An informal review of CTF abuse • Hacker News Board

Re: An informal review of CTF abuse

#41

Post by sandeep1338 » Mon, Jul 25, 2022, 4:41 AM UTC

gynvael wrote: post #14

Retr0id wrote: post #11

Earlier quoted context omitted.

This is a relatively common pattern in CTF (and probably, other competitive activities). Being a top-level CTF competitor takes a big time investment, both in terms of maintaining your skills, and actually competing. It's hard for an individual to maintain that level of commitment over time, especially if their personal responsibilities increase (getting a full-time job, starting a family, etc.). Responsibilities asi…

Also the pandemic happened. In the later years we were playing mostly to go to offline finals. And the pandemic meant no offline finals.

That's true, I met team in code blue in physical conf and saw who they were solving problems. I'm hoping to see the team again in the conferences.

Re: An informal review of CTF abuse

#42

Post by saagarjha » Mon, Jul 25, 2022, 5:11 AM UTC

gynvael wrote: post #39

saagarjha wrote: post #33

Earlier quoted context omitted.

CTF challenges typically do not involve zero days as their intended solution, due to time constraints. Often they will inject a vulnerability into e.g. Chromium by patching it in a way that might approximate a real bug, then hand you the patch so you save the weeks, months it takes to find stuff like this normally. So from there it becomes purely a test of being able to exploit the bug, although still your constraint…

This is true, though I need to add the missing phrase - "CTF challenges typically do not involve zero days" in real world software . They do however strictly involve zero days in software created for the purpose of the CTF - that's basically what CTFs are about.

Fair enough, although I would argue that a zero day in a menu-based heap massaging challenge is not really all that interesting :P

Re: An informal review of CTF abuse

#43

Post by saagarjha » Mon, Jul 25, 2022, 5:12 AM UTC

prvit wrote: post #40

saagarjha wrote: post #38

Earlier quoted context omitted.

Right, so my point is that hacking everyone playing the CTF or the infrastructure is similar to running rm. Using a zero day on a challenge to get a flag is often allowed and even seen as amusing.

> Right, so my point is that hacking everyone playing the CTF or the infrastructure is similar to running rm. It’s really not. rm is destructive, hacking competitors or infra to collect flags isn’t.

If you hack the infra to get all the flags it's really pretty close to just nuking the competition then and there isn't it? What's the point for everyone else to continue after that?

Re: An informal review of CTF abuse

#44

Post by prvit » Mon, Jul 25, 2022, 9:07 AM UTC

saagarjha wrote: post #43

prvit wrote: post #40

Earlier quoted context omitted.

> Right, so my point is that hacking everyone playing the CTF or the infrastructure is similar to running rm. It’s really not. rm is destructive, hacking competitors or infra to collect flags isn’t.

If you hack the infra to get all the flags it's really pretty close to just nuking the competition then and there isn't it? What's the point for everyone else to continue after that?

Winning is not the same as nuking the competition.

> What's the point for everyone else to continue after that?

Fun? Second, third, fourth … place?

I’d imagine most CTF teams don’t go in expecting to win.

And how are the other teams supposed to know anyway?

Re: An informal review of CTF abuse

#45

Post by gynvael » Mon, Jul 25, 2022, 8:54 PM UTC

saagarjha wrote: post #42

gynvael wrote: post #39

Earlier quoted context omitted.

This is true, though I need to add the missing phrase - "CTF challenges typically do not involve zero days" in real world software . They do however strictly involve zero days in software created for the purpose of the CTF - that's basically what CTFs are about.

Fair enough, although I would argue that a zero day in a menu-based heap massaging challenge is not really all that interesting :P

Not saying it's interesting (in the terms of a real world application), but it technically is an 0-day ;)