Event RPE-001: The Chameleon and the Snake

Events

RPE-001: The Chameleon and the Snake

THIS EVENT IS COMPLETE. THANK YOU FOR YOUR PARTICIPATION AND SUPPORT!

Date: September 17-20, 2018 | Location: UMBC Training Center in Columbia MD

See updated scores here!

Check out photos from the RPE-001 Social here!

Overview

This RPE specifically targets malware signature diversity and signature measurement for Microsoft Windows (x86 and amd64) in a simulated operational environment at a realistic pace. We want to challenge participants to:

1. As an 'attacker', create (through integration, enhancement or from scratch) a single tool for altering the signature of an operational tool for Microsoft Windows without changing functionality
2. As a defender, create (through integration, enhancement or from scratch) a single tool for the fully automated classification of an unknown Windows Executable as malware/benign, variant of known sample, attributed to known group (based on previously established knowledge)

This RPE will be treated as a force on force exercise where each side has a specific goal:

• DEFENSE – Good Guys are a series of 3-5 computer network defense, malware analysts and live forensic experts who specialize in Microsoft Windows. These guys are no stranger to programming and understanding C#, C/C++ and Python/Ruby. They understand all the traditional malware analysis tools such as Cuckoo Sandbox, Wireshark, ssdeep, Capstone Disassembler
• OFFENSE – A fictitious hacker collective that is a team of 3-5 individuals who specialize in malware and the Microsoft Portable Executable Format, Windows API, malware techniques and communication

Each side should select a leader, but we explicitly leave this decision up to participants. DreamPort personnel will be exercise control (EXCON) operating in a manner to ensure each side gets information and inputs they need and evaluating the outcome without unduly influencing either side. We suggest that this RPE should exclude commercial products but welcome commercial participants so long as they don't violate company NDA or Acceptable Use Policies using trade secrets or patented technologies.

Details

DEFENSE is under constant cyber-attack from their enemies including the OFFENSE. They are bombarded with constant threats 24x7 some of which result in successful intrusions into the DEFENSE network known as HQ. HQ is a sensitive environment consisting of virtual and bare metal machines (no more than 20 endpoints) that is supposed to be disconnected from the Internet but unfortunately it is not. Since there are illicit and undocumented Internet connections, these threats may unfortunately leave behind remote access trojans and other malware samples on-disk and in-memory of multiple mission critical Microsoft Windows 7, Windows 10 and Windows Server 2012 stations within HQ. These trojans are sophisticated enough to call out for command and control (C2) instructions when DEFENSE is not expecting. DEFENSE employs a team of experts who have access to any open source tools they need for malware and intrusion analysis but there are too many hosts, too many threats and not enough time.

In this challenge, we will pit the DEFENSE versus the OFFENSE. OFFENSE will be given a series of Windows malware samples sourced from across the Internet with which to work. DEFENSE will be given a small subset of Windows malware sample files that were previously attributed to OFFENSE. The job of OFFENSE in this RPE is to build upon existing known packer tools and libraries (or start from scratch) and create a single tool capable of modifying any Portable Executable file (not .net at this time) so that it is mis-attributed and mistakenly labeled as benign. The job of DEFENSE is to utilize existing open source (or that which you bring with legal permission) technology to create a single tool capable of classifying a Portable Executable file as:

• Benign or Threat
• If Threat:
  • What group can it be attributed to (given the pre-classified samples you will have access to)?
  • Is it a variant of a known sample? If so, which?

We require that each tool (OFFENSE and DEFENSE) provide some type of additional output beyond the classification so that an operator can directly explain or lookup and explain why a sample was classified the way it was. There are no expectations on the format of this output so long as a team member can interpret. This point is referenced again later when we discuss scoring.

It should be noted that it is acceptable for both OFFENSE and DEFENSE to use freely available tools or websites to check any sample they are working with (or against). We deliberately do not mention any tool names in this description, this is left up to the challenger(s). This challenge is planned to last for 4 days. This is the 'window of opportunity' for OFFENSE to attack with increased chances for success. It is insufficient to rely on these services alone as they are disjoint, prone to false positives and will not explain their answer in many cases.

HQ will be a simulated entity as it doesn't need to physically exist for this content to work. Exercise Control or (EXCON who are representatives of DreamPort) will periodically issue security alerts to DEFENSE that include multiple files that have been named by fictious security systems as being part of suspected intrusion(s). A security alert will be a USB disk with a collection of files (benign and malicious) that have been named in a security alert. One hour prior to the delivery of this USB disk to DEFENSE, EXCON will notify OFFENSE they must deliver their next sample(s) on USB disk (and provide disks to OFFENSE at that time). Provided they are returned EXCON within the hour, EXCON will then add additional files for randomization purposes. DEFENSE must take these files and provide an answer on the status of each file in the alert within 60 minutes. The answers can be provided written on a piece of paper to EXCON but DEFENSE must be prepared to show their work. As we discuss in scoring below, DEFENSE must be able to explain their tool conclusions to a third party (e.g. EXCON) but in the real-world tempo of this RPE we can address this later if an EXCON participant is not available. For this reason, both DEFENSE and OFFENSE must take care to ensure their work is repeatable.

Before the RPE even begins, DEFENSE and OFFENSE will have access to past incident report intelligence that names a small number of malware samples that have been previously attributed to OFFENSE. They should use this data wisely. When processing a security alert, DEFENSE should analyze files named in the security alert and determine which files are malware (which maybe suspected to be or are not), which files can be attributed to OFFENSE, and if any alerts warrant further investigation. If they choose to attribute a sample to OFFENSE, they must provide an explanation as to why.

Both DEFENSE and OFFENSE must bring their own stations and they may bring any unclassified tools or techniques they wish provided they agree that:

• United States Cyber Command reserves the right to release the tool/technique as open source at some point in the future.
• They are not violating company agreements or NDA by using the tools outside of work.

DEFENSE cannot predict how often the security alerts will 'pop' within HQ. For planning purposes, EXCON will inject malware into the simulated HQ at least once per day including the first day of the conference.

Who should sign up?

We will accept both teams (of no more than 5) and individuals. We need offense and defense here people, not just one side!

What should I bring?

You need to be prepared to bring your own machine(s). Internet access will be provided. There are a limited number of outlets so do not bring more than two machines per person (no one said you can't run a Pi Cluster if you have enough USB ports) one better not be rolling a half-rack into our facility!

Other Details

• This RPE is entirely unclassified. All tools and techniques used must be unclassified
• Further engagement details, teaming, equipment, scoring, and success criteria details will be provided upon registration for event.

FAQs

How can I participate?

Want to participate? Registration is closed.

Questions?

For any RPE-001 questions or concerns, please contact us.

Thank You

A special thanks goes out to Brian and Dorian whose good ideas serve as an influence for this RPE.