The RVAsec CTF team is beginning the setup and planning phase of the 2016 conference.  As many of you know, we pride ourselves with this CTF being an all-inclusive learning CTF and not just a ‘stump the chump / who’s the best engineer in the room’ kind of CTF. That said, we need volunteers to come up with fresh ideas, challenges, and setups that are both fun and informative. Additionally, we do want to provide a challenge for those who show up looking for one, so if you are a more advanced user or admin and have some killer challenges that can stump someone, we’ll need those too for the higher tiers.

Speaking of Tiers, we plan to have 3 or 4 tiers this year and they will be as follows:

Tier 1 -Beginner

This tier will comprise the majority of the challenges and points ideally. Challenges in this category should be purely beginner level challenges. Some examples of year past are:

 Connecting to SSH and copying part of the SSH key as the flag

 Looking in web page source code for the flag

 Trivia questions related to IT / Hacking History / Etc.

 Wireshark dumps of plain text authentications

 Port and/or device identification (that’s port 25, used for SMTP, running on a Raspberry pi, identified by its MAC OUI)

Tier 2 – Moderate

This is a moderate tier geared more towards people who digging deeper into Security and the different facets it includes as well as experienced Pentesters. Some examples from the past:

 XOR code samples with python

 Heartbleed exploit to retrieve login information

 Local privilege escalation to find the Flag

 SQL injection

 MS08-67 Exploits

 Brute force SSH or SFTP sites

 DFIR recovery and artifact location

Tier 3 – Hard

The hard tier, built mainly with ‘stump the chump’ challenges that are for the seasoned CTF player and people solely after winning prizes and spending the whole con in the CTF:

 Reverse engineering samples

 Malware C2 traffic Analysis

 Chained exploits

 Ghost services that have to fuzzed

 Firmware disassembly

Tier 4 – Hardware

Hopefully, we will be able to include various hardware challenges this year with the help of HackRVA as we have in the past, this tier will be specific to the Badges but we are always open to including other Hardware or IoT related challenges in at this level, so any idea, let us know!

So all that said – Come help out! If you are interested in assisting, please send an email to Mike Bailey and we’ll add you to the mailing list going forward as we begin to work it all out.

We are looking for a sponsor for the CTF, if you are interested please contact us to discuss!

Thanks and we will provide more updates as they happen!

We caught up with Nick Popovich from the RV4sec CTF team and he had some great information to share with us!

The RV4sec CTF is next week, and is going to be the most intense CTF the 804 has ever seen! Here’s what’s new and amazing this year. Also you’ll want to read on for some info that will aide you during the event.

New:

1). We have what most folks expect: the RV4sec CTF with new challenges and our smiling faces.

2). Bugcrowd will be onsite, and all LIVE, REAL vulns in the Bugrcrowd bug bounty system that CTF participants submit during the event will be checked on the spot. Points for the CTF will be awarded if the submitted bugs are accepted as valid by Bugcrowd.

3). GE has partnered with us and will have their Ghost Red CTF running with MANY amazing challenges (including hacking a simulated nuclear power plant). All points for Ghost Red will also be added to total RV4sec CTF score.

4). Last but certainly not least, the HackRVA folks have included CTF challenges in the RV4sec badges. That’s right, you can tinker with your badges and find “keys” or “flags” and submit those into the RV4sec CTF scoreboard for points.The scoreboard also has clues (for all the challenges).

Info:

There will be three systems that folks can register for that will count towards their total score for the CTF:

1). The RV4sec CTF scoreboard.
2). The Bugcrowd system via the Internet (click here for more info for Bugcrowd)
3). The GE Ghost Red CTF scoreboard

The Bugcrowd info linked to above has some values for “points” but that is for the Bugcrowd system only. We will be adjusting the point values for Bugcrowd vulns for the CTF to match our points system. But obviously, the harder/neater the vuln is to exploit, the more points you’ll get.

It is CRAZY important that in all the systems you choose THE SAME USERNAME, and append “_rvasec” without quotes to your username. I’ll say it again. CHOOSE SAME USERNAME IN ALL SYSTEMS and AND “_rvasec” without quotes to your username. if you don’t the points won’t be added up for all your hard work across the systems.

Example: If i want my username to be pipefish, I would put pipefish_rvasec in when creating accounts in all 3 systems.

I know some App Devs, DBA’s and IT folks are scowling now, asking why we don’t have API’s or some consolidated system that curates all the data from the three systems and shows a single leaderboard. To you I say… maybe next year 😉 This year, we have three systems, and that’s that.

We’ve got some rad prizes too including a OnePlus phone loaded with NetHunter courtesy of Offsec, Netsparker licenses, WiebeTech Forensic ComboDock v5, USB-WiFi-Premium KeyGrabber and a Yubikey NEO!