4 Lessons I Learned from My First Capture the Flag (CTF) Event!

Speaker: 00:00:00

Hey, what's up, everyone?

Speaker: 00:00:00

John here.

Speaker: 00:00:02

Today on the Titan of Tech podcast, I want to review four lessons that

Speaker: 00:00:07

I learned when I participated in my first Capture the Flag CTF event

Speaker: 00:00:13

just about a week ago, March 2024.

Speaker: 00:00:16

And the first thing off the bat is don't be me.

Speaker: 00:00:20

Definitely don't be me.

Speaker: 00:00:21

So for those of you that clicked on this and you're like, what is a CTF?

Speaker: 00:00:25

What is a capture the flag?

Speaker: 00:00:26

Let me explain capture the flag.

Speaker: 00:00:28

It's a security vulnerabilities game.

Speaker: 00:00:31

That's conducted in a test environment, you are instructed to

Speaker: 00:00:36

find a hidden piece of information that they refer to as a flag.

Speaker: 00:00:40

Maybe it's a specific file.

Speaker: 00:00:42

And there are typically two types of capture the flags when it's called

Speaker: 00:00:46

the jeopardy style where you're just given a series of challenges and the

Speaker: 00:00:51

other is attack and defense where you've got your teams where you

Speaker: 00:00:55

each have your own specific network and you're trying to protect your

Speaker: 00:01:00

network at the same time you're trying to attack another team's network.

Speaker: 00:01:04

Now, in my particular case, we were in jeopardy style.

Speaker: 00:01:07

It was a three hour capture the flag event and there was a total of 16 different

Speaker: 00:01:13

puzzles that they were that we were given that we needed to solve and we and

Speaker: 00:01:19

there was no way nobody solved all 16.

Speaker: 00:01:21

That was part of the part of the drill.

Speaker: 00:01:23

It was just I think they said it was normally made for a six hour

Speaker: 00:01:28

game, but we did it in three.

Speaker: 00:01:30

Now, as far as the types of puzzles, you have digital forensics, which

Speaker: 00:01:34

is the one that I was able to solve as the as time was about to expire.

Speaker: 00:01:38

There's some reverse engineering.

Speaker: 00:01:40

There's cryptography.

Speaker: 00:01:41

You know, files are encrypted.

Speaker: 00:01:42

There's some Web security trying to break into a website.

Speaker: 00:01:46

And in the case of the one that I saw that the last legitimately there was 10

Speaker: 00:01:50

seconds left before the game expired was a digital photograph of a cat by a pool.

Speaker: 00:01:58

And it was, and the instructions were to find out exactly the location

Speaker: 00:02:03

and name of the building that this photo was supposedly taken in.

Speaker: 00:02:07

And I was able to use some tools that were out there, extract the metadata

Speaker: 00:02:11

that had the latitude and longitude.

Speaker: 00:02:13

slap that into a mapping program and bring up the exact location that

Speaker: 00:02:17

the picture was supposedly taken to.

Speaker: 00:02:20

Now some of the benefits of doing these capture the flag games and

Speaker: 00:02:23

environments are it's, it's risk free.

Speaker: 00:02:25

You're not doing this in production.

Speaker: 00:02:26

In our case, there's a company called Cyber Ranges.

Speaker: 00:02:29

They, that's actually what they specialize in.

Speaker: 00:02:32

Larger companies may have their own Cyber Ranges to keep their skill

Speaker: 00:02:35

sets up of their, of their employees.

Speaker: 00:02:36

And there's other, these third party ones that are out there.

Speaker: 00:02:40

That will run events that are similar to these, so it's completely

Speaker: 00:02:43

virtual risk free environment.

Speaker: 00:02:44

You're not in somebody else's production environment.

Speaker: 00:02:47

You get the hands on skills necessary that that with the with the software

Speaker: 00:02:52

and the tools that you would use in a production environment.

Speaker: 00:02:55

In real time.

Speaker: 00:02:56

This is not theoretical.

Speaker: 00:02:57

This is not book knowledge.

Speaker: 00:02:58

This is real hands on experience.

Speaker: 00:03:00

And you also get to learn teamwork, which comes into one of our, my lessons

Speaker: 00:03:04

learned when producing one of these, as everybody has strengths and weaknesses

Speaker: 00:03:09

when it comes to anything that you do.

Speaker: 00:03:11

And most of these are conducted with teams.

Speaker: 00:03:14

I do believe that there may be some capture the flag.

Speaker: 00:03:16

Events that are solo, but in our case, there was teams of two to four.

Speaker: 00:03:21

And I think most of us had four, our team had three and the tools that

Speaker: 00:03:25

you're typically using with these and the ones that we use were Kali Linux.

Speaker: 00:03:28

We attempted to use wire shark that kind of.

Speaker: 00:03:30

Failed at connecting to the virtual environment with one of our teammates,

Speaker: 00:03:35

as well as just got to understand your Unix prompts, which I'll get into a

Speaker: 00:03:39

little bit of some of the issues that I walked into having never done this

Speaker: 00:03:42

before and having not really used Unix in a, in a really long time.

Speaker: 00:03:47

So what are the four lessons that I learned after going through this?

Speaker: 00:03:51

Gotta practice your Unix commands.

Speaker: 00:03:53

It had been years since I had used Unix environments.

Speaker: 00:03:58

I don't do a ton of hands on keyboard stuff.

Speaker: 00:04:00

I've got a few things like Raspberry Pis.

Speaker: 00:04:03

That I use internally for my own network.

Speaker: 00:04:06

So I, I occasionally get into those, but this is definitely not a regular

Speaker: 00:04:09

basis, you know, maybe once a quarter that I've messed with my own stuff,

Speaker: 00:04:13

performing an update type of thing.

Speaker: 00:04:15

And this specifically, you would need to learn Kali Linux,

Speaker: 00:04:18

which is some of the, the.

Speaker: 00:04:20

The, the, I'm going to use the term cracking tools, but the tools necessary

Speaker: 00:04:23

to help with cybersecurity engineering and vulnerability assessments to go

Speaker: 00:04:27

into there, I had kind of made the assumption that we were going to

Speaker: 00:04:33

be given some sort of cheat sheet.

Speaker: 00:04:35

The, the, the scenarios for, or this capture the flag event was kind

Speaker: 00:04:40

of advertised as beginner level.

Speaker: 00:04:43

Anybody that had any IT experience, please come join us.

Speaker: 00:04:46

It was a free event.

Speaker: 00:04:48

I knew the people that were running it.

Speaker: 00:04:50

was also on my team.

Speaker: 00:04:52

He had not.

Speaker: 00:04:52

He had not done one in years either.

Speaker: 00:04:54

So there was a team of us at least two.

Speaker: 00:04:56

And so I had watched one of these events back in the end of 2023.

Speaker: 00:05:01

And I had swiped a book called breaches and attack simulation for dummies.

Speaker: 00:05:06

I had not flipped through it at all.

Speaker: 00:05:08

I had never went through it.

Speaker: 00:05:10

It had been sitting there for a couple months.

Speaker: 00:05:11

The day before the capture the flag event, I decided I'm gonna sit outside.

Speaker: 00:05:16

It's nice.

Speaker: 00:05:16

I'm gonna read this thing.

Speaker: 00:05:17

I'm gonna At least kind of get myself primed up for what I'm going to

Speaker: 00:05:21

experience for the capture the flag event.

Speaker: 00:05:23

Well, when I started flipping through this, this was more of a managerial

Speaker: 00:05:26

for dummies book, which those concepts I already know already trained and

Speaker: 00:05:31

certified in, in all of those things.

Speaker: 00:05:33

And this was not a refresher or a primer on Unix commands, Kali Linux,

Speaker: 00:05:38

any of the tools or any other tool necessary to be able to participate

Speaker: 00:05:42

in a capture the flag event.

Speaker: 00:05:45

So that didn't help.

Speaker: 00:05:46

So I kind of breezed through that, skimmed it, didn't help.

Speaker: 00:05:51

The next thing after we, so we get into the, the room we were, we could

Speaker: 00:05:57

bring our own laptops, which I had brought mine and I actually do have

Speaker: 00:06:00

some of the tools installed, even though I don't use it for whatever

Speaker: 00:06:02

reason, but I forgot my power cord.

Speaker: 00:06:05

So that didn't work well.

Speaker: 00:06:06

And I had to use one to provided.

Speaker: 00:06:08

Computers that they had, which were essentially fresh Windows 11 install

Speaker: 00:06:13

computers, nothing else was installed, was installed on the machine.

Speaker: 00:06:17

So none Wireshark wasn't installed on the machine.

Speaker: 00:06:20

None of the Kali Linux stuff was installed on the machine to be able

Speaker: 00:06:23

to, we could connect using those computers into the virtual environment.

Speaker: 00:06:28

So that became a little bit of a problem.

Speaker: 00:06:31

An issue with connecting one of our teammates.

Speaker: 00:06:34

We actually had a third teammate walk in the door miles.

Speaker: 00:06:36

I'm gonna tag him into the post.

Speaker: 00:06:38

I appreciate him showing up.

Speaker: 00:06:39

It was great to work with and actually had participated in one of

Speaker: 00:06:42

these recently, but it was having difficulty with the provided equipment

Speaker: 00:06:47

using wire shark to connect into.

Speaker: 00:06:56

So having equipment already installed with the software already known to be

Speaker: 00:07:01

working within that particular cyber range, I think would have helped out a

Speaker: 00:07:05

little bit and not with me not knowing how to use the commands, but for

Speaker: 00:07:09

others that knew what they were doing.

Speaker: 00:07:10

I think that would have smoothed over a couple things.

Speaker: 00:07:14

Also walking into this, I didn't really understand having never

Speaker: 00:07:17

seen it before, how the clues and the scenarios work together.

Speaker: 00:07:21

So you would be given a puzzle and there'd be maybe a one word or a couple

Speaker: 00:07:25

word clue on the direction that you were supposed to take the challenge.

Speaker: 00:07:28

And this was one of those things that I thought, again, we were going

Speaker: 00:07:32

to get some sort of cheat sheet as this was initially believed to be

Speaker: 00:07:36

an entry level capture the flag.

Speaker: 00:07:39

There really wasn't anything given as far as that it was like,

Speaker: 00:07:42

Hey, here's the environment.

Speaker: 00:07:43

Click it, log in.

Speaker: 00:07:44

There's the 16 puzzles.

Speaker: 00:07:46

You can bounce around them.

Speaker: 00:07:47

You can pick whatever you want.

Speaker: 00:07:48

There you go.

Speaker: 00:07:49

And each of the puzzles are weighted a score.

Speaker: 00:07:51

I think it was 10 points, 15 points, 20, and I think up to 25.

Speaker: 00:07:56

Of course, the, the harder the, the puzzle, the more points you

Speaker: 00:07:59

got for being able to solve that.

Speaker: 00:08:00

The one I solved was a 10.

Speaker: 00:08:02

But I got it.

Speaker: 00:08:03

That's the way I look at it.

Speaker: 00:08:05

So I think and also during this process, I, I, instead of seeing that this was

Speaker: 00:08:09

really entry level, I saw that the scenarios were marked as intermediate.

Speaker: 00:08:14

So that kind of a term I had been using was monkey on the keyboard,

Speaker: 00:08:17

where I was just sitting there just kind of hacking away at this.

Speaker: 00:08:20

Where I would have Kali Linux commands up and trying to break through.

Speaker: 00:08:24

I'd actually found something for one of the scenarios that used an old Perl

Speaker: 00:08:27

script for anybody that is familiar with that to be able to backtrack.

Speaker: 00:08:30

And I made it all the way to the end.

Speaker: 00:08:32

It just wouldn't execute the way it was supposed to, supposed to have executed.

Speaker: 00:08:36

I was able to get that installed and work through.

Speaker: 00:08:39

So it was definitely a understanding, just not being able to execute.

Speaker: 00:08:44

And the last thing for sure is that I think teamwork makes the difference.

Speaker: 00:08:47

The team that won the event in the end of last year that I have

Speaker: 00:08:51

observed, They showed back up again, and they crushed everybody.

Speaker: 00:08:55

They finished first they had quadrupled our score, and I think they doubled

Speaker: 00:08:59

the score of the team in second place.

Speaker: 00:09:01

This is a college team that travels around, and this is what they do.

Speaker: 00:09:05

I think they know exactly, everybody has their role defined, everybody

Speaker: 00:09:09

has the tools they're supposed to be used, everybody knows the strengths

Speaker: 00:09:11

and weaknesses of the others.

Speaker: 00:09:12

Which allows them to function as a unit as no different that you would run the

Speaker: 00:09:17

department that you run, the business that you run have predefined roles.

Speaker: 00:09:22

They probably had great communication.

Speaker: 00:09:24

There were a few tables away from us, so it wasn't like I could eavesdrop on them.

Speaker: 00:09:27

Matter of fact, we were at the end, so I didn't have anybody to eavesdrop off

Speaker: 00:09:30

of as we were going through this As we were going through the exercises, because

Speaker: 00:09:34

that probably would have helped but it, you know, the teamwork definitely made

Speaker: 00:09:38

a difference with what they with what they were doing, and they ran away with

Speaker: 00:09:41

it on top of just having the required skill sets to be successful for this.

Speaker: 00:09:47

So now that I've went through the process of of participating in a collapse, capture

Speaker: 00:09:53

the flag, who do I think should try one?

Speaker: 00:09:56

If you are an I.

Speaker: 00:09:56

T.

Speaker: 00:09:57

leadership of any sort.

Speaker: 00:09:59

And I'm talking about CIO, CTO, definitely a CISO of course.

Speaker: 00:10:03

I think this is something that you should go participate in, just

Speaker: 00:10:06

to understand the complexity of what goes into these skill sets.

Speaker: 00:10:11

Particularly for those that, like myself, who kind of been away from

Speaker: 00:10:14

the keyboard for a while, and maybe this was never even part of your job.

Speaker: 00:10:19

That if you, Go and participate in one of these.

Speaker: 00:10:21

It's a game.

Speaker: 00:10:22

It's for fun that you'll be able to communicate that complexity back in

Speaker: 00:10:28

a in a more sound way when it comes to determining budgets, determining

Speaker: 00:10:34

other resources that may need to be protected, particularly if you're

Speaker: 00:10:38

someone that works in a large environment that has a very big threat landscape.

Speaker: 00:10:43

You've got lots of employees, lots of equipment.

Speaker: 00:10:46

Maybe you actually produce code.

Speaker: 00:10:50

You store a lot of customer files.

Speaker: 00:10:53

You have a lot of sensitive information that I think just going through this

Speaker: 00:10:57

experience shows that complexity to you for never experienced for those

Speaker: 00:11:01

that have never experienced it.

Speaker: 00:11:02

And I am definitely not one that says for you to be an effective leader.

Speaker: 00:11:07

That you need to go and understand at every granular level, every person's

Speaker: 00:11:11

job underneath you, absolutely not.

Speaker: 00:11:13

It doesn't work that way.

Speaker: 00:11:14

You go and hire those skillsets, but if you're in a situation where you

Speaker: 00:11:18

just can't grasp the reality of what a role brings and what the value brings

Speaker: 00:11:23

to the table, that spending a couple hours in their, in their shoes, what

Speaker: 00:11:28

you're not going to become the expert.

Speaker: 00:11:30

I won't be definitely have no intention of becoming the expert at some of these

Speaker: 00:11:33

things, I would do it again, it helps reframe your mind for those things that

Speaker: 00:11:38

you don't quite understand if you're in say, if you're working in cyber security,

Speaker: 00:11:42

but you're non technical, let's say you're an auditor or you're just you

Speaker: 00:11:46

know, in the governance and risk piece.

Speaker: 00:11:49

This is something I think you should be exposed to as well.

Speaker: 00:11:51

Again, it goes back to.

Speaker: 00:11:53

Understand the complexity, be able to communicate that complexity when you

Speaker: 00:11:57

start evaluating those environments and seeing where maybe somebody is not

Speaker: 00:12:01

checking all the boxes they need to be if they need to, if they need to

Speaker: 00:12:04

comply with a certain framework within their industry that , you can kind

Speaker: 00:12:08

of elaborate on how the complexities of these types of skill sets and

Speaker: 00:12:13

understanding security vulnerabilities.

Speaker: 00:12:16

And of course, If you are a hands on keyboard, absolutely love threat

Speaker: 00:12:20

hunting and things of this nature.

Speaker: 00:12:22

This is, to me, this is a must do, . It keeps your skills sharp.

Speaker: 00:12:27

It allows you to be exposed to other people in a safe environment

Speaker: 00:12:31

that may have new tactics that you haven't thought about.

Speaker: 00:12:34

If you get locked in stovepiped within a large organization, this will probably

Speaker: 00:12:39

let you get exposed to new areas of work that you've not seen before, as well

Speaker: 00:12:44

as counting to your own work portfolio.

Speaker: 00:12:47

This is one of those things that I think counts to building up your skill sets.

Speaker: 00:12:51

You can work on things maybe you're weak on with other people that

Speaker: 00:12:54

have those as, as their strengths.

Speaker: 00:12:56

You can also do that in reverse.

Speaker: 00:12:58

The things that your strengths, you can give that to others.

Speaker: 00:13:00

I mean, this is a.

Speaker: 00:13:01

You know, to me, it's a unity thing.

Speaker: 00:13:03

It goes back to that teamwork environment, and you can sit there, figure out

Speaker: 00:13:06

how best the teams work together.

Speaker: 00:13:08

So definitely again, I think I was texting, I was texting my wife

Speaker: 00:13:14

and a buddy of mine who another buddy of mine who wanted to

Speaker: 00:13:16

participate and like, how's it going?

Speaker: 00:13:18

And I said, and I just kept using a term and said, I think

Speaker: 00:13:20

I'm monkey hitting the keyboard.

Speaker: 00:13:22

I had not prepped.

Speaker: 00:13:23

Do not walk into one of these prepped if you are in I.

Speaker: 00:13:26

T.

Speaker: 00:13:26

Leadership or you're in a non technical cyber security role and you would

Speaker: 00:13:30

like to participate in one of these.

Speaker: 00:13:31

Absolutely do it.

Speaker: 00:13:32

But at least spend a little bit of time going over basic Unix

Speaker: 00:13:36

commands going over Kali Linux.

Speaker: 00:13:39

Maybe you're looking at Wireshark and just getting a good frame of reference with

Speaker: 00:13:43

How someone that works at a rudimentary level and make sure you're interested

Speaker: 00:13:46

entering, , one of the capture the flag events that is based for beginners.

Speaker: 00:13:51

I don't think I would have had nearly as much fun if we were in the, the

Speaker: 00:13:56

attack defend environment with the teams going against each other,

Speaker: 00:14:00

because it's not what I've done.

Speaker: 00:14:02

It's not what I do.

Speaker: 00:14:03

Talk about getting creamed, but I did solve a puzzle.

Speaker: 00:14:06

So until the next one, talk to you later.