Lessons Learned Planning, Managing, and Running the BSTJF CTF
Upcoming SlideShare
Loading in...5
×

Like this? Share it with your network

Share

Lessons Learned Planning, Managing, and Running the BSTJF CTF

  • 121 views
Uploaded on

Derek and I talk about how we run the BSJTF CTF

Derek and I talk about how we run the BSJTF CTF

More in: Technology
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Be the first to comment
    Be the first to like this
No Downloads

Views

Total Views
121
On Slideshare
121
From Embeds
0
Number of Embeds
0

Actions

Shares
Downloads
2
Comments
0
Likes
0

Embeds 0

No embeds

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
    No notes for slide

Transcript

  • 1. Lessons Learned Planning, Managing, and Running the BSJTF CTF Ben Ten (@Ben0xA Derek Thomas (@dth0m) Bsides Detroit 2014
  • 2. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About Ben Ben Ten (0xA) @Ben0xA - twitter Chicago - #burbsec Vice President Security Officer Developer PoshSec Framework Developer / Creator Gamer Geek
  • 3. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About Derek Derek Thomas @dth0m - twitter Detroit-#MiSec Security Consultant Log Monkey BSJTF Co Organizer
  • 4. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About BSJTF Where did this all start? ● MiSec competing in many capture the flag competitions ● CSAW 2012/2013, Ghost in the shellcode 2012/2013, RuCTFe 2012 ● Wanted a proving ground for creating new challenges for the team ● Wango Ztango steps ● Zombie Tango stepped up and built the initial framework ● Was used to host some training challenges and eventually hold a CTF ● During 2013 collaboration between Chicago and Detroit Bsides events and it was suggested that we work together to host a combined event
  • 5. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About BSJTF Cross City CTF 2013 was born! ● Collaborative CTF event was created to start at Bsides Chicago and end in Bsides Detroit ● Collaborators: Ben, Derek, Juan ● Started planning for the event in Nov or Dec of 2012 ● Each city had around 25-30 challenges with a local winner but there was also an overall grand prize winner. ● Teaser challenges were dropped in the weeks leading up to each competition ● Challenges were open for 2 days ● Framework was hosted in AWS ● Built in event logging system developed to detect potential attacks on the application
  • 6. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About BSJTF Chicago Event ● Strong turn out with some talented teams ● Started Saturday Morning and ran until Sunday evening ● Saturday competition went relatively ok ● Encountered several challenges where the answers were not communicated and entered correctly, Hard to solve a challenge that doesn’t have a right answer ● This can occur since many of the challenges are submitted by volunteers and sometimes the importance of an exact answer is underestimated ● Competition continued until Sunday to allow teams to have 2 days at each competition ● Sunday went alright until Ben noticed that someone’s score started increasing at an abnormal pace
  • 7. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About BSJTF Transition to Detroit
  • 8. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About BSJTF (Challenges and lessons learned) ● Planning and running a CTF is a lot of work ● Challenges can take a significant quantity of time to develop and test ● It was important to have organizers with a wide array of skills ● We wanted to focus on creating fun challenges that were solvable in the time allotted ● Many tips were given to help teams along ● We encountered issues with challenge answers that were too vague ● Definitive walkthroughs and answers are a must
  • 9. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About BSJTF 2014 – A New Year!
  • 10. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About BSJTF Chicago 2014 ● Went off without a hitch ● Tried a new category for home automation with the help of Beltface ● We thought it would be cool to hack the Hue lights ● So did everyone else, the lights became completely un responsive and unable to connect to the network ● We thought they were bricked somehow but ultimately the lights were fixed
  • 11. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About BSJTF Circle City Con 2014
  • 12. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About BSJTF Lork – many Lulz!
  • 13. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About BSJTF Lork – many Death threats!
  • 14. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About BSJTF Lork – Hosting Issues Email at 4am from Host: “Please... make them stop!!!! :'(
  • 15. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About BSJTF Detroit – Happening Naow!
  • 16. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About BSJTF 2014 Lessons Learned ● 3 CTF competitions in roughly 3 months with close to 90 challenges is tough ● We feel the competitions are worth it ● Help develop new skills ● Refine old skills ● Think outside of the box ● Lots of fun
  • 17. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About BSJTF Requirements for CTF ● Varied Talent ● Varied challenges ● 25-30 challenges easy to mind bending difficulty ● Solid unfiltered Internet connection ● Dedicated wireless network for the CTF ● Spare the civilians ● Framework to host the challenges, track the progress, and verify the answers ● Lots of time ● Couple hours per challenge minimum? ● People to play
  • 18. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) About BSJTF The Future!
  • 19. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) Contact - Q&A Ben Ten (0xA) @Ben0xA - twitter http://ben0xa.com https://bsjtf.com web@ben0xa.com irc.freenode.net #burbsec, #poshsec, #pssec QUESTIONS?! Derek Thomas @dth0m - twitter https://bsjtf.com irc.freenode.net #misec
  • 20. Practical PowerShell Programming for Professional People Converge Detroit - Ben Ten (@Ben0xA) Thank You!