Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An informal review of CTF abuse

gynvael.coldwind.pl

Post reply on HN
Print view View original

11–20 of 45 posts

Re: An informal review of CTF abuse

#11

Post by Retr0id »

tester756 wrote: post #4

What happened to author's team (Dragon Sector)? Until 2020 they were almost always around top3 and a few times top1 teams in the world according to https://ctftime.org/ but in 2021/2022 I don't see them

This is a relatively common pattern in CTF (and probably, other competitive activities). Being a top-level CTF competitor takes a big time investment, both in terms of maintaining your skills, and actually competing.

It's hard for an individual to maintain that level of commitment over time, especially if their personal responsibilities increase (getting a full-time job, starting a family, etc.). Responsibilities aside, people also just get bored and/or burnt out (after a point, most challenges are just variations on something you've seen before).

For a team to stay competitive over time, they either need enough members to fill the gaps, or a sustainable influx of new members.

Re: An informal review of CTF abuse

#14

Post by gynvael »

Retr0id wrote: post #11
tester756 wrote: post #4

What happened to author's team (Dragon Sector)? Until 2020 they were almost always around top3 and a few times top1 teams in the world according to https://ctftime.org/ but in 2021/2022 I don't see them

This is a relatively common pattern in CTF (and probably, other competitive activities). Being a top-level CTF competitor takes a big time investment, both in terms of maintaining your skills, and actually competing. It's hard for an individual to maintain that level of commitment over time, especially if their personal responsibilities increase (getting a full-time job, starting a family, etc.). Responsibilities asi…

Also the pandemic happened. In the later years we were playing mostly to go to offline finals. And the pandemic meant no offline finals.

Re: An informal review of CTF abuse

#15

Post by tester756 »

gynvael wrote: post #14
Retr0id wrote: post #11

Earlier quoted context omitted.

This is a relatively common pattern in CTF (and probably, other competitive activities). Being a top-level CTF competitor takes a big time investment, both in terms of maintaining your skills, and actually competing. It's hard for an individual to maintain that level of commitment over time, especially if their personal responsibilities increase (getting a full-time job, starting a family, etc.). Responsibilities asi…

Also the pandemic happened. In the later years we were playing mostly to go to offline finals. And the pandemic meant no offline finals.

Imma use that opportunity and ask

Are skills of military/state-level actors comparable with CTF people?

Or they're mostly focused on different things, so it's tricky to compare those things?

I'm asking because it feels like at the end of the day all of those groups search for 0days

Re: An informal review of CTF abuse

#16

Post by PragmaticPulp »

prvit wrote: post #7

>(or rather: fun factor after a couple of years passed and folks stopped being annoyed or down right furious at the perpetrators) Poor sports, I’ve always struggled to understand people who’d partake in hacking competitions and then get upset because someone got onto their computer and took all the flags.

> Poor sports, I’ve always struggled to understand people who’d partake in hacking competitions and then get upset because someone got onto their computer and took all the flags.

The sport is about everyone racing to solve the same puzzles. If one team is sabotaging the puzzles in the process, it's a different kind of competition than the players expected. Frustration is warranted.

It would be like signing up for the 100m dash but then having your competitors throw obstacles into your lane. That wasn't the intent of the competition.

Re: An informal review of CTF abuse

#17

Post by gynvael »

tester756 wrote: post #15
gynvael wrote: post #14

Earlier quoted context omitted.

Also the pandemic happened. In the later years we were playing mostly to go to offline finals. And the pandemic meant no offline finals.

Imma use that opportunity and ask Are skills of military/state-level actors comparable with CTF people? Or they're mostly focused on different things, so it's tricky to compare those things? I'm asking because it feels like at the end of the day all of those groups search for 0days

There is some overlap, but only some.

In general CTF problems are limited in the sense that they need to be solvable withing the tournament time frame (usually 48h), and also the process is simpler - you don't have to be quiet, you grab the flag and that's it; no need to think beyond that point (i.e. no need to worry about backdooring, C2, hiding the traffic, lateral movement, detection, etc).

Also CTF problems might be super specific, to the extent of being unlikely to be encountered in a real world. The real world is a bit different - a lot of systems have same old boring issues. On the flip side when dealing with 0-days in stuff like modern browsers you are likely to exceed the level of complexity of even top CTF pwn challenges - mostly due to the aforementioned time constrain in CTFs.

That said, a lot of technical skills would be transferable between both areas. Regardless which way one would switch, there would still be a decent amount of learning (e.g. learning the CTF metagame, learning to think beyond getting a shell).

Re: An informal review of CTF abuse

#18

Post by znpy »

Dunno, many of those things are occasions for learning.

Back in like 2014 we were competing in RuCTF and some other team hacked our vulnbox and just shut down the rng, making the box effectively inaccessible via ssh and slow as molasses on tls-enabled services (besides capturing all of our flags).

It was an enlightening experience.

Now granted, ructf was pf a particularly spectacular violence… but still, it’s been an experience that has taught me a lot.

Re: An informal review of CTF abuse

#19

Post by Snetry »

Supermancho wrote: post #5

Would be nice if there was the briefest description about what CTF means here, since I expected it to be about gaming (ie Team Fortress) https://www.enisa.europa.eu/news/enisa-news/capture-the-flag...

Its Capture the Flag but instead of gunning down enemies you have to hack a system that is vulnerable in some way

Re: An informal review of CTF abuse

#20

Post by gynvael »

Supermancho wrote: post #5

Would be nice if there was the briefest description about what CTF means here, since I expected it to be about gaming (ie Team Fortress) https://www.enisa.europa.eu/news/enisa-news/capture-the-flag...

Sorry about that. I added a paragraph after the first one in the blog post. I didn't expect the blog post to travel beyond the CTF community.
Post reply on HN