Overview

The game attempts to test a security administrator’s ability to secure a complex system with unknown but required functionality. While this task seems rather odd, this is similar to a day job as a security consultant: a customer has a large dot.com site, they don t know what it does (the IT staff have all left), and they want it to be secure. And don’t turn it off, there is live traffic running on it. The HITBSecConf CtF game models this situation as follows:

· Players are provided with a table, one 5-point power outlet, and one Ethernet connection.

· Players get a class-C network address space, and all traffic coming to the player s connection is reverse-NAT’d so that the source of traffic cannot be identified. This eliminates the obvious defence of filtering all traffic from other teams using a simple firewall.

· Players are handed a reference system at the beginning of the game. The reference system is guaranteed to provide all the Services required by the Score Server. The Flags which the Score Server is looking for have already been implanted in each team’s reference system. This becomes the Home Flag of the team.

· The actual Services required by the Score Server are secret, and subject to change throughout game play.

· The reference system is riddled with security vulnerabilities, and may possibly include vulnerable Services, such as telnet and FTP.

· To score a home point, a team’s server must fully satisfy the Score Server’s requested interactions, and the team’s Flag must be intact on their server.

· To score an own3d point, the Score Server must be fully satisfied with the Services on other team’s server, the attacking team’s Flag must be present on other team s server, and the attacking team’s server must also be fully functional. This is to prevent a team from deploying only attackers, and not bothering to defend.

· To discourage DoS attacks and lazy bulk scanning, each team is charged a penalty for bandwidth coming from their connection. This penalty may include temporary disconnection from the network and thus the loss of home points as the Score Server will not be able to score the team.

Having to both simultaneously defend the home position and at the same time to plant your Flag in an opponent’s server to score 0wn3d points makes the game much more challenging and even handed. In addition to making the game more interesting, the format of the game tries to mirror situations as it would happen in the real world.

Apart from the security expertise needed, some measure of intuition and creative investigation would be required to guess the Services and Flags the Score Server is looking for. Having an attack-only strategy would thus not be beneficial as the points lost in not being able to fulfil the Score Servers request would be difficult to regain.

Attack and Defend

This Capture the Flag will be the sixth CtF game to be held in Malaysia, after the hugely successful games held during HITB Security Conference in 2002, 2003, 2004, 2005 and INFOSEC 2003. This year, we’re continuing the highly successful format we deployed last year - whereby each participating team will be given a server to defend, and at the same time launch penetrative attacks against the other teams. As such, participants must know how to attack and plant Flags on opponent.s servers in order to score points, and at the same time, know how to defend their own box from being compromised and losing points.

While all this is happening, the CtF Score Server will be keeping track of Services and Flags running on each team’s chosen server, so teams can’t totally close all Services on the box either. If the Score Server does not detect a Service/Flag on the chosen server, it will deduct points for the team concerned. Teams will not know which Services/Flags the Score Server is looking for, and will have to infer this from the game play. This setup duplicates a common computing infrastructure environment in the enterprise.

The Reference Distribution

Sounds easy? Think again. Prior to the game, teams will be given a reference distribution server that has been preinstalled. A number of Services will be running on the server with Flags implanted in some of them. These Flags are known as the Home Flags. Do note though that the Services may or may not be vulnerable. Some of the Services may or may not be needed to run at all.

The Score Server that will attempt to establish connections to the Services and ensure they are running and at the same time check for the presence of the Flags. Points will be given if the Service is up, or deducted if the Service is down or a Flag can’t be found. The catch is, teams will not know which Services the Score Server will check before hand. Thus, they must be able to differentiate between legitimate Score Server connections and attacks from opponents during the competition itself. Teams however are allowed to patch any Services which are vulnerable, keeping in place any Flags that the Score Server may be looking for.

The Reference Distributions and Services chosen for each operating system will be announced 1st September 2006

Rules

· NO flooding of network. A 30 minutes NO GAME penalty and points deductions will be given to teams that who are found to be flooding the network.

· NO Denial of Service (DoS) attack. A 30 minutes NO GAME penalty and points deductions will be given to teams that are found to be launching DoS attacks

· All teams must obey PIT STOP calls. PIT STOP calls are rest intervals where all teams must leave the game area to facilitate for the CtF judges to update the score, and/or do maintenance work etc.

· NO harassment of other opponents (verbal abuse, etc).

· NO physical attack.

· NO attacking of Score Servers. Teams that attack Score Servers will be given points deductions.

Game Play
The Game

1. Teams are allocated their own network block.
2. They must defend one host (the reference server) and keep it running.
3. Teams attack each other.
4. Teams will attempt to plant their Home Flag on their opposing team’s servers to replace the opponent’s Flag.
5. Teams with the highest accumulated points at the end of the game wins.

Scoring

1. +10 points for each successful Flag/Service request from Score Server.
2. +20 points for each successful Flag planted on opponent server.
3. -10 points for each failed Flag/Service request from Score Server.
4. -20 points if server is compromised and opponent’s Flags is detected.
5. -100 points for DoS attack.
6. Score server polls are randomized at a regular interval.

NOTE: Keeping Services up and running is vital to get more points. Team scores are updated after every Service poll. This will give the teams hints as to what/which Services the Score Server will be polling for.

Reference Distribution

1. Teams will be given reference CDs upon request that will contain the Operating System.

2. They can choose to upgrade port or replace the Services; however Teams must note that the Score Server may look for specific Flags hidden inside some Services. Any upgrade/port/replacements of these services must include the Flags or the Team will start to lose points very quickly.

3. Team servers will be installed with Ubuntu 6.06

4. The Reference Distribution OSes will be as per the last official release of the operating system by the vendor or OSS project. The Reference Distributions will not be patched, bugfixed or altered in any way from the stock sources as released on the date of the official release.

5. Teams are responsible for bringing their own patches, vulnerability fixes, bugfixes and other tools necessary to patch up the system.

6. Teams must indicate the choice of OS upon registration.

7. Teams ARE NOT ALLOWED to run their servers off CDs. This is absolutely prohibited. Teams that are found to do this will be eliminated from the game.

8. Teams ARE NOT ALLOWED to run their servers off honey pots. This is absolutely prohibited. Teams that are found to do this will be eliminated from the game.

9. External/Third Party Firewalls ARE ABSOLUTELY outlawed. However, teams may set up any OS based firewalls (e.g. IPTables, IPChains, IPFW, IPFilter) on the server itself.

10.Teams ARE NOT ALLOWED to bring extra servers.

11. If the Teams have to reinstall their server OS, the Reference Distribution MUST be used. The Organizing Team will NOT inform the Team what Services are needed to be run or are being counted by the Score Server. The Organizing Team will NOT provide the Flags for the Team for reinstallation.

12. Any action which causes the Score Server to dislike the Team’s Services and Flags are solely the fault of the team and the Team will lose points for this.

Hints

· Plan, plan, plan.
· Be organized. 1 team principal. 1 firewall/IDS expert. 1 l33t sysadmin. 1 l33t hacker. 1 code junky would be a good line up.
· Learn, learn, learn. Learn what the Score Server wants, and please it.
· Learn how to attack the reference distributions.
· Learn the importance of taking backups, in order to restore yourself to a known state in the unlikely event that your server has been r00ted or 0wn3d.

Final Judgement

· At all times, the decision of the CtF Organizing Team is final on any matter in question.
· Team Leader’s should feel free to work with the CtF Organizing Team to resolve any disputes that may arise.

Prizes

This year’s cash prizes are sponsored by Scan Associates Sdn. Bhd. while the CTF competition itself is sponsored by Ascendsys.

1st Place - RM3000 CASH
2nd Place - RM2000 CASH
3rd Place - RM1000 CASH

Acknowledgements

The HITBSecConf organizing committe would like to give shoutouts, ninja greetz and ghetto loves to The Ghetto Hackers, who came out with the attack and defense concept for the CtF game. Much love also to the current organizers of Defcon’s CTF, kenshoto!

REGISTER NOW! SEND YOUR TEAM DETAILS TO CTFINFO@HACKINTHEBOX.ORG