4 ms·
> "...this type of activity definitely will break terms of service for internet service and hosting providers, as well as potentially several laws." How so? Is
by dkokelley 13y ago
> "...this type of activity definitely will break terms of service for internet service and hosting providers, as well as potentially several laws."
How so? Is the activity itself inherently against TOS or laws? It seems to me that by running the competition, ctf365 intends to have users purposefully exploit sandboxed systems.
- talmand 13y agoI would imagine one example could be a website hosted by a third party. Possibly you would have to inform the host of the situation and get their approval. Otherwise you might be breaking a generic law about gaining unauthorized access to a computer.
- dkokelley 13y agoSee my reply to mjolk. I am under the impression that the "fortress" infrastructure is provided by ctf365.
- talmand 13y agoAh, I suppose that would cover most bases. If they own the servers and they are giving permission to access them in such a way then there's likely no worries over unauthorized access type laws.
- BWStearns 13y agoI took a look at this a while back (excited to see it's still going), but there is the chance that your ISP might send you a nastygram/suspend service if they notice a lot of activity that looks like port scanning, though that depends on how intrusive/vigilant your ISP is being.
- dkokelley 13y agoIf ctf365 wanted to keep the playing field level, they could sandbox the entire network so that attacks originate from another device on the network. So you have: -----------------Network----------------------------------- my_fortress <- targeted by: competitors_command&control_box my_command&control_box :targets -> competitors_fortress ----------------------------------------------------------- No shady traffic ever needs to traverse the public internet. Only ssh access to my_command&control_box and my_fortress is required. This has the added benefit of normalizing the attacking horsepower of the entrants.
- BWStearns 13y agoThat would limit to some degree the gear that you could bring to the fight. Given that choice of tools in this situation is a valid differentiator I don't think arranging the challenge as "Backtrack5 at Dawn" is a realistic way to go about it. Clearly you could write or upload anything you wished if you sshed in, but the added convenience of BYOD seems like a net win.
- kerosen 13y agoWe build our own IaaS (Infrastructure as a Service) and you'll get access through vpn. Building our own IaaS keep us much busy than we thought.
- mjolk 13y agoHow do you define a 'sandboxed' system? What if I choose to run the Wordpress/Django/Drupal/Whatever-CMS on a shared host? Cracking tools don't often take into account the negative effects on non-target hosts, nor are they generally tolerated by shell providers. For example, see 'Prohibited Usage' for Linode: https://www.linode.com/tos.cfm https://www.linode.com/tos.cfm Unless you're paying for raw bandwidth, you're subject to the ToS of each resource provider along the way.
- dkokelley 13y agoHmm. I think my confusion comes from the assumption that each "fortress" (server) is a virtual server hosted by ctf365. From their rules: Don't try to conduct underground activities with your Fortress (system) from our platform in the Real World (e.g. using our platform to spam others, attack other servers on the internet and so on). We don't care who you are, but we do care what you are doing in our home (CTF365 Platform). Please remember that you are our guest and please behave accordingly. I read this to imply that they will provide the "fortress". So when I say "sandboxed" system, I mean a system provided by ctf365 on their own infrastructure - infrastructure which permission is implicitly granted to attack.
- kerosen 13y agoYes, we will provide the VPS and more, you'll be able to connect your own hardware as a fortress.