More on CyberThon success: ‘You got pwnd. We own you.’

Press Release from School District: Cyberthon Challenges High School Info Techs
PFHS Cybersecurity Students Fight Hackers With Teamwork

“You got pwnd. We own you.” For most people working with information technology, seeing this message on a computer screen would cause panic. However, not for Diego Zepeda, he knew just what to do. He knew he needed to immediately access backup information and when that didn’t work, he quickly called on his team for ideas.

“Brandon Thurston came up with the idea that worked and in seconds, we posted a message that our web site would be down for a maintenance period,” said Zepeda. “As soon as that message was up, we were able to access our backup information. From there, we were able to identify the two corrupted folders. We isolated those folders and had everything else back up and running.”

Zepeda explained this phase of Cyberthon 2015, a competition that was locally created to test the internet security skills of two teams of local high school students, as calmly as he might give someone directions to the nearest video game store. Zepeda is a junior at Pine Forest High School and a member of their new Cybersecurity Academy. Thurston is a senior at Pine Forest, also in his first year in the academy.

“Cyber warfare is about a tiny, little attacker trying to take control of the web assets of a monster-sized defender,” explained Doug Underhill, Escambia County Commissioner, District 2, and a key organizer behind the creation of Cyberthon. “The attacker, or hacker, wants to take control and force the larger defender to have to react to his every move. By creating a maintenance window, the defender maintains control and then has time to detect the source of the attack, defend against the attack, and restore their web services to their consumers.”

“By constantly refreshing their team’s webpage and email, Zepeda showed us that he has already figured out the importance of continuous monitoring and found a human solution,” explained Underhill. “Their quick thinking gave Blue Team 1 their best win of the day.”

The Blue teams’ participants in Cyberthon came from Pine Forest High School, Pace High School, Spanish Fort High School and Catholic High School. The members of the Red Team (aka The Bad Guys) were volunteers from a variety of IT companies and government agencies. Additional volunteers acted as mentors for the members of the Blue Teams. Cyberthon was sponsored by the local chapter of the Armed Forces Communications and Electronics Association. (AFSEA) and it was hosted by the Naval Flight Academy, located aboard NAS Pensacola, giving the competitors a chance to utilized the Flight Academy’s Joint Information Bureaus, rooms filled with state of the art computers, and smart technology.

The Red Team’s role was to launch attacks known to IT security training specialists as MSELs, pronounced “measles”, which are activities on a Master Scenario Event List. MSELs incorporate various METs– Mission Essential Tasks. The first MSEL was a missing folder. The students said that was easy to recover and only took them a few minutes to locate and restore. With each round and each new MSEL, it got harder. Their web sites crashed, but they got them back up. They were also attacked by a DDoS – a Distributed Denial of Service (pronounced dee-doss), which is an effort to overload a site until it crashes.

“We used Splunk, an application that shows everything happening in your network. It let us see the attack source and block it,” Alec Le, a Pine Forest High School, 9th grader, explained casually, like this is something he does every day.

These attacks led up to the event described above when they were “pwnd” (pronounced powned), which meant their site had been taken over.

Both teams figured out how to regain their control, but Team 1’s extra quick thinking impressed the Red Team as well as their instructor, Angela Irby.

“They all did an awesome job this weekend; they have been learning these skills in concept and theory. Cyberthon let them tie it all together like fitting together the pieces of a puzzle. I also think they are having a lot more fun than they imagined,” said Irby. “Another positive aspect of Cyberthon is they are getting to meet people in the industry, both civilian and military, and hear some amazing speakers.”

“Cybercrime is an exponentially growing threat,” FBI Special Agent John Windness, told the students. He explained the variety of cybercrimes and that it isn’t like what you see in the movies with a guy sitting alone on his computer in a basement somewhere attacking the world’s computers. “Today, hackers are incredibly professionally run organizations.”

Escambia County Sheriff David Morgan, a sponsor of the event, also spoke to the students explaining that he was honored to assist in making this event happen. He also made a point of telling the students that the money his office donated to help fund the weekend-long competition came from drug seized money. “Those drug dealers, whose money we are spending here today, are not sitting here today; they are in jail.”

Morgan also pointed out the volunteers in the room, people gathered there to coordinate the competition and mentor the students as they worked through the cyber attacks. “These mentors care enough about all of you to give you their time.”

Underhill told the students, “I joined the Navy in 1991 and I worked in counter-intelligence. But cybersecurity is more exciting for me because it has a real impact on protecting my own family. I can’t imagine a more rewarding career path.”

Zepeda sat with his friends Angelo Mayorga (PFHS, 9th grade) and Alec Le (PFHS, 9th grade) comparing notes on how they handled the various attacks. They all knew that after the“pwnd” event that those two corrupted folders were filled safely away, but still there.

“Tonight I plan to try to find a way to deal with them next time,” said Zapeda.

“I used to think that one person could handle defending a computer system, “ explained Mayorga, “Now I see that it takes a team.”

They also talked about what they are learning and how it is affecting their perspective on how to handle their personal computer equipment. Le said, “I was always careful, but now I will be even more careful.”

“I have never worried about it,” said Mayorga.” “I downloaded lots of stuff.”

“Man, you have got to be more careful,” urged his cybersecurity academy classmates. They should know.

All of the high school students who participated in the 2015 Cyberthon received certificates and many offers from mentors to be there to help later with recommendations for jobs or on college applications. They also received limited edition Cyberthon Challenge coins.

“These coins are a military tradition, given by commanding officers to commemorate an exceptional performance,” Underhill explained to the students. “You have joined a pantheon of exceptional people this weekend. We all expect you to continue to perform at an exceptional level in school, and we challenge you to stay involved in science, technology ,engineering or math (STEM) classes and we hope you will persue a career path in a STEM field.”

The 2015 Cyberthon security warriors stood in front of a room filled with local leaders, business owners, military service people, school district personnel and IT specialists who had served as their mentors and their attackers who all joined together to give the kids a standing ovation. That was the only time, all weekend, that they looked the least bit frazzled.