CTF Submissions - There can be only one!

[Dark Tangent]

CTF submission #1 of 4

- Number of people in your organization (that will actively be participating in creating/planning/executing CTF):
20

- Experience team members have had in planning events (This could be a bake sale with 500 people, or a DoD briefings for 20 people, something that indicates some planning experience):

Coordination for training events for 40+ individuals.
Coordination semi-annual meeting of 20 corporation CEO's.
Coordination for activities of small groups of hackers to participating in ctf.
Experience with leadership of diverse hacking groups, attack forces and defensive forces
Experience with add-hoc generation of task teams to meet game or crisis needs
Access to a wide array of people which can be leveraged at and before con to problem solving and challenge meeting associated with the new CTF game.

- Technical ability of team. This would include a general list of people's abilities * networking, hardware, etc and support the idea you can pull this off:

Several professional developers of networks wireless
Two sometimes professional engineers of networks
Several professional security researchers/forensics analysts
One amateur sheep luuuuuva
Other really smart people

- Physical resources (if any) that you will be bringing to help run CTF such as a disco ball, robots or enigma machines. This to help us plan to accommodate it with the hotel if you require extra power or special fire marshal approval for your Cray 1 cooling towers.:

~10 servers
~3 routers
~1.7 chemistry sets (GHB and Vitamin K synthesis for sheep luuuuuva)

- What experience have your team members had in playing CTF in the past. This is not a requirement, but shows real-world knowledge of the game as it has been played in the past.:

Occasional participants in defcon CTFs over the many years. Some participation in other (not-defcon) CTF type exercises

- Explain you vision for CTF -Explain, in a general manner, your vision of your CTF.

We view the CTF as the venue for real hackers to demonstrate/practice their skills at breaking into computers by remote. While we recognize that there are many skills to hacking such as social engineering, lock picking and more we think that some of these skills are already tested in other contests running at Defcon. While other contests may be combined in some capacity, they will not be a core focus of our flavour of CTF.

- Explain how you hope the attendees will experience it. For example, they sign up on-line, get a secret package in the mail, start blindfolded with an unusual laptop? Are their certain crises points you will introduce during the game to confuse or add to the pressure?

Attendees wishing to participate in the team portion of CTF will be required to register in advance in order to participate in the team qualifying round expected to take place approximately 2 months prior to Defcon. We anticipate accepting nine teams (plus returning champion) into the team competition to take place over the three days of Defcon. An individual competition organized similar to the qualifying round may be also offered during the con. Such an individual round could be entered by anyone choosing to register at Defcon. The individual competition would be accessed on the conference wireless with a scoreboard displaying the current individual leader board in the CTF arena. Teams may be required to overcome some initial challenge such as picking a lock to obtain access to their network feed into the game. A mob style element may be introduced by providing a game connection to the chill out area/amateur ctf tables. The mob would effectively be a non-scoring team capable of attacking all of the other teams and introducing general mayhem (other than DoS attacks which will not be acceptable. Too great bandwidth consumption by the mob will result in disconnection. We are not interested in seeing a bunch of nmap/nessus scans against the game network.

-Provide three reasons your group should host CTF.

1. We have enjoyed playing and observing CTF over the years and would like to give something back to the community.
2. We feel that the perspective we have gained as players will offer us the best opportunity to make a game that agrees to the spirit of CTF, incorporating the best of what we have experienced, with fresh ideas gained from an detailed knowledge of the game that only players could appreciate.
3. We have no commercial interest in the game and are doing this not for personal gain.
4. We don't really want to play a game not hosted by Kenshoto so we thought we might try to running the thing ourselves.

-How do players or teams qualify (if there are qualifications)?

As like the past, the qualification round will consist of a point oriented competition with wide variety of topics and exercising a wide variety of skills. The challenges will take the form of a Jeopardy style board. The nine top scoring teams will be offered spots to CTF. Ties will be broken by the first team to reach the score. Qualifying teams will have two weeks to confirm to CTF. After two weeks, any teams that have not confirmed their intention to participate at Defcon will lose their spot in the game and the next available team as determined by qualifying score will be offered a chance to participate in CTF.

-Is it multi player or single-player, or a combination?

We intend to maintain the team oriented aspect of the game while introducing an individual part to the game as a way to get more interest from Defcon attendees. A prize may be set aside for the winner of the individual competition.

-What innovations or new ideas are you bringing to CTF?

We intend to bring a new scoring system to the game with different visualization for the game activities. Additionally, there may be side challenges designed to mix things up a bit and test the diversity of each teams skills. Unlike recent years, we hope to make teams to defend multiple servers running different operating systems. In order to attract more attendees to the game we hope to make several opportunities for attendees to drop in and play in some way.

-How long will the contest take, will it be 24x7, 8 hour shifts, etc?

26 total hours. 10 hours Friday, 10 hours Saturday, and 6 hours Sunday.

-What technical work is required to execute your plan. This includes setting up environments beforehand, pre-qualification work if any, writing a scoring system, etc.?

Qualifications and the actual CTF competition will each require setup.

Quals will require making questions/challenges and answers as well as communications channels, web pages and score viewing methods.

CTF will require the setup of multiple environments including scoring, display and target services.

-Give an outline of the rules that will be presented to the participants:

Generally we're finding rules to be superficial, as such we don’t intend to enforce many.

Rough outline:
No DoS. Windows is better!
No nmap/nessus scanning (they won't get you anything anyway)
Table limit of 8 enforced
No physical coercion (sheep excepted).

Quals:
We will conduct the qualifications in a similar manner as the previous Kenshoto CTF organizers to choose skilled teams for the purpose of supplying the eventual CTF competition with the most highly skilled players. The quals will include real time chat and multiple challenges with skill requirements similar to the skills required in CTF.

CTF:
All competing teams will be supplied with the same challenges at the same time or have equal opportunity to gain points or make progress. Simple game rules will be supplied in printed or digital form to ease potential language barrier issues.

-Why do you want to do this?

See section “Provide three reasons your group should host CTF.”

-Explain what you believe is the best way to gauge a hacker's abilities, and how your vision of the contest could do this?

Cross between depth of skill and breadth of skill.
Team flexibility
Team diversity
Parallels with either business or national capability
Ability to pick up sheep

CTF has traditionally been oriented around computer network attack and defense. While we recognize that there are many other areas of interest within the hacking community, we feel that many of these areas are well tested by other Defcon contests, and we would like to continue the tradition of Defcon hosting the premiere CTF event. The primary focus of the game will be software exploiting. Some side challenges may use other areas of hacking such as lock picking. Our type of the game would present approximately 15 network based services for each team to attack. Vulnerabilities made into the services would range in difficulty from simple stack overflows to more complex heap overflows and cryptographic challenges.

-Tell us anything else that you think may be important or that we might consider in choosing your group to host CTF.

You know us and our intentions/culture Our priorities lie with the reputation and progress of the game and the conference rather than in the furtherance of commercial interests.

Te amo en la noche,
Te amo en la mañana.
Me largo para que cuando fuera,
Oh ovejas de hacer lo de banana.

[Dark Tangent]

Here are four sanitized submission, with some private details removed.

I am posting them here so everyone can comment on the different styles and get an idea of how the contest will go this year. We will be selecting the winner next week, so please comment on them!

[Note: Just fixed some hints as to who team #2 is.. if you figured it out please keep it to yourself]