Prologue
Last week, I alongside with 3 other Indian Students, Sejal, anikait and Rajarshi represented India to participate in GCC 2024 at Thailand. We had an amazing experience representing our country at the Global Cybersecurity Camp (GCC) 2024 in Thailand. This blog isn’t about the technical nitty-gritty, but rather about the incredible memories and fun we had during that unforgettable week.
A big shoutout to VueNow and Traboda for sponsoring this amazing trip! Their generosity made it possible for me to attend GCC 2024, and I’m incredibly grateful.
The Road to GCC: A Nationwide Challenge
There was a nationwide Capture The Flag (CTF) competition where all top university CTF teams and individuals were invited. The CTF lasted for 6 hours and I successfully secured a coveted spot in the top 5, earning a place on Team India for GCC!
Touching Down in the Land of Smiles
After a long flight, we finally touched down in Thailand at 5:00 am. Buzzing with excitement, we navigated immigration and baggage claim, reuniting with the entire Team India at DMK Airport. Our group consisted of six - four students and two staff. Just then, our awesome Thai staff, Gong, showed up! Gong whisked us away from the airport and towards our hotel. The journey was a whirlwind of laughter and cultural immersion, thanks entirely to Gong’s infectious enthusiasm. He ensured a smooth ride and treated us to a taste of authentic Thai cuisine at a local breakfast stop. We couldn’t have asked for a better welcome to the Land of Smiles!
Arrival at The Sez Hotel
So, we pull up to The Sez Hotel, Bangsaen, all excited to crash after our flight. Guess what? Marathon madness! Apparently, the whole road was blocked off, and our van had to drop us about 750 meters away. Luggage in tow, we started the trek towards the hotel, only to see Team Japan rolling up beside us. Looks like we were in a heated race for “first to arrive” honors, even if it was just on foot!
Bad news struck when we found out our rooms weren’t ready yet. Stuck in a conference hall with Team Japan, we started brainstorming ways to kill time. A quick “aha!” moment later, we were sprinting to the nearest 7-Eleven to grab Thai SIM cards. Hey, gotta stay connected, right? We even snuck in a walk on the beach – a little pre-event relaxation.
Back at the hotel, we struck up conversations with the Japanese students. That’s where I met Yuma – we clicked instantly, and guess what? We’re still in touch! A few from their team, including Kana-san, even joined us for lunch. What a cool way to break the ice!
The whole day had this electric vibe thanks to the IRONMAN Triathlon happening nearby. Seeing those athletes pushing their limits was seriously inspiring. Finally, after a few more hours and a bunch of other teams showing up, we got the keys to our rooms. Surprise! We weren’t rooming with our own teammates, but with students from other countries. My roommate for the event? Yitian Cao from Singapore – guess that’s another perk of traveling for competitions!
Ice Breaking Party
During the icebreaker ceremony, each country was required to present an on-stage introduction to all of the students and personnel. It was fascinating to learn about everyone’s backgrounds and see what the folks in the room had done.
There were people with CVEs, people with startups, people who attended the DEFCON CTF Finals, and just folks who had accomplished wonderful things in hacking. And it was incredibly exciting to see so many amazing individuals in one area, and to know that I’d be able to spend a week connecting with them.
After Dinner, I attended a party at someone’s room with my fellow teammates.
Day 1
The icebreaker ceremony buzz wore off as we headed to the meeting hall for the official opening. This time, seating was assigned by group – a sign of the collaborative work to come. In GCC, students from different countries are placed together to tackle group projects and presentations. I found myself in Group 7 alongside
- Takaaki Toda (Japan)
- Curious (Taiwan)
- Kai Xuan (Singapore)
- Hongkrok Lim (Korea).
Our first session delved into the fascinating world of cybersecurity ethics. The instructor unpacked the core concepts of consequentialism, deontology, and virtue ethics before throwing us headfirst into group discussions on real-world ethical dilemmas. These discussions were a blast – a fantastic way to bond with my teammates! Takaaki Toda (Japan) and I especially hit it off, his insightful contributions sparking lively debates. The thought-provoking topics kept us all engaged and eager to explore the nuances of cybersecurity ethics.
After lunch, the real teamwork began. We learned the project assignments:
- Analyzing OSINT feeds for scams
- Diving into CVE and exploit databases,
- Crafting CTF challenges,
- Building Maltego plugins for mobile forensics
Our group was given the “CVE and Exploit Database” topic. While CTF challenges were the hot commodity (probably for everyone!), we were determined to make the most of our assigned subject.
The afternoon took an unexpected turn when Team Singapore surprised everyone! They handed out specially designed GCC 2024 stickers by Yao Xuan and the coolest souvenir ever: a penguin circuit board (courtesy of Manzel) that not only played music but also held hidden flags for us to capture! A huge thank you to Team Singapore for their creativity and generosity! This was just the boost we needed to dive headfirst into our group project and make the most of our GCC experience.
The Deep Dive into AD Attack Techniques
The “Deep Dive into AD Attack Techniques” session with Mars Cheng was a highlight for me. Since I do pentesting, I already had a basic understanding of AD but I didn’t have a very clear idea since the topic is very large.After this session I have gained a solid idea about AD. I always wanted to learn more about Active Directory (AD) attacks, but self-study kept getting pushed aside. This course was a game-changer!
Cheng packed the session with hands-on labs, guiding us through setting up our own environments and testing various attack techniques. The pace was intense, especially for someone new to AD. But unlike the usual slow-burn university courses, this one felt refreshingly focused. We dove into infiltration, lateral movement, the art of kerberoasting, and even crafting gold and silver tickets for persistence. Cheng’s delivery was clear and concise, making even complex concepts understandable. The labs were the real stars, though – putting theory into action solidified our learning.
By the end, though, everyone’s laptops sounded like helicopter rotors – running three VMs simultaneously takes its toll! After the session, we were all pretty fatigued from parsing all of the knowledge presented to us, so we decided to eat dinner and explore outside the hotel a bit.
Day 2
Day 2 saw two main talks: Threat intelligence and Kernel fuzzing.
Handling Threat Intelligence
Tomohisa Ishikawa’s “Handling Threat Intelligence” session was an eye-opener. Focusing on vulnerability research, web exploitation, pentesting challenges (the attacker’s perspective!), I hadn’t ventured into the world of threat intelligence before. This talk filled that gap, comprehensively covering everything from threat intelligence fundamentals to threat hunting and the layered approach to incident response within organizations.
The hands-on labs were particularly engaging, guiding us through examining samples and crafting YARA rules to detect and filter malicious files.The engaging hands-on labs challenged us to craft YARA rules. These rules acted like digital fingerprints, allowing us to identify and filter malicious files with pinpoint accuracy. The goal was to differentiate genuine threats from harmless programs, all while avoiding false positives.
We breaked for lunch and then we had a session on Fuzzing
Fuzzing in the kernel world
A GCC 2020 alumni and Balsn member delivered a mind-blowing talk on kernel fuzzing. She started with a deep dive into fuzzer mechanics. The real fun began with the hands-on labs – no local setup required! We kicked things off by installing afl++ and fuzzing custom code with an abort call.
Next, we upped the game by fuzzing an older version of xpdf, aiming to unearth a real-world CVE (Common Vulnerability Exposure). The session then explored the importance of virtualization (a concept I need to brush up on!).
Finally, we reached the core: kernel fuzzing. We compiled the Linux kernel and embarked on creating a vulnerable kernel module. This custom module would then be tested with Syzkaller, a fuzzing tool that bombards the module with various inputs to find weaknesses. Throughout the process, the speaker expertly explained kernel fuzzing principles and kernel modules.
This session was a goldmine of knowledge, leaving me excited to delve deeper into the world of kernel fuzzing.
The day ended with a splash at a poolside party after dinner. It was a fantastic opportunity to chat with even more people and solidify the connections I’d made throughout the day. By the end of the evening, a group of us found ourselves gathered by the pool, deep in conversation.
Day 3
Day 3 saw two main talks as well - LLM prompt injection and forensics with velociraptor.
How (not) to build a vulnerable LLM web app
This session was a game-changer, led by the mastermind behind the infamous ShinoBot malware simulator – a speaker who’d graced stages at DEFCON and BlackHat! He kicked things off with a bombshell: how to manipulate Large Language Models (LLMs) to disregard their intended programming and follow our commands instead. The room buzzed with a collective “wait, what?”
He then unleashed his own custom CTF (Capture the Flag) challenge, featuring these very LLMs. The objective? “Prompt Injection” – a hacking technique where we had to subvert the model’s instructions to snag the hidden flag. After battling through the CTF, he dropped another bombshell: a personal GPT-3.5 API key! This key allowed us to build our own LLMs, equipped with the knowledge to resist prompt injection and other vulnerabilities.
This session was unlike anything else at GCC – a blend of exhilarating challenge and cutting-edge knowledge. It easily rocketed to the top of my list of must-attend sessions!
Hunting with a dinosaur
The session on threat hunting with Velociraptor piqued my interest, even though forensics isn’t my usual focus. Andreas, with his impressive knowledge of Digital Forensics and Incident Response (DFIR), led us through the process of using Velociraptor, a powerful forensics tool.
The highlight was a series of hands-on labs set within a captivating storyline. Our mission: to become digital detectives, scouring Windows event logs to pinpoint the intrusion point across multiple machines. While forensics might not be my usual playground, these labs offered a fascinating glimpse into the world of forensic workflows.
Dinner provided a welcome break, followed by another productive group meeting where we delved deeper into our project discussions.
Day 4
Day 4 only had one training, which was the car hacking training.
Hands-On Car Hacking
Kamel Ghali’s car hacking session was a masterclass in practical learning. He is affiliated with the Car Hacking Village in DEFCON.
The session kicked off with videos showcasing real-life car hacking vulnerabilities, effectively setting the stage. Ghali then systematically deconstructed a car’s internal network, providing a clear foundation.
Next came Bluetooth hacking. Pre-configured VMs allowed participants to jump right into reconnaissance techniques, solidifying theoretical concepts with practical application. For those with prior knowledge of CAN networks (like myself), Ghali seamlessly dove deeper into this critical protocol.
But the true highlight was the hands-on experience. A physical CAN network setup enabled experimentation with inter-device communication. Ghali then surprised us with the pièce de résistance: a genuine infotainment system and instrument cluster ready for hacking! I, along with many others, successfully exploited these real-world systems.
This session effectively blended theory, practical application, and real-world scenarios, fostering a deep understanding of car hacking principles. It was a truly exceptional learning experience.
After this we had an Industrial Session where we met the sponsors for other countries. They were also giving out internship opportunities as well as cool swag/merch. This was the last day we had left to prepare for our project. And we we’re hustling trying to complete the project and get it run.!
Day 5
Day 5 also had one session, this time about malware analysis, specifically .NET malwares. Because it was the final day of GCC, this was also the night of the project presentation, which had something at stake (the top two teams would obtain admission to the offsec playground and receive a $100 voucher). Additionally, it was the day of the closing dinner.
Practical Malware Analysis and .NET Reversing
This session was by taken by Wei-Chieh Chao and Yi-Hsien Chen. The instructors started with the fundamentals, ensuring everyone was on the same page. This clear foundation allowed me to grasp the concepts fully and breeze through the well-designed labs. The focus was on a real-world menace: RedLine malware. The session incorporated a CTF platform where we could submit flags unearthed from each lab, adding a layer of gamified learning to the process. Overall, the session was both informative and engaging, solidifying my understanding of .NET malware analysis.
After this we had our lunch and were on the final stretch of our project completion. Our team barely made it and managed to submit on time. The GCC curtain closed with a mix of emotions. We all received certificates, a tangible reminder of our accomplishment. A wave of gratitude washed over the room as each country delivered heartfelt closing remarks, sharing their experiences and expressing appreciation to the organizers.
The main event of the night was the group project presentations. While my team’s well-rehearsed delivery was cut short by the strict 5-minute time limit, I wasn’t too fazed. After all, part of the challenge was condensing our weeks of research and collaboration into a clear and concise presentation. In the face of time pressure, our presentations became a testament to both the knowledge we’d gained and the strength of our teamwork. It was a thrilling finale to an extraordinary week at GCC. Congratz to team 8 and team 9 for winning the groupwork competition.
Conclusion
GCC was a whirlwind – an incredible week that zipped by in a blur of learning, camaraderie, and cyber challenges. I forged friendships with amazing people, expanded my cybersecurity knowledge base, and delved deeper into areas I already knew. From icebreaker introductions to late-night project discussions, every moment was filled with valuable experiences. This wasn’t just a learning event; it was one of the best weeks of my life.
A big thank you to the GCC organizers! Everything, from travel and accommodation to the top-notch training sessions, ran smoothly and flawlessly.
While I tried to condense the most exciting parts of my experience here, there’s simply too much to capture in words. This blog post serves as a personal memento of an unforgettable week – a week that will undoubtedly shape my future in cybersecurity.
Epilogue
- Thanks to Vipin Sir for making it possible for India to join the GCC and allowing me to be a part of it.
- Thanks to the trainers, they had very interesting and engaging sessions.
- Thank you to my group members who collaborated with me on the project and assisted with the presentation so that I could deliver it smoothly.
- Thank you to everyone at GCC for making this a terrific experience.
- Also, a special thank you to VueNow and Traboda for sponsoring our trip and allowing Team India to attend the event.