Sharing Session on SCC and HITB CTF with Year 2s

On the morning of 29th Oct, a number of students who took part in the Singapore Cyber Conquest 2012 (GovernmentWare 2012) and Fallout Apocalypse (Hack In The Box) Capture The Flag competitions joined about 60 year 2s DISM students and shared about their enriching experience and learning journey (details of which can be found in our previous blog entries).

From left to right: Edmund Teo, Jeremy Heng, Ku Wee Kiat, Nikolas Tay and Amadeus Tan

During the Ethical Hacking and Defense class, year 1 student Nikolas Tay first talked about how he tackled the various puzzles in his debut attempt, and then Jeremy Heng and Ku Wee Kiat presented on the nuclear-warfare-themed game setup and finally year 3 student Amadeus Tan shared with everyone on how collaboration between teams proved to be crucial.

After the session in the morning, some of the year 2s showed abundant interest and engaged in an extensive conversion with year 3 seniors on an IRC channel. Let us hope more and more DISM students join force and achieve greater heights in their future endeavors!

Learning Reflections After HITB

The Hack In The Box "Fallout Apocalypse" Capture The Flag competition in Kuala Lumpur concluded last week, and upon return to Singapore our warriors could not wait to share with the rest about their interesting experience and enriching journey. And here is one selected piece of reflection write-ups from each participating team from DISM.


HITB CTF: Fallout Apocalypse   by Nikolas Tay, team AIF

Hack In The Box (HITB): Fallout Apocalypse was a Capture The Flag (CTF) competition held in Kuala Lumpur from 10th October to 11th October. The competition went on for 32 hours straight and consisted of teams from all around the globe.

This was my second CTF experience after competing in the GovWare Cyber Conquest CTF the month before. Though it was my second CTF experience per se, it was still a completely new experience to me. This is mainly because this CTF would be held in an Attack-Defense format rather than the usual Jeopardy format (otherwise referred to as a "puzzle-based" format). Therefore, the concept of running daemons, exploiting / defending services, etc... was still foreign to me.

This competition was indeed on a whole new level compared to my past experiences. Before the actual competition even started, we were presented with a Virtual Machine (VM) which was secured with a password. They then told us that we had 30 minutes to set up our equipment, (somehow) get into the VM, and finally change the password. In my opinion, this first instruction given to us really set the tone of the competition. Unlike the earlier GovWare Competition where the login credentials were given to us off the bat, there was no spoon-feeding here. This is the real deal.

Initially, we started off by trying to log in using common login credentials. After a few minutes of failure, we realized that they had actually intended for us to log in through single user mode to change the root password. Hence, we went on that said approach and then successfully gained access to the machine.

Not long after changing the root password, the competition started. Our first move was to check the list of users on the system using the command "cat /etc/passwd". After which, we realized that there was an account dedicated to each daemon (called Reactor Cores (RC) in the context of this competition). Our first instinct was to change the passwords of the seven RC users to more secure ones before we started running them. We then proceeded to run the first daemon, RC1. This was where things started to go awry.

Though the daemon ran flawlessly, the scoreboard did not react to it. In response to this, we ran a "ping" to the scoreboard server and consequently realized we had lost connection to it. This left us rather puzzled and we tried various ways to troubleshoot the problem. After some time, we found that the LAN cable attached to our computer was faulty. We confirmed this with the organizers and had it changed. Little did we know that the cable was not the root of the problem, it was in fact only part of the problem. After a few more hours of troubleshooting, we were hit with more bad luck as there was a short circuit in the main power strip where we were seated. This was the last straw. Without a connection to the score server, we were doing nothing but losing points for the past 7 hours or so. At this juncture, we decided to re-strategize.

We requested for an entirely new VM from the organizer as we did not have a backup of the original VM. This would cost us further points and we could only get it after about 4 hours' time. We agreed to the terms and decided to return to our hotel to revitalize ourselves before coming back for the new VM.

When we came back, everything was finally up and running. According to the organizers, it turns out that it was a fault on their end as their firewall was somehow set to block connections from us. This is where the actual competition really started for us.

We then stayed on throughout the night, decompiling binaries and examining them for vulnerabilities. Though I was relatively familiar with x86 assembly, this was the first time I actually attempted to look for vulnerabilities in a program. My lack of experience in this area proved to be a huge drawback when trying to write exploits for the services.

At one point in the competition, one of the more professional and well-known teams, Sutegoma2 from Japan had all their RCs damaged by LOL (a team from Vietnam) who were playing very strategically by taking out their strongest competitor as soon as possible. As such, it was impossible for the former to gain any more points. Consequently, one of the members from Sutegoma2 approached our team and proposed to form an alliance. After some discussion, we decided to agree to the alliance. Teaming up with such an experienced team would be a potential learning experience for us.

This is where things finally started to go uphill. We seized the opportunity created by this alliance to aid Nandy Narwhals (the other SP team) rise up further in the rankings as they were already doing relatively well at around 4th-5th place. At this stage, it was somewhat of a three-way alliance.

In the end the alliance clearly paid off for everyone; it was literally a win-win-win situation. Sutegoma2 clinched the top spot, Nandy Narwhals managed to get a record breaking (for SP at least) position of 3rd and we also rose to 7th place. In addition, we also forged friendships with the Japanese team.

This competition was indeed an invaluable experience for me. Just from this trip alone, I not only benefitted in terms of technical aspects. I also took home some strategies and important things to note for future competitions, discovered various areas of improvements and most importantly, life lessons that would be very much applicable in my future endeavors.

HITB CTF 2012 Summary   by Ku Wee Kiat, Nandy Narwhals

For some of us, its the second year taking part in HITBKUL CTF whilst for others its their very first.

Those that have been to last year's HITB are now be familiar with the competition venue, the lodging venue as well as miscellaneous travel arrangements.

This is an advantage as we will be able to concentrate more on the competition than to worry about getting lost in a foreign land.

The other important gain in this year's HITB for us is the chance to talk with members from other teams. 

Unlike last year where some of us stayed in the hotel during the 2nd day of the competition, this year all of us camped for the entire duration of competition which gave us plenty of opportunities to interact with other teams as well as to enjoy a exciting and often antagonistic competition atmosphere.

For example there were team LOL from Vietnam, sutegoma2 from Japan and 0xDC381015 from Singapore, and we were able to learn quite a bunch of stuff through talking with them. This could in a way point us in the right direction when we practice for future competitions.

DISM Students In Action At HITB@KL

In the last week of the the vacation, five DISM students along with lecturer Mr Calvin Siak once again set foot in Kuala Lumpur (KL), Malaysia to take part in the fun-filled Capture The Flag (CTF) competition under the Hack In The Box conference 2012 hosted in KL.

To celebrate the 10th year anniversary of HITBSecConf, the CTF Overlords and CTF Crews 1.0, 2.0 and the all-new 3.0 have come together to work on a 32 HOUR NON STOP CAPTURE THE FLAG COMPETITION which are called CTF Weapons of Mass Destruction – Fallout Apocalypse! 

... ... 

Fallout Apocalypse requires each team to manage a nuclear power plant and protect their daemons, which represents the reactor's cores, from attacks while at the same time launch attacks against rival teams' nuclear reactor. Weaponized SCADA exploits can be used to cause monetary damage towards rival teams. Fallout Apocalypse also features a spanking new black market where teams may trade exploits and also purchase countermeasures. 

[Summarized and adapated from hitb.org website]

This annual overseas venture has almost become a tradition of the DISM Special Interest Group. And this year, our boys are back with the best ever result with two teams ranked at third and seventh against participants made up of almost entirely professional security consultants and university students!

All members of the "expedition" team after first arriving KL

The huge pull-up banner for the Fallout Apocalypse CTF

The scoreboard at the very beginning of the competition

A corner of the competition venue, hosting 10 teams

Team AIF laying down strategy! 

Team members (from left to right):

Nikolas Tay, Edmund Teo and Amadeus Tan

Amadeus, are you trying to ... social engineer

the legendary pro-team Sutegoma2 from Japan?

And he succeeded ... in having a group photo

containg both team AIF and team Sutegoma2!

This status map certainly has a certain "nuclear" look

The final scoreboard with team Nandy Narwhals

from DISM losing narrowly to the second place

Team Nandy Narwhals receiving the second runner-up prize

Team members (from left to right):

Ku Wee Kiat and Jeremy Heng Wen Ming

 

As shown in the photo of the final scoreboard above, team Nandy Narwhals finished off at third place with 2,568,000 points while team AIF got 1,756,000 points at seventh position. One thing worth mentioning was that team Narwhals was competing with one member short due to some visa problem, making the achievement even more extra-ordinary.

Kudos to DISM students! Congratulations to both teams Nandy Narwhals and AIF.

No doubt it is by far the highest ranking ever achieved in HITB CTF by teams from DISM, but we have every reason to believe in years to come future batches definitely have the potential to soar to greater heights. 

Photos courtesy of Mr Calvin Siak and Amadeus Tan

STAR Development Program 2012

During 8th to 10th October, the annual DMIT STAR Development Program (formerly known as the STAR Camp) took place at The Hall and various on hilltop facilities. Several year 1 DISM students were among participants, and they were Peh Sze Chi, Tan Si Hui, Cheong Ren Hann, James Edward Teoh and Bay Min Han. 

Mission of DMIT STARs (STudent AmbassadoRs) 

The Student Ambassadors exist to build and reinforce the connections that foster rela-tionships among our alumni, students, school, staff, prospective students, and Singapore Polytechnic in addition to providing opportunities for the personal, social and professional growth of its members while in pursuit of their academic excellence. 

[Extracted from DMIT STAR Facebook group]

A little ice-breaking game at the hilltop foyer

Trainer Mr. Rahul sharing on presentation & public speaking skills

Come up and straight away apply what was taught

Preparation on how to present during DMIT facilities tour

What is Ren Hann doing? Why does he look astonished?

Well, here is a little game called "passing the message"

"Human dog and bone"! Perhaps NOT for the faint-hearted ...

Heavy lunch time conversation topic: End of The World =.=

On the last afternoon a year 3 senior STAR presenter from DISM was also awarded and conferred the Certificate of Commendation by Deputy Director of DMIT Ms Shirley Ngiam together with a few students from other courses such as DIT and DDM for the excellent service rendered in the past two years.

At the end of three days, many student participants were rather tired but at the same time feeling excited. While most are looking forward to more STAR activities, some committee members have already started planning for the next gathering - Year End cum Christmas party.

All the best and make DMIT proud, fellow young STARs!

Photos courtesy of Ms Junie Tan

DMIT Day - More Photographs

8 Oct 2012. More photographs on the DMIT Day.

DISM Chair, Mr Liew, briefed the DMIT staff on the Security Training at the Cyber Wargame Centre.

 

DMIT staff with the game master, Jia Sheg, a DISM Year 3 student.

 

The first group of DMIT staff working through the problems on the given scanario.

 

The scoreboard at the foreground.

 

The second group of DMIT staff taking part in the game.

 

DMIT staff with the yagi antenna outside the classroom.
Their objective was to track down the physical location of the IT security attacker.

 

 

 

 

 

DMIT Day a hit with staff

7 Oct 2012. Bonding was the name of the game at this year’s DMIT Day. But it was bonding with a big twist. Staff from the School of Digital Media & Infocomm Technology (DMIT) gained much insight into their colleagues’ work and lives during the one-day retreat.

The day started with a game of Human Bingo, before the staff took part in a series of workshops. They got to learn more about the courses taught by other colleagues and to explore two new facilities in DMIT – the Media, Arts & Design (M.A.D.) Studios and the Cyber War Game Centre during the day.

Cyber War Gaming workshop: At one of DMIT’s new facilities, the Cyber War Game Centre, staff are exposed to scenario-based learning methodology through the use of offensive, defensive and investigative skills. Examples include being able to detect security breaches in cyberspace and to track down the perpetrator.

“Besides creating opportunities for staff to bond, we also made use of DMIT Day this year to let staff be updated with the latest developments in the School and in technology. This also prepares them to be familiar with other courses offered by the school for future course promotion and Open House,” explained Senior Lecturer Mdm Quek Nguan Tuan, one of the members of the organising committee for the retreat.

Christian James Sethmohan, a Senior Lecturer, said of the activities organised: “I think it is refreshing and insightful for each staff to know what other staff are doing so as to create an environment of learning and appreciation of each other.”

“I really enjoyed getting to work hand-in-hand with staff whom I do not normally work with and getting to see and hear about the passionate things they are involved in,” he added.

As for Senior Lecturer Ms Magdalene Lim, she said: “I feel that this year’s DMIT Day is a good change as I have always wanted to learn more about the other diplomas offered by DMIT. Even before this, I was very tempted to sit in for a class in modules such as drawing, photography and sculpting.”

“There was definitely a lot of bonding as the day went on as we laughed over each other’s handiwork during the sculpting workshop and cracked our brains to solve security challenges during the cyber war gaming session,” said Magdalene.

Reprint from Singapore Polytechnic's Web Site.

Reflection after GovWare and SCC 2012

As the GovWare 2012 came to an end, DISM students who participated in the event benefit in various ways. Aside from metaphysical learning, one of the students even won himself an New iPad!

Let us take a look at some of the extracts:

"Overall i find the oppurtunity given to my group to go to Govware 2012, a very much appreciated and memorable experience as well as fruitful in terms of learning. I would like to thank DISM as a whole and it was awesome working with my groupmates through thick and thin for the entire kinect project and the three amazing days at Govware."

Alvin Lau Tze Wen, DISM Year 3

"I enjoyed the 3 days showcasing our fyp project to people at govware. it definitely proves to be a good experience as i have able to understand more threats and solutions against cyber-attacks. A good interaction platform between different industrial professionals to learn as a whole. Look forward for more events like this in future!"

Benjamin Low Yu Cheng, DISM Year 3

"It was a good experience and exposure for me. i learned a lot of what the other polytechnics are doing for their projects. Explaining and showcasing our product to other IT profressionals around was really interesting as some were impressed while some suggested the ways that can be done that we didn't think of."

Muhammad Hafiz bin Abdul Majid, DISM Year 3

On the other hand, year 1 student Nikolas Tay too shared on his enriching experience at the Singapore Cyber Conquest (SCC). Below is a brief summary of the tournament from the official SCC website followed by a detailed reflective essay by Nikolas.

Participants will be faced with numerous challenges with 6 levels of difficulty. The type of infrastructure mimics a real-world company that has wired connections, multi-segmented networks and web applications. Participants will be required to capture the many flags available and challenges not only include typical web-based and binary analysis, but stenography and hardware forensics as well. 

Judges will score on the basis of time and difficulty. It will be a Jeopardy style game where the point system increases with the difficulty of the questions. Participants can start at any level of difficulty. 

[Extracted From govware.sg website] 

And here is how Nikolas felt as he commenced upon and completed his first ever CTF adventure:

"On 25th September 2012, I participated in Cyber Conquest 2012 which was a Capture The Flag (CTF) competition organised by SYPRIS.  As this was my first CTF competition other than the internal competition organised by the DISM Special Interest Group (SIG), I did really not know what to expect.

During the day of the competition, many things ran through my mind – What will the challenges be like? How should I best approach them? How will I fare? Etc.... When the competition finally started, I clicked on the first challenge and heaved a sigh of relief and as it was something I had come across before during my preparation. After capturing the first flag, I felt a sense of adrenaline and continued hammering away at my keyboard; consequently solving a few more challenges. The sense of satisfaction I had after “capturing” each flag was just overwhelming.

Towards the mid-point of the competition, I was stuck at some of the challenges that I was attempting. Despite the countless failures, I tried to approach the challenges in every single possible way that I could think of. This process resulted in me experimenting with several different tools that I have never used before and forced me to think of various creative approaches. Getting some of the flags was definitely not an easy task. In my attempts to solve some of the challenges, I had to push myself to my limits.

By the end of the competition, my team (NTnRH) solved 7 challenges and earned a total of 550 points. Though it was a nowhere near the 3000+ points achieved by the winners of the competition, I really enjoyed the competition as it was indeed an eye-opener.

On hindsight, this competition has definitely broadened the horizons of my knowledge in the field infocomm security. It also exposed me to several new techniques which I will definitely find useful in my future endeavours.

As a whole, this competition was an enriching experience for me and I truly look forward to competing in future CTF competitions!"


Keep up the good work guys! It is certainly a pleasure to read such a writeup from the actual participant's perspective. Hope more DISM students can share with us on their learning journey in time to come.