0wn the box? Own the box!

**meee** · June 12, 2007, 12:08

Re: 0wn the box? Own the box!

hmmm a great way to get rid of old equipment.

**renderman** · June 12, 2007, 12:56

Re: 0wn the box? Own the box!

Hacker pinkslips

**sk00t** · June 12, 2007, 14:01

Re: 0wn the box? Own the box!

Originally posted by renderman

Hacker pinkslips

You got it. I'm hoping we can get some folks to bring some interesting gear. I have one c64 with web server signed up now...

Anyone who wants to sign up, please send me a PM for more details.

How cool would it be to have a shirt that said "Nobody 0wned me at DC15!"?

**kallahar** · June 12, 2007, 14:31

Re: 0wn the box? Own the box!

If the services are simple then it shouldn't be too hard to write secure code. Just disable all the remote admin stuff, make sure your code doesn't have buffer overflows... It should be pretty easy to make an unbreakable box. What are the "two services"?

**sk00t** · June 12, 2007, 15:04

Re: 0wn the box? Own the box!

Originally posted by kallahar

If the services are simple then it shouldn't be too hard to write secure code. Just disable all the remote admin stuff, make sure your code doesn't have buffer overflows... It should be pretty easy to make an unbreakable box. What are the "two services"?

Roger that, totally understood. I initially thought it best to be vague, but maybe I should get some more detail out there.

The two services will need to actually be complex (a forum like this one, a CMS, a functioning mail server, etc), and not just sit there, be patched, and offer up a banner.

There will also be two stages, the first day being remote only, the second day we'll up the stakes, requiring you to give out accounts or shells, so entrants will need to also think about authenticated users local to the box.

Complexity breeds exposure, so an entrant should expect complexity.

**converge** · June 12, 2007, 15:12

Re: 0wn the box? Own the box!

heh.. I still have a bunch of reading to catch up on this new contest... but I have to comment, sk00t has .. bar none.. the best Uncle Ira avatar on the forums.

**Chris** · June 12, 2007, 15:13

Re: 0wn the box? Own the box!

I think this is a cool contest, but the way it reads, if you lose, you lose your box, but if you win you get to keep your box. There must be additional prizes...otherwise the risk/reward ratio seems pretty weak if you are just trying to fend off others, not actually attack.

Other than the joy of keeping your own equipment, are you offering anything up to the winner?

**sk00t** · June 12, 2007, 15:41

Re: 0wn the box? Own the box!

Originally posted by Chris

I think this is a cool contest, but the way it reads, if you lose, you lose your box, but if you win you get to keep your box. There must be additional prizes...otherwise the risk/reward ratio seems pretty weak if you are just trying to fend off others, not actually attack.

Other than the joy of keeping your own equipment, are you offering anything up to the winner?

Actually, you don't need to bring a box to participate, you can obviously be an attacker without bringing a box... Or maybe you should? "Upload ratios enforced"?

The idea was to make this something more casual, where it doesn't require someone to spend the whole con, like CTF / aCTF (which are very cool, don't get me wrong...). So, as an attacker, you can sort of pop in and out, as interested.

If you're a defender, and bring a box, yeah, you're right, what's the reward? At a minimum I am promising "Nobody 0wned me at DC 15" shirts, and we'll be part of the awards ceremony, but yeah, I dunno yet. What would entice someone to do this?

I'll think hard and see what I can come up with to encourage people.

For me, I thought it would be a fun way to unload some hardware. I'm also going to hassle as many security-centric projects as I can and see if I can get a bite or two... Updates as warranted.

**Chris** · June 12, 2007, 16:18

Re: 0wn the box? Own the box!

Originally posted by sk00t

Actually, you don't need to bring a box to participate, you can obviously be an attacker without bringing a box... Or maybe you should? "Upload ratios enforced"?

The idea was to make this something more casual, where it doesn't require someone to spend the whole con, like CTF / aCTF (which are very cool, don't get me wrong...). So, as an attacker, you can sort of pop in and out, as interested.

If you're a defender, and bring a box, yeah, you're right, what's the reward? At a minimum I am promising "Nobody 0wned me at DC 15" shirts, and we'll be part of the awards ceremony, but yeah, I dunno yet. What would entice someone to do this?

I'll think hard and see what I can come up with to encourage people.

For me, I thought it would be a fun way to unload some hardware. I'm also going to hassle as many security-centric projects as I can and see if I can get a bite or two... Updates as warranted.

Like I said, I think this is a cool contest.

I am interested in participating, but basically from the standpoint of build it and drop it off (I have too much to do to actually sit there for any period of time) and see if my config/scripts/etc can withstand the attacks. That said, if all I get for my effort is my own computer that I already had, it seems like kind of a waste...although I do agree that the knowledge that you were able to fend off the attackers is pretty slick in and of itself, but I don't think that makes up for the risk of potentially losing the box.

As for what would entice folks..I don't know...but you'd think that the reward would need to be rather significant to even out the pot odds.

**sk00t** · June 12, 2007, 17:51

Re: 0wn the box? Own the box!

Originally posted by Chris

Like I said, I think this is a cool contest.

I am interested in participating, but basically from the standpoint of build it and drop it off (I have too much to do to actually sit there for any period of time) and see if my config/scripts/etc can withstand the attacks. That said, if all I get for my effort is my own computer that I already had, it seems like kind of a waste...although I do agree that the knowledge that you were able to fend off the attackers is pretty slick in and of itself, but I don't think that makes up for the risk of potentially losing the box.

As for what would entice folks..I don't know...but you'd think that the reward would need to be rather significant to even out the pot odds.

Build and drop it off is exactly the intent. In addition to not having space to set up for the keyboards / monitors / etc, to me it would be kind of unfair to let people sit and babysit their boxes.

So yeah, you'd be expected to hand it over, and (hopefully) get it back at the end of con. I'm still puzzling on rewards. I will nag Kita / Russ and see what schwag they can come up with.

Of course, this is Vegas, and if someone's absolutely confident their stuff is unownable, no matter what, what's to lose? :)

**TheCotMan** · June 12, 2007, 19:28

Re: 0wn the box? Own the box!

Attackers could provide something in order to be assigned an IP address to use, and then the defenders get to keep the attacker's goodies when the attackers don't come in first, second or 3rd by # of boxed "owned".

Entrance fee? Booze? Money? Food? Something else?

Give the attackers something to lose as well. :-)

**sk00t** · June 12, 2007, 19:40

Re: 0wn the box? Own the box!

Originally posted by TheCotMan

Attackers could provide something in order to be assigned an IP address to use, and then the defenders get to keep the attacker's goodies when the attackers don't come in first, second or 3rd by # of boxed "owned".

Entrance fee? Booze? Money? Food? Something else?

Give the attackers something to lose as well. :-)

There's always the possibility of vigilante justice if someone walks in with an 0day and grabs ten boxes in a swipe. We're not promising security after you walk away with the box and leave the con area.

This could get ugly...

BTW, one update, I got one offer of a low-serial number NeXT box. Right now my count is somewhere around 5, and I haven't started on my own stuff to bring yet.

Still working on the defenders prize side, I may have tracked down a patron.

**sk00t** · June 18, 2007, 00:03

Re: 0wn the box? Own the box!

Originally posted by converge

heh.. I still have a bunch of reading to catch up on this new contest... but I have to comment, sk00t has .. bar none.. the best Uncle Ira avatar on the forums.

It's actually Che Stallman, but yeah, sans glasses and Hackercrombie tee, you're right, the resemblance is pretty uncanny...

**Chris** · June 19, 2007, 04:43

Re: 0wn the box? Own the box!

Originally posted by sk00t

Build and drop it off is exactly the intent. In addition to not having space to set up for the keyboards / monitors / etc, to me it would be kind of unfair to let people sit and babysit their boxes.

Just curious, how does this fit in with day 2? You mentioned that day 2 would require interaction, accounts, etc. How are we supposed to do that if we drop the box off on day one and walk away?

0wn the box? Own the box!

0wn the box? Own the box!

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment