Tag Archives: Infosec

NCL 2014 Team Challenges

Posted on by

Although I wont cover all of the team challenges that Kernel Panic completed during the NCL 2014 Team Post Season round, several stood out amongst the rest.

I’d also note, some of the challenges from the individual round were covered on the site of my Cyber Defense Team.

Passwords 1:

For this challenge, we were given a password hashing algorithm written in java script. I heard from some other teams, that they had successfully reverse engineered the algorithm; in order to decode the passwords. However, we had s better rate of success just running a word list through the algorithm and doing some string comparison. In the end it turned out, that the passwords were all World of Warcraft towns, and a few Google’s made a winning word list.

Recon 2:

In this challenge we were asked to find the port on a server that was actually running an HTTP 1.0 compatible server and to then to find several flags. After a very confusing start, we discovered that the server was running port spoof. This nifty piece of software, randomly generates one of roughly 400 legitimate service banners, on each of the unused ports. Several of these possible banners being Apache products. However, it turned out that the web server was running nginx, which only really has one service banner. So we were able to use nmap to request the service banner for each port and then grep through the results for nginx. We then found the correct port to be 56565, and the first 5 flags could be found from viewing the pages source.

NCLRecon2

In order to get the last flag, you would have had to guess or know from previous exercise (<- what the heck NCL), that you can just throw a /flag on the end of the site URL. You will then be served a text file with the flag information inside it.

NCLRecon2flag

Web 3:

Using the CHANGELOG.txt file of the site, we were quickly able to identify that the server was vulnerable to a string of Drupal vulnerabilities that had recently surfaced. However, due to the destructive (<- no fun NCL) nature of these SQL based exploits, we were unable to gain a strong foot hold within this box. It should be noted that towards the end of the session a metasploit module (drupal_drupageddon) was even release to exploit this vulnerability, and still very few teams were able to capture the flag.

Exploit 3:

This challenge was all about gaining access to the system and gathering flags. The exploit being the shellshock vulnerability allowing for a special string of characters to be passed into a web function that processes bash commands. In this case, the vulnerability existed in a php-cgi script called dpkglist. This allowed for a specially encoded string to be passed as the user agent of an http request, to the effected web server. This string can also be manipulated to allow for fully qualified commands to be entered and their output to be displayed, if they output only one stream. Bellow is the curl command I engineered during the challenge to run the cat command on the flag files.

curl -H “User-Agent: () { ignored; }; echo Content-Type: text/plain ; echo ; echo ; /bin/cat flag.cgi;” -k https://54.83.28.186/cgi-bin/dpkglist.cgi

 

Special thanks to the other members of my team:

Turner “Shadow_Crux” England

Wade “HelpdeskMan” Schimmoeller

Elliot “CiscoMan”  Stidd

Michael “Seleventyeleven” Contino

My Honest Advice About Information Security Education

Posted on by

Now that I am a security professional and mentor, there is one question that still haunts me to this day. It’s that simple moment when an aspiring young hacker (formal use, as in enjoys figure out how things work), looks to the future and asks for advice in furthering their education. The question is normally placed in the form of “Where should I go to school?” or “What college do you recommend”. I hesitate to answer these types of questions, because honestly my answer would be none. I find it hard to bring myself to recommend any of the schools I’ve gone to or have heard of to an InfoSec geek like myself. In fact I wish someone would have sat me down a few years ago and told me the truth about prospects for education. Instead, I got the same old sales pitches for degree’s that severe all your needs, from the big universities. So, for anyone out there who is looking for barely honest advice on the topic of information security education, I offer up my experiences in clear text for your consumption.

The first and last piece of advice I would give anyone is that you will need to do a substance amount of learning on your own time. I don’t care what college one goes to, or what program they belong to, they will not cover the material you need to know to work in the field. Most of the schools I’ve heard of do not offer any classes in information security and if they do, it’s a theory class that goes to about the level of a CompTIA Security+ certification. I think there are two main causes of these issues, based upon the colleges I’ve attended. First Is just fear, they are scared of teaching the “dark arts” to students, because of both the legality that exists and the fact that students may use their knowledge for unethical means. The second is the shear lack of student interest, accreditation, and standardization that has led to a truly sluggish development of InfoSec course work. That being said, there has been a noticeable push by several government bodies to form a basis for preparing security professionals for the future. This effort, known as Centers of Academic Excellence in Information Security, is in its infancy and still only has the backing of a few large, slow-moving institutions. So needless to say, it stands to be quite a while before we see fully developed information security degrees. In fact based on speaking with several universities, I don’t expect to see a fully accredited Information Security Bachelor’s degree from a top 10 school until around 2020.

That being said, there is a real need in the current education landscape to supplement your education, with additional work outside the class room. The good news is for us InfoSec geeks, there is a lot of free and cost effective training out there for us. The bad news is, you will have to prove you were engages in it and/or justify it to any future employer.  This learning commonly takes place online and can be video lectures like those found on Udemy.com and coursera.org. Others can be rather cost effective courses taught by security professionals online, like Georgia Weidman, Joseph McCray, and Marcus Carey. I also highly recommend going to as well InfoSec conferences as possible as well, as they are a wealth of information and networking opportunities for a future career. Many of these conferences are free of charge, the bsides events, and many others have limit student rate tickets as well. Also be sure to get involved in as many of the InfoSec competitions as possible to brush up your skills. Some may require you to be a full time student at an accredited university, but still do as many as possible. Some of the major competitions for college students are CCDC, CyberWars, and NCL.

The other huge source of knowledge is technical certifications. These certifications can be a great learning opportunity and great proof of knowledge to an employer. However, in the Information Security Industry not all companies give certifications the same weight. In fact some may require you have or acquire a certification, while others many not even give you a pat on the pack for them. In fact, many certification exams have been getting easier and more expensive over the years as demand has gone up. This devalues the certification itself, and makes the cost much higher. For this reason, I recommend not getting cert happy while in school. As a side bar, I will recommend taking all certifications for any courses that will gain you credit for passing the certification exam itself. This will save you a signification amount of money and give you something else to really shine on a resume. There is nothing wrong with doing the course work for a certification and explaining that to an employer.  They will understand and you will find that a lot of employers will pay for certifications when you are in the work force. As such I recommend doing just that, if you take a course and like it, find the certification and study the material. Simply state you completed the course work on your resume instead of the certification itself and explain the cost barrier to any prospective employer. This makes a nice conversation piece during the interview process and will help with the cost. Just do not feel the need to go out and get all the certifications, they are rather costly to maintain and may not produce the desired result.

Now I would not necessarily say there is a requirement in this industry, to go to a collegiate institution. However from personal experience I will say many large corporations will require at least a 4 year degree before they will consider you. Most of the time however, the hiring process comes down to what you have done in the past and how you present that information to a hiring manager. Never the less if you are looking for a college or need to go, here are some helpful questions to find the right place.

  1. 1.       Does the college offer a course over open source software and operating systems (linux)?

This question is where I think many colleges currently fall short. Most universities I talked to, during my search for a school, were all about teaching Windows, Cisco, and Java.  These technologies may be the most common, but they will severally limit your abilities when it comes to a career in the field. I put Linux in as an example, because if they do not even teach an introduction to Linux you are going to be really hurting. The truth of the matter is most security professionals use Linux every day and develop their tools for it as well.

  1. How many courses do you have that relate to the security, integrity, confidentiality and availability of computer networks?

This question is almost self-explanatory, it seeks to drill down and ask how many courses you will get that will be directly related to your field. This will hopefully give you some additional information about the types of course you will be taking and how they might relate to your prospects for a career.

  1. Is there a student organization on campus that focuses computing, security, InfoSec, or Cyber Defense? If so, do they engage in competitions?

It is very import to be involved with active student organizations that exist on a school’s campus. In my experience these organizations offer more of a learning experience then most classes. If a school does not have any such organization it most likely is not that school for you. If it does, try and set up a meeting with several of the members. It is just as important to make sure you will mesh with any groups that exist there. Also check and see what professional or national organizations meet on campus or nearby, these groups will offer great networking opportunities and can be a good source of knowledge as well. Most importantly, figure out if any of the organizations participate in collegiate competitions. If they don’t, check with the dean or a few professors about the policies on engaging in such events. You might find that some school will not support these academic competitions and in which case, the school is probably not a good choice.

  1. Is this school accredited or do they do research in the realm of Information security?

Once again this will really speak to the quality of any program that exists at the prospective institution. Just be sure to ensure that the school holds a current version of the accreditation that they claim they have. If, they are doing information security research ask about the projects they are working on and who is involved. If it’s a single grad student or a professor who has an interest in security and are doing some research it might not be a good reason to go. Also be sure to check that the research is current and producing useable results, there is no reason to go to an institution with bad research practices.

  1. Are there any courses that require a certification for completion or follow a certification track?

As I stated earlier in my tangent about certifications, they are a double edged sword. If the institution focuses too heavily on certifications it may not be the best choice. However, on the other hand if they encourage and support their students in acquiring certifications as opposed to requiring it, they may very well be a good choice. Be sure to ask if they school has a certification center on campus. If they do, be sure to ask which certification companies they are contacted with. Also ask if vouchers or reduced rates are available for students.

 

Once you have chosen a university or school the next step is making the most out of the experience.  Now there are several ways to maximize your learning, and I will continue to update this list with more over time, but here are my top few.

  1. Get involved with student organizations and always strive to make them that one step better.
  2. Try your best to pass your knowledge on to the other students and expect the same in return.
  3. Find the professors who encourage you to orient your assignments toward your prospective career and take as many classes with them as possible.
  4. If your professor does not allow you to orient your work or doesn’t let you do it your way (and you still fulfill the assignment criteria), do it anyway, and if issues arise go straight to the dean.
  5. Try to get local or regional security professionals to give a talk at your institution.
  6. Never forget to have fun or you will burn out.
  7. Find internship opportunities and do the work you love.

My Top Three user account design Pet Peeves

Posted on by

In this internet infused world we live in today, it’s not uncommon for user to have to remember several username and password permutations (please note order of characters does matter and thus it’s a permutation not a combination). That being said there are three aspects of the user account design process that really grind my gears.

User Responsibility

This aspect of user account design doesn’t seem to be talked about very often, but it is extremely important. Individuals need to take responsibility for the protection of their usernames and passwords. In fact most web based services clearly indicate as such in their User Level Agreement. That is to say, if someone gains access to your account by means of your username and password permutation, you are responsible for any and all damages. Users need to understand that they are already being held legally responsible for their login information and should take it upon themselves to protect it as if it were any other valuable piece of information.

Secret Username

I grew up online and have watched large web based service provides change their user account design practices over time. Although, most of these changes have greatly increased the general security of user accounts online, I’ve always wondered why changes were never made to user names. In fact usernames have remained almost constant in the online landscape for years. For some reason, early adopters of this authentication model decided that the username should be shared to represent a person online. I personally believe that it is important to have an online identity and that it’s your choice weather to divulge your physical identity alongside a virtual one. This should not require me to log into a web service with such an identity or handle. My username, that I use to log in, should not be public information. In fact I’m a firm believer that it should be treated as if it were a second password. After all, two things you known might not be 2 factors of authenticate, but it is two facts. Web based service provides need to allow users to create usernames that are just as advanced as their passwords. These usernames should not be made public and another method of virtual identity handling should be used. If nothing else, please please stop using email addresses for account login. Email addresses are used everywhere online and are widely known pieces of information and one need only go to the password recovery prompt to see if an email is indeed in use.

Password Complexity

Password complexity is a double edged sword and I hope to make a far more technical and detailed posting about it in the near future. However password complexity, in my mind, has only come about as a method to force users into take more reasonability for their passwords. In a perfect world, a password of all lower case letters or all numbers would be just as difficult to decipher as a password that uses a range of characters. That is to say, if users were truly random in their character selections, the user who chose a password of 33784091 would be just as secure as the user who choose L(k&6hlY, because the available character space did not change. However users are not random and in fact are rather predictable. So our solution is to create a list of rules that a user must follow in order to use a service. This forces a user to create a password that is hopefully harder to guess and crack, but in my experience neither case really holds true. These rules restrict the user by reducing the useable character space and realm of possible passwords. These restrictions alongside the added pressure of maintain a secure posture, all but forces users to reuse old passwords and create ones from common phrases. This undo stress adds predictability to the equation and is at the root of the username and password problem. My solution is a simple one, use the same methodology that is commonplace for usernames. When a user sets or changes a password don’t let them use a password that someone else is already using. In the background, just add what every passwords your organization has deemed weak to the already in use list, just as many already do for usernames deemed inappropriate.