Lessons Learned Planning, Managing, and Running

the BSJTF CTF

Ben Ten (@Ben0xADerek Thomas (@dth0m)

Bsides Detroit 2014

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About Ben

Ben Ten (0xA)@Ben0xA - twitter

Chicago - #burbsecVice PresidentSecurity OfficerDeveloperPoshSec Framework Developer / CreatorGamerGeek

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About Derek

Derek Thomas@dth0m - twitter

Detroit-#MiSecSecurity ConsultantLog MonkeyBSJTF Co Organizer

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About BSJTF

Where did this all start?● MiSec competing in many capture the flag competitions● CSAW 2012/2013, Ghost in the shellcode 2012/2013, RuCTFe

2012● Wanted a proving ground for creating new challenges for the

team● Wango Ztango steps● Zombie Tango stepped up and built the initial framework● Was used to host some training challenges and eventually hold

a CTF● During 2013 collaboration between Chicago and Detroit Bsides

events and it was suggested that we work together to host a combined event

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About BSJTFCross City CTF 2013 was born!

● Collaborative CTF event was created to start at Bsides Chicago and end in Bsides Detroit

● Collaborators: Ben, Derek, Juan● Started planning for the event in Nov or Dec of 2012● Each city had around 25-30 challenges with a local winner but

there was also an overall grand prize winner. ● Teaser challenges were dropped in the weeks leading up to

each competition● Challenges were open for 2 days● Framework was hosted in AWS● Built in event logging system developed to detect potential

attacks on the application

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About BSJTF

Chicago Event● Strong turn out with some talented teams● Started Saturday Morning and ran until Sunday evening● Saturday competition went relatively ok● Encountered several challenges where the answers were not

communicated and entered correctly, Hard to solve a challenge that doesn’t have a right answer

● This can occur since many of the challenges are submitted by volunteers and sometimes the importance of an exact answer is underestimated

● Competition continued until Sunday to allow teams to have 2 days at each competition

● Sunday went alright until Ben noticed that someone’s score started increasing at an abnormal pace

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About BSJTF

Transition to Detroit

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About BSJTF

(Challenges and lessons learned)● Planning and running a CTF is a lot of work● Challenges can take a significant quantity of time to develop

and test● It was important to have organizers with a wide array of skills● We wanted to focus on creating fun challenges that were

solvable in the time allotted● Many tips were given to help teams along● We encountered issues with challenge answers that were too

vague● Definitive walkthroughs and answers are a must

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About BSJTF

2014 – A New Year!

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About BSJTFChicago 2014

● Went off without a hitch● Tried a new category for home automation with the help of

Beltface● We thought it would be cool to hack the Hue lights● So did everyone else, the lights became completely un

responsive and unable to connect to the network● We thought they were bricked somehow but ultimately the

lights were fixed

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About BSJTF

Circle City Con 2014

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About BSJTF

Lork – many Lulz!

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About BSJTF

Lork – many Death threats!

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About BSJTF

Lork – Hosting Issues

Email at 4am from Host:

“Please... make them stop!!!! :'(

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About BSJTF

Detroit – Happening Naow!

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About BSJTF2014 Lessons Learned

● 3 CTF competitions in roughly 3 months with close to 90 challenges is tough

● We feel the competitions are worth it● Help develop new skills● Refine old skills● Think outside of the box● Lots of fun

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About BSJTFRequirements for CTF

● Varied Talent● Varied challenges● 25-30 challenges easy to mind bending difficulty● Solid unfiltered Internet connection● Dedicated wireless network for the CTF● Spare the civilians● Framework to host the challenges, track the progress, and

verify the answers● Lots of time● Couple hours per challenge minimum?● People to play

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

About BSJTF

The Future!

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

Contact - Q&A

Ben Ten (0xA)@Ben0xA - twitterhttp://ben0xa.comhttps://bsjtf.comweb@ben0xa.com

irc.freenode.net#burbsec, #poshsec, #pssec

QUESTIONS?!

Derek Thomas@dth0m - twitterhttps://bsjtf.com

irc.freenode.net#misec

Practical PowerShell Programming for Professional PeopleConverge Detroit - Ben Ten (@Ben0xA)

Thank You!