Tag Archives: MACCDC

CCDC

What is actually learned from CCDC

April 8, 2016 Tony E 1 Comment

A great questions was asked from a Red Teamer on twitter: What is actually learned from CCDC?
(https://twitter.com/carnal0wnage/status/718204762290843648)

I don’t think I could fit an answer into 140 characters so, I took to a blog for a proper response.

If your asking what is actually learned from the red team hacking a bunch of blue teamers…. NOTHING. We know you can do it. You know you can do it.

What we do learn are the things we taught ourselves in preparation for the competition. We don’t directly learn any of the objectives outlined in the CCDC Team Packets. (Did anyone even read them?)

For MACCDC the objectives are outlined as:

Build a meaningful mechanism by which institutions of higher education may evaluate their programs
Provide an educational venue in which students are able to apply the theory and skills they have learned in their course work
Foster a spirit of teamwork, ethical behavior, and effective communication both within and across teams
Open a dialog and increase awareness among participating institutions and students

Lets break this down 1 item at a time.

Build a meaningful mechanism by which institutions of higher education may evaluate their programs

Institutions of higher education cannot use CCDC to evaluate their programs. College’s often have guidelines and requirements to stick to course material as provided by their vendors. Sure, some teachers/professors stray from that a little. They do not use CCDC as a gauge to see how well their material is being taught. How well a team performs in CCDC is not a directly correlation to how well those students performs in class thus, it cannot be used for higher education to evaluate their programs.

In fact I’d be interested to find-out how many colleges request pcaps and the scoring metrics to see how their school did and if there is anything that could improve in their programs for next year. They probably don’t and secondly MACCDC probably couldn’t deliver those items.

Provide an educational venue in which students are able to apply the theory and skills they have learned in their course work

I think this statement should be changed from ‘educational venue’ to ‘venue’.

Every experience in life is a learning experience. Everywhere we go and everything we do is learning experience. We don’t call all the places we go ‘educational [place]’. In order for something to be called an “educational [place]” its primary function should be for educating. CCDC is not for educating and should NOT be labelled an ‘educational venue’ instead just ‘venue’.

Now with that statement changed to “Provide a[n] ~~educational~~ venue in which students are able to apply the theory and skills they have learned in their course work”, I can agree with part of it. I can agree with “Provide a venue in which students are able to apply theory and skills they have learned”, that’s it. Believe me, in your ‘course work’ you aren’t studying BigBlueButton, PBX, Cyclos, Request Tracker or JessX. None of these are in any course work I have seen come from any college. Leave me a comment below if you have worked on these boxes as part of your regular studies.

Foster a spirit of teamwork, ethical behavior, and effective communication both within and across teams

This is a mixed message with taken into context with the rules of the game. On page 7 of 2016 Team Packet Final it states:

e. Team members are forbidden from entering or attempting to enter another team’s competition workspace or room during CCDC events

I’m sure this will be twisted into saying ‘this doesn’t mean blue team to blue team, it means blue team to red team and vice-versa’. I’ve had CCDC officials twist things like this.

I can say from personal experience we have been instructed not to talk to other blue teams. We couldn’t talk to other blue teams even when trying to troubleshoot an issue where we needed to test connectivity from outside of our own site.

I wasn’t able to attend the Red Team-Blue Team mixer this year but I bet that was the most valuable part.

I wish the ‘teamwork’ extended to inter-team communication not just intra-team communication.

Open a dialog and increase awareness among participating institutions and students

I don’t even know what this means. “Increase awareness” about what? CCDC? Cyber Security?

Just the facts Ma’ma.

Through my CCDC experiences I learned a handful of technical skills that are still with me that I use everyday. Simple Linux administrative tasks, ASA and pfSense administration. The differences between stateful and stateless protocols and how they both work with iptables, Cisco ACL’s & MPF, and pfSense rules.

Being a team leader I learned how to give lectures and create powerpoint presentations and spin up VMs for live demos.

In-order to give a proper and well informed presentation about something you are forced to learn more about it than you ever thought you needed to know. I think a great training exercise for CCDC is to have every student create a presentation about something so they are forced to learn everything about it.

Everything I learned for CCDC is something I taught myself and its those things that stayed with me for life.

As for what I’ve gained from my CCDC experiences. I have gained something no class can teach… friends. I came into the CCDC club for my school and met a bunch of strangers. We made it through qualifiers and into regionals as acquaintances and classmates. We left regionals as friends. Some of those friends I still talk to even though we haven’t see each other in a few years.

In Conclusion

Even though CCDC is flawed(probably throughout the nation) it still offers a place where like minded individuals get together to teach each other and try to reach a higher understanding of the aspects of cyber security that interest them and then ultimately exercise those skills in a place with your friends. This competition is only as fun as you make it. I remember most of our systems had NyanCat across our screen. There was nothing left to do other than the Macerena, so we did. I remember having to leave the pit together for an inject and running through the mezzanine with our arms out like a bunch of airplanes. We always sent the Red Team fun gifts that we contributed to as a team.

If any one wants to share what they’ve learned or has an opinion on what is actually learned from CCDC competitions leave a comment below.

Blog, MACCDC2015, Qualifiers

MACCDC: Qualifiers – How to prepare

June 3, 2015 Tony E Leave a comment

The regional CCDC qualifying round for the Mid-Atlantic region is dubbed ‘Virtual Qualifiers’, because it is held on virtual servers in Amazon’s EC2 cloud infrastructure.

In order to properly prepare for such an even its best to know a little bit about it. The best source for information is from people who have participated in years past. The second best source is of-course, this site. Familiarize yourself with the historical data I have gathered from the past competitions.

Registration & Scoring:

Registration and scoring is done through threatspace: https://sb2.threatspace.net

Don’t let the day of competition be the first day you’ve looked at threatspace. Make yourself as familiar with it as you can, it will help you to feel comfortable and confident, and can shave time off from trying to figure out their site during the competition.

Scoring is done by something we call ‘scorebot’. It is the name we have given the scoring engine for the MACCDC region because it often uses the username ‘scorebot’ to log into systems. It is an automated system that checks for services that are up. ‘Scorebot’ reports this and displays it in pretty graphs and colors on threatspace’s website. You can change ‘scorebot’s password and I recommend doing so as it is often set to “chiapet1” and has been for years. [A future post might discuss the necessity for open sourcing the scorebot]

How many systems and which:

Typically you are given 4 systems, 2 windows & 2 *nix. Again, check the resources I have provided, this will help you figure out which systems they like to bring back year after year.

Team Structure:

This has been gone over before in other posts from other sites and I’m sure each school or region will have their own twist on it but, make sure you have the best man/woman for the job. Some members on your team will be good at everything and some will have only a specialty or two. Make sure you put the best person on the keys that needs to be there. In qualifiers there is only 4 systems but there are 8 team members. Naturally we split up into teams of 2 for each system. One person on the keys and the other person as researcher. Unlike MACCDC regionals, you have full-blown internet access, there is no air-gap. The person in the ‘researcher’ role is there to look things up and provide support to the person on the keys. They should not be looking up things like “how to turn on your firewall” or “adding a user in AD” those are things you should already know how to do. Instead they would be most useful looking up how to administer or harden the web-app and back-end for the software that you’ve never seen before.

What to prepare for:

Don’t stand up 12 VMs and base your practice environment off of one of the topologies from the regional competition, until you get there.

Don’t spend your whole time practicing for regionals if you haven’t gotten past qualifiers. Remember you must get past qualifiers first. With that said, you will need to rehearse for regionals in-addition to qualifiers.

How to prepare:

Since qualifiers are held in Amazon’s EC2 cloud infrastructure, so should your practice environment for qualifiers. Go, sign up for the cloud service and stand up 4 VM’s. They have pre-made images for the systems that you will likely see. A couple hundred dollars worth of Amazon credits should get you enough for your team to get plenty of practice. If your school has a cyber security club maybe you can approach them about the possibility of funding such a thing. If not have each person put in $20. It’s not a huge investment and it will get you started.

Schedule:

The MACCDC qualifer is only 4 hours long. Time is of the essence. There is something like 32 schools in the MACCDC region. Generally qualifiers are held ~8 teams per day over 4 days. As a school you have the option of choosing which day you would like to compete on. You don’t always get the day you choose. Some theories range from:

Choosing day 1 means this will be a new environment to red team so they won’t be familiar with it, but this means if there is anything wrong with the infrastructure you will be the test dummies to figure it out.
Choosing a later day means the infrastructure should be fully tested but the red team will already know all the in’s and out’s of all the systems.

Things I’ve seen go wrong:

People getting locked out of their own boxes. (guilty)
Overly complex passwords don’t play nice. I’m not sure if it is threatspace’s website, or their database or input sanitization. Passwords with alot of symbols will cause ‘scorebot’ to incorrectly identify a service as being down. Instead choose a long alpha-numeric string.

A word of advice:

Do continuous pings to each of your scored systems so you’ll know when they go down. Don’t rely on ‘scorebot’.
Do nmap scans of your scored boxes, make sure the services you need up are up and responding. Check them from an outside computer. Do this constantly as things will change often in 4 hours.
You only have 4 hours: Keep It Simple Stupid!
Eat and go to the bathroom before competition starts. If allowed at your facility have a bottle of water with you.

Red Team activity:

2013: I didn’t participate in competition but friends did and did not remember any particular red team activity in the qualifiers.

2014: We didn’t see any red team activity, that is, we didn’t see any red team activity.

2015: There was a lot of red team activity. I have made blog posts about it, and so have others. Also, on one of our windows boxes they kept standing up a telnet server.

Feedback:

How do you prepare for the qualifiers? What are the qualifiers like in your region? Leave a comment below.

Blog, MACCDC2015, Qualifiers

The “No Pictures” Policy

April 6, 2015 Tony E 2 Comments

We, @ AACC always enforce a strict no pictures policy @ qualifiers, until its over. Then we enforce a no social media policy. Here’s why…

After qualifiers I went searching through social media and turned up a couple posts regarding MACCDC Qualifiers. This was one of those posts I found from a competing school:

This picture was taken before qualifiers began and was posted before they began. The caption read “Ready for this…”

The problem is what’s in the background:

Passwords on the whiteboard!!!!!

What other information can we see?

Listing Roles & Chain of Command, from Mubix's "How to Win CCDC" Presentation. — Listing Roles & Chain of Command, from Mubix’s “How to Win CCDC” Presentation.

WiFi networks @ your school:

We can almost read the Sticky Notes on the desktop:

After the competition, it becomes a little more revealing:

Lets zoom in on each piece: Enhance…. Enhance… Enhance…

A printed slide from Mubix's "How to win CCDC" presentation. — A printed slide from Mubix’s “How to Win CCDC” presentation.

Which tools are they using:

Another printed slide from Mubix's "How to win CCDC" presentation. — Another printed slide from Mubix’s “How to Win CCDC” presentation.

Looks like PBX to me:

root_at_10-10-10-110 — root@ip-10-10-10-110:

MySQL service won’t stay started: (More on this in a future post.)

Crème de la Crème: Moar Passwords!!!!

This post is not meant to make fun of or point out any flaws in any one person. This post is to bring awareness to the rest of the BlueTeam community that seemingly harmless photos can sometimes be too revealing.

Personally, I don’t even like posting pictures after the competition just in-case I make it to regionals and maybe nationals I don’t want to accidentally reveal any information to prying eyes.

As a team you should discuss whether or not you want to have a Pictures/Posting Policy and what it should be.

What are the policies at your school? What should they be?

Let see if the red-team can guess which school this was based on the passwords?

Blog, MACCDC2015

MACCDC 2015 – Badges

April 2, 2015 Tony E Leave a comment

This year’s competition was called “Operation Transit Storm” and was based on public transportation. It was only fitting that our badges fit the same theme. Larry Pesce (@haxorthematrix) did the badges as he has done in years past.

Upon entering on Thursday we were each given a blue etched badge on a lanyard with a RFID card glue to the back of it, a RasberryPi B+, a 3 page manual(Derpypot 1.0 Instructions) and verbal instructions that “this is a honey pot to use it if you wish. The login name and operating instructions are in the packet but you’ll have to figure out the password to login.”

Our blue badges were completely etched with something base64 encoded. We were all instructed to move into the auditorium were we would be briefed on the following days schedule of events.

While waiting we took out our badges and plugged in the etching into a base64 decoder.

rootkitthenutwork.net??? was this a typo? We checked the DNS TXT records, for rootkitthenutwork.net and didn’t get anything. We tried rootkitthenetwork.net and got:

We tried navigating to both sites but neither had any pages published.

A quick googling using the half of the quote that was given to us yielded the other half quickly.

Later that night it was confirmed that one of the teams bought rootkithenutwork.net and stood up a page with false clues for solving the puzzle. I forget which school it was but I thought that buying the domain that morning was pretty good.

The next morning I approached Larry and asked did he intentionally throw us off with the typo “nutwork”. He said no and that who ever owns that domain was just having fun with us. The difference was in translating the encoding from the badge to the decoder. If you thought it was a “1” it came out ‘nutwork’ if you thought it was a lower case “L” it comes out ‘network’.

cm9vdGtpdHRoZW51dHdvcmsuY29tlGRucyB0eHQ=

cm9vdGtpdHRoZW5ldHdvcmsuY29tlGRucyB0eHQ=

On the Pi is Tom’s Honeypot.

CCDCBlueTeam.com