Hacktivity Cyber Security Labs

Security Scenario Generator (SecGen)

Randomised Hacking Challenges

Security Scenario Generator (SecGen) is an open source technical framework for generating randomised VMs for security training purposes. We created and use SecGen for a wide range of activities including hacking competitions, labs and realistic security assessment exercises.

Development of SecGen has been supported by a Higher Education Academy (HEA) learning and teaching in cyber security grant (2015-2017), and supported by a Leeds Beckett University Teaching Excellence Fund grant (2018-2019), and development continues as one of our core research and development activities.

We have published various papers describing SecGen and how we have used it to benefit our student experience: enabling our students' hands-on opportunities to carry out penetration testing, ethical hacking and security audits against a range of realistic scenarios, and hacking challenges. Randomisation helps to prevent issues of plagiarism and collusion, and promotes replayability.

VMs are created based on a scenario specification, which describes the constraints and properties of the VMs to be created. For example, a scenario could specify the creation of a system with a remotely exploitable vulnerability that would result in user-level compromise, and a locally exploitable flaw that would result in root-level compromise. This would require the attacker to discover and exploit both randomly selected vulnerabilities in order to obtain root access to the system. Alternatively, the scenario that is defined can be more specific, specifying certain kinds of services (such as FTP or SMB) or even exact vulnerabilities (by CVE).

SecGen is a Ruby application, with an XML configuration language. SecGen reads its configuration, including the available vulnerabilities, services, networks, users and content, reads the definition of the requested scenario, applies logic for randomising the scenario and leverages Puppet and Vagrant to provision the required VMs.

SecGen is released as open source software and we are aware of its use in other universities internationally.

Hackerbot: An attacker chatbot

We also created Hackerbot, a unique approach for teaching and assessing computer security: students interact with a malicious attacker chatbot, who challenges them to complete a variety of security tasks, including defensive and investigatory challenges, rewarding successful completion of challenges with flags that can be submitted for marks.

Hackerbot can carry out real security attacks, running actual exploits against VMs under the students' control; enabling students' hands-on experience defending against attacks, and investigating security breaches and attacker activity.

The interactive attacker chatbot approach has enabled us to turn defensive and incident investigation tasks into interactive capture the flag (CTF) scenarios. Our evaluation results have been encouraging, students find the approach engaging, fun and interactive.

Hackerbot challenges are randomised by leveraging SecGen.

Hacktivity Cloud-based Lab Environment

We have also developed an innovative lab environment and portal, Hacktivity, which provides access to a safe remotely-accessible lab space.

Hacktivity provides a portal for students to access a virtualised lab environment, with interactive hands-on tasks, with constant and instant feedback based on automated marking of randomly generated challenges. Students have remote access to virtual machines (VMs), scoreboards and progress monitoring dashboards.

VMs are uniquely generated with randomised challenges so that students can put their skills to the test, including putting theory into practice in weekly lab work challenges, practical tests, assignments and regular optional hacking competitions. Hacktivity manages the provisioning of VMs; student access and control of VMs; and marking of flag submissions. Hacktivity builds on free and open source technical frameworks that we have created for dynamically generating randomised challenges (SecGen), chatbots for interactive lab work (Hackerbot) and our deployment of an oVirt datacentre.

Hacktivity is used to deliver computer security modules to our local and remote students and is now used extensively throughout our security degrees. Hacktivity was identified during the BCS accreditation of courses, as an example of best practice.