What ever happened to the t2 challenge?

So, the t2 challenge of 2017.. It’s over for sure, but not in a way we anticipated. Before we get ahead of ourselves, let’s get back to the beginning.

The challenge was originally created in 2005 to give out free tickets to people with fantastic technical talents – there were two tracks, speed and elegance. You could either win by being the first one to solve the challenge, or by submitting the finest write-up. The idea was that also those without a personal training budget had a chance of participating the event – in practice, many new talents got a turbo boost for their contacts and career in security.

The format was successful for almost a decade, until the successful completions, attempts and downloads/page views started to drop steadily. The numbers were coming down and there was no denying it – the format of each year’s challenge appeared to have no effect on this.

We tried to compensate by putting more effort into creating the challenges, and promoted them also on Twitter in addition to the traditional channels. Alas, this did not work and we pivoted to a bug bounty this year.

The challenge was open for three full months over the summer, and during that time our own tweets alone reached over 130 000 people. Further promotion was done on our own blog, and mailing list, in addition to Full Disclosure and DailyDave. In the spirit of past challenges, the rules emphasized quality submissions and finesse to allow people to focus on what truly matters. Most importantly, the target had been selected exclusively for the t2 challenge, and had not been previously subjected to a bug bounty.

Despite a major scope increase two weeks before the challenge end date, we received exactly zero submissions. Not one, not two, but Z-to-the-E-to-the-R-to-the-0. Talk about failing..

Our question now to you, esteemed fellow hackers is:

How should we give out the free tickets in the future?

Please tweet or e-mail us, we want to hear your ideas! All feedback on the subject is appreciated.

There is sunshine after the rain – our good friend Leo Niemelä invited t2 to judge the annual LocalTapiola Hack Day. That’s the where the story continues in the following post.

Registration closed

The registration for t2’17 is now closed and all available tickets have been sold.

Yes – just like last year, we’re out of seats a month before the event.

A big thank you to all registered attendees and speakers – you are making this happen. See you soon!

F-Secure sponsors t2’17

As one of our oldest supporters, F-Secure has been sponsoring t2 since 2011. We’re more than delighted to have sponsors who stick around! A cyber security company headquartered in Helsinki, with 25 offices around the world, F-Secure will be celebrating their 30th anniversary next year.

A home to many recognized security experts, F-Secure provides a broad range of cyber security products and services to consumers, corporations and governmental organizations.

In case of any questions, you can reach them through multiple accounts on Twitter, or just apply for a job and find out the answer yourself! F-Secure products are covered by a vulnerability reward program.

Should you want to meet them in person, you can do that at t2’17 in Helsinki, October 26-27.

Less than 20 seats left

If you’ve ever been to t2, you know that the atmosphere and networking is everything. In order to keep it that way, we have to limit the amount of attendees, meaning there is a total of 99 seats available, including speakers and organizers.

That being said, we have passed the 80% mark. If you want to make sure you’ll actually have a seat, we advice you to register right now.

Cosmic Duke

In this video from t2’15 Artturi Lehtiö peers inside over 7 years of state sponsored malware operations. The presentation covers themes such as less glamorous side of APT research, tools and approaches, in addition to the challenges related to publishing this type of information.

Those into offensive work can view the video as training material for improving tradecraft.

For additional information on the subject, here are the links for the whitepapers mentioned during the talk.

t2’17 schedule complete

Those on Twitter may have noticed yesterday that our schedule is finally complete and available online. Check out the contents and RT if you like what you see!

This year’s program is indeed great! There are many familiar names – almost an alumni meeting of sorts, but also those who are making their t2 debut. Speaking of debuts, our new sponsor Beyond Security will also be present and available to discuss SecuriTeam Secure Disclosure.

The last week of the challenge is starting – there is still time left to claim the free ticket to t2’17. Registrations have continued steadily, and 70% of available tickets have been sold. If you are planning to attend, we recommend booking your seat now.

Budgeting season

Surprisingly many companies lock down their next year’s budgets already in Q3. While many of our attendees have negotiated conference and training costs to be part of their annual non-negotiable compensation package, there are also those who rely on the good graces of financial overlords to okay their attendance. This post is to remind that it’s yet again time to have the discussion about t2’18 – after all, it’s the 15th anniversary.

Why do we pester our readers with this? As Thomas Lim finely stated it in his keynote at Infiltrate 2012:

“[..] Conferences don’t really make a lot of money, unless you’re Black Hat [..]”

In many years, the question of making a small profit to guarantee enough liquidity for organizing the next event comes down to having the right sponsors. No sane person would enter a business with this kind of a risk/reward ratio. The talk is filled with other gems as well, and it’s definitely worth watching.

The reasons for organizing are elsewhere, namely you want to give back to the community, love the atmosphere of a small event and want to see world class security presentations in your home country. The volunteer work behind the scenes only works when you focus on high quality and networking – it also helps getting repeat guests who value the effort put into curating the program, and setting the stage for making new friends. A considerable part of the audience comes from outside Finland, and it’s certainly not thanks to the weather.

To summarize some of our core values:

  • Networking is an integral part of the event
  • We focus on new research and technical aspects of information security
  • We never sell or give out the attendance list
  • Sponsorship does not give you a speaking slot or influence on the agenda, only CFP does

If you are interested in sponsoring t2, we are glad to discuss your exact needs. Please get in contact with us.

t2’17 challenge update

We are updating the rules slightly, and increasing the challenge scope to cover the complete LocalTapiola Bug Bounty program.

The basic rules stay the same, with these changes:

  • The in-scope domains are expanded to cover all the domains that are in-scope in the normal LocalTapiola bug bounty program as well
  • All submissions are eligible for bounties – the rules are the same as in the normal LocalTapiola bug bounty program ($50-$50k)
  • Only NEW reports are eligible – don’t duplicate current open and/or unresolved reports from the normal LocalTapiola bug bounty program
  • In any case of confusion or ambiguity between the two bug bounty programs – LocalTapiola reserves all rights to make wise decisions

Happy hunting!