Fight On, State! .. wait, our machine is down?

This past Friday, I got to compete on Penn State's iCTF team, comprised of twenty members of none other than IST's IA Club. I was thrilled to have had the opportunity to compete with them, and eagerly looked forward to the competition.

From the iCTF website:

The contest, (known as "Capture The Flag") is a distributed, wide-area security exercise, whose goal is to test the security skills of students from both the attack and defense viewpoints. This is the 6th edition of the security exercise, and its largest version.

Each team is given an Internet server that provides a number of services. The services have a number of undisclosed vulnerabilities, which have been included by the contest organizers.

The goal of each team is to maintain the set of services available and uncompromised throughout the contest phase, by finding the vulnerabilities and fixing them in their own copy of the server. The teams will also leverage the vulnerabilities they found to compromise other teams' servers.

During the contest, an automated scoring system keeps track, for each team, of what services are available, and which services have been compromised (that is, "who is hacking who"). Points are assigned to the teams according to their ability to defend their systems and successfully compromise the systems of other teams.

At approximately 9 AM EST, we arrived at the apartment we were competing at. The server image was made available at 11 AM, and "open fire" at 1 PM. Unfortunately, it took us far longer to decrypt and install the image than we had hoped. And then, for reasons quite unbeknownst to myself, we had some difficulties in connecting our server to the competition VPN, thus making it impossible to attack other machines. Nevertheless, we had a great deal of the offensive and defensive teams working furiously to get it up, while the research team poked and prodded at the image to attempt to find vulnerabilities for when we finally got it operational.

Which, unfortunately, never happened. I did learn a lot, however, particularly in some areas pertaining to encryption technologies, Python, and WEP cracking. I look forward to what else I can learn in the IA Club, as well as next year's competition.

And now, some pictures (warning, crappy cell phone pics):

The offense side of the room.

The research team's setup.