgious field of uber-nerd malevolence?
Re:and the real crackers... (Score:1)
I was telling that to some homey's on the South side last night about 2AM. They was strutting in there NFL jackets/NBA shorts with gold chains and giant medallion and a stocking caps. The was like like "This muthuh fnck1n cracker iz just aksin for a cap in his muthuhfnck1n a55!"
I replied, "Sir, I appreciate that. Most people call me Hacker. And I much prefer Cracker."
What swell fella's.
(writing in from hospital)
You're on to something here, but. . . . (Score:2)
Each side would have three boxes with "hot" files on them. The goal of the game is to capture as many of your opponents hot files as you can while protecting your own. You get points for every file captured and, obviously, also loose points for every breach of your own security, even if some of those breaches don't result in the loss of a hot file. Points would also be given for every attacker "captured."
Thus each side would have two squads. There would be the security team protecting the files, as well as a "tiger team" trying to gain access to the opposing teams systems.
In fact, rather than calling it a "hacker's contest" I'd call it a Tiger Team contest.
If nothing else it makes geeks sound more "macho."
KFG
Re:and the real hackers... (Score:3, Interesting)
(Naturally, this was several years ago. Any high schoolers caught doing something like this today would probably be locked up.)
Re:and the real hackers... (Score:2)
I must have been blown up by a half dozen "car bombs" my senior year in high school. Of course, this was 1992, I'm sure that in today's political climate, this game would be viewed as extremely dangerous.
Re:and the real hackers... (Score:2)
The most popular method was to simply walk into a class your victim had and shoot him with a dart gun. But I bet if you tried that today you'd be expelled and given a court order to see a psychiatrist.
Max
Re:and the real hackers... (Score:2, Funny)
Sleeveless t-shirt under your other clothes marked 'bulletproof vest'. "Hey, I shot you!" "No, you didn't." *BANG*
Cardboard box inserted in someone's locker, with label 'thermonuclear device'.
Master the possibilities.
This sounds like ... (Score:3, Insightful)
Speaking of which, did anyone get tired of the poorly thoughout contest and break into a game of Quake, Counter Strike, or War Craft III???
Honestly, this event sounded like it had potential, but the organizers just didn't plan things well enough
Re:This sounds like ... (Score:1)
Re:This sounds like ... (Score:1)
Re:This sounds like ... (Score:1)
Or, perhaps, the PREVIEW button?
Cracking is boring (Score:1)
But, the format they used, while it has some problems, might be useful. I think a show-off night would be more fun. Everyone brings their laptops with their code on it, and they take turns showing off what they've done to the group on the big screen. While I wouldn't want to try this with a full theater, it'd be fun with 30-40 people.
Or what about... (Score:2, Funny)
Maybe even a contest to make the smallest distro right from downloading the latest mandrake linux to booting up on a 486DX66 with 32MB ram. Should be a fascinating spectator sport.
The contest (Score:5, Informative)
Although #2 required you to run a specific application on the webserver.. this one you could put anything you want.. (aka a static page with hello world).
But all and all it was good.
I came in #1 for the 2nd contest.
Team 2600 came in 1st this time
(We, team penguinati, came in second this time).
but oh well.
It was fun.... the best thing is the food and beer...
ChiefArcher
Re:The contest (Score:2)
My geeek card (Score:1, Insightful)
Seriously. I am not worthy of the title, because there is no way in hell you could ever drag me to one of these events.
It turned out to be pretty boring?
Gee, I wonder why.
Hacking IMO isn't a spectator sport.
Kinda like eating oatmeal isn't a spectator sport.
Uh oh, here come the flamebait mods.
Hey, it's my opinion folks. Don't like it? Reply with why. But you know I may just be the first to say it, but I'd be willing to bet many here are thinking the same thing.
Re:My geeek card (Score:1, Funny)
It's like the golf channel, only with geeks instead of Republicans.
It's like the NASCAR channel, only with geeks instead of trailer-trash.
It's like the gardening channel, only with geeks instead of Aunt Lulu.
One man's boredom is another man's thrill.
Pics? (Score:4, Informative)
Yah... People asked... I found... it seems...
my sugestion (Score:1)
"there were more women than you'd expect" (Score:5, Funny)
Re:"there were more women than you'd expect" (Score:5, Funny)
Mom
Re:"there were more women than you'd expect" (Score:3, Funny)
Yeah, right, as if ANYONE in that building would ask...
Local information (Score:5, Informative)
Since this is in the Austin area, I recommend checking out the Austin area slash based GeekAustin [geekaustin.com]. They had a head's up on this event a while ago [geekaustin.org]. I haven't seen a followup yet.
Hacked Comp? (Score:3, Interesting)
Any hacker worth the time wouldn't shuffle off to an ACM-esque programming comp. Just doesn't seem to be what's cool to me. I'm much more inclined to believe the monitoring box was hacked to flop-like-a-fish all night.
As far as hacking, why not run a box per team local to the gathering all night. They all have the same holes, and the team that can exploit it best wins.
For the majority of my time though, I'd prefer to simply watch presentations about known hacks and documented exploits. Esp. given the mystery about the GOBBLE and such latests dealing with P2P.
mug
yup, I was there and you're right (Score:3, Informative)
Ineffable (Score:3, Funny)
All elements meant to distract you from the fact that there is nothing going on in the room and you wasted gas and money driving there.
I'm heading off to a dog show now...
More than the format... (Score:5, Insightful)
Truth is, hacking in general is not rocket science. Anyone can do it. Securing a box is not hard, however the reason so many machines get hacked is ignorance and/or apathy to the situation. Hell, the hardest part about hacking is finding a box with holes to exploit. If you already know the box has holes, you can run a script to find them. I went to the first Linux top gun and it was a total washout as well. This one sounds a bit more organized (at the first one, half the attendees were bums there for pizza) but the entire idea of this contest just sounds stupid. Anyone can be a l33t h4x0r, it takes intelligence not to want to.
TOP GUN PHOTOS!!! (Score:5, Informative)
Re:TOP GUN PHOTOS!!! (Score:1)
Re:TOP GUN PHOTOS!!! (Score:4, Funny)
New /. vote (Score:2)
Chicks in metal bras are:
Re:Let's compare - post your pic (with metal on). (Score:2)
2)It's unlikely that the slashdot community at large would turn down any girl, ugly or not.
3) Cowboy Neal.
Re:TOP GUN PHOTOS!!! (Score:2)
Metal bra (Score:2)
Team Penguinati (Score:5, Interesting)
http://www.penguinati.com [penguinati.com]
we did an "odd todd" ripoff to present our information.
ChiefArcher
Hacker==Cracker? (Score:3, Insightful)
Hacker = Cracker
and good linux programmers are just good linux programmers.
It's sad that mass media has finally triumped over the geeks.
Small metal bras (Score:2)
On the upside, the DJ had a good stream of music, there were more women than you'd expect, and some in small metal bras.
Come now, don't disappoint the Slashdot community. Where did you post the pictures?
Latency and DoS attacks (Score:2, Interesting)
It seems to be that the most legitimate measurement that response times provide in a hacking contest is how effective a DoS attack is.
Past that, all the majority of that result comes from how much traffic you have. Last time I checked, this was a hacking contest, not a web server benchmark.
Geeks and meeting planning (Score:2, Insightful)
Expecting geeks to know what is entertaining in a group format is asking a little much. Also, the more intellegent the audience, the harder it is to satisfy them.
Some real thought needs to be put into the venue. Conduct some tests and trials for christ sakes. That would have exposed the weaknesses of the format.
small metal bras? (Score:3, Funny)
Isn't ESR the top Gun-Hacker around here? (Score:1)
Only visual? (Score:1)
Idea for next year... (Score:2)
Top Gun, eh? (Score:2)
How do you improve the event? (Score:5, Funny)
Create a points system based on method of entry and create a rating system (open, hardened, impossible, etc.) for targets. Scores are created by combining the various entry levels with the various target ratings. Targets could be selected by the audiencs, the teams or the event coordinators. Targets could be published before hand or not.
Granted this would be shut down so fast. All involved would be sent to Guantanamo Bay for being terrorists but it would be _really_ fun to watch. I also think that it could be done without causing real damage and in fact would _increase_ security. It would still be shut down though.
Re:How do you improve the event? (Score:2)
And live ammunition.
AP rounds, HE rounds, Incindiaries, and Fuel Air Explosives.
Expecially Fuel Air Explosives, those are SOOO awesome!
-
The event was so bad.. (Score:2, Funny)
Amazing (Score:2)
Real World TV series of hackers (Score:2)
Re:I don't condone these types of events (Score:2, Informative)
Re:I don't condone these types of events (Score:1, Troll)
Re:I don't condone these types of events (Score:2)
this isn't crime any more than a gun show is inciting terrorism, or flying on airplanes is inciting terrorism. it would be really nice if this society could get off this whole terrorism soap box, but i guess GWB will ensure that doesn't happen for a few years.
attempting to crack a box is entertainment for lots of people. some like to spend their saturday afternoon watching the nfl playoffs, some like to try to crack into another's server. it's not like they don't have permission to the box or anything.
trolling, trolling, trolling..
Re:Neither do I, for different reasons (Score:4, Insightful)
As far as terrorism goes... please! There's nothing illegal or "black hat" about breaking into a box you've been told to break into. What better way to find bugs or flaws, so that you can then close them? I'd be a lot more worried about gun shows before I worried about hacker conventions cause last I checked, the gun to computer related death factor was still INFINITE.
The more people banned (or are bullied) into stopping completely legal and (possibly) worthwhile activities, the more I'll seriously consider moving to Canada... or running for office. Neither of which I'd really enjoy, BTW.
Re:Neither do I, for different reasons (Score:2, Funny)
Explain to me the connection (Score:1)
Re:yeah but (Score:1)