Well, now we are going to welcome seven guys, who are nothing more and nothing less than the winners of the European Cyber Security Challenge.
And besides, we are going to have both Raúl and Antonio to interview them.
They are going to tell us how the contest was, how they prepared for that contest, for the competition, and how the competition itself was.
But if you like, first of all, we see a video of how their preparation was.
The Spanish team that is going to represent our country in the European Cyber Security Challenge 2016 in Düsseldorf.
Well, if you like, boxers and coaches, to the ring!
Come on, a big round of applause for them.
Well, thank you all for being here.
And this is the beginning of a pretty nice story, because we are talking about 2016, but it has to be said that in 2015, the General Directorate of INCIBE entrusted a group of people with a group of talents, who are very good technically, to generate a team that was able to win the European Cyber Security Challenge.
In 2015, the team was a revelation.
And this 2016, Spain, in its second year, has won the gold medal, the first place for Spain.
And this is the team, right Raúl?
Yes.
That has done that part.
I don't know if you want to ask them something.
Yes, well, as you can see, they have worked as a team, but they have not competed together last year, but each one has competed just like you or many of you individually, they have competed among themselves.
And this year they have been a team.
But I also have to tell you that even being a team, it costs us a lot, you may have seen it in the photos, to put on the same shirt.
So, well, I wanted to ask you a question, and it is precisely related to that.
What have you found a little more difficult to work as a team?
You can answer any of them, you have microphones here on the tables.
Come on, José.
The most difficult thing to work as a team has been coordination and communication.
Because each one of us is used to work individually, and every time we get some information, we keep quiet about it and we continue to work until the end.
And maybe to work as a team it is better to communicate and that the whole team works together on those advances.
It is what has cost us the most to say it, but in the end we got it.
That part of the magic, of the young people who have been here, many will surely be in the Spanish national team next year, right?
But there is also the part of the training where we make people suffer and go to the gyms and other things, right?
Borja, for example, what did you like the most about the training period where you have had different instructors?
Even ex-teammates from 2015.
Thank you, Borja Portaporte.
For me, the best thing has been how well we have taken all the teammates.
From the first day we have always had a lot of coordination.
As José says, it was difficult for all of us to coordinate, but it has always been a team of people who are always in the world.
We like to investigate forums and it has not been difficult for us to be a good team.
Well, that's what they say now, because you have to see them the first day when they come in, until they start coordinating.
But well, I believe you.
What would you say to those who are competing today or who are going to compete tomorrow?
What would you say about this competition?
Let's see, captain.
Basically, to those who have competed today, don't be afraid.
Keep competing and compete against anyone, at any level.
They are capable and they have proven to be capable and they will always learn something new.
And to those who will compete tomorrow, more of the same.
Don't be afraid and go for it.
And well, we also had a person who we thought was not going to do much, his name is Pablo.
The young man who came from the... what are they called?
Cyber Olympics.
The Cyber Olympics.
But really, Pablo was able to integrate perfectly into the group.
And I would like to know, on the day of the competition, what do you feel?
That adrenaline and such.
What did you like the most about facing 10 teams?
Well, I don't know.
Especially because I didn't have much practice in this, in the CTFs.
I hadn't participated in many.
So, we had participated in both the Cyber Olympics and this year in some practices.
But it's true that it has nothing to do with a real competition, with that pressure.
Above all, you are with the 10 teams that have the 10 best hackers in each country.
So, it's something quite serious.
And totally stressful.
From minute one, continuously trying to solve answers, put the flags, get points.
Then there were many times that, for whatever reason, the markers didn't work well.
So, continuously going to the jury, putting pressure.
So, it was from minute one, pressure until the end.
Although we were winning a lot, with a lot of difference.
But well, it's true that there is a lot of pressure and continuously.
And the worst minute of the competition?
Because I think there was someone who got ahead of us for a while.
Juan Carlos.
I know you don't like it much.
The worst minute of the competition?
When Romania gets ahead of us.
I don't know.
But you thought, we are going to win, right?
Evidently.
Why?
Because we always win.
Of course.
I like that.
I have to admit that there was one thing that helped a lot, which was the motivation that was given to the team.
We were unmotivated, or not.
When we got there, we found ourselves in a room of one person, two bunk beds and an extra bed in the middle.
Five people in a room, no towels, no soap.
Then we got there to the competition and we found teams with servers, when apparently the maximum budget had to be 300 euros.
And he said to me, no, if it's a server, it's already old.
No, look, it's a play.
I mean, this is worth much more than 300 euros.
You can imagine the faces of the team.
Raúl, fight for that.
Antonio, fight.
It can't be.
We go to the vote and in the end it is voted in favor of those who have brought the server.
Keep it.
The team was sunk.
It was destroyed.
There was a very important strategy of Antonio, which was to encourage the team by shouting at the Spaniard, even when the team had not achieved anything.
And then there was a second goal with that, right?
Not only to encourage them, but to discourage the rest of the teams.
And then they told us at night.
That it worked.
We said, this is Spanish.
There were already people who said, well, it would be good to give the second and third.
We did not have flags at that time, but anxiety was generated.
Yes, it is true that many times when they called us to the jury, we thought, what have we done?
Because I, the truth, going with this team out there, we did not trust them much because they are good, but as good as they are, they are scary.
So, my question is going to be, really, what have we not found out here now that we are in public, Antonio and I, that you have done?
If you have done something.
It can't be told.
They disqualify us.
Well, better not then.
No, well.
It is true that Raúl has commented that I took people and went with their blades for cracking the password.
You know how they are, those from up north, they structure their heads too much.
Spanish is good at one thing, at always solving yes or yes, at the end.
But Adrián, what secret weapon did we have?
When that secret weapon comes out, you know, Europe trembles.
Dani's notebook, clearly.
Dani's notebook.
Maybe people don't know what Dani's notebook is.
No, you don't know what Dani's notebook is?
Yes, Dani is a guy who, from a notebook with a pencil, you know, does the same work as a cracking server.
So, when Dani takes out his notebook, Europe trembles, you know?
But I have a question for Dani.
Dani, what is the best thing you have experienced?
What did you like the most?
What I liked the most?
Well, everything in general, there is nothing that I liked more or less.
The competition, the training, everything.
The competition, of course, everything related to the competition.
What I liked the least?
The hotel room.
And...
For the rest, for having won, above all.
Yes, because it is a pride, really.
The thing is that I only said last year.
This is something they should do.
You always do things in life for yourself, for your family and for your country, you know?
And in this case, it was played for Spain.
And I don't know if it would also be good to talk, for Hector to comment on how the parties are, to encourage people, how the parties are when you win, later.
Well, here is the image that is being given to me.
No, no, well, the truth is that very well.
In the end, the Spanish team, not only technically, but we earned the respect for that very reason.
For that, for Spain, the party, man.
And we knew how to guide the rest of the countries to have fun, even the one that had the worst result.
In the end, the important thing is to know people from other countries who have the same tastes as you and that.
And we had a great time.
In the end, after the competition, no.
I recommend that you try to go because it is worth it.
Well, and as you can see, we also had a good time.
And we also did a lot of things.
I, if you like, because it seems that, well, in the end, technically we have not taught you anything.
We had prepared, people from the team had prepared, a small presentation about some of the cases, examples that you can find, for example, next year in this competition.
And if you like, Antonio, we can give way to two of the team members, so that they get ready, which are Josi and Dani, and they will teach you a little, technically, about some of the challenges we had there.
Well, I am Josi Ignacio Rojo, he is Daniel Fernández.
We are going to give a small presentation about the competition itself and a couple of examples of challenges with which we have encountered and a specific category of scoring, which is that of Pauna.
Basically, the team that you have already seen.
And, well, there were a series of categories that were scoring and we are going to differentiate what is the attack and defense and I lost and achieved.
On the one hand, we had the central part of what was the competition, which was a CTF of attack and defense, where several categories were scored, for example, availability, code patching, attack, defense, and then there was a special category, which was Paunes,
which was to do something that supposedly could not be done, a hole in the organization.
Then, in this part, it consisted of attacking the servers of the other teams, while we had to defend our server so that the other teams did not attack it, and, in turn, patch the code to cover the vulnerabilities.
Then, the job party part is a capture the flag, like the one that has been given today or the one that is going to be given tomorrow.
These are challenges of different categories that have to be solved to add points.
Then there is the part of achievements, which was called achievements, which was basically to perform a task.
That task was to configure an intermediate CA from a CA that they give you, an entity of certification, and develop a small application that managed the permissions based on the certificates signed by that CA.
The architecture of the CTF consisted of...
Each team had a VMWare server with virtual machines, one for each challenge.
There were two servers in each of the challenges, there were four.
Ours, which was inside our machine, and another, which was one of the servers that we did not have access to.
Access to that server was achieved through a GUI to correct vulnerabilities.
The deployment was done automatically, because we only had root access in our own server.
Then, the strategy we did was, in our server, to defend everything we could.
In fact, we replaced the web server to each machine.
They had an Apache.
And what we did was to put forward an Nginx, and in that way see all the requests that arrived and have control over all the attacks that we received.
And, on the other hand, the issue of code parsing and so on.
We also took care of this a little bit.
Well, I'm going to present a small cryptography challenge with which we found ourselves.
Basically, they gave us a private RSA key, but they covered, so to speak, a large part of the private key.
We see there that we have access to a part of base64, and that base64 itself is valid.
Therefore, we can extract information from that base64, which we are now going to break down to briefly explain the challenge.
Ok.
Do you know the format of the private keys?
The format of the... Does it sound familiar?
No?
Nobody?
Basically, this information we see on the screen is the number in hexadecimal format of what we have seen before.
That is to say, what can be read in asterisks is equivalent to this.
So, the format of the key is a specification for how to define the parameters of the RSA key in a private key.
So, the last part of the private key that we had is what appears on the screen.
Well, if you look at how the RSA key works and so on, you know that they are prime numbers and so on.
So, what we had in the end of Q, which was not complete, not only the end, but that also helps us, we had dp, dq and qi, which I will now explain better what this is about.
Basically, we have the number...
well, a small final part of the number Q' we have dp, which is the CRT exponent.
In dp, we have the CRT exponent of Q and qi is the CRT coefficient of...
of the inverse of Q.
So, CRT means Chinese Reminder Theorem.
It is how to find the opposite of the module operation.
And basically, it is a small optimization to be able to find it in a reasonable time.
So, what do we need from this information?
We need to obtain the prime numbers p and q that make up the private key.
And to get to them, we use mathematical formulas that define RSA, which are the ones we can see at the top right and developed at the bottom right.
Playing with them, we have p and q based on the last digits of q.
So, we have a small script in Python that will help us to find these numbers.
What did we do?
We made a Python script that, using these mathematical formulas, solved the equations and we could obtain the original prime numbers.
So, we can say that the function you see here that says isPrime is not really a function to check that it is prime, but to check that it is a valid candidate for the coefficient.
To sum up, we needed to obtain the prime numbers p and q that make up the private key and, using mathematical formulas, we were able to obtain them.
So , that was the challenge.
It is one of the ones we liked the most and that is why we put them here.
So, we are going to show now, in attack and defense in particular, one of the applications and how we managed to get the total control of the system.
It was an application that could upload images.
It was like an image platform where you could upload an image and a kind of platform for images and so on.
So, we had the information of the challenge and we were told that there was a bug in the application.
So, what did we do?
We looked at everything that was on the server, we found it, and it turns out that in the image, if there was information embedded in the least significant bits of the image pixels, that information was extracted and executed as if it were Python code.
So, of course, it was an execution of the code.
Of course, the problem is that we had a limited access to the Git.
We did not have full access to all the code of the application or everything.
And we did not know how we were supposed to fix it.
Of course, a solution would be to modify the image, but the ideal solution would be to remove the bug.
And we could not get to remove it.
So, what we decided was to attack ourselves and remove it from the server.
And, well, we do not know why, the rest of the teams did not do the same.
And they left it open.
Well, basically, the Pawn category, as I said before, usually comes from a remote code execution, an RCE.
So, it is a special category with its own score, although it really was not worth it, but it is more because of the satisfaction of having achieved it.
Last year, although the Spanish team did not win, they were the first to achieve this category, this Pawn, and to control a system.
This year, we repeated it again, and that gives us a lot of satisfaction in that sense.
So, once we have the RCE, the Remote Code Execution, we have to be able to get a privilege scaling.
We have to get root access, so to speak.
So...
There are different ways to do it, and , of course, you never know.
You never know if it is possible.
So, we worked hard to do it, and recently, a month ago or so, there was a vulnerability that had a lot of impact, so to speak, a lot of repercussion, and we did a preview of the event, and the team said, have they fixed it?
But, of course, it takes 20-30 minutes to test it, because it is tedious to run the tests, and it is worth spending time on it, I am sure they have fixed it.
I mean, this vulnerability was very sound, but what if they haven't fixed it?
So, here, it was the moment when we were testing this.
Let's see if they have fixed it or not.
So, about the vulnerability, well, does this sound familiar to you?
Does it sound familiar to anyone?
Some of you know what it is.
Have they fixed it?
We assumed so.
Is it worth spending time on it?
Well, as we can see, they haven't fixed it.
They had an updated kernel in September, so it was vulnerable.
DTK is a vulnerability that came out a month and a half ago, which consists of a kernel load condition in Linux, which allows you to write arbitrarily on any hard disk file, with any user.
So, how do you get root?
You overwrite a binary with the sub-id, you run it, and you get root.
So, the problem we have with this exploit is that it is unstable.
Very unstable.
Well, the exploit itself is not unstable, but the examples of proof of concept leave the machines in an unstable state, because they are not well implemented, so to speak.
So, this exploit leaves the machine in an unstable state, and if anyone uses it, accidents can occur.
I remember that one of the fundamental rules of this competition was that you can't sabotage others.
Yes, we had root access to all the servers of a specific application, but we couldn't sabotage them, we couldn't spy on them, we couldn't read their code, we couldn't monitor them in that sense.
The jury explicitly came to ask us that, please, you have already scored, stop, you can't use this.
And, I insist, very unstable.
The problem that it is unstable, on the one hand, can be solved with what you see up here.
So, to take advantage of this current condition in the kernel to run arbitrary code, the first thing to do is to disable this phrase of the kernel that you see up here.
So, in this way, it is avoided to try to overwrite the file in memory, which is corrupt, and that's what causes a kernel panic, with the implementations that are normally out there.
Well, there are some that already solve that problem, but most fail.
So, of course, the problem was that we use this way and we don't break anything, we don't leave the server unstable and nothing happens.
But in the case of the English, it was not like that.
Well, to say that we managed to perform the PAUM in the first instance and then the English team was able to replicate it, but, of course, they replicated it against Linzstein in this case, but they didn't do it very well, they didn't know or weren't able to leave the machine stable and they denied Linzstein's machines.
For that reason, an emergency committee was organized to fix the situation.
I mean, there has been a sabotage, it is legal that this team penalized Linzstein's team.
And, well, I remember that it goes against the rules, so it was delivered and the captain of the English team had to swear that there was no bad intention, that it was an accident, let's say.
And, well, basically the example was set that the Spanish team has made this same exploit, but nothing bad has happened.
I mean, they have been able to know how to use it well.
I mean, it is possible.
If you have enough knowledge, you can do it well.
And also here, the people, the envoy of NISA, of the European agency, were totally against this category.
I mean, their philosophy was no, no, no, we want to train professionals who adjust to the rules, we don't want people to do evil.
So this category had a little bad reputation for that.
And this example was precisely bad, it gave a part of the reason and luckily another team, ours, knew how to use it correctly and according to the rules, etc.
And then, lately, I would like to put this formula, so to speak.
If we all act as a team, we can really achieve much more, which is what we achieve, than if we act individually.
There were very powerful teams, but they were not able for their talents to act together.
I mean, they acted individually, they did not communicate, they wanted to do it alone, etc.
And that was a burden for many teams, many countries.
Yes, well, for my part, I can say that last year I was also in the Spanish team, this would be the second year that I participate, and a big difference that I have found from last year to this year, is that last year we had less organization, as a team we were less organized.
Maybe there were talents, but maybe the organizational part failed.
This year we have improved a lot, especially the organizational part, that each one had well-defined tasks, we formed a team that each one had its function, and that we had it well in the game.
And that was what made us get points until we reached victory.
Well, thank you very much for your attention.
Thank you.
Hello?
Yes?
Hello?
Well, as an image is worth more than a thousand words, all this that has been told to you, and thanks to the realization here of our cameras, we are going to show you, we are going to put a video about this experience, so that everyone can experience it firsthand.
Video?
And to finish, well, you have seen that there are more members of the team than here, they have not been able to come, Pablo, Jimeno, Ángel, and besides, there are many people behind this, we are not alone, okay?
So I would like to call here to the stage that the rest of the team could come, so that you also know them, and to give them a round of applause.
Therefore, Tatiana, Susana, Beatriz, Alberto, Calron, Remote, Moncho, Juanjo...
Stand up, please.
As you can see, even our cameras have done a commendable job, and nothing else.
I just want to tell you that we believe that it is a very good experience, that you can all participate in it, that next year we have the challenge not only to try not to be too far behind, maybe winning is already very difficult, but also with your help we will try to stay in a good position,
but possibly it is you who are in this team, okay?
So, just tell you that next year it will be in Spain, we have to organize it, and as I say, in addition to the challenge of trying to stay in a good position, we have the challenge of organizing it, so nothing else, thank you very much, and a very strong applause for the rest of the team.
A photo?
Wait a second, a photo, you leave very quickly, a family photo we have to take, right?
Come on, a family photo.
Alberto, did you hear me?
More forward.
More forward, more forward.
More forward, more forward
.
Come on
, the one of three, patata.
Patata.
Strong applause for them.
Thank you.