Digging In
The first day of competition is always the most exciting for the Red Cell Hackers and the most stressful for the Blue Cell Defenders. Palms sweat and knees bounce in anticipation as both Attacks and Defenders wait for the clock to announce the start of the competition. The Red Cell Hackers silently grin at each other, as they know the first day almost always ends in their favor. This is where the hackers dig into poorly configured and vulnerable systems, using a barrage of tools and techniques including Metasploit, w3af, and custom scripts developed by the hackers specifically for this event. The primary goal of the attackers is to establish "persistence" on as many systems as possible before the defending teams are able to adapt and effectively defend their systems. The Red Cell Hackers use many techniques to obfuscate their presence in the systems they compromise. This technique requires the Blue Cell defenders to have a keen eye toward identifying abnormal accounts, behaviors, and files on their systems. Once they've identified an intrusion, the Blue Cell teams must figure out how to extract the malware and repair any backdoors embedded into their systems. These invaluable skills will be an asset to students as they pursue a career in information security.
High-Tech Badges and Equipment
Another unique twist to this year's Mid-Atlantic CCDC competition was the use of XBee 802.15.4-compliant radio-enabled badges. Each competitor was required to wear a badge during the competition, and each badge acted as a power meter, similar to those used in industries and consumer's homes to track and monitor power consumption. For the competition, the XBee badges represented power nodes, integrated into the Smart Grid power systems that each team was required to manage and protect. The badges were configured to emit a predetermined amount of power usage at regular intervals. The power usage was transmitted and collected by back-end infrastructure, and then tallied and scored for each team's environment. A team's power usage represented a critical element to its overall success. If a team's Smart Grid infrastructure reported that its system was utilizing too much power, the team's score would take a hit. The goal of these intelligent badges was to simulate some of the components that make up a Smart Grid infrastructure, immersing students into the game play of regulating power usage, as they must ensure that no abnormal activity existed.
Cracking the Badge
It didn't take long for the Red Cell Hackers to discover the inner workings of the XBee badges and start to manipulate not only the badges themselves, but the back-end infrastructure that was used to support the Smart Grid system. Like the competing students, each Red Cell Hacker was given an XBee 802.15.4 radio consisting of an Arduino Duemilanove clone microcontroller with an integrated XBee radio. The Hackers discovered that each radio was assigned a unique address, mimicking XBee radios commonly used in consumer applications.
The hackers were able to determine that the radios assigned to the competing teams were configured to use the same channel and network (known as a universal identification, or PAN ID). This design provided the hackers with a foothold to manipulate not only the Blue Cell's badges, but to craft attacks against the back-end infrastructure that each team depended on to assess its power usage. The hackers reconfigured their badges to mimic those owned by competing team members. With the badges cloned, the hackers had complete control over the power usage of those hacked badges and could dramatically increase the power usage of their competitors' badges.
As teams began to notice significant increases in their power consumption, they devised defense strategies for protecting their badges. In an example of a high-tech cat-and-mouse game, the Blue Cell teams changed their badges' addressing, and in some cases even started to send negative values to lower their power-consumption scores. In the exchange of attacks and defense, the hackers escalated the stakes by creating custom code that converted their badges into a denial-of-service (DoS) Smart Grid attack platform. The hackers changed the configuration of the XBee devices to cover all possible addressing combinations and then proceeded to send maximum power usages to their opponents. During this exchange, students learned a valuable lesson that often takes security professionals years to understand—that it's not always possible to defend against all vectors of attacks. Sometimes the best solution is simply to mitigate the risk, rolling with any attacks that might happen.