Recap Amrita InCTF 2019 | Part 1
Amrita InCTF 10th Edition is an offline CTF(Capture the Flag) event hosted by Amrita University at their Amritapuri campus 10 KM away from Kayamkulam in Kerala, India. In this year’s edition, two people from Opstree got invited to the final round after roughly two months of solving challenges online. The dates for the final rounds were 28th,29th, and 30th December 2019. The first two days comprised of talks by various people from the industry and the third day was kept for the final competition. In the upcoming three blog series starting now, we’d like to share all the knowledge, experiences, and learning from this three-day event.
Talk from Cisco
The hall was full of a little more than 300 people, among which a lot were college students all the way ranging from a sophomore year up till final as well as pre-final year. Also, to our surprise, there were roughly 50+ school students sitting ready to compete for the final event as well. The initial talk by CISCO was refreshing and very insightful for everyone present in the room. The talk majorly focused on how technology is changing lives all around the world be it with machine learning to help doctors treat faster or be it use drones to put off fire or IoT enabled system to provide efficient irrigation in remote areas. The speakers also made a point on how learning in a broader segment of technologies and tools serves longer than in-depth knowledge of limited technology.
One thing that really stuck with me was that I never learn technology just for the sake of it or for the hype around it. But learn with a thought on how it can solve a problem around us.
Talk Title: Cyberoam startup and experiences -Hemanth Patel
Hemal Patel talked about his couple of startups and how he has always learned through failures. The talk was full of experiences and it is always serene to listen to someone telling about how they failed over and over again which eventually led them to succeed at whatever they are doing today. He talked about Cyberoam which is a Sophos Company, secures organizations with its wide range of product offerings at the network gateway. The talk went on to give us an overview of how business is done along with different governments all around the world and how Entrepreneurship is so much more than just tackling a problem at a business level. And how Cyberroam ended up making the product that they have today.
Talk on Security by Cisco — Radhika Singh and Prapanch Ramamoorthy
This was a wide range talk about a lot of things affecting us. We’ll try to list down most of it here.
The talk started out with exploring Free/Open WiFi. Though it has a huge benefit of wifi being free it comes with a lot of risks as well. To name a few :
→ Sniffing
→ Snooping
→ Spoofing
These just to mention a few ways you can be compromised over free WiFi.
You can read up more on it here :
The talk also presented us with facts over data, how only 1% of the total data is generated via laptops and computers, Rest all are generated by smartphones, smart TVs as other IoT devices. Hence comes a very important point of securing IoT devices.
It was pointed out during the talk that the majority of the companies worry about security over the end of the entire IoT chain i.e. over the cloud etc. But not many people are caring about the edge devices and how lack of security measures here can compromise them.
There was this really interesting case study about IoT devices brought down the internet for the entire US east coast and how this attack was just meant to get some more time to submit an assignment at its initial days. Read more on this story from 2016 here
Memes apart, The talk also focused on privacy vs security and how Google’s DNS resolution encryption helps in securing DNS based internet traffic on the world wide web.
National Critical Information Infrastructure Protection Centre(NCIIPC)
National Critical Information Infrastructure Protection Centre (NCIIPC) is an organization of the Government of India created under Sec 70A of the Information Technology Act, 2000 (amended 2008), through a gazette notification on 16th Jan 2014, based in New Delhi, India. It is designated as the National Nodal Agency in respect of Critical Information Infrastructure Protection.
Representatives from this organization were there to speak at the event and they talked in detail about defining what is a CII (Critical Information Infrastructure) is and how any company with such infrastructure needs to inform the government about it.
A CII is basically any Information Infrastructure (by any financial/medical etc institute) which if compromised can affect the national security of the country. And attacking any such infrastructure is an act of terrorism as defined by the article 66F in the IT Act,2018.
They talked about some of the threats they deal with at the national level. They particularly talked about how the BGP routing protocol which works on trust was compromised lately to route all Indian traffic via Pakistan servers/routers.
One more interesting talk was about the composition of the Internet.
How we think that the internet we see would comprise 90% of the total internet but in reality it’s just 4%, bummer right? The deep web is the one which comprises 90% of the total internet and as a matter of fact that no one completely knows about the DarkNet and its volume. Hence even the numbers mentioned above are as good as a guess.
This was a very insightful talk and put a lot of things in perspective.
Digital Forensics — Beyond the Good Ol’ Data Recovery by Ajith Ravindran
This talk by Ajith Ravindran mainly focused on Computer forensics, which is the application of investigation and analysis techniques to gather and preserve evidence from a particular computing device in a way that is suitable for presentation in a court of law.
The majority of tips and tricks shared were about getting data from Windows-based machines even after it is deleted from the system and how such data can be retrieved in order to show as proof for crimes.
Some of the tricks talked about are mentioned below :
→ The prefetch files in Windows gives us the list of files and executables last accessed and the number of times executed.
→ User assist allows investigators to see what programs were recently executed on a system.
→ Shellbags list down files that are accessed via a user at least once.
→ The Master file table enables us to get a list of all the files in the system or even entered the system via a network of USB drives.
→ $usrnjrnl gives us information regarding all user activities in the past 1–2 days.
→ Hiberfil.sys is a file the system creates when the computer goes into hibernation mode. Hibernate mode uses the Hiberfil.sys file to store the current state (memory) of the PC on the hard drive and the file is used when Windows is turned back on.
This was all from day 1 talk, Come back next Tuesday for talks from Day 2. And as the final segment of this series, we’ll be updating about attack/defense and jeopardy CTF experience.
Stay Tuned, Happy Blogging!
Opstree is an End to End DevOps solution provider
Originally published at http://blog.opstree.com on January 7, 2020.
