Today, immediately after my rules lecture to the 9:30AM (Central) information security class, the Spring 2010 iteration of Capture the Flag here at Mississippi State University will begin.  While I have handed off much of the responsibility for running CTF to Chris Vance, our Security Lab Administrator, I will still be covering the event on this blog, much like I did last year.

The format is the same as last semester: 6 teams, trying to capture as many “flags” (10-digit hexadecimal strings. For example: 489066dd35) as possible.  They submit these flags to a scoring server that also happens to be in the target network.  There is always a very interesting meta-game between the teams, as they try to figure out how to submit their flags securely.

Last semester was the first CTF to run for multiple days, and I believe it was a huge success.  We’re continuing this time format, and the current CTF will run until 9:30 AM on Tuesday.  I will update this site with scores and a bit of commentary (though I won’t be spending as much time in the lab this time as I did last semester).

Here’s a list of posts from last semester’s CTF:

• Capture The Flag Begins Today!
• CTF Update: Wednesday 5:00PM
• CTF Update: Thursday Morning
• CTF Update: Thursday 5:00PM
• CTF Update: Friday Morning
• CTF Update: Friday 5:00PM
• CTF Weekend Update: Sunday 2:30PM
• Capture The Flag: Final Scores – Ring 0 Wins!

Ring 0 pulled it off in the end, with VM to VM flag submission to prevent their own flags from going out on the wire, thwarting the McGrewchebag’s attempts at automated sniffing/resubmission.  They were here all night hacking away and their devotion paid off.  I expected to find them face-down on the keyboard when I got back to the lab at 7AM, but they were still going, fueled by caffeine.

In the last moments of the game, with “Eye of the Tiger” playing from an unidentified laptop, the two top teams submitted all of the flags they had been afraid to submit earlier, along with plenty of cover traffic.  The scoring server creaked and groaned under the pressure, and I closed all of the other VMs to help out a bit.  When the clock hit 9:00 AM, I pulled the power to the hub, cutting the VM server off from the rest of the network.  The two teams congratulated each other, and we all went down to the classroom for the awards ceremony.

The final scores:

1. Ring 0 : 29 Flags
2. McGrewchebags: 23 Flags
3. Where’s Jerry?: 12 Flags
4. Team 3: 6 Flags
5. Team 5: 4 Flags

After a very busy morning, the number of students in the lab hacking away at CTF went down in number, but up in rowdiness.  There are three close “top” teams now, with “Where’s Jerry?” (formerly known as Team 4, name in reference to a missing member) joining McGrewchebags and Ring 0 in being very active.  ”Where’s” is not to be underestimated, having run their score up to the current value in a very short period of time.

The teams are getting more and more humorous with their trash talking.  It’s all in the spirit of the competition, though, as they’re being very friendly and sportsman-like to each other.  Earlier, I was witness to a member of Ring Zero sharing his copy of Fyodor’s nmap book with a member of McGrewchebags.

There was a bit of social engineering action today (bribery, etc.), and a small handful of points were handed out.  The best social engineering attempt, a survey sent to us, was actually rewarded by providing the team with an answer to one of their survey questions, rather than a “social engineering flag”.  That answer might serve them well.  It’s difficult to judge the social engineering attempts objectively, so I simply go with my gut.  Occasionally students protest about perceived uneven applications of rules and rewards, but it all evens out in the end.  Either way, there’s no way to appeal my decisions

Teams are getting a good handle on their sniffing and packet analysis skills, and are falling into a good routine on that front.  Most of the teams appear to be working well with each other as a team, and continue to put in some long hours.  I wouldn’t be surprised to see a sleeping bag in here the next time I drop by to see what’s going on.

I will be dropping by at least once tommorow and Sunday, and will post updates then.

Current scores:

1. McGrewchebags – 15 Flags (Last capture, 7:39 AM)
2. Ring 0 – 9 Flags (Last capture, 11:31 AM)
3. Where’s Jerry? – 8 Flags (Last capture, 11:25 AM)
4. Team 5 – 3 Flags (Last capture, 12:16 PM)
5. Team 3 – 1 Flag (Last capture, 2:46 PM)

Today has been a busy day, but with slight movement to the scores.  The two busiest teams, McGrewchebags and Ring 0, have been at work re-evaluating and re-deploying their sniffing and counter-sniffing measures.  Representatives of two other teams have been by to poke at the network and their own reserved computers, yet remain quiet on the scoreboard.

Three flags were submitted for scoring today.  This includes one flag each by Ring 0 and the McGrewchebags, 30 minutes apart from each other.  The remaining flag is more interesting for one reason: it was credited to Team 3, who had no members in the room at that time.  I know the reason for this, along with many other CTF secrets that I cannot reveal until after the closing ceremony.  For now, it is an exercise for the readers and other teams to figure it out.

Network traffic is picking up with “cover traffic”, designed to confuse other sniffing teams.  If it begins to get out of hand, I will need to start unplugging network cables, but so far so good.  The active teams are learning a lot about filtering through packet logs.

Soon, it seems, teams will be getting very serious about attacking target VMs and actually capturing flags for themselves

The scores as of 5:00PM:

1. McGrewchebags – 13 Flags
2. Ring 0 – 5 Flags
3. Team 4 – 1 Flag (Time of last capture NULL, only flag is social eng. granted)
4. Team 3 – 1 Flag (Time of last capture: 2:46PM, no members present!)
5. Team 5 – 0 (Sleeper cell, or just asleep?)

It’s time for me to leave the lab for the evening, but Capture the Flag and the participating teams march on.

After a briefing on the rules of CTF to the students from 9:00 to 9:45 this morning, this semester’s marathon Capture the Flag began.  The five teams have until 9:00 Monday morning to rack up their score.  There is plenty of time to go, although some teams are getting an early start.

The McGrewchebags (I love their name) have had an excellent start.  Members have been in the lab working on it ever since the end of the initial briefing, and have found most of the publicly available flags along with a handful of flags on the isolated CTF network.  They are also the very first team to break the scoring server in such a way that they could end the game right then and there.  The game was quickly repaired and the McGrewchebags were rewarded 2 points on the spot.

The teams that have been on the network have quickly realized that having an entirely hubbed network (one large broadcast domain) and the lack of a secure way to submit flags for scoring presents an interesting set of opportunities and challenges.  Passive monitoring is allowed, and each team is laying claim to one computer in the lab from which to run scripts and sniffers.  Espionage and communications security are top concerns for some of the teams, with counter-measures and counter-counter-measures being discussed in hushed tones.

The only team to submit flags to the scoring server, the McGrewchebags, are in the lead, although it is not known how many flags other teams are “sitting on” at the moment.  It’s a battle of nerves, as ties are broken by the earliest time of last submission.

The un-named Team 4 was just (50 minutes ago) awarded with one flag for a nice social engineering attempt.  This team sent me an email, spoofed to appear as though it was from the professor of the class, informing me that Team 4 deserved points because “they got me earlier” (meta-social-engineering!).  The email wasn’t perfect.  The headers didn’t match Dr. Vaughn’s usual emails, and they accidentally double-spaced his signature, but it was a pretty good attempt and earned them a flag.

Ring 0 just chose their name, and appear to be in a sort of set-up stage.  They may be a little slower to jump in than the McGrewchebags, but I get the impression that they are very serious about winning.

Scores as of Wednesday 5:00PM:

1. McGrewchebags : 12 points
2. Team 4 : 1 point
3. Ring 0 : 0 points
4. Team 3 : 0 points
5. Team 5 : 0 points

If everything stays up and running, and I don’t get any emergency calls, I will be back on the CTF network in the morning, and will keep my readers up to date with scores and commentary.