Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An informal review of CTF abuse

gynvael.coldwind.pl

Post reply on HN
Print view View original

31–40 of 45 posts

Re: An informal review of CTF abuse

#31

Post by saagarjha »

prvit wrote: post #22
PragmaticPulp wrote: post #16

Earlier quoted context omitted.

> Poor sports, I’ve always struggled to understand people who’d partake in hacking competitions and then get upset because someone got onto their computer and took all the flags. The sport is about everyone racing to solve the same puzzles. If one team is sabotaging the puzzles in the process, it's a different kind of competition than the players expected. Frustration is warranted. It would be like signing up for the…

>it's a different kind of competition than the players expected CTFs are (usually) hacking competitions for hackers, what else would you expect?

CTFs are not free-for-all competitions, they are clearly time-bounded and designed for enjoyment. Having a team show up with a zero day chain for Linux that they designed for a year spoils the enjoyment of everyone else.

Re: An informal review of CTF abuse

#32

Post by saagarjha »

znpy wrote: post #18

Dunno, many of those things are occasions for learning. Back in like 2014 we were competing in RuCTF and some other team hacked our vulnbox and just shut down the rng, making the box effectively inaccessible via ssh and slow as molasses on tls-enabled services (besides capturing all of our flags). It was an enlightening experience. Now granted, ructf was pf a particularly spectacular violence… but still, it’s been an…

They’re usually occasions for the organizers to learn :)

Re: An informal review of CTF abuse

#33

Post by saagarjha »

tester756 wrote: post #15
gynvael wrote: post #14

Earlier quoted context omitted.

Also the pandemic happened. In the later years we were playing mostly to go to offline finals. And the pandemic meant no offline finals.

Imma use that opportunity and ask Are skills of military/state-level actors comparable with CTF people? Or they're mostly focused on different things, so it's tricky to compare those things? I'm asking because it feels like at the end of the day all of those groups search for 0days

CTF challenges typically do not involve zero days as their intended solution, due to time constraints. Often they will inject a vulnerability into e.g. Chromium by patching it in a way that might approximate a real bug, then hand you the patch so you save the weeks, months it takes to find stuff like this normally. So from there it becomes purely a test of being able to exploit the bug, although still your constraints are a bit different as you can be loud and only really need to succeed once when an actual state-level actor will want something better than that. But again, this is a result of time constraints.

Re: An informal review of CTF abuse

#36

Post by prvit »

saagarjha wrote: post #31
prvit wrote: post #22

Earlier quoted context omitted.

>it's a different kind of competition than the players expected CTFs are (usually) hacking competitions for hackers, what else would you expect?

CTFs are not free-for-all competitions, they are clearly time-bounded and designed for enjoyment. Having a team show up with a zero day chain for Linux that they designed for a year spoils the enjoyment of everyone else.

rming the CTF infra spoils the enjoyment of everyone else, winning because you’re the best and showed up with a cool exploit chain isn’t spoiling anything for anyone.

Re: An informal review of CTF abuse

#37

Post by prvit »

PeterisP wrote: post #28
prvit wrote: post #22

Earlier quoted context omitted.

>it's a different kind of competition than the players expected CTFs are (usually) hacking competitions for hackers, what else would you expect?

It's like saying in biathlon (skiing+shooting) how can you arrive at the finish second if you have a working gun? Rules are rules, there's a clearly defined scope of where the fighting happens and where it does not.

> It's like saying in biathlon (skiing+shooting) how can you arrive at the finish second if you have a working gun?

It’s really not.

Re: An informal review of CTF abuse

#38

Post by saagarjha »

prvit wrote: post #36
saagarjha wrote: post #31

Earlier quoted context omitted.

CTFs are not free-for-all competitions, they are clearly time-bounded and designed for enjoyment. Having a team show up with a zero day chain for Linux that they designed for a year spoils the enjoyment of everyone else.

rming the CTF infra spoils the enjoyment of everyone else, winning because you’re the best and showed up with a cool exploit chain isn’t spoiling anything for anyone.

Right, so my point is that hacking everyone playing the CTF or the infrastructure is similar to running rm. Using a zero day on a challenge to get a flag is often allowed and even seen as amusing.

Re: An informal review of CTF abuse

#39

Post by gynvael »

saagarjha wrote: post #33
tester756 wrote: post #15

Earlier quoted context omitted.

Imma use that opportunity and ask Are skills of military/state-level actors comparable with CTF people? Or they're mostly focused on different things, so it's tricky to compare those things? I'm asking because it feels like at the end of the day all of those groups search for 0days

CTF challenges typically do not involve zero days as their intended solution, due to time constraints. Often they will inject a vulnerability into e.g. Chromium by patching it in a way that might approximate a real bug, then hand you the patch so you save the weeks, months it takes to find stuff like this normally. So from there it becomes purely a test of being able to exploit the bug, although still your constraint…

This is true, though I need to add the missing phrase - "CTF challenges typically do not involve zero days" in real world software.

They do however strictly involve zero days in software created for the purpose of the CTF - that's basically what CTFs are about.

Re: An informal review of CTF abuse

#40

Post by prvit »

saagarjha wrote: post #38
prvit wrote: post #36

Earlier quoted context omitted.

rming the CTF infra spoils the enjoyment of everyone else, winning because you’re the best and showed up with a cool exploit chain isn’t spoiling anything for anyone.

Right, so my point is that hacking everyone playing the CTF or the infrastructure is similar to running rm. Using a zero day on a challenge to get a flag is often allowed and even seen as amusing.

> Right, so my point is that hacking everyone playing the CTF or the infrastructure is similar to running rm.

It’s really not. rm is destructive, hacking competitors or infra to collect flags isn’t.

Post reply on HN