How !SpamAndHex become a top hacker team (part 1)
Gábor Pék (CTO, Avatao)
Summer just started in 2011, when Gábor Pék, Buherátor and Bencsáth Boldizsár (aka “Boldi”) decided to do some nice hacking over the summer instead of going to splash in Lake Balaton all summer long. The annual international university hacking competition called iCTF was a big challenge with top competing teams. These guys needed to pull up their socks to have a chance.
The guys were not new in hacking, but they never considered competing before. They were typical self-taught hackers, reading blogs and hacker news, never learned hacking in the classroom.
To get better, they assembled a list of security topics to practice for the competition.
- Basic hacking tools: nessus, nmap, nikto, dirbuster, acunetix
- Operating system tools: bash, perl, python, process explorer, sysinternals tools
- Web hacking magic: sql injection, XSS, CSRF, cookie jacking, session hijacking
- Memory-based vulnerabilities: rop, bof, format string
- Hacks of the year: sony, anonymous, lulzsec
- Targeted attacks and APTs (advanced persistent threat)
- Malware disassembly
- Forensics: volatility
- Network handling: proxy, channeling
- Certificates, OTP
- Social network hacks: spear phishing, social spam
- Google hack DB
Most people were enjoying their vacation, but a small group of motivated students joined the effort. By September, the guys held regular meetings on Thursdays rigorously reviewing tools and hacks (with the help of some pizza and beer). The days of the iCTF 2011 competition came and the team finished 36th (named as Team.iCTF.CrySyS.A). I think this was the beginning of a beautiful friendship!
How did we get from this first CTF competition to compete twice at the DefCon finals? We will tell you in the next post.
Reading Time: 9 minutes The cloud data system has numerous advantages as well as many dangers. 80% of companies have had at least one data breach in the past months.
Reading Time: 7 minutes Companies understand the way you handle data security has a direct impact on their bottom lines. This has led to most companies requiring all vendors to have a special compliance certificate called an SOC2.
Reading Time: 7 minutes Our team attended Hacktivity, the biggest IT security conference in Central and Eastern Europe – a whole day full of interesting presentations and workshops. Click to see how we liked it!