This year’s pre-conference challenge will be a t2 exclusive bug bounty. For more information on how to participate, please see the t2’17 Challenge page.
As we’ve been organizing challenges for over a decade, you might wonder why change now? For several years in a row, the challenge participant numbers have been steadily declining, despite increased efforts put into creating the technical puzzles, challenge descriptions and back stories, and actual promotion. It’s not just the number of submissions, but also the downloads and page views. Thomas Malmberg kindly pointed out that with conference challenges we’re competing for people’s time – this is the arena where also bug bounties play.
It was time for us to either adapt or perish. This being t2, failure was not an option and quitting is something you do for apps, not in real life. With conference budgets one simply does not organize a bug bounty – you need friends’ help for that. That is the reason we partnered up with LocalTapiola to provide you a t2 exclusive bug bounty, targeting a real world business application running in production environment. To make sure the spirit of t2 challenges is still there, we are emphasizing the vulnerability quality and proof of exploitability. The challenge is not a speed competition – the most elegant and meaningful vulnerability submission will receive the free ticket, and we have adjusted the whole bug bounty process to reflect that.
Once you convert someone else’s medium severity local file read into unauthenticated remote code execution, you start to value proper analysis and investigation into the technical details of a vulnerability. In other words, 2002 called – they want their apache-scalp.c back. The 15 year anniversary is a pure co-incidence, as is Dave Aitel’s headline keynote at t2’17, the stars just happened to align the right way, like good exploitation primitives after putting in the time and effort.
The challenge is dead. Long live the challenge.
We hope you enjoy the reinvigorated format!
t2’16 Challenge winners
Carl “Zeta Two” Svensson from Sweden was the first one to solve the t2’16 Challenge. Well done! Congratulations!
The elegant write-up trophy goes to Alexander Polyakov, Russia. His write-up will be published soon so you’ll have a change to evaluate the submission yourself.
Congratulations to both winners! We would also like to thank each one of you who participated. Last but not least. if you have an interesting idea for t2’17 Challenge, please let us know – authors get a free admission to the conference among other perks 😉
t2’16 Challenge write-up submission deadline is 2016-10-08 10:00 EEST
This is just a short note to let you know that the deadline for t2’16 Challenge write-up submissions is 2016-10-08 10:00 EEST, after which the creators of the Challenge will select the winner.
Please remember that the criteria for the selection is the elegance of the answer. The solution must include a detailed description of methods and tools used. If you don’t know the definition of elegance – please check out the winning write-ups from previous years.
t2’16 challenge submission form
We just realised that we forgot to include the link for submitting the flags (it was not supposed to be part of the challenge 😉
Sorry!! Here we go!
t2’16 Challenge is on!
t2’16 Challenge is on! Good luck!
As usual, you can follow the contestants via (near) real time scoreboard!
t2’16 Challenge to be released 2016-09-10 10:00 EEST
Everybody is a fan of disruption until it hits them personally.
Background
Unicorns attract competitors, copycats and charlatans. For a VC, the road to losing the principal is paved with poor decisions, bad luck and ultimately betting on the wrong horse. One of the challengers in the unregulated pay-per-hitchhike app industry, Astley Auto Association, has been trying to raise a C round. Its founder and CEO, a controversial character, is claimed to represent the darker side of the booming startup scene. While his fans cheer the sticking-it-to-the-man attitude R. Astley has demonstrated to the regulators, there are critics, including many notable venture capitalists and angel investors, who say the man embodies the lack of integrity and honesty.
With circumstances as messy as those of a publicly funded open source project, it gets even messier. An unknown actor has compromised the e-mail server of Astley Auto Association. To prove they have the whole archive, chosen mails from CEO of AAA, R. Astley, and other employees were collected to a dump.
A disgruntled employee, competitor, VC trying to bring down the valuation, angry customer, or a random opportunist – clearly an attribution question so difficult it can only be solved by world leading threat intelligence companies.
Luckily we are more interested in a good hacklog and thorough compromise. A properly placed string tells sometimes defenders and investigators more than thousand words in a compliance report. The mission, should you choose to accept it, is to analyse the e-mail dump and uncover the clues left by the unknown actor, which demonstrate the devastating level of control they have over the environment.
Details
The first person to recover all flags will win a free ticket to t2’16 conference. In addition to this, the creators of the Challenge will select another winner among the next ten correct answers. The criteria for the other selection is the elegance of the answer. In short, you can win with both speed and style.
The Challenge will be released on 2016-09-10 10:00 EEST right here at t2.fi
t2’15 Challenge winners
Richard Baranyi (Crypto wizard23) from Slovakia was the first one to solve the t2’15 Challenge. Well done! Congratulations!
The elegant write-up trophy goes to Juha Kivekäs, Finland. His write-up will be published soon so you’ll have a change to evaluate the submission yourself.
Congratulations to both winners! We would also like to thank each one of you who participated. Last but not least. if you have an interesting idea for t2’16 Challenge, please let us know – authors get a free admission to the conference among other perks 😉
t2’15 Challenge write-up submission deadline is 2015-10-17 10:00 EEST
This is just a short note to let you know that the deadline for t2’15 Challenge write-up submissions is 2015-10-17 10:00 EEST, after which the creators of the Challenge will select the winner.
Please remember that the criteria for the selection is the elegance of the answer. The solution must include a detailed description of methods and tools used. If you don’t know the definition of elegance – please check out the winning write-ups from previous years.
t2’15 Challenge hint #4
t2’15 Challenge hint #4: If you failed to read the recipe …
t2’15 Challenge hint #3
t2’15 Challenge hint #3: What file format was invented on the date contained in the missile system decryptor?