[ale] Sunday 05-22-05 6PM RUN-AS-ROOT CHALLENGE

[Geoffrey]

ChangingLINKS.com wrote:
>  On Tuesday May 17 2005 18:02, Geoffrey wrote:
>  > > CHALLENGE:
>  > > 1. If no one can down/infect/harm my system for more than 20 minutes
>  > > TOTAL - you fix (or have fixed) the 6 problems that I posted (and give me
>  > > exact directions on how to apply the fixes myself.)
>  >
>  > You're on.
> 
> . At 1800 (6PM) on Sunday 05-22-05 the challenge will begin.
> . I will setup my box like so: Internet -> broadband cable modem -> box
> . I will drop all firewall rules 
> . Geoffrey can confirm by phone that he has no problems reaching /
> . I will leave the system open for 30 minutes
> . During this time anyone on the ALE list can hack at my DAILY USE box
> . At 1830 (6:30PM) I will restore the entire computer within 10 minutes.
> . Finally, I will post the procedure for restoring the system as proof.

As previously noted, I will not be available Sunday.

> 
> Overview of the system:
> This challenge is similar to Bob Toxen's "expert hacker" challenge. Like him, 
> I will give away the IP address. 
> 
> Unlike him, though, I will go much further:
>  I will give everyone the root password
>  I will be running as root the entire time
>  I will drop all firewalls and typical security that I run
>  I will NOT have a "hot spare" - or more than 1 hard drive in the box
>  I will run a server including Apache, PHP 
>  (Bob said it was very insecure awhile back), 
>  MySQL, Perl, sshd (if I remember to start it)
>  I will NOT add or remove hardware during or immediately after the challenge.
>  Moreover, I will do my best to verify that ALL of you can reach root. 
> 
> For this challenge, I will be removing personal data from the system. My worry 
> is not to protect it from loss, but since I will be giving FULL access to the 
> entire box - and want to keep the private data private. Outside of the 
> missing data, the lack of firewalls, and the direct connection to the 'Net, 
> you will have direct access to the setup that I run everyday as root. I can't 
> think of anything else that will aid my defeat. My point is that I will not 
> try to hinder the hacking - I will let the box sit "insecurely." 
> (Note: I have been having weird net connection problems for a week or two. 
> It's been ultra slow. If there is a connection problem on Sunday, we can move 
> the challenge to whatever time I can connect. The downtime is short-lived.)
> 
> Rooting for the visitors:
> Some strategy is in order. Some of you may want to run rm -rf / as root while 
> others may want to install some type of virus or trojan. I suggest you use 
> this thread to coordinate that - so that you won't bump heads.
> 
> 
> 
> Challenge results:
> The challenge will have no "tie." I will either restore the system back to 
> clean state quickly (and outline how I did so), or I lose the competition.
> 
> IF I am unable to restore the system, I would like there to be a consequence. 
> That's what makes challenges fun. Perhaps I can fund the pizza for the next 
> Installfest ($100 worth) or something like that.
> 
> IF I am able to restore the system and explain what steps I did to make sure 
> that it's "clean" and fully restored, Geoffrey will be responsible for 
> providing me with clear instructions on how to fix the SIX problems (with my 
> OS - not Gentoo :) ) that started this thread - within a reasonable amount of 
> time. The six problems include and are limited to: 1. Unstable browser. 2. 
> Reset mpu port to 300 3. Fix Gnutella  4. Get scanner working 5. Install IVTV 
> driver 6. Get noteedit to produce sound 
> I would like the instructions so that I can apply the changes *myself* (for 
> security reasons and to learn the solutions). I will forward the journals 
> that I kept on the issues and take significant steps to assist him.
> 
> 
> 
> My goals:
> 1. To get my system fixed within a reasonable amount of time.
> 2. To prove that I can safely run as root all of the time.
> 
> As you all know, I am NOT an expert. I don't like reading manuals much. Most 
> of the time, I don't even fully understand them. I am not a professional 
> system administrator. I am just a guy who uses Linux to get things done.
> Thus, it should be easy for the group to defeat me in this challenge. 
> 
> I hope the most vocal anti-run-as-root crowd who sometimes come off as 
> "know-it-alls" (i.e.: James Sumners, Jonathan Rickman, George Carless, Jason 
> Day, Jerald Sheets, et al) will be available to participate. Moreover, in the 
> event Geoffrey needs assistance, my hope is that the "RTFM, It's not a Debian 
> problem" people will help him.


-- 
Until later, Geoffrey