October is national Cyber Security awareness month, and what better way to promote it than with the 2010 Hacker Challenge.

The 2010 Hacker Challenge Logo

The Hacker Challenge is a competition in which Department of Defense Sailors, Soldiers, Marines, Airmen and civilian government employees try their hands at solving computer and network security problems. It’s a free and open competition designed for beginner to intermediate level security professionals and enthusiasts, and is designed to engage military and civilian members in a fun and educational way.

It started three years ago as a way to address training deficiencies in some of the military’s mandatory computer security training courses.

Hacker Challenge 2010 Details

The 2010 Hacker Challenge begins on October 27, 2010, and ends November 10, 2010.  During this two week period, participants will work at their own pace to solve the challenges. If you’re interested in participating in the 2010 Hacker Challenge, you must sign up before October 25, 2010.

Teams of up to 6 members are allowed, including one person teams.

The Hacker Challenge is comprised of two parts – a written portion and a hands-on portion. The written portion involves a series of questions that will test a participant’s knowledge of technology and security topics. The hands-on portion will test the participant’s security knowledge through the use of tools during practical exercises. Some challenges will be easier than others. For a few examples see the sample Hacker Challenge questions below.

This is a friendly competition, and does not involve the use of any malicious software. There are also strict rules on cheating, and what is considered cheating. Any team caught cheating will be disqualified, and it will be publicized on the Hacker Challenge blog.

Sample Hacker Challenge Questions

Below are a few of the questions you might find in the Hacker Challenge competition. These questions were taken from the 2009 Hacker Challenge. Remember this contest is for beginner to intermediate level security enthusiasts.

1) Download and crack the passwords found at this link.

2) You perform a banner grab against a customer’s web server and get the following response. What does it mean?

GET / JUNK/1.0
HTTP/1.1 200 OK
Date: Sun, 15 Jun 2003 17:17:47 GMT
Server: Apache/1.3.23
Last-Modified: Thu, 27 Feb 2003 03:48:19 GMT
ETag: "32417-c4-3e5d8a83"
Accept-Ranges: bytes
Content-Length: 196
Connection: close
Content-Type: text/html

3) Download the packet capture in the below link and look at the device with the MAC address of 00:12:0E:6F:B4:4B. What is this device, and what do you think it’s doing during the time period traffic was captured?

4) Watch Hak5 episodes 1 and 3 from season 4 and pay attention to the sections dealing with the “WiFi Pineapple.” Discuss how the WiFi Pineapple is able to masquerade as a “trusted” AP and suggest at least one way that a user can tell this type of attack is occurring.

5) Dig through the below captured packet and state the following things: (a) What browser is being employed? (b) What application on the browser will be used? (c) What OS is being used? (d) What device did this packet come from?

0000    00 04  5a f2  25 d8  00 12  0e  6f b4  4b  08  00   45  00
0010    00 de  a2 ab  40 00  40 06  b5  3d ac  14  14  05   4a  dc
0020    d7 3b  05 f9  00 50  c5 5f  13  be 38  8e  eb  66   50  18
0030    0b 68  c9 47  00 00  47 45  54  20 2f  63  68  75   6d  62
0040    79 5f  76 69  64 65  6f 73  2f  62 61  6c  6c  73   2e  66
0050    6c 76  20 48  54 54  50 2f  31  2e 31  0d  0a  48   6f  73
0060    74 3a  20 72  62 65  6c 6f  74  74 65  2e  6e  65   74  0d
0070    0a 41  63 63  65 70  74 3a  20  2a 2f  2a  0d  0a   55  73
0080    65 72  2d 41  67 65  6e 74  3a  20 4d  6f  7a  69   6c  6c
0090    61 2f  35 2e  30 20  28 63  6f  6d 70  61  74  69   62  6c
00a0    65 3b  20 55  3b 20  43 68  75  6d 62  79  3b  20   4c  69
00b0    6e 75  78 29  20 46  6c 61  73  68 20  4c  69  74   65  20
00c0    33 2e  30 2e  34 0d  0a 50  72  61 67  6d  61  3a   20  43
00d0    68 75  6d 62  79 0d  0a 43  6f  6e 6e  65  63  74   69  6f
00e0    6e 3a  20 63  6c 6f  73 65  0d  0a 0d  0a

For more information on Hacker Challenge 2010, visit the official website.

Coming Soon: The Advanced Hacker Challenge

If you are a security professional in the advanced category, don’t lose hope. In late 2011 an advanced Hacker Challenge will be introduced, and it will be completely different from the basic/intermediate version. The new advanced version will be almost completely hands-on. The advanced version write-ups will require a deeper understanding of security concepts, and the targets will be a bit of a challenge. And FYI, some of the advanced challenges will require participants to sign a “release of liability” form.