2015 - Guillaume Ross - CTF or WTF?

### Overview In this talk, Guillaume Ross from Rapid7's Strategic Services team contrasts the experience of Capture the Flag (CTF) competitions—specifically NorthSec (nsec)—with real-world enterprise security. While CTF challenges are deliberately crafted, often Linux-heavy puzzles with known vulnerabilities, real-world corporate environments suffer from extensive technical debt, legacy systems, poor segregation, unhardened endpoints, and basic configuration weaknesses. Ross encourages attendees, especially those working in defense or engineering, to use CTF experiences not as an excuse to believe enterprise networks are safer, but as an opportunity to audit, detect, and fix practical security issues.

### Key Topics - **CTFs vs. Real-World Attack Surfaces**: CTFs feature designed, intentional vulnerabilities (often on Linux) and lack active defense teams, whereas enterprises run legacy Windows endpoints, old Java stacks, and unhardened systems with vast attack surfaces. While organizations often purchase expensive SIEM tools for compliance, they frequently lack an effective defense team that monitors or acts on logs. - **Authentication and Password Auditing**: Unlike CTFs that require lateral thinking or custom scripts to decipher movie quotes, real corporate environments are filled with weak credentials like "password1" or company names. Ross notes Rapid7 consultants often crack a majority of corporate passwords within 24 hours on modest hardware. Relying solely on compliance guidelines (e.g., standard seven-character requirements) breeds false confidence. - **Application Security and Injection**: CTF web challenges often involve convoluted blacklists to force complex bypasses, whereas corporate web apps frequently fail basic practices, displaying raw SQL errors vulnerable to automated tools like sqlmap. Developers transitioning from older languages (e.g., COBOL) often lack web security fundamentals. - **Physical and Cryptographic Defenses**: While CTFs showcase badge hacking and smart card pin extraction, physical breaches in real life rely on unmonitored doors and tailgating. In enterprise crypto, organizations regularly store plaintext, manage keys poorly, or buy third-party vertical applications that claim "bank-grade" encryption while merely using Base64 or storing keys beside encrypted data.

### Technical Details - **Password Cracking**: Cracking thousands of corporate Active Directory hashes in 24 hours using a single workstation equipped with GPUs, bypassing conventional dictionary attacks because users rely heavily on corporate names and simple substitutions. - **Spear Phishing**: Targeted campaigns routinely achieve high success rates (around 75%) in capturing valid user credentials due to insufficient security awareness and lack of endpoint hardening. - **SQL Injection**: Real vulnerabilities frequently lack parameterization and can be exploited using out-of-the-box tools like sqlmap without needing elaborate blacklist bypasses. - **Hardware and Badges**: Referencing a NorthSec 2013 challenge involving setting a PIN on a card and applying ROT13 to extract a flag, compared to physical tailgating in corporate offices.

### Takeaways - **Audit Passwords Actively**: Defensive teams should actively crack their own enterprise credentials ("auditing password strength") and educate users and sysadmins on weak account and service passwords. - **Move Beyond Checkbox Compliance**: Meeting compliance standards like PCI does not equal security; defensive strategies must focus on actual attacker behavior rather than auditor checklists. - **Test Vendor Claims**: Push software vendors on encryption implementations and audit commercial off-the-shelf software in test environments to verify they do not rely on pseudo-security such as Base64 encoding. - **Build Real Detection**: Blue teams should review the vulnerabilities and tools used during CTF competitions and evaluate whether their internal monitoring and SIEMs can detect similar attacks in production.