The 11th CTF Summer School is taking place in Solnechnogorsk from July 30 to August 10, with the Coordination Center for TLD .RU/.РФ supporting the event as a long-term partner. The CTF Summer School is an annual summer camp program that combines immersive and intensive training in information technology and information security with meeting like-minded people and relaxing in a scenic suburban area. The participants, aged 14 to 25, include high school students and Information Security majors. The event was organized by the Association of Chief Information Security Officers and supported by the RuCTF organizing committee.
The participants have two weeks to immerse themselves in information technology and information security, attending lectures given by leading information security experts, as well as hands-on workshops and team competitions. Those taking part are usually divided into 12 groups, each having to score as many points as possible every day by performing applied development and design tasks.
On August 3, Vadim Mikhailov, the Coordination Center’s infrastructure consultant, gave a lecture on Visual Similarity Threats in Domain Name and Email Addressing. He explained to the audience what homoglyph attacks, typosquatting, combosquatting and TLD squatting are, how scammers can use homoglyphs to create phishing websites or carry out BEC attacks, and spoke about existing techniques to fight them. In his lecture, he devoted considerable attention to BEC attacks.
Business Email Compromise or BEC are multi-stage attacks on corporate email systems where the scammer sends emails to employees tricking them into actions that compromise confidential data. The attackers can pose as the target’s actual contacts; their emails might imitate an order from the company director to the accountant to transfer money, a request to sign a document allegedly sent by a corporate lawyer to the company head, or invoices from alleged partners that need to be urgently paid, etc.
Vadim Mikhailov noted that, according to last year's FBI Internet Crime Report, victims of cybercriminals lost more than $10 billion in 2022. “More than a quarter of the reported crimes were BEC attacks. It should be noted that this type of attack ranks second in terms of financial losses, while conventional phishing takes only 19th place,” the lecturer said.
In addition to the lectures, the students took part in a competition hosted by the Поддерживаю.РФ (which stands for I Support.RF) project. A few days before the summer school started, they were asked to pretend they were “benevolent hackers” and develop an attack scenario based on homoglyphs in domain names and/or emails and methods of protecting some typical infrastructure from that attack – they could choose an email provider or a banking system. From the eight participants who joined the competition, Vadim Mikhailov chose the two best projects and awarded the winners prizes with the Поддерживаю.РФ logo.
In addition, at the end of the CTF Summer School, every participant who undertook such a challenging project will receive gifts from the Coordination Center with the Domain Patrol security project logo.
