Lessons Learned Planning, Managing, and Running the BSTJF CTF
-
Upload
ben-ten-0xa -
Category
Technology
-
view
132 -
download
0
description
Transcript of Lessons Learned Planning, Managing, and Running the BSTJF CTF
Lessons Learned Planning, Managing, and Running
the BSJTF CTF
Ben Ten (@Ben0xADerek Thomas (@dth0m)
Bsides Detroit 2014
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About Ben
Ben Ten (0xA)@Ben0xA - twitter
Chicago - #burbsecVice PresidentSecurity OfficerDeveloperPoshSec Framework Developer / CreatorGamerGeek
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About Derek
Derek Thomas@dth0m - twitter
Detroit-#MiSecSecurity ConsultantLog MonkeyBSJTF Co Organizer
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About BSJTF
Where did this all start?● MiSec competing in many capture the flag competitions● CSAW 2012/2013, Ghost in the shellcode 2012/2013, RuCTFe
2012● Wanted a proving ground for creating new challenges for the
team● Wango Ztango steps● Zombie Tango stepped up and built the initial framework● Was used to host some training challenges and eventually hold
a CTF● During 2013 collaboration between Chicago and Detroit Bsides
events and it was suggested that we work together to host a combined event
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About BSJTFCross City CTF 2013 was born!
● Collaborative CTF event was created to start at Bsides Chicago and end in Bsides Detroit
● Collaborators: Ben, Derek, Juan● Started planning for the event in Nov or Dec of 2012● Each city had around 25-30 challenges with a local winner but
there was also an overall grand prize winner. ● Teaser challenges were dropped in the weeks leading up to
each competition● Challenges were open for 2 days● Framework was hosted in AWS● Built in event logging system developed to detect potential
attacks on the application
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About BSJTF
Chicago Event● Strong turn out with some talented teams● Started Saturday Morning and ran until Sunday evening● Saturday competition went relatively ok● Encountered several challenges where the answers were not
communicated and entered correctly, Hard to solve a challenge that doesn’t have a right answer
● This can occur since many of the challenges are submitted by volunteers and sometimes the importance of an exact answer is underestimated
● Competition continued until Sunday to allow teams to have 2 days at each competition
● Sunday went alright until Ben noticed that someone’s score started increasing at an abnormal pace
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About BSJTF
Transition to Detroit
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About BSJTF
(Challenges and lessons learned)● Planning and running a CTF is a lot of work● Challenges can take a significant quantity of time to develop
and test● It was important to have organizers with a wide array of skills● We wanted to focus on creating fun challenges that were
solvable in the time allotted● Many tips were given to help teams along● We encountered issues with challenge answers that were too
vague● Definitive walkthroughs and answers are a must
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About BSJTF
2014 – A New Year!
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About BSJTFChicago 2014
● Went off without a hitch● Tried a new category for home automation with the help of
Beltface● We thought it would be cool to hack the Hue lights● So did everyone else, the lights became completely un
responsive and unable to connect to the network● We thought they were bricked somehow but ultimately the
lights were fixed
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About BSJTF
Circle City Con 2014
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About BSJTF
Lork – many Lulz!
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About BSJTF
Lork – many Death threats!
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About BSJTF
Lork – Hosting Issues
Email at 4am from Host:
“Please... make them stop!!!! :'(
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About BSJTF
Detroit – Happening Naow!
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About BSJTF2014 Lessons Learned
● 3 CTF competitions in roughly 3 months with close to 90 challenges is tough
● We feel the competitions are worth it● Help develop new skills● Refine old skills● Think outside of the box● Lots of fun
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About BSJTFRequirements for CTF
● Varied Talent● Varied challenges● 25-30 challenges easy to mind bending difficulty● Solid unfiltered Internet connection● Dedicated wireless network for the CTF● Spare the civilians● Framework to host the challenges, track the progress, and
verify the answers● Lots of time● Couple hours per challenge minimum?● People to play
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
About BSJTF
The Future!
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
Contact - Q&A
Ben Ten (0xA)@Ben0xA - twitterhttp://ben0xa.comhttps://[email protected]
irc.freenode.net#burbsec, #poshsec, #pssec
QUESTIONS?!
Derek Thomas@dth0m - twitterhttps://bsjtf.com
irc.freenode.net#misec
Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)
Thank You!