Hacking Exposed Computer Forensics Blog

Showing posts with label redteam. Show all posts

National CCDC 2018 Redteam Debrief

Hello Reader,
Another year of CCDC is over and another winner has been crowned.

For those of you just here for the presentation, here are this years debrief slides:

https://www.dropbox.com/s/o2fkwbjsefq1ixk/NCCDC2018.pptx?dl=0

For those of you looking for more:

This year at Nationals we had a lot of success as a red team From 0 knowledge (Except ips in scope) to plain text credentials in 3 minutes ensured that our initial load of persistence was successful. However like in all great pursuits it was not perfect. This year we attempted different delivery and propagation techniques that need to validate our malware was successfully implanted to make sure all systems are talking to us.

Speaking of talking to us this year teams got better at their egress filtering and locking down incoming services. This means we have to get better at backdooring existing services and work on techniques that don't require call backs that egress filtering will stop.

Lots to plan, lots to do for next year.

Also Read: National CCDC 2019 Redteam Debrief

redteam

National Collegiate Cyber Defense Competition Red Team Debrief 2017

Hello Reader,
I've been busy lately, so busy I didn't get around to posting this years red team debrief from the National CCDC. After just leaving Blackhat/ Bsides LV/ Defcon and running our first Defcon DFIR CTF I thought it was important to get these up and talk about the lessons learned.

The Debrief

First of all for those of you coming just to get the presentation its below:
here: https://www.dropbox.com/s/fy23c7wi35qe81b/NCCDCRedTeamDebrief2017.pptx?dl=0

For those of you who have no idea what any of these means, let me take a step back.

What is CCDC?

The National Collegiate Cyber Defense Competition ( CCDC ) is a now 12 year old competition where colleges around the United States form student teams to defend networks. CCDC is different from other competition involving network security as it focuses strictly on defense. Students who play are put in charge of a working network that they must defend, the only offensive activity in the competition comes from a centralized red team.

The kind of enterprise network students take charge of changes each year. Past years business scenarios have included:

Private Prison Operator
Electric Utility
Web hosting
Game Developer
Pharma
Defense Contractor
and more!

The idea is that the last IT team has been fired and the student team is coming in to keep it running and defend it. While the students are working on making sure their systems are functioning they also have to watch for, respond to and defend against the competition red team.

Scoring happens a couple ways.

Students get points for:

Keeping scored services running (websites, ecommerce sites, ssh access, email, etc..)
Completing business requests such as policy creation, password audits and disaster recovery plans
Presenting their work to the CEO of the fake company
Responding to customers

Students lose points for:

Red team access to user or administrative credentials
Red team access to PII data
Services not responding to scoring checks aka services being down
SLA violations kick in if the service stays down for a period of time

There are now 160 universities competing in 10 regions across the united states. If a student team wins their region they make it to nationals where the top 10 teams in the country compete for some pretty amazing prizes, including on the spot job offers from raytheon.

If you are a student or a professor who would like to know more about competing you can go here: http://nccdc.org/index.php/competition/competitors/rules

What is the National CCDC Red Team?

The National CCDC Red Team is a group of volunteers who works to build custom malware, c2 and exfiltration and persistence strategies to bear each year to give the students the best real world threat experience. I'm the captain of the red team and have been for the last 10 years.

How do I get on it?

When the call for volunteers goes out send a resume to volunteer@nccdc.org.

Be advised our threshold for acceptance is very high and we look for the following:
- Active projects on github or otherwise to show your experience
- Real experience in developing, maintaining and layering persistence
- Custom malware kits that are unpublished to bring to bear

We don't care about certs, years of experience or who you work for. We need people who can not only get in (the easy part) but to stay in over a two day period of competition while an aggressive group of defenders seeks to keep you out.

Also Read: Daily Blog #381 National CCDC Redteam Debrief

redteam

Daily Blog #381 National CCDC Redteam Debrief

Hello Reader,
The 11th year of the National Collegiate Cyber Defense Competition has ended, congratulations to the University of Central Florida for a their third consecutive win. I hope you make it back next year for another test of your schools program and ability to transfer knowledge to new generations of blue teams.

If you want to show your support for my efforts, there is an easy way to do that.

Vote for me for Digital Forensic Investigator of the Year here:

https://forensic4cast.com/forensic-4cast-awards/

However the team that won over the Redteam was the University of Tulsa who came with a sense of humor. Behold their Hat and Badges: