Challenges in Informatics: Patching, Hacking and Exploiting - Cipher3
Last updated on 06.11.10 20:24
C.I.P.H.E.R. 3: Challenges in Informatics: Programming, Hosting and ExploRing. .
Click here for the results and some statistics of the contest.
CIPHER is a Capture The Flag-style exercise in IT security for teams of students from universities. The task is to maintain a server running multiple services, while simultaneously trying to get unauthorized access to the other team's servers. Each successful penetration gains points, as well as keeping the own services up and functional during the course of the game.
The exercise is co-arranged by the Special Interest Group SIDAR (Security - Intrusion Detection and Response) of the German Informatics Society (GI) and the Security and Privacy Research Group of the RWTH Aachen. Technical organization and hosting is provided by the Security and Privacy Research Group and is coordinated by Lexi Pimenidis. CIPHER 3 co-executes with the international Conference on Detection of Intrusions and Malware & Vulnerability Assessment - DIMVA 2007 (July 12-13). On-site participation of conference attendees is possible.
DescriptionThe exercise consists of multiple teams, each hosting a server that has multiple services running, like e.g. a webserver, a mail server, or customized services. The services contain typical security vulnerabilities that allow to compromise the server to a certain extend.
The goal is to maintain the services up, functional and uncompromised for the duration of the game. Additional scores can be gained by patching the vulnerabilities of the services and exploiting the knowledge of the found weaknesses at the other team's servers.
The focus of the exercise is on application layer security.
The contest will consist of multiple teams, each hosting a server that has multiple services running, like e.g. a webserver, a mail server, or customized services. The services contain typical security vulnerabilities that allow to compromise the server to a certain extend.
We recommend to use two different host systems for routing and the vulnerable image due to robustness reasons. The router, i.e. a team's gateway, can be any kind of hardware - any machine with two network interfaces will do the job. Note that this machine should still be able to run at least one instance of openvpn. The host machine carrying the vulnerable image should have at least 1GHz and 512MB of RAM, more is preferred, and at least 1GB of RAM is recommended. If the VMWare image will run on the gateway, the box should have at least 1.5GHz and 1GB RAM minimum. In addition to these two machines every player will need a terminal to access the services of their own server and the other teams' servers. Whatever the students can work with, will suffice here.
For local participation only (at the conference): there's internet access with enough bandwidth, tables and seats. You'll have to bring with you: a LAN-switch, network cables, power cords, multipliers, and computers as described above.
The vulnerable image will be for x86-architecture with 32bit.
As in CIPHER2 we will add an additional server to the game which will serve the same services as the other servers. In contrast to the team servers, this one will not be maintained by players but serve as a mere target without an defending team.More details can be found here.
Differences to previous CTF Contests
This section contains some ideas that will likely differ from previous contests.
Third party access: For testing purposes, we will allow a limited and registered set of interested individuals take part
in the contest as third parties. These will not get scored, neither will they host images, but only
be allowed access to the VPN in order to attack the hosts.
Prizes:We're trying to organize a set of prizes for the winning teams. If you're a player, please send us suggestions for prizes, if you're a sponsor, send us cool gadgets ;)
The scoring system will get much simpler this time. Currently we're thinking along these lines:
Acknowledgements & GreetingsTo Giovanni Vigna, Ulrich Flegel, Spida, Chrissi, and a lot of others. (Mail me, if I forgot to put your name in here).