Tutorial: Wargames: Part 3 -- LONG!

[hypronix]

Isn't that every instructor's dream, to see his subjects rise above?

Of course, luckily that's not what happened with the Hitler Youth, but you get my jist... I'm still amazed, after my time here on AO and on the Internet in general, that people - from home users to webadmins - often regard security as something of an option, not a requirement. In some cases, I guess black hats teach some sense into those people [of course, we have Skids to worry about too, when regarding the home user]

Anyway, I wouldn't share APs unless there was a meaning to it. So, again, great job on the tut. Waiting for number 4!

[PM8228]

I guess I had a different idea. While I do not have a box that you can harp on. My idea was that people would sign up for teams (or teams would be randomly decided). The defenders would try to prevent the attackers from gaining access. There could be a program or something that an attacker would run to let the Monetors know that a certain box had been broken. The rules would go something like....

1) No DoS
2) Do Not Delete, Ruin, or do anything to the victims machine except run the specified program
3) Log what you did so that people can learn from it

That type of thing. Thoughts? RuleS?

-Cheers-

PS: Flames?

[hypronix]

So who's box will this be done on? I guess that's the main issue, the idea of having two teams and people randomly trying to hack eachother... uhh sounds kinda harsh [but I'm sure some people wouldn't mind doing it . however, what about the newbies in this type of thing?]

Hmm I think if somebody [attacker] is traced or there's conclusive evidence that he/she penetrated the box [which doesn't mean 'win' yet] the GameMasters can take him out of the game. Kinda like when the Feds are knocking on your door, you know :P

[Tiger Shark]

Ms. M:

And if you're truly creative with a *nix box you can use a sniffer to act as your logger.

I can do that with a "winners" box too..... and it isn't that creative, really..... send syslog to a fake IP and have a stealthed Snort box log all traffic.... Not too difficult..... And, No, it wasn't my bright idea.... ...... but it works really well....

My point is that in the edu situation you can sit down with your attacker and "slap it out of them". In the "real world", just about the only thing they will have _after_ the dirty deed is their logs. I would suggest that, since the question is not "if" but "when" they get "hacked/cracked/owned or whatever it's called today..... when they regenerate their system from scratch, what will stop it from happening 3 minutes later

It's the logs that's the Art of security in the end, IMO.... The less you know - the more you log and secure them. Without the logs, even after a successful attack, you are blind. Personally. I log everything, sometimes doubly or tripley, (are those words?), so that I have a record of what happened. Then I can learn from the logs if nothing else......

Ms. M. .... Yep it's a criticism, it's supposed to be constructive and _I_ believe it's very important.... Much more important than people give it credit for...... We see so many "I've been hacked" threads here that either have no logs to look at or, if they have any, can they be "trusted"...

It's my "little bugbear".... What can I say......

[Sunflare]

My Favorite type of wargame is your basic espionage one...

The defender saves a "top secret" file somewhere on their system, and puts whatever defenses they can on it. The file contains a single phrase... the attacker wins if they can tell the defender the phrase, the defender wins if either:
a) the time for the game expires (they've successfully kept the file secure)
b) They trace the attacker (if the attacker gets the phrase but is traced, the defender wins.).

-Extra points go to the attacker if they can retrieve the information without the defender knowing about it, and for the ammount of time left before the challenge is over.

-Extra points go to the defender for every service they have running from the box that could be a security problem(ftp, web server, wireless LAN, etc).

-The defender must be able to access the information somehow from a remote machine.
-The attacker is not allowed to trash the system (The worst violation of this I've ever seen was when someone managed to flash their opponent's BIOS to a game of PONG)

Maybe we could get a few games of this going?

[hypronix]

How would you give points depending on the service? Like, what if, for example on a windows box, somebody installs an older version of a FTP client so that it has flaws, does that give them more points? [I understand it's quite pointless to have a flawed version of something, but this is all theory ]

[ZreK]

Great post, can't wait until the next one comes out

[PM8228]

Sunflare, I like your espionage idea. In fact, I think Sunflare has outlined a great idea, if we could flesh it out more it would be great. Each member of the defense would have a "secret file" and the attacking team would work to get as many as they could. Basically Sunflare, and people could have like registered clans and rankings, and individual rankings and all that. I would love the help set it up, I would not even mind being the target (no DoS because I am on a home LAN and I need internet or my brother/'rents would get pissed). The only trouble is that while I try to secure my computer, I am still a relative newb at security.

-Cheers-

PS: AIM: Wix 555 Lesser Evil
Email: [email protected]

Lets try to develope a system and stuff. Then make a website. Let the Games begin!

[qod]

printed them all, and looking forward to the next one

[Mcvay]

nice nice, i love this stuff man.

I showed part 1 and 2 to my teacher at school, and he said that it brought him on an idea.

So hopefully were also gonna do some wargames in class.

I really hope so, they seem to be fun.

nd its all thank to you MsMittens