{"id":7339,"date":"2017-04-13T14:19:23","date_gmt":"2017-04-13T22:19:23","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/04\/13\/news-1130\/"},"modified":"2017-04-13T14:19:23","modified_gmt":"2017-04-13T22:19:23","slug":"news-1130","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/04\/13\/news-1130\/","title":{"rendered":"Hack2Win &#8211; VXCON Hong-Kong"},"content":{"rendered":"<p><strong>Credit to Author: Maor Schwartz| Date: Thu, 13 Apr 2017 08:34:07 +0000<\/strong><\/p>\n<div class=\"entry-content\">\n<p>Hi everyone,<\/p>\n<p>We have decided this year to not only sponsor VXCON, but also to have a IoT hacking-village! <\/p>\n<p>Will let you win prizes and show your skills in hacking network based devices.<\/p>\n<p><span id=\"more-3138\"><\/span><\/p>\n<p>We have selected 7 devices for you to try and hack.<\/p>\n<p>The goal of the event is to find who is able to gain the highest privileges on any of these devices.<br \/> <strong>Products:<\/strong><\/p>\n<ol>\n<li>Synology <a href=\"https:\/\/www.synology.com\/en-global\/products\/RT1900ac\" target=\"_blank\">RT1900ac<\/a> router<\/li>\n<li>Dahua PoE <a href=\"http:\/\/www.dahuatech.com\/product_detail-4746.html#\" target=\"_blank\">DH-NVR4108HS-8P-HDS2<\/a> H.265<\/li>\n<li>D-Link <a href=\"http:\/\/support.dlink.com\/ProductInfo.aspx?m=DIR-850L\" target=\"_blank\">DIR-850L<\/a><\/li>\n<li><a href=\"https:\/\/world.taobao.com\/item\/44737254473.htm?fromSite=main&#038;ali_refid=a3_430620_1006:1103982926:N:HDMI+IP:d5468d274a9b700ea957e9f7dc087e7c&#038;ali_trackid=1_d5468d274a9b700ea957e9f7dc087e7c&#038;spm=a312a.7700714.0.0.S6dN6A\" target=\"_blank\">HDMI 100M TCP-IP Extneder Tx\/Rx<\/a><\/li>\n<li><a href=\"https:\/\/world.taobao.com\/item\/546409494081.htm?spm=a312a.7700714.0.0.kF7zCQ#detail\" target=\"_blank\">Wifi Doorbell Camera Video Intercom Phone Control IP Door set<\/a><\/li>\n<li><a href=\"https:\/\/world.taobao.com\/item\/546719257961.htm?spm=a312a.7700714.0.0.fBOwAO#detail\" target=\"_blank\">EU Plug Portable Free WiFi Home Offices Automation<\/a><\/li>\n<li><a href=\"https:\/\/www.smartthings.com\/\" target=\"_blank\">Samsung SmartThings Hub<\/a> and Motion sensor<\/li>\n<\/ol>\n<p><strong>Prizes:<\/strong><br \/> First place winner getting <strong>3,000$ USD<\/strong><br \/> Second place winner getting <strong>2,000$ USD<\/strong><br \/> Third place winner getting <strong>1,000$ USD<\/strong><\/p>\n<p><strong>Judging Criteria<\/strong><br \/> The decision whether someone wins first, second or third place will be based upon the following:<\/p>\n<ul>\n<li>Complexity of attack \u2013 what was required to achieve the access<\/li>\n<li>Innovative method \u2013 XSS, SQLi, RCE, from least to most innovative<\/li>\n<li>Whether Attack affects the LAN or WAN \u2013 more points if it affects the WAN<\/li>\n<li>What is achieved by the attack \u2013 no access is given to the challengers, so they would need to reach from no-access to some access \u2013 therefore a guest access would be considered less valuable than root<\/li>\n<li>Write-up Quality \u2013 the best write up (in English), most detailed, best explanation, etc<\/li>\n<\/ul>\n<p><strong>Device Settings<\/strong><br \/> All the devices will be factory reset \u2013 i.e. default settings, and the only non-default setting would be the password for the \u2018admin\u2019 (or equivalent) account as documented in the product\u2019s user guide, and the WiFi password (if applicable).<\/p>\n<p><strong>Device Access<\/strong><br \/> The devices will be accessible to participants via the WAN Ethernet interface, or WiFi access.<\/p>\n<p><strong>What counts as \u2018hacked\u2019<\/strong><br \/> A device would be considered \u2018hacked\u2019 if the participant can prove they:<\/p>\n<ul>\n<li>Gained access to the device\u2019s post-authentication admin web interface (remember \u2013 you will not be given any credentials)<\/li>\n<li>Changed some configuration value, like WiFi password (note: We will not be giving any award for changing the IP address of the device)<\/li>\n<li>Made the device do something it\u2019s not supposed to do: like execute code, open a port\/service which was previously closed (like SSH, telnet, etc)<\/li>\n<li>Did something else that would be innovative and unexpected. Be creative! For example: get images from the Camera without actually hacking it<\/li>\n<\/ul>\n<p><strong>What we won\u2019t count as a \u2018hacked\u2019<\/strong><\/p>\n<ul>\n<li>Causing a malfunction to the device, DoS, making it unresponsive, making it no longer boot, etc \u2013 we will immediate disqualify a participant if we feel this is being done intentionally<\/li>\n<li>Physically opening of device, connecting to the device in any means other than what we allowed the participant to use (Ethernet or WiFi)<\/li>\n<li>Usage of any known method of hacking \u2013 known methods including anything that we can use Google\/Bing\/etc to locate \u2013 this includes: documented default password (that cannot be changed), known vulnerabilities\/security holes (found via Google, exploit-db, etc)<\/li>\n<li>Anything we at Beyond Security would consider as being unfair \u2013 like doing Social Engineering on Beyond Security staff or personnel, hacking a device that is not the target and using that as means of gaining access to the device, etc<\/li>\n<\/ul>\n<p><strong>Eligibility<\/strong><br \/> The contest is open to anyone who is at the legal age to receive a contest prize in your country, if you are not allowed to receive prizes \u2013 and please make sure to check this before participating \u2013 you may want to team up with a person that is at the legal age to receive prizes.<\/p>\n<p>The contest is not allowed to anyone working for any of the above companies whose device participates in, or are involved in development of any of the above devices.<\/p>\n<p><strong>Announcing the winners<\/strong><br \/> We will announce all the winners at the end of the VXCON event. We plan stop the hacking event 2hrs before the end of the event \u2013 so that we can prepare. Please don\u2019t wait until the last minute!<\/p>\n<p>Good luck! <\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/blogs.securiteam.com\/index.php\/archives\/3138\" target=\"bwo\" >https:\/\/blogs.securiteam.com\/index.php\/feed<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Credit to Author: Maor Schwartz| Date: Thu, 13 Apr 2017 08:34:07 +0000<\/strong><\/p>\n<p>Hi everyone, We have decided this year to not only sponsor VXCON, but also to have a IoT hacking-village! Will let you win prizes and show your skills in hacking network based devices. We have selected 7 devices for you to try and hack. The goal of the event is to find who is able &#8230; <a href=\"https:\/\/blogs.securiteam.com\/index.php\/archives\/3138\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Hack2Win &#8211; VXCON Hong-Kong<\/span><\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10643,10754],"tags":[10756,10757],"class_list":["post-7339","post","type-post","status-publish","format-standard","hentry","category-independent","category-securiteam","tag-conferences","tag-securiteam-secure-disclosure"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/7339","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=7339"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/7339\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=7339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=7339"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=7339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}