Defcon Capture the Flag: Defending Vulnerable Code from Intense Attack
نویسندگان
چکیده
Defcon’s Capture the Flag (CtF) game is the largest open computer security hacking game. This year’s CtF hat rules that made it particularly difficult to be a successful defender. We entered an Immunix server, comprised of five years of IA&S, OASIS, FTN, and CHATS technologies, to see whether this system could survive sustained attack from determined experts. We describe our experience surviving Defcon CtF.
منابع مشابه
Scalable and Lightweight CTF Infrastructures Using Application Containers
Attack-defence Capture The Flag (CTF) competitions are effective pedagogic platforms to teach secure coding practices due to the interactive and real-world experiences they provide to the contest participants. Two of the key challenges that prevent widespread adoption of such contests are: 1) The game infrastructure is highly resource intensive requiring dedication of significant hardware resou...
متن کاملWatch What You Write: Preventing Cross-Site Scripting by Observing Program Output
We introduce a dynamic technique for defending web applications that would otherwise be vulnerable to cross-site scripting attacks. Our method is comprised of two phases: an attack-free training period where we capture the normal behavior of the application in the form of a set of likely program invariants, and an indefinite period of time spent in a potentially hostile environment where we che...
متن کاملPartitioners Track: Generating Security Vulnerabilities in Source Code
This paper describes a framework, which modifies existing source code to generate security issues. An example plugin for generating SQL injection in Java source code is described. The generation process is based on static code analysis techniques like dataflow analysis and abstract syntax trees. The framework is evaluated with the help of Java projects from GitHub. One modified project was succ...
متن کاملMitigating Node Capture Attack in Random Key Distribution Schemes through Key Deletion
Random Key Distribution (RKD) schemes have been widely accepted to enable low-cost secure communications in Wireless Sensor Networks (WSNs). However, efficiency of secure link establishment comes with the risk of compromised communications between benign nodes by adversaries who physically capture sensor nodes. The challenge is to enhance resilience of WSN against node capture, while maintainin...
متن کاملForcement Learning Agents
We introduce two novel tactics for adversarial attack on deep reinforcement learning (RL) agents: strategically-timed and enchanting attack. For strategicallytimed attack, our method selectively forces the deep RL agent to take the least likely action. For enchanting attack, our method lures the agent to a target state by staging a sequence of adversarial attacks. We show that DQN and A3C agent...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
عنوان ژورنال:
دوره شماره
صفحات -
تاریخ انتشار 2003