Star wars Day: Orange Cyberdefense hacks the Death Star

Discover our experts’ ploys to hack the galaxy’s most secure datacenter.

Hacking the Death Star: a real challenge

Here is the challenge we proposed to our experts:

In Rogue One: A Star Wars Story, a group of rebels stole the plans of the Death Star. Using your imagination and/or your cybersecurity knowledge, how would you have hacked the Death Star to steal the plans?
And now, the five best ideas we received!

#1: the most “team spirit”

All the Sales Teams, and the full Rebel Orange Cyberdefense Armada fleet consisting of our Sales North Squadron, South Squadron and Central Squadron and their ace account managers piloting in their fast and responsive X and Y wing fighters all throw everything we have at the Empire in a massive DDoS style attack.

While this is happening and the Empire is distracted, onboard of  a stolen Millenium Falcon –  a Trojan ship – there is an elite team of hackers from the planet SensePost, and with them, a droid from our IT Infrastructure Team called P.E.T.E.

Immediately, when the Marketing teams communicates that the firewall shield has been brought down by Sales Squadrons, Millenium Falcon lands on the planet surface and the P.E.T.E. droid gains network access by external plugin device. As there is no two factors authentication or admin rights, he quickly locates the plans of the base and the location of the Death Star plans.

The blueprints and location of the Death Star plans are not even encrypted. The Empires cybersecurity protocols are not good : not even multifactor authentication or network segmentation.

The Sensepost hackers launch a clever phishing attack to bypass security, however Darth Vader has landed and lit up his sabre like a Christmas tree in readiness to punish phishers. Lord Vader battles the SensePost team however one rebel of Orange Cyberdefense gains access to the hardrive and gets back to the Millenium Falcon which punches into hyperspeed narrowly escaping with the Death Star plans.

Lord Vader looks up menacingly and says “I find our lack of cybersecurity disturbing”.

Thanks to Sarb G. from Orange Cyberdefense UK.

#2 : the funniest

1. I start an investigation on the Internet and identify resources linked to the domain name “deathstar.com”.
2. I notice a request for technical help posted on a public forum by the IT manager of the Death Star datacenter.
3. Thanks to a research on social networks, I find the intergalactic phone number of this IT manager.
4. I call him to ask him to give me light-speed administrative access to critical servers in the data center. He refuses.
5. I reveal to him that I am his father. Shocked, he accepts.
6. I set up the VPN access and connect to the internal data center network with the communicated accesses (login: admin2, password: v4d0r-2020).
7. Because the Force is with me, I easily spot the virtual machine that allows access to the Autocad plans of the Death Star. The plans I have now.

And may the force be with you too.

Thanks to Fabien S. from Orange Cyberdefense France.

#3: the most multifaceted

Being a true Kyber Slicer I use multiple attack vectors:

• Starting a brute ‘Force’ attack.
• Found a bug in their Jabba-script running on their mail.imperial.space which allows me to steal Session-Wookies.
• Generate a list of mail addresses based on the Imperial code name system. Since I’m targeting the higher ranks and don’t want to be marked as spam or getting noticed by their IT, I only generate low numbers.
• Transmitting messages “SALE: Buy 9 Imperial Droids and get the 10th for free” which steals the Session-Wookie.
• To be thorough, I actually sell these and they act as Trojan Droids.
• To bypass the Shield Gate for transmitting the plans, I created a Force imbedded server called ‘this-is-not-the-server-you-are-looking-for.ur’ (hosted in the Unknow Regions for anonymity purposes)
• Usb drop on the Devastator’s docking bay, containing the Filename OrsonKrennic_Wage.xlsm

Thanks to Peter R. from Orange Cyberdefense Belgium.

#4: the most resourceful

Very confident in themselves, stormtroopers of the First Order did not apply the patch management procedures on the IPAM server of the First Order’s main ship. The head of the Resistance exploits a flaw and commits a spoofing of the DHCP service. Now, it only issues requests to Resistance ships that enter the solar system.

Thanks to R2D2 which contains a powerful malware, his brother Luke Skywalker sends a signal which spreads the malware to the enemy ships of the First Order and encrypts the command post which now displays the error message “//Orange Cyberdefense: BEST company ever//”.

Enemy’ ships are now of no use. Any potential attack on the solar system has now become impossible.

The plans are safe, in a protected server, located in a highly secure area. Thanks to a man-in-the-middle attack, Princess Leia intercepts the identifiers and passwords that pass in clear within the Death Star. The door to the secure room opens.

Princess Leia, Luke Skywalker, Rey and Chewbacca are facing the physical server. Luke, helped by Rey, forms a botnet taking advantage of equipment found on the Death Start. Consequently, a DdoS attack is launched but it fails.

Chewbacca panics, tears off the server from the wall, places it on his back and flees into a Resistance ship.

The Resistance wins.

Thanks to Nadia J., from Orange Cyberdefense France.

#5:  the most « inside job »

The Death Star is being finalized, in Scarif’s orbit. The local human population, exploited by the Empire, has to do all the unrewarding tasks: clearing, backfilling, etc.

I contact the son of one of Scarif’s native families, Karedig Trenteun, and offer him and his family a new life on one of the central planets of the galaxy in exchange for their help.

Pretending to use a HoloNet communication to get news from his parents, he transmits coded instructions to his father, Janark. Janak modifies the delivery manifest of a plastell cargo to attribute it to an imperial cargo ship stolen by the Rebellion, the Jumbo Cart.

A duo of spies and I camouflage ourselves among the cargo, indistinguishable in the middle of plastell containers impervious to scans. We land on Scarif.

At nightfall, Janark discreetly frees us during his hangar cleaning duty.
I infiltrate the living quarters of the foremen responsible for the construction of the Death Star and steal the datapad of the prime contractor to find info on the station, code-named Star Dust.

With the help of Janark, I install a rootkit on five copies of MSE repair droids; the rootkit is by definition very difficult to detect and will resist any remastering of droids by the Empire.

The droids go to the Citadel Tower, then to the high-security data warehouse. All the entries referencing the Star Dust project are copied and duplicated on each droid which are reassigned for the next day on the Star Destroyer in orbit and the Death Star itself.

The droids leave the planet and transmit data at the earliest opportunity to the Rebellion via the anonymous Rot network.

Thanks to Cédric C. from Orange Cyberdefense (France)