How much does it take to hack a mobile network?
Is electronic government secure
in the era of WikiLeaks and Anonymous?

Is SCADA hacking a Hollywood fiction
or the nowadays reality?
Internet banking: is there any chance to win
over the fraudsters?

Cyber-crimes, cyber-espionage, cyber-war: where do we draw a borderline?

Pages

Wednesday, June 27, 2012

Show Me the Money! The $natch Competition at PHDays 2012


The visitors of the Positive Hack Days 2012, which took place in the Digital October Center, not only had a chance to listen to reports by information security professionals or watch the epic CTF battle, but take part in discussions over important industry issues at specialized sections.

Among such discussion platforms, there was a section called How to Protect Money, moderated by Artem Sychev (Head of Information Security Department, Rosselkhoznamk). Along with theory – discussions over the security challenges of the banking sector, – the section offered a practical task: the $natch competition. The competition tried out participants’ skills of exploitation of typical remote banking vulnerabilities, rather logic than web ones.

Specially for the competition, we developed our own remote banking system from scratch and imbedded common vulnerabilities revealed by Positive Technologies experts in the course of security assessment of such systems. The solution called PHDays I-Bank was a standard Internet bank with a web interface, PIN code to access the account and a processing.


The day before the competition the participants received an image of an operating system with the installed remote banking (and its source code, of course) and a test base. Thus, they have a day to detect the vulnerabilities and write an exploit for them. During the competition, each participant got their personal login and password to the remote banking system and a real bank card bound with a specific account. 


The competition lasted for 30 minutes. The participants were to hack the base (this time – operational), transfer money to another account and then, use the bank card to cash out the money in an ATM waiting in for the winners in the lobby.

Though it was not officially announced, the money could have been stolen not only from the “bank” but from other participants as well :) The balances were displayed on a large screen, so during the 30 minutes the guests could follow the game and know who had managed to steal get more money. 



Finally, the competition was won by Gifts, who could take out 3,500 rubles, followed by Chipik (900 rubles). The third place was taken by Raz0r. The game was fair: ATM gave out all the amounts they earned.


CTF vs. Online HackQuest

Then it was time for the CTF teams to join the competition. Their task was to ensure the system’s security. The contestants were also given the image of the operating system with the remote banking, its source codes and the test base. They had 4 hours to detect and eliminate the vulnerabilities on the condition that the system functionality remains unchanged. In other words, the secure but not working system was not an option. 

The role of hackers was played by the Internet users participating in the Online HackQuest competition. When they were granted a VPN access to the network, they had 30 minutes to attack the system and take out the money from the CTF teams’ account.  Detailed description of the rules is published in our blog entry. In the end, the CTF teams snatched the victory: they managed to save almost all their money.

Both the participants and the on-lookers enjoyed the competition immensely and unanimously called it the star turn of the forum’s program.  We already have some ideas of how to make the competition even more exciting and entertaining and will try to embody them in PHDays 2013. So, see you next year!

P. S. We’d like to point it out once again: the remote banking system used for the competition was developed by Positive Technologies specially for the PHDays 2012 competitions. It IS NOT USED in any real bank; though, it is as similar to the real systems as possible and contains vulnerabilities typical for such systems. 

52 comments:

  1. All information that you need to know about how to write summer homework you will find in this blog. Thats why I think that you should check it out

    ReplyDelete
  2. Great site and a article as well. In turn, I also want to share with you one good writing service wich provides help with an essay for students - draftify.net. A very professional team with great writers and amazing support.

    ReplyDelete
  3. If you are a student, do not waste your time and relieve your stress by letting our writers work on your academical papers. That's good you can make such desicion and I'm sure you will not regret it ever.

    ReplyDelete
  4. Hi! I stumbles over you post and decided to add some information. If you have no time fro writing papers then you can apply to the essay writing service and find there college essay topic help It is comfortable and saves time!

    ReplyDelete
  5. Very much impressed with this post. Please do find the latest. best men’s cologne of all time

    ReplyDelete
  6. Look for custom term paper writing service that guarantee your research proficiency. Seek our Cheap Custom Essay Writing Services that will provide you competent top writers with excellent research abilities.

    ReplyDelete
  7. A great competitor to check the skills and to find new tech talents. This is not so easy to be a part of such a community and usually, the most successful developer is the most focused and it is so interesting when you deliver one of the steps that makes you closer to your aim. This is the miracle from one part, but you need to listen to yourself to be extremely focused on things you like.

    I used to experience with this thing when I've got work after my university at writing service https://essaypro.com/write-my-essay.html. I'd found out that if I want to be a master of something, I need to be master of simple things like personal finance, personal planning, personal relation, personal dietician, personal training. Why is it so important to contest like described. Because these things are very closer to you and you have a direct impact.

    This was the lesson from my university, that I will remember all my life. Be patient to everything near you, as this life is not about the future this life is about the current moment.

    ReplyDelete
  8. I am glad that I saw this post. It is informative blog for us and we need this type of blog thanks for share this blog, Keep posting such instructional blogs and I am looking forward for your future posts.
    Cyber Security Projects for Final Year

    JavaScript Training in Chennai

    Project Centers in Chennai

    JavaScript Training in Chennai

    ReplyDelete
  9. Hey! Nice information dude! The article is really informative and i would like to the author of the blog for the nice blog.

    I have also some blogs find the latest article here.

    PS Vita Emulator For PC Free Download

    Lookout Premium Apk

    Best Android App Killer Battery Saver

    ReplyDelete
  10. Nice Article thanks for sharing. Try this amazing app http://ggmodzpro.download/ for android decices to install this App

    ReplyDelete
  11. Online psychology paper writing service companies are very keen when it comes to Psychology Research Paper Services for students stuyding psychology studies in order for them to score straight A’s in their custom psychology research papers.

    ReplyDelete
  12. Get all the updates and replays online in hd. All the pinoy lambingan tv replays you will be watch online in hd.

    ReplyDelete
  13. Hey! Nice information dude! The article is really informative and i would like to the author of the blog for the nice blog.

    I have also some blogs find the latest article here.
    most addictive android games offline

    ReplyDelete
  14. The ultimate goal of e-commerce assignment writing services is to provide E-commerce Essay Writing Services and e-commerce research paper services since most business assignment writing service students lack time to complete their custom e-commerce homework writing services.

    ReplyDelete
  15. I have also wish to examine the ATM machine and want to know how this machine takes out the money about the requirements. This is the best information for us. I hope you will provide me with one chance of visiting the ATM machine. dissertation writing services

    ReplyDelete
  16. Social science essay writing help has become very popular among students seeking Social Science Writing Services and social science coursework writing services.

    ReplyDelete
  17. Professional History Research Paper Services is very popular for students in search for history essay writing help services and history assignment writing services.

    ReplyDelete
  18. Human resource assignment writing services are not hard to come across for those in need of Human Resource Writing Services and human resource research paper writing services.

    ReplyDelete
  19. Among other courses, nursing coursework writing services has become popular since students seek Nursing Research Papers Services and nursing assignment writing services.

    ReplyDelete
  20. Apkprofit APK profit | Download free Games Tools Apps free APK files
    what a fantastic post! This is so chock full of useful information i can not wait to big deep and start utilizing the resources you have given me your exuberance is refreshing ,i am very thankful to the admin for sharing the great content with us

    ReplyDelete


  21. This is a powerful archive tool that lets you open, create, and manage archive files.
    Supports all file formats including zip, 7z, ISO, and other common formats. OneArchiver can add an exported file to a virtual drive.
    WinArchiver Virtual Drive Crack is a free virtual CD / DVD ROM tool. It can include all popular CD / DVD image files as well as all popular files.
    Without the original CD / DVD, you can play programs and access files from virtual drives.
    Virtual drives run 200 times faster than traditional CD / DVD ROM drives.
    Download it free from here:
    https://softserialskey.com/winarchiver-4-8-full-crack/

    ReplyDelete
  22. Students often prefer to opt for assignment help in business report writing. Study reveals that many students find report writing a tedious task when they are not aware of fairly standard sections. So as to write a professional business report, the person has to be well equipped with both practice of business and theories, beside some first-hand experience and ways to conduct accurate research to back up the finding.

    ReplyDelete
  23. Assignment Help Australia has been working in the field of academic writing for years. It not only offers building assignments from the scratch but also provides sample assignments. The sample assignments are provided under the tag of sample assignments on our website. It is the best assignment help website that is available for the students in Australia.

    ReplyDelete
  24. Use Assignment Helper administrations in the event that you don't discover anything to form your scholarly paper or schoolwork. Now and again, you can't focus on your investigations in view of being occupied with numerous exercises and discover hard to compose your assignment.

    ReplyDelete
  25. We offer Custom and Assignment Help Australia

    Help to both College and University students who are stuck with their research projects, essays, case studies, business reports and need Urgent Assignment Help.

    ReplyDelete
  26. Are you facing an error updating your QuickBooks software? The reason could be the corrupted download files not allowing you to update the QuickBooks application and trigger QuickBooks error 15106. The problem generally occurs due to the presence of a spy sweeper on your computer. Another reason could be you might not have a login as an administrator. Not having enough administrator privileges also triggers 15106 error in QuickBooks. To fix the problem, you can try to uninstall spice speaker and logged in to your system as an administrator. Further, you can also try to reset the update a clean installation of QuickBooks. Still, facing an error 15106? Call us to get rid of this issue.

    ReplyDelete
  27. What is the first thought that came into your mind when your new Epson printer finally got delivered to your home? You must be thinking about how amazing it is, Right? But we are not talking about that right now. Now that your printer is next to you, it's time to worry about Epson Printer Setup and how to get started with it. It’s not going to be easy but it shouldn’t be troublesome either. You can simply follow the setup manual you got with your printer and complete the setup in a jiffy. If you don’t find the manual much helpful, feel free to visit our website and get help from our resources. From unpacking the printer machine to installing toners, ink cartridges, and installing printer drivers, you can find everything that you are looking for in one place. So, what are you waiting for?

    ReplyDelete
  28. Place an order for Assignment Help in Singapore so you can connect with professional writers. Pay a good amount to buy the services of online assignment help even in Singapore.

    ReplyDelete
  29. Thanks for sharing such a awesome information, I hope you provide more best and unique content here.


    Driver Booster For PC

    ReplyDelete
  30. The Ascent is a leading Variable Capital Company Singapore, which provides fund administrator as per the client's specific needs. As a fund administrator, Ascent performs various sets of activities, including fund accounting, NAV calculations, etc.

    ReplyDelete
  31. QuickBooks requires license data to get started and it throws an error 3371 when it can’t access them. The problem could have caused due to missing or damaged files and QuickBooks error 3371 appears followed by the status code either 11118 or 1. You can resolve the problem in several ways, however, the most effective one is renaming the entitlement file. For that open the run dialogue box and paste this file path – C: DocumentsandSettingsAllUsersApplication DataIntuitEntitlement Client V2. and hit enter. Now you can rename the EntitlementDataStore.ECML to fix the error 3371.

    ReplyDelete
  32. Most of the dissertation begins with emerging research idea or topic followed by thoughtful and well-crafted research proposal and at last a full proof write up of it. Primarily, it is crucial to first come up with list of dissertation topics which is emerging and current concern of debate, and then the research questions and objectives of it that holds significance.

    ReplyDelete
  33. Follow the steps given below to fix your HP LaserJet Printer Error Code B0605.
    Don’t follow the below procedure if you are not handy with your computer. In that case, you can take the help of our HP Support printer experts and let them fix your problem instead.

    1. First of all, you need to bring your HP printer in the boot code mode.
    2. Press and hold the Cancel button and then press OK.
    3. Now switch on your printer once again and keep on holding the power button until the control panel shows up. You will see Hewlett-Packard written in the first line, followed by Boot code in the second line.
    4. Your printer is not in boot code mode 2. Make sure your HP printer is connected to your computer using the USB cable.
    5. The next step is to run the HP LJ P2055 firmware update utility which you can download from the HP website.
    6. Once the utility is launched, select your HP LaserJet P2050 printer from the dropdown list and then select Send Firmware.
    7. You will now see a message that says Downloading Update Data on your printer screen. The message will be followed by programming App Flash. You need to wait until the upgrade is finished.
    8. At last, your HP Printer will restart automatically and you will see Ready status on your printer screen once it is started.

    ReplyDelete
  34. Are you feeling uninterested when you are working on your homework or any academic project? If your answer is yes, then you have to divert your attention to Assignment Help services. You need to write plenty of assignments during your higher education to score good marks. Whenever you enter into Malaysia universities, you need to be more focused and dedicated to your work to add bars in your academic performance.

    ReplyDelete
  35. How To Writing a Letter of Demand? Before you start the letter, understand your relationship with the individual who owes your money. Is it a relative or friend or someone? Well, if you want to know everything about How To Writing a Letter of Demand, let’s get in touch with our assignment help writers who will help you and provide you the best service.

    ReplyDelete
  36. When it come’s to ordering your pestel analysis Assignments, College Essays, need help with Homework or any other academic help, than My Assignment Help is the best website you can order your assignment from.

    ReplyDelete
  37. Assignment Help Malaysia is the best option to complete academic papers without any stress. If you don’t want to degrade your academic performance, make sure to connect with the professional service provider of assignment writing help.

    ReplyDelete
  38. Who can provide me with the simplest law assignment help? is that this the question baffling you? Well, we at the best assignment experts understand that it's difficult to try to to your law assignment help with none professional help.

    ReplyDelete
  39. Perfect post admin wonderful content thanks for sharing here. HTC Fastboot Drivers

    ReplyDelete
  40. The android phones always have new and trandy apps to download! as the trend is changing. The major reason for android popularity is the diversity among the public. Thanks to cheap and easy to use android is getting popular among masses

    ReplyDelete
  41. Wow, such an awesome blog you have written there and you and I get exactly what information I am looking for, in the third paragraph you put amazing effort to explain the theme of the content. As a content writer, I can understand efforts because when students ask me for essay help, I do the same.

    ReplyDelete