spoonfork

rd, that dude (yeah that dude), has written a quick summary of this year's ctf game. check out the summary here. links to binaries and source codes are also available. note: solutions are not posted, so if you're up to the challenge (source codes are available anyway) feel free to mail the solution to rd at thc dot org.

it's rather odd, but for the past few years, only the chinese newspapers have been interested in HITBSecConf's capture the flag. i think sin chiew interviewed me a few years back, now it's nanyang. anyways, i can't read chinese, but i AM pretty sure there were some misinterpretations of what i've said about the game by the reporter. the original news item is here.

i was asked a few questions, some of which i can remember are:

what is the purpose of this game?

to tell my mom that i'm 1337. to provide a legal and fun environment for hackers and security professionals to test their skills against each other. also, to show to the public what hacking is all about. as you can see right now, most of the participants are examining the source codes to the vulnerable applications that we provide which requires skills and knowledge in finding and exploiting vulnerabilities, and not just using available tools. NOTE: "to test their skills against each other" was probably interpreted as "to show off".

how can they defend themselves?

they can deploy and IDS and IPS (intrusion detection and intrusion prevention system), firewall, and proxy to monitor incoming requests to their servers. NOTE: this question is regarding the defensive part of this game.

do you limit the tools that they can use?

nope. they can use whatever tools they want, but bear in mind since the applications are custom made, tools such as nessus have no use. the tools that they can use are debuggers (gdb) for finding vulnerabilities, and exploit framework (metasploit) to write vulnerabilities.

NOTE: i'm not sure why the reporter kept asking about tools. the tool for any job, as we all know is this.

who are the participants? which companies are they from

some of the participants are full-time security professionals and some are students. they are between 18-30 years of age, but most won't reveal which companies they're working for.

that's some of the stuff i remember.

takizo's sheep in the box (sitb) is available for download here. now, if you were at hitbsecconf2006 and used the wifi to check your emails (via pop, smtp or http!) and not
pops, smtps, imaps or https or some form of ssh-tunnelling, silly silly stupid you and thanks for all the passwords! you know who you are!

other stuff: presentation slides are here (still incomplete though)

photos are here.

caption time!




listening to: dj krush - what's behind darkness

First place: dokdo-kor (South Korea)
Second place: zone-h (Italy)
Third place: Qb1t (Singapore)

the 1st, 2nd and 3rd place won RM 3000, RM 2000, and RM 1000 respectively. both zone-h and dokdo-kor donated their prize money to the MAKNA (National Cancer Council), which was the noblest thing to do.

this year's game was several levels more challenging than last year's, and the most difficult to run and organize. the game write-up will be out "soon".

i would like to thank all the participants, the sponsors (scan associates and ascendsys), the organizers (hitb.org) and all the ctf crew members: rd, xwings, geek00l, takizo, yomuds, adly and ditesh. if i've screamed and insulted anyone throughout the set up day and game days, please accept my humble apologies. also a big thanks to the speakers that contributed codes for the ctf game - julien tinnes, philip biondi, wes brown, nish bhalla, fyodor y, and rd.

i am now, going to listen to dj krush, dj shadow, underworld, electric light orchestra, wax tailor non-stop for the next few days... adios

listening to: rjd2 - good times roll (part 2)