<div dir="ltr"><img src="cid:15df6d1430ecb971f161" alt="image.png" class="" style="max-width: 100%; opacity: 1;"><br><br>Like - this is fascinating. <div>Shellphish gets it first, then later ForAllSecure gets it. But are they replaying it? Why doesn't Shellphish patch their version (or if they do, why doesn't it work?) ? Why doesn't ForAllSecure's work against Diseckt later? </div><div><br></div><div>I still have so many questions about the CGC.</div><div><br></div><div>Bug is interesting too...</div><div><img src="cid:15df6d398a5cb971f162" alt="image.png" class="" style="max-width: 100%; opacity: 1;"><br></div><div>-dave</div><div><br></div><div> <br><div class="gmail_quote"><div dir="ltr">On Fri, Aug 18, 2017 at 10:58 AM Dave Aitel <<a href="mailto:dave.aitel@gmail.com">dave.aitel@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">So basically what we REALLY want is to know which team found a POV first? That CPUID thing did make it into the video btw. That really complicates the analysis. If you ran this again, maybe there is another way?<div><br></div><div> <a href="https://github.com/lungetech/cgc-challenge-corpus/blob/master/CROMU_00055/src/proto.c" target="_blank">https://github.com/lungetech/cgc-challenge-corpus/blob/master/CROMU_00055/src/proto.c</a> <--would def. expect simple static analysis to find this. (Shellphish found it first, I think, but you would expect every time to find this?)</div><div><br></div><div>How many vulns did Shellphish find that no one else found? What's the overlap rate? I see a lot of stack corruption bugs in the corpus - do we have statistics for what the types of vulns solved were?</div><div><br></div><div>This one is interesting: <a href="http://www.lungetech.com/cgc-corpus/challenges/CROMU_00058/" target="_blank">http://www.lungetech.com/cgc-corpus/challenges/CROMU_00058/</a></div><div><br></div><div>Also, did ForAllSecure or any other teams fix and rerun their engines on the corpus?</div></div><div dir="ltr"><div>-dave</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Fri, Aug 18, 2017 at 10:06 AM Jordan Wiens <<a href="mailto:jordan@psifertex.com" target="_blank">jordan@psifertex.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Replaying someone's bug was absolutely a thing. <div><br></div><div>Each team was given what amounts to a direct feed of all network traffic to their server. If they had good instrumentation they could replay it locally and automatically detect which flows represented successful exploits and which didn't. </div><div><br></div><div>There are some interesting ideas though on how you might ensure that an automated system can't do such a thing. Rubeus, for example, fingerprinted the cpuid output of the target infrastructure and introduced divergent behavior based on that cpuid. I don't know if it made the final cut of the video (still watching it now!) but we did find teams biting on their honeypot on multiple occasions. A team would be successfully exploit a vulnerability, Rubeus would replace the service with one similar except adding a fake vuln only reachable with a non CGC infrastructure cpuid and the team would now target that vulnerability, losing out on the points they were getting before and netting rubeus some free defense points when they were still vulnerable. </div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Aug 17, 2017 at 3:59 PM, dave aitel <span dir="ltr"><<a href="mailto:dave@immunityinc.com" target="_blank">dave@immunityinc.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<p>Ah, it's there for sure, although you're not sure which bug they
exploited. Interesting to draw some corrolations. For example
DeepRed (Raytheon) got two weird heap overflows exploited, and
then a lot of stack overflows...did that heap overflow come from a
replay of someone else's bug? Is that a thing?<br>
</p>
<p>Heap Overflows:<br>
</p>
<ol>
<li><a class="m_-6274269475164821908m_6586573090025479394m_2641109338170938652moz-txt-link-freetext" href="http://www.lungetech.com/cgc-corpus/challenges/CROMU_00055/" target="_blank">http://www.lungetech.com/cgc-corpus/challenges/CROMU_00055/</a></li>
<li><b><a class="m_-6274269475164821908m_6586573090025479394m_2641109338170938652moz-txt-link-freetext" href="http://www.lungetech.com/cgc-corpus/challenges/NRFIN_00052/" target="_blank">http://www.lungetech.com/cgc-corpus/challenges/NRFIN_00052/</a></b><br>
</li>
</ol>
<p>Hmm. Lots of interesting information here, although somewhat hard
to dig through I guess? <br><span class="m_-6274269475164821908m_6586573090025479394HOEnZb"><font color="#888888">
</font></span></p><span class="m_-6274269475164821908m_6586573090025479394HOEnZb"><font color="#888888">
<p>-dave</p></font></span><span>
<p><br>
</p>
<br>
<div class="m_-6274269475164821908m_6586573090025479394m_2641109338170938652moz-cite-prefix">On 8/17/2017 3:31 PM, Chris Eagle
wrote:<br>
</div>
<blockquote type="cite">
<pre>Dave,
You may find some of what you want here: <a class="m_-6274269475164821908m_6586573090025479394m_2641109338170938652moz-txt-link-freetext" href="http://www.lungetech.com/cgc-corpus/cfe/" target="_blank">http://www.lungetech.com/cgc-corpus/cfe/</a>
I have all the raw data from the event including the answers to some of your questions below. If I can format then in some useful manner I will post some of those answers.
Chris
On 8/17/2017 8:51 AM, dave aitel wrote:
</pre>
<blockquote type="cite">
<pre>So I wanted to type up some notes on the CGC Wrapup <a class="m_-6274269475164821908m_6586573090025479394m_2641109338170938652moz-txt-link-rfc2396E" href="https://www.youtube.com/watch?v=SYYZjTx92KU" target="_blank"><https://www.youtube.com/watch?v=SYYZjTx92KU></a> video, which was excellent. I mean, a part of what you want to do, while you watch it, is strip out all the parts of the thing that are about "playing the game". I know Jordan loves CTFs as some sort of e-sport and also there's a whole community who for whatever reason plays CTFs instead of playing corewars on helpless Chinese networks like of yore, but that stuff is 100% distraction when it comes to the CGC.
As you can see, the tiny red lines on the right are supposed to be some combination of "could hack and could secure a service". I can't find anywhere something that has a simple spreadsheet of which samples <a class="m_-6274269475164821908m_6586573090025479394m_2641109338170938652moz-txt-link-rfc2396E" href="http://www.lungetech.com/cgc-corpus/challenges/NRFIN_00080/" target="_blank"><http://www.lungetech.com/cgc-corpus/challenges/NRFIN_00080/></a> (and even which vulns in which samples) were able to be attacked by which teams. So much of the game was weighted towards performance characteristics that it's hard to determine the information you really need from the scores, although the video goes over some anecdotal examples where RUBEUS and MECHAPHISH were able to attack particular historically interesting programs. It's telling that Mayhem won despite being basically off for half the contest. ;)
Does anyone have better data on this?
-dave
P.S. Holy cow the visualizations on program execution are next gen! Worth a close watch just to see them.
_______________________________________________
Dailydave mailing list
<a class="m_-6274269475164821908m_6586573090025479394m_2641109338170938652moz-txt-link-abbreviated" href="mailto:Dailydave@lists.immunityinc.com" target="_blank">Dailydave@lists.immunityinc.com</a>
<a class="m_-6274269475164821908m_6586573090025479394m_2641109338170938652moz-txt-link-freetext" href="https://lists.immunityinc.com/mailman/listinfo/dailydave" target="_blank">https://lists.immunityinc.com/mailman/listinfo/dailydave</a>
</pre>
</blockquote>
</blockquote>
<br>
</span></div>
<br>_______________________________________________<br>
Dailydave mailing list<br>
<a href="mailto:Dailydave@lists.immunityinc.com" target="_blank">Dailydave@lists.immunityinc.com</a><br>
<a href="https://lists.immunityinc.com/mailman/listinfo/dailydave" rel="noreferrer" target="_blank">https://lists.immunityinc.com/mailman/listinfo/dailydave</a><br>
<br></blockquote></div><br></div>
_______________________________________________<br>
Dailydave mailing list<br>
<a href="mailto:Dailydave@lists.immunityinc.com" target="_blank">Dailydave@lists.immunityinc.com</a><br>
<a href="https://lists.immunityinc.com/mailman/listinfo/dailydave" rel="noreferrer" target="_blank">https://lists.immunityinc.com/mailman/listinfo/dailydave</a><br>
</blockquote></div></blockquote></div></div></div>