CyberWire Daily - Capturing the flag at NXTWORK 2019 [Special Editions]

Episode Date: December 15, 2019

Capture the Flag competitions are an increasingly popular and valuable way for both cyber security students and seasoned professionals to test their skills, stay sharp and maybe even put a bit swagger on display. We set out to capture the excitement of a capture the flag event. As luck would have it, our sponsors at Juniper Networks were hosting a capture the flag hackathon at their annual NXTWork conference in Las Vegas, and they invited our CyberWire team to join them to experience it for ourselves. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. life. You'll be solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first future together. Head to salesforce.com slash careers to learn more. The real challenge with these events is that you can't

make it so easy you can do it in two minutes, and you can't make it so hard people get frustrated and leave. It's just a way to challenge and learn so it's like maybe stuff that you haven't done or don't deal with in the real world and you get a chance to go try it and learn it. All three of us admitted right at the beginning that we're not really security focused so we kind of just had to make sure we teamed up and you know worked on it together. We've hacked our own server so you know we gleaned some good insights from that. I was a little bit nervous going in. I wasn't sure what to expect.

But with the JSA and automation, it made things surprisingly easy. It's worth the effort because, I mean, it's a partner and customer summit. Hello, everyone. This is Dave Bittner from the Cyber Wire. Capture the Flag competitions are an increasingly popular and valuable way for both cybersecurity students and seasoned professionals to test their skills, stay sharp, and maybe even put a bit of swagger on display. When I speak with people in hiring positions, many of them say that Capture the Flag experience is something they look for on a resume. It can demonstrate technical skills, teamwork, creativity, grace under pressure, and determination. So, with all that in mind, we set out to capture the excitement of a Capture the Flag event, to share with you what it's like to take part as luck would have it.

Our sponsors at Juniper networks were hosting a capture the flag hackathon at their annual next work conference in Las Vegas. And they invited our cyber wire team to join them, to experience it for ourselves, capture some of what it's like for you. So thanks to Juniper for organizing the event, inviting us to witness it and for sponsoring this Cyber Wire special edition. Hello, everyone. This is Dave Bittner from the Cyber Wire, and we are live in beautiful

Las Vegas at the fabulous Caesars Palace. We are here at NextWork 2019. This is Juniper's big event, and I am attending the hackathon. And joining me is Oliver Sherman. Oliver, great to have you here. Hi, good morning, Dave. Glad to be here. We've got quite a day ahead of us. Lots of activities. We are going to be doing kind of a play-by-play with this hackathon. Why don't you set the stage for us? What can we expect from this competition today? Sure. This is kind of our third year of doing the hackathon and it continues to grow a good bit. Really the objective here is not to be a giant Juniper commercial, although we do know who we work for. So there will be some Juniper

components to it, but really it's about the convergence of both network security and automation and how do we stop some of the more sophisticated things that are out there today. So looking around the room here for folks who are listening at home, the physical setup of the environment here, we are in a big hotel ball room, but it has been divided into two sides. Explain to us what's going on with that. So really the intent, and we've kind of done both versions of this, but this is a red team and a blue team capture the flag exercise. The point of the red team obviously is to capture the flag and make as many moves as possible. There's actually four goals here to get through the event or four milestones. Now the blue team's objective is completely the opposite. It's to stop the red team from getting to, it's actually an Ocean's Eleven theme. We figured we were in a

casino, so we have them trying to get into the casino vault. And once they get the combination through various different techniques, very similar to the movie Ocean's Eleven. Very nice. You'll see that actually come out and they get cash and prizes. Right, right. Well, maybe not cash. So looking at the room itself, we've got multiple tables set up for multiple teams, much more red teamers than blue teamers. What's the dynamic there?

Well, I mean, that's really real world. You know, we have automation, you have a ton of things that come at you. If you look at denial of service attacks and botnets, you have a lot more attackers or things that are attacking you out there than there are defenders. And that's also indicative of the shortage we have in cybersecurity, as far as professionals that know this. So this is very much a real world scenario where you have, you know, we're heavily weighted towards the red team, maybe less so than in real life, but actually this is what people will experience. We also have some automated noise and attacks that are in the background as well. So really the blue team will be feeling the pressure today. Tell me about the teams themselves. How did these teams get formed? Who are they composed of?

The teams are formed of a mix of both folks with programming backgrounds, meaning that, you know, programming, scripting, Python, etc. You have some networking professionals that are more on the traditional networking side, as well as security professionals. And we created teams that were kind of a mix of all of them as we find that's a good blend of skill sets to really give you what you need and also replicating what we really see out there in the real world. What's the importance of an event like this for Juniper to support like this? My understanding is that these capture the flag events, not only are they great exercises for the people, but a lot of people who are hiring these days, they're looking for experience of

these sorts of events from folks who are looking for jobs. Well, I think it's a culmination of a lot of things, but quite frankly, yes, it's folks that have real world experience. There's a lot of ways you can get cybersecurity knowledge from books or from certifications, etc. But the real world application of that, using some of the folks like we have on our team to really show what's really out there and demonstrate kind of what's there. So that really helps folks up level their skill set. And yeah, it does help people get jobs. All right. Well, we are just a few minutes away from the competitors coming into the ballroom here. It's certainly going to be an exciting afternoon, and we're happy that all of you are

here to listen along as we go. It's going to be a lot of fun. Again, this is the Nextwork Hackathon, courtesy of our friends at Juniper Networks. Now, let's get into the background story behind today's hackathon. It's just about a disgruntled employee who got laid off from Acme Casinos, and he put out a contract to any hacker that can breach that casino's data center and the vault. So you come in, you come in as the hacker. This is from the red team I'm talking. While doing reconnaissance at the resort casino, you notice the model of the IP cameras that they used.

And then you kind of want to go in there and load malware on those cameras. So that's done for you already. Those cameras are calling out to the command and control servers that you as the red team own. And what's going to happen is the red team would have two ways of getting into the blue team's environments. The blue team's environment consists of a casino and a data center. The casino has cameras and the data center has web servers and the vault. The red team essentially has two ways of getting into the blue team's environment,

of capturing the flag and getting the safe code for the vault where the cache is at. And if you're able to exploit any of the two vulnerabilities, the first one being the IP cameras and the second one being the web servers through which you can go to the database and the vault, you essentially win the hackathon. We don't need any more rules.

We're all hackers. We're in here to win it. We're in here to be rich. So we don't need no more stinking rules, right? Enjoy. Happy hacking. skating. Too icy. We could book a vacation. Like somewhere hot? Yeah, with pools. And a spa. And endless snacks. Yes! Yes! Yes! With savings of up to 40% on Transat South packages, it's easy to say

so long to winter. Visit Transat.com or contact your Marlin travel professional for details. Conditions apply. Air Transat. Travel moves us. Cyber threats are evolving every second, and staying ahead is more than just a challenge. It's a necessity. That's why we're thrilled to partner with ThreatLocker, a cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data,

and ensuring your organization runs smoothly and securely. Visit ThreatLocker.com today to see how a default deny approach can keep your company safe and compliant. So, Oliver, we have begun. The blue teams and the red teams are off and running. Give me a description of what's going on now. What are each of the teams doing as they get started? What are the types of things that they're working on? Well, the blue team is getting started learning their tools and their environments. Where the red team has got a couple lessons they have to complete to kind of understand what some of the hacks are and some of the vulnerabilities. Also we've just given them the instructions on kind of what they're looking at, getting logged in their environment, plus as you can see on the screen here, we have a treasure map that has four different

goals that they have to achieve to win this game. So that's the objective of the red team is very much capture the flag. You know, it's a big challenge for these guys because they have to be, or they have to throw a bunch of stuff at this and the blue team's trying to defend and they're a little bit ahead. So we'll see what happens today. It's going to be interesting. So a component of this exercise being educational, you mentioned that they're doing lessons before they really set off. What kind of things are they doing? These lessons are really designed to demonstrate the kind of hacking environment they're in and what kind of hacks they can use.

We do that in order to ensure we level set folks that come in. We are not targeting professional hackers. That would be a different show. These are generally folks that know a little bit of code, understand networking, understand a little bit of security, and we're trying to up-level them, so to speak, as far as this environment. So let's get some level set with folks that may know a little bit more. And then over on the blue team side, what are they up to? The blue team side is just learning their defenses, what they have to work with. There are really no rules, except you can't mess with each other in this particular event.

So if the blue team gets together and decides they have a particular tool set they like that we haven't provided, they can download whatever they want. But same goes for the blue team gets together and decides they have a particular tool set they like that we haven't provided, they can download whatever they want. But, same goes for the hacking team, if they don't like the tool set they have and they have something that's going to really get them ahead, they're allowed to do that as well, which will make this really interesting. At what point do they actually set off against each other? When do the two networks connect and the clash begins? They're connected now. Everybody can see everybody. They're able to do whatever. So it's just a matter of who gets up to speed first and who gets started. So I'm here with Dwan Hall and we are on the blue team side of the room and we've really just kicked things off. We've just gotten started. So describe for me, where are we now? What are

the blue teams working on? What sort of tasks are they set off on? So one of the challenges coming into an event like this is that people need to get, they're sort of coming in cold. So what they're doing now is getting acclimated to the environment. We ran a few synthetic attacks. We reviewed the tools that they have with them. And now they're sort of dividing and getting really just acclimated to the environment, logging into the tools, looking at the dashboards, and dividing up responsibilities. So let's dig into that a little bit. I mean, on the individual teams, how does it work in terms of them organizing themselves? Do they each take on particular tasks depending on which team they're on? This is a self-organizing event. So they are

encouraged to divide the work up and assign different roles. For the most part, it looks like they're actually doing that. And you can see people are pretty much heads down, looking into their tools, right? And the attacks haven't even started yet. So the intensity is going to pick up very shortly. When the attacks start, how does that signal happen? How do they know? Are they monitoring the network? Because those attacks happen at any time? Yeah, well, we're going to give a thumbs up. So the other thing is with the red team side,

we can't assume that people have hacking skills. So they're starting off with learning how to hack into the type of web servers that we're running on the blue team. So we're going to give each other a thumbs up, and then it'll be red team versus blue. So we're going to give each other a thumbs up, and then it'll be red team versus blue. So I want to try to set the scene as we look around the room for what's going on here. We are in a hotel ballroom, and there are round tables set up between three and eight people sitting at each table, all of them with laptops.

And they are plugged in. They are head down in their laptops. One side of the room is the red team. There's probably twice as many red teamers as there are blue teamers. And there is a divider between the two sides. So they can't see each other. They can't hear each other. And at this point in the competition, they are preparing for the actual attack and the defense. Probably about 100-150 people total. Wide variety of folks, different ages, different ethnicities, different backgrounds. Mostly men, a handful of women. We've got a variety of systems. I see Macs, I see PCs. At this point, you can tell that the teams are starting to form. They're communicating amongst themselves and they're dividing up the task. It looks as though different team members

are taking on different responsibilities. What is your sense so far for how it's going in terms of everything that you built, the architecture that you put together here? Does it seem to be playing out the way that you imagined that it would? It is. Obviously, every time you do an event like this, there's some connectivity issues or whatever with people's laptops and VPN connections. But by and large, I mean, this is going very well. We're about an hour plus into the event.

Everyone's still super engaged. For the most part, the infrastructure is holding up. Again, there's one or two teams that are having some issues, but it is playing out like we expected. Now, you've been over here on the red team side for most of this competition. What is your sense of how the teams on this side have been doing? Have they been making progress? Have they been running into roadblocks or frustrations?

How's it going? I'm seeing them running into everything, roadblocks, frustrations. Whenever I see someone get a beer, I understand that either they're pretty happy or they're disgruntled. But yeah, I mean, it's a good flow I'm seeing here. They obviously need some hand-holding here and there because it's so vague and that was what the idea was but that was expected because i mean coming into a completely new environment and um with not much info about the the deployment itself we were expecting that they're not gonna they're gonna come back to us for hints and that's that's what we're trying out we're trying to help them out just pointing them in the right direction

and that's what our hackathon is all about. Why is an event like this important? At a conference like the one you're holding here, there's a tremendous amount of work that goes into something like this. Why is this worth the effort? It's worth the effort because, I mean, it's a partner and customer summit. So obviously, we want to bring everyone together. We want to show them that, I mean, it's just a fun start-off event, I would say, because, I mean, just adds to the energy, and most of them are engineers here, I suppose. So hackathons just get everyone excited. In general, I mean, there's prizes and swag, free swag they can take along. So you guys are over here on the red team side, and this is Victor I'm speaking with.

You're off and running. Where do you guys begin? So we're trying to do IP scans and trying to use the enumerate tool to see if we can find a vulnerability and exploit it. How have you guys organized your team? Somewhat. We issued out usernames. Chaos. Somewhat. We issued out usernames when... Chaos. A little bit of chaos, but we've been working together, trying different, you know, sub-etscans. For instance, you know, if EP finds one of the IP addresses, then we all

start maybe working on it a little bit, and then move on from there. All right. Terrific. Good luck, gentlemen. The attack has begun, yes. The Red Team has started in on your network. Can you just describe to me in this initial stage, what sorts of things are you guys seeing? We're not entirely sure. We're seeing port scans. We're seeing some other potentially nefarious behavior, but we're still trying to wrap our head around exactly what it is we're looking at as well. How have you organized your team? Have you organized your team?

We've identified a few things that we think we can each contribute and some roles that we wanted filled, and we've done our best to fill them, and now we'll just see how effective we are. We've done our best to fill them and now we'll just see how effective we are. Can you give me an idea of how it's going so far? What kind of stuff are you guys doing? We've got, I think we found two promising IPs that we're looking at and we've been blocked twice now from those IPs but we've been able to run one of our word lists on it to try to obtain a password. So overall, going on too bad. I'm looking around the room and I'm seeing that one of these things is not like the others, and that's you.

Oh, yeah. Is this a typical experience for you, being the only woman in a room or on a team? Oh, yeah. I went to a strictly STEM school, and so the percentages was about 13% female versus 87% male. And so for me, many of my classes, it was myself as the only female or one other girl. But honestly, it doesn't bother me. It doesn't bother me at all.

It's just we're just people. We're all learning from each other, and as long as everybody treats each other the same, which I've experienced for the most part, then there's nothing I find difficult about it. So I have Jeff Fry. First of all, this is just a big picture here. How's it going so far? Good. It's an entertaining time.

Good team building. Learning a lot. Having fun. What about the structure of the event itself? Are you enjoying that? How well do you think they've done in setting it up? Yeah, it's a pretty good setup. They gave us good documentation. I mean, before the event, we got a query from them of how familiar with different tools,

and I think that may have helped divide the people as to the familiarity. If you've used this tool, then okay, you might be on this team. If you haven't, you may be on the other team where they haven't used it. It seems as though maybe there's a little more collaboration and information sharing going on on the blue side. I hear cheers coming from this side and maybe sensing some frustration on the other side. That's a good thing because we're defending. That's how it's supposed to be. What's the importance of an event like this?

I mean, what draws you to it? Why do you like to participate? I think it's because you get to meet people you may not have normally been able to meet. So it's a way to meet people at the conference that, why would I talk to half the other people as walking in the hallway? But this kind of brings us together. Plus, it's a way to challenge and learn. So it's like maybe stuff that you haven't done or don't deal with in the hallway, but this kind of brings us together. Plus, it's a way to challenge and learn.

So it's like maybe stuff that you haven't done or don't deal with in the real world, and you get a chance to go try it and learn it. Oliver, we are how long into this? A couple hours in so far. How are things tracking so far? Are there a red team, our blue team? How's everybody doing? It's been pretty interesting. The red team is starting to get stuck on a couple things, right? They're still kind of sitting at the first flag. So we've kind of let out the next clues, which is a positive sign. These aren't easy things to accomplish.

The blue team has started to collaborate, which really is, I think, one of the things that's making it a little bit harder to get through to the blue team. So we're starting to let out some more clues for the red team so they're able to kind of be more efficient in their hack. We've also encouraged them to collaborate, although it is a competition, so sometimes that's hard to do when you're in competition. It's hard to balance, do I want to win or do I want to win on my own or do I want to win as a team? So that's kind of what they're going through right now, and we'll speed this up a little bit, because we like to give out clues. The real challenge in one of these events is that you can't make it so easy you can do it in two minutes,

and you can't make it so hard people get frustrated and leave. We seem to have achieved the right balance here, and I think everybody's pretty engaged and having a good time. a good time. So just like that, in the blink of an eye, the three-hour time limit is reached and the game is called. It's hands off the keyboards,

eyes off the screens. Let's listen in. All right, ladies and gents, I think we're ready to wrap this up. I guess the most important question is, who had a good time?

My boss is like three things over, so everybody clap, scream, do something. So really kind of the star of the show today, what you guys were interacting with, at least in the blue team, was policy enforcement, which is a component of our connected

security strategy. Now, again, I'm told this wouldn't be a Juniper commercial, an architecture slide, but the point is being able to block this closest point to the end user, which generally is a network, which is an advantage we see. And I ask you to judge on your own, right? I've been drinking the Kool-Aid now making it. But really, we'll talk about who won. I'll let Duan talk more about this, but that'll turn it over to the mastermind behind the project, Mr. Hall. The mic's too high for me, Ali, but thank you. Hey, guys, if I can have Team 4 and Team 2 from the blue team come forward.

On the blue team side, we had an open source PFSense firewall. We had Juniper products as well. And we were trying to show integration and security automation. There were many more of you folks than there were of the blue team. Now, it sounds like I need to apologize to some of the red team because I didn't make it as easy as it should have been to capture some of the flags. So whoever made it the furthest

on the red team will be the red team winner. Like one of the things I really noticed is that the blue teams were working together. They started dividing up all the work and they were working together to make this happen.

The winner for the blue team was team four. They blocked the most. The winner for the blue team was team four. They blocked the most attacks. They are the blue team. Definitely an honorary mission. But team four is the one that actually won. They did the most blocks.

Thank you. Hope you enjoyed the hackathon and we'll see you next year. Cheers. So I am here with the winning blue team. Which team number were you? Team four. Team four.

Let me just start off. I get each of your names and where you're from or what organization. We'll start with you. So my name is Josh Barron. I'm from Synoptic. I'm Jason Forster. I work with IT&E. We're from University of Florida.

All right, terrific. So what was the event like for you? Give me an overview of what was the task that you were assigned to do here. Our job was to basically protect our casino network and our casino data center network. We were told that the cameras would be exploited. We were told that potentially web servers and database servers would be exploited. There was connectivity between the data center and the casino that we had to watch out for, so there was potential for east-west traffic attacks.

We had some interesting rules that we kind of struggled with in the beginning. For some reason, our quote-unquote CISO decided that ICMP was must-be-allowed, which is in all three of our networks was not something that we would ever allow, so that was a bit surprising. And we struggled a bit with the fact that none of us, of the three members of our team, really had any experience with JSA.

We had some experience with SRX, and switching JSA was pretty new to us. And somebody from our team, Hui, was completely Cisco, so we found that the jsa interface was really good once we figured out how to automate the protection mechanisms i mean the red team was done right we basically for the vast probably the last 45 minutes to an hour we just sat back and just and watched the blocks because there was very little that they could do to hit us so overall it was a lot of fun i think the smaller group of blue team made it easier to collaborate with the different teams. There was only four teams, technically only three.

There was a lot more red team, but we realized that because we were outnumbered, we collaborated a lot, which indicates something that the industry has been doing and needs to get better at, which is collaboration among organizations against the bad actors of the world, right? What do you think it was about your team in particular that gave you this advantage to set you apart from the other blue teams? We are small and we work close and we make things more efficiently. And most of all, we get to know the automation tool, which makes things better and do the job.

How do you think the overall architecture of the event was itself? In other words, was it fun? Did you enjoy yourselves? Was it technically challenging? How was the combination of elements? Definitely fun. I was a little bit nervous going in. I wasn't sure what to expect. But with the JSA and automation, it made things surprisingly easy. Towards the end, we were kind of just looking for things to do because the system was basically doing everything itself at that point. But overall, it was a really good experience seeing a potential real-world type of scenario and how would you react against it. So yeah, great learning experience for us, for sure.

Can you just say your name for me? Cody Jenks. All right. So before we dig into the winning that you did here today on the red side, just give us a little description. What was the scenario that you were doing here? So we were one of the red teams, and we were trying to hack into a casino to get the code to a vault

so we could get the money out of it, essentially. So the idea was to get past the casino and then get access to the data center, which is where the server was that had that information. And then there were some additional things like the IP cameras. We had access to those because someone used social engineering to get them to reverse SSH back to a command and control server. So there was a couple things kind of in place before we even got started. And then we got the IP ranges for what we were trying to target. And we just had to use some tools in Kali Linux to try and identify what was open and then get in and try and find that safe code, essentially. What's your impression of the overall event itself?

Was it fun? Was it educational? What did you get out of it? It was fun and educational. I'm mostly networking from my career standpoint. I know a little bit of security, so this was definitely getting me a little out of my comfort zone, which is good. Same thing with Linux. I know enough to be dangerous, but again, kind of pushed my limits on there too. So they were good about giving us hints. And then using the Slack channel for all the red teams, we were able to kind of collaborate with the other teams too. So we were sharing a little information here and there, which definitely helped because there's obviously all different kinds of skill sets in this room here. Definitely didn't want to leave people behind that maybe weren't as up to speed as others. So that

definitely helped. But yeah, a lot of it was new to us. Some of the tools were new. So it was a good experience to kind of learn those and really kind of to challenge us a little bit. Because like I said, I think a lot of us were out of our comfort zone and we really had to, you know, work to try and figure out what was going on because they didn't just give us the information, just hints here and there. So yeah, it was a really good experience. I thought it was pretty well put together. We had a couple little technical issues at the beginning that they got resolved, but other than that, it went pretty smooth.

It just came down to the amount of time that we had to do it, because that three and a half hours flew by pretty fast. All three of us admitted right at the beginning that we're not really security focused, so we kind of just had to make sure we teamed up and, you know, worked on it together and kind of put our minds together. So we kind of just had to make sure we teamed up and, you know, worked on it together and kind of put our minds together. So, Oliver, we have what I would say is a very successful capture the flag here in the bag. Give me your impressions. How did it go?

I think it went very well. Like I said earlier, the blue team collaborated and was able to kind of stick together and figure out who was doing what, which is largely what you see some of the alliances that are out there in the community, that we kind of help each other figure out what's out there, right? It's not one company or one person that will solve this problem, whether that's a vendor or whether that's an alliance. So we all need to band together and help that. The second piece is that the red team had a good challenge on their hands. I mean, it wasn't too easy to get through, which a which is the hard thing to judge for this like I said before. They also started collaborating and they had some folks that got through and they they learned something and they all had a good time so I think that's

that that's what counts but you know we're here to replicate this again if there's a partner or somebody wants to do this with us we're happy to do that. We're talking to you guys about it as well so look forward to doing more of this. Did it play out the way that you envisioned that it was? Were there any surprises along the way? I think there were a couple surprises because I think it took a little bit longer for folks to get to the initial lesson

than we would have thought, which is really telling about the skill set out in the industry. We had very talented people in the room. These are challenging things, right? If this were easy, anybody could do it. So once they got through it, they started moving along and then still took some clues to move them along, which is good.

So also we proved that banding together again as a blue team really helped out. One thing I heard as I was walking around and talking to people on the different teams was that one of the things that drew people to this was the ability to interact and meet other people that they otherwise wouldn't meet. Especially as you're kicking off a multi-day conference like this, it's an opportunity to get to know people that maybe you wouldn't cross paths with otherwise. That's been a big piece of this. It's about the community, about getting people together and having them have conversations. And this is why we do it in less of a Juniper commercial fashion than we do in a fashion of an open community. So folks have met. We do a lot with our partner ambassadors. They're here quite a bit. So that collaboration is also key because, again, it takes the community. And that's our CyberWire special edition. Our thanks to Juniper Networks for hosting us and

for sponsoring this show, especially Oliver Sherman and his team for putting together a first-class event and making it all look easy. Our Cyber Wire team was Jennifer Iben, Kelsey Bond, Bennett Moe, Peter Kilby, Tom Hanson, and I'm Dave Bittner. Thanks for listening. Thank you.