Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1102 Thanks!
[Music]
since the 28 C3 there has been at least
one Capture the Flag every year so the
next three speakers that we have are
always organizing a capture the flag
there here representing all their team
please welcome with a huge round of
applause Andy Zao and
Malo Mal hi everybody um so yeah again
welcome from our side to a talk uh what
the FL is CTF uh this talk is going to
be a foundation talk and we want to tell
you uh what a CTF is uh how to play it
uh what game modes there are um this is
the first part um um of the talk a bit
of an introduction and after that we're
going to show you three challenges that
we prepared for this year's CTF so
should you actually decide that you want
to play a CTF in the future you uh know
what to expect uh when you when you
actually play it um yeah so a few words
about us um our team is called Eat Sleep
pone repeat or espr for short uh we are
a CTF team um and um I don't know how
long we even exist it must have been
like three or four years now uh maybe
even five and um we are all just people
who in our free time were interested in
it security and we got together in
hacker spaces or the university and um
we just started playing CTF and
everybody participated and that's well
how a group formed and now we are e
sleep home repeat um yeah that's that's
that's all there is to it um I'm always
talking about a CTF what actually don't
know maybe you actually don't know what
a CTF actually is so CTF stands for
capture the flag and for the older ones
of you this has nothing to do with the
Unreal Tournament game mode um it's
except for the name and that there are
flags um a CTF is a contest between uh
different teams where all the teams
solve different challenges um that are
somehow related to the it security
domain um a CTF usually can be played in
two main game modes of course there are
variations to them but these are the two
modes that you generally have the first
one is the attack and defense style and
the second one is the is the Japes style
you will see in the next slides uh what
I mean by that um over the years it's
absolutely crazy how the community grew
when we started playing there were just
a handful of ctfs per year now if you
check out how many ctfs there are you
can actually play a CTF every weekend
and um all these ctfs are usually
organized by other CTF teams uh so there
there's a lot of work by also done by
other teams uh to organize these these
ctfs and it's essentially all completely
community-driven and uh if you want you
can relatively easy be easily be part of
that as well and that's that's what the
the goal of this talk is
essentially now I mentioned the Jeopardy
style uh CTF that is the the easiest
game mode uh that you that you have and
it's also the easiest to organize
because it resembles a Jeopardy uh game
the the game show the American game show
where we have different U categories of
uh of puzzles with uh different um uh
difficulties and according to the
difficulty you are awarded a certain
amount of points when you solve that
challenge and
um either the uh amount of points is is
fixed so you get I don't know 100 200
300 400 500 points for a challenge uh
according to the difficulty or uh
nowadays often we have Dynamic scoring
so the more people uh challenge uh the
the the more often a challenge is solved
by people um the less points you're
going to get because it's actually
relatively hard to uh uh to Define what
your challenge should be worth and the
to play that game it's it's actually
really easy you just pick a challenge
you look at it you try to solve it you
submit the flag on a web interface
somewhere you get points and you just
repeat that uh until you solved
everything or you are on the first place
um and of course the winner is uh the
team with the most points if there is a
tie the uh the team that got first to
that amount of points uh
wins uh the typical categories that you
have on a Jeopardy style CTF are stuff
like for example pone where you have
classic binary exploitation you get some
network service somewhere and you need
to connect to that service and do some
weird stuff to it to get code execution
and run your own programs on that
machine that you're that you're owning
um crypto U custom crypto uh algorithms
that are implemented or crypto
algorithms that are used in a wrong way
that you need to find out why that is
and then you can abuse that uh to
usually decrypt something or uh recreate
a key or whatever web the usual stuff
that's normally that's um that's just
web applications um in all kinds of
different Frameworks and server side and
client side and whatever there all is um
or if you're ESP we we had a joke
category once I think where we uh put
browser exploits in there so it's not
really web but that was just a just a
joke and then stuff like reversing for
example we have to reverse Engineers
some executable and try to find out what
it does and reverse engineer some
mathematic uh calculations and
whatever um the next game mode is attack
and defense and that's the more classic
Mode uh there are just a few per year
because it's very hard to organize uh
because you hack in quot marks real
services on real servers on real
networks because every team gets a
virtual machine image which contains
which essentially is a server which
contains uh services that are
specifically crafted for that CTF where
uh somebody placed buck in there and um
all these machines are connected over
VPN and the teams can reach each other
and the goal is that everybody hacks the
service Services of everybody else and
steals data from these from these
vulnerable machines and then you can
submit that to a game server and then
you are awarded scores and of course if
you have full control over the machine
your task is also not only to exploit
the other teams but all also to fix your
own stuff so you don't get exploited
anymore so there also you need to make
sure that your services stay up because
if they are down uh usually you don't
get any points awarded for Flex you
steal U and stuff like that so there are
three main things you need to do you
need to fix your stuff and remove the
bugs you need to find the bugs and
exploit them on other people's machines
and you need to uh keep everything
online
um yeah as I said the main scores there
are usually uh offense defense and SLA
that's what I mentioned uh either attack
other people's Services uh defend your
own services and keep them online uh
this is usually played in rounds every
round starts from scratch and you get
points awarded uh per per round and um
after that uh all the points are are
added and the team with the most points
wins there are a few few things that are
different in every attack and defense
CTF in terms of the rules but that's the
general uh stuff that always
happens this is what a typical
scoreboard looks like when you play an
attack and defense CTF this for example
was from R CFE and um yeah I I took the
one where we were in the first place and
um you see in the different columns you
see all the
services that are available like for
example a crash the bin weather
cartographer and so on and the um um the
the red and yellow uh the red and and
blue um boxes mean the surface is up or
is down you can see how many flags we
scored what the SLA was in percent so
how many uptime versus downtime did we
have how many flxs we lost uh that's the
the the the the the number in the uh
bottom right corner in every box like
minus 32 for crash so we lost 32 Flags
there and we stole 15,000 flags and then
the FP is just the flag points yeah you
add everything together and you get your
like your your main score um and a
ranking of the
teams so now that you know how to play a
CTF why even why even do it I mean yeah
so it's relatively obvious it's pretty
cool to play uh because you can actually
hack stuff uh completely legally um uh
because well that's part of the game uh
it's fun it's fun to to to learn new
stuff and you learn a lot of new stuff
um uh during this CTF but also after the
CTF when you talk to other teams and try
to find out what the solution was and
everything and um yeah you make friends
during that for example we are uh um one
of our our our our friends is the the
Polish team team Dragon sector and every
time we meet we have some beers and we
chat about uh the CTF and everything and
we we actually made made some good
friends there and um also you you may be
able to travel around the world so ctfs
are held locally sometimes you need to
qualify for it and then you can fly
around the world and um play locally uh
a CTF and maybe even win
something so yeah our CTF that we
organized uh we um we do this as already
uh announced every year since 28 C3 I
can see a few logos there from the past
years um we always try to match the uh
the Congress theme and um this year we
had uh in the main CTF we had 636 teams
that at least submitted one flag uh we
had a small flag a small task that we
call sanity check where you just needed
to like paste a a string into into the
flag box uh just to see how many teams
were online and yeah that was 636 teams
we had 30 Challenge and these 636 teams
solved them
1,457 times so
1,457 flags were submitted by all the
teams on all the
tasks uh we also had a few guest
challenges this year so not all
challenges were made by us so we would
like to thank Koko titis Jay Ven kubasa
and Yin um for for ideas or even
complete challenges that we were able to
deploy and had the people solve and um
the three winners are KGC and macaroni
paston on on U the second place and
dragon sector on the third so uh yeah
congratulations again to them
um and because every year uh this this
ctfs got more and more complicated and
very hard to solve for beginners last
year we introduced the junior CTF with
easier challenges that more closely
matches the difficulty level um when we
started actually when when we started
playing CTF and there we have the the
same stuff uh uh we had 520 teams so not
that much teams but uh 33 Challengers
that we deployed and 2 761 solves in
total so they solved actually more stuff
than the main ctfs in terms of raw
numbers of challenges and again we had
some guest guest channels guest
challenges by gel Domino PR and TR de
mored so thank you and the winners are
um mate in MIM the second place is SN
and the third one is
zanck
and so now that you know um what is
going on during a CTF what do you need
if you if you really want to play um so
the first one you need is actually you
need a
CTF um there is a cool website that's
called CTF time.org you can check it out
and get um a listing of all upcoming
ctfs and you can just uh register on
that CTF and then once it goes live you
can play in terms of skills um you don't
need that much uh you do you actually
need to be able to program uh you need
to know a scripting language to to do
all your dirty work like if you need to
pass a file or if you I don't know
dissect some Network traffic stuff like
that for reverse engineering and binary
exploitation you absolutely
unfortunately need to know Assembly
Language and a bit of reverse
engineering
skills uh to tie all that together you
need the basic Linux shell skills
because the the tools under Linux are
just well better suited than on Windows
of course you can Windows you can just
use the the window the Linux subsystem
nowadays it works the same and um so to
learn Pony and binary exploitation you
can play so-called war games on the last
slide there are a few links you can
check them out uh there's one of there
so that's the war game is essentially a
CTF that's always online and you can you
can U go through it at your own pace
without any time restrictions uh you can
check out older CTF Challengers there
are archives on the internet you can
just download them and run them locally
and and try to exploit them um and um it
has been um so there are so-called
writeups by other CTF teams sometimes
when another CTF team solved a challenge
and they thought it was a cool challenge
somebody's going to do a write up on
that and explain in a blog post or
whatever uh how it was solved so you can
read that and learn stuff if you're more
of a video person there's somebody on
YouTube called life overflow from the
CTF scene and he's doing awesome videos
on different CTF tasks and he goes
through it like how he solved it and
what the idea behind the challenge was
and so on and of course you don't want
to play this alone because it's more fun
to do this with other people and um just
use the internet try to find a groups
try to find like-minded people um or
just go to a hacker space and ask around
if somebody's interested and every now
and then you can play a CTF or do the
war game stuff and so on like just like
we
did
okay now that we explain to you what uh
is going on and during a CTF I'd like to
hand over to Mal who's going to show you
some challenges we
had okay hi um I'm going to give you an
idea how to approach uh such CDF
challenges and I can highly recommend
this book from Gia and on how to solve
problems and as an example I'll I took
an Challenge from from the junior CDF
called Blind and this is the
description uh hacking blind and an URL
with uh the path to the flag and it's
estimated as a
medium um difficulty challenge at least
in the junior CDF and it's based on a bu
found by riptech in
2017
and approaching a
challenge um to approach a challenge it
is needed to understand the problem
first right so when you go to this URL
you are presented with this source code
it's PHP source code and we're going to
walk through it the first part of the
source code is actually a hint it's not
needed to exploit the challenge but it's
hinting to uh a vulnerability called PHP
object injection and this actually was a
The Bu um where you could um include
local files until PHP 5.3 but we use
php7.2 and the next block is a bit of
boiler plate code so we have two classes
called black and green and what they do
is only setting the colors of um the
syntax highlighting and if you provide
uh store URL parameter you can save the
theme in a cookie which comes uh which
is important for
later so the next section
was um an interesting part because it
hints already at the path to
exploitation the first one you get in
the first step you get the theme URL get
parameter and store it in
this uh variable in the next slide uh in
in the next line you check if
it's either the black class name or the
green class
name then you check if this class
actually
exists um you set the variables
depending on the input in the from the
URL parameters and this is the
interesting part now you um instantiate
an object of the given class um which
could either be PL or cre screen and you
have full control over the parameters
you give to the Constructor of this
class um the next part of the code was
also um storing the theme but this time
from the
cookie and then you check if the first
part of the cookie is an existing
class then sorry then um you pass the
parameters which are stored in the
cookie to this to the Constructor of the
class and you instantiate a object of
that class and the last part is just
giving you some info what modules are
loaded so the bug was simply that you
could instantiate an arbitrary PHP
object and you control the arguments for
its
Constructor
so the next step is to make a plan um so
we try
to
um get together all the things we we
have given and what we want to do so we
have fully control over the data in the
cookie and we can instantiate a PHP
object of an existing class and we
control the argument so what we have to
do now is we you have to find a
class which does nice things like
reading a file when giving specific
arguments and
there's this handy class called Simple
XML
element um which is able to read files
XML files from a remote
Source uh if you set the option to
two um you it will even substitute
entities in the XML file so this will
come uh this will be important later
and now we have to carry out the
plan this is the easy
exploit um we set a cookie called theme
the first part of the cookie is our
class name simple XML element and the
second part is the path to the flag and
as you can see the flag is uh is
is printed in the warnings right there
so this only works because warnings were
enabled so the next thing you do when uh
solving problems is looking back and
what what uh how could we approach The
Challenge in a different way or with
different
constraints
and if the warnings weren't en enabled
we were kind of blind that's where the
the challenge name comes from and we
don't get output
and with XML you can include external
entities and it works like that you
declare an entity and give it a path
name and then
you
uh yeah you include it in the
XML and this is how you could exploit it
so you you get an second XML file from
your own
server
which that is at the bottom of the
slides and it gets the flag and sends it
contents to your own server so when
you execute a simple exploor like this
you start a PHP server and then you you
call uh this URL with curl you get
presented with uh
request that looks like that and because
we uh encoded the flag with base 64 we
have to decode it and then you get the
flag this
way so next part is
for the main CDF by Sayo yeah thank
[Music]
you okay um yeah thanks so now you just
saw an example of
rather typical web CTF challenge um Now
by now we we have a lot of teams that
are really really skilled um they have
been playing CTF for many years they do
computer security as their day-to-day
job um and so of course we also want to
make very challenging uh and interesting
uh CTF for these teams right um and so
one thing we do is we try to make
somewhat realistic challenges based on
real real world software and
vulnerabilities um so yeah on this slide
you see some logos of of software that
we base challenges on in in some way for
this CTF here um now one fun fact uh we
actually this time had three different
teams use zero days uh to to instead of
solving the challenge in the intended
way they use zero days for the software
which is fair game uh yeah I don't know
what that says about R CDF but it's
pretty interesting
um and so what I want to do now is just
we'll present two of these challenges uh
I'm going to present a browser
exploitation challenge a little bit um
and talk a bit about this the setup how
to host such a challenge uh Etc
um yeah so we had browser exploitation
challenges the last two years already um
now for some years now a browser is uh
they come with a Sandbox right so if you
just have one vulnerability in the
rendering stuff where it renders the
HTML um that's not enough to fully
compromise the browser um the last years
we only had the rendering exploit part
so the real browser stuff but no sandbox
now this year we decided we should do uh
a full like a real browser exploit
challenge with two parts one part is the
the rendering exploit the the web kit in
this uh this this time um and the other
part is the sandbox Escape um and we
based that off of yeah
real uh exploit chains that were
presented this year or last year um so
how do you how do you make such a a
browser challenge what what we did um is
we we took webkit this time uh last year
we had Chrome and the year before
Firefox so this year we used webkit
which uh is the the browser engine
powering Safari for example um and we
changed we we implemented some some
buggy optim ization somewhere in the
JavaScript part um so this is the first
thing that there's one vulnerability
there in the web kit uh the next thing
we did uh we wrote some some meos system
Services um again kind of based on real
vulnerabilities that were presented this
year um and and so they were of course
also buggy in some way they had some
vulnerabilities um and then we deployed
both the modified Safari and those
services to a meos virtual machine um
and so then what users can do is they
get on the top right here you see that
they get a website um where they can
submit a URL to their exploit right so
it's a browser exploit so the exploit is
going to be some web page um they
can um here type in their the URL for
their exploit uh and then what happens
is on our servers uh it will boot up
this virtual machine um open Safari with
that URL and then the users will get
back um a video of of that virtual
machine booting up um and then the goal
or the task here is to read SL flag or
SL flag.txt so some file on the file
system um and so they what they could do
is they could display it on the screen
and so then they would see it in the
video um so yeah
here's pretty much how it looked like
from a player's perspective uh what they
would do for this challenge is they
would get from us a webkit patch and
those Macos Services as binary so they
would have to reverse engineer them um
so then they go and audit for
vulnerabilities hopefully find some um
and they would write exploits so in this
case it's it's a malicious website um
they will host that on some server that
they control uh with a public IP address
and then submit this URL to um to our
yeah scoreboard server thing um and then
again that boots up this virtual machine
records the video and shows the video to
the players so here's how it looks like
uh I hope it works yes um so this is
exactly what the players would get after
typing in uh the URL into the scoreboard
um so they would get this video feed so
let's see what happened here um yeah in
the background you see the this the
modified Safari uh which is opening the
players URL um and it's printing some
stuff from the exploit blah blah blah um
and then it so it does a web kit exploit
so it can now run uh acher code in the
webkit process and then it's exploiting
these system services that we wrote
which are running outside of the sandbox
and so then it can open uh or run any
commands outside of the sandbox on the
system so in this case the exploit
starts uh this text editor app uh and
lets it open SL flag.txt and it's
probably pretty small but in the the top
left you can see there it's uh showing
you the flag and now you have to type
this into the scoreboard and then you
get your
points um yeah so so why why is this uh
why do we think this is a nice challenge
um or why why do you want to solve this
of course I mean this gives you lots of
points for the CTF this is actually not
one challenge but three challenges um so
we made it so that you could solve the
sandbox Escape part uh regardless of
whether you had the web kit exploit
working um so there was was one flag
that you got if you only had the the web
kit the Safari part there was one other
flag that you get if you only have the
sandbox escape and then there's a third
flag if you have both and you combine
them into a single exploit yeah then you
get the sht flag um but yeah apart from
CTF so we try to also make these
challenges um so that you may are able
to learn something new maybe right so
the webkit part uh it it could hopefully
teach you or hopefully you would learn a
little bit more about JavaScript or just
in time compiler uh vulnerabilities on
the path to solving that um or the Mac
OS Services yeah we made them so that
it's it gives you an easy entry into
Macos security right so this is yeah
something to keep in mind um we will
release source code so for this
challenge here it's going to be up in
some is probably on on my GitHub um and
then yeah it it uh it tries to make it
easy to transition from the CTF and
maybe go to the real world security
scene um with challenges like these that
give yeah with Source go give you a nice
entry um yeah and that's it from me and
next up is Andy
again thank
[Music]
you I also did a challenge too and um
those of you uh those of you who are old
enough you're going to remember this
phone right so the story behind my
challenge was that I uh privately was
interested in GSM stuff and I just
wanted to know how stuff works and so on
so I set up a GSM network at home with a
software defined radio and everything
and used old Nokia phones and so on and
then I got an
idea um I built my own
phone uh what you can see here is uh
part of the challenge you you can see
that I reimplemented the UI of a Nokia
phone essentially and it lcks onto a uh
gsm network uh which is not using radio
waves but um the the GSM traffic is um
sent over uh UDP multicast traffic in
the core Network and then I also have
like my SDR on there so that my own
phone can talk to the real phone that's
what you just saw and um I found this
this this feature of that challenge
where you don't have radio waves for
communication with the GSM uh network is
usually used for unit tests by the
developers of the of the network
services to run your own gsm network
because they don't want to mess with
radios and everything just to test their
software so they implemented like this
this um uh ethernet layer to uh do GSM
and that was perfect for um a CTF
challenge because we don't have we don't
only have local players uh so in theory
I could just set up a few sdrs and
transmit my own uh uh gsm network um if
you uh have the right licenses and so to
to do so in the RF Spectrum um that
being another issue but uh in theory you
could do that but somebody from the US
or um wherever else is not able to
participate in the challenge and we we
always want to have uh the capability
for remote players to play as well so I
set up an open VPN tunnel essentially
where the network lives in and your own
phone uh this this target phone that you
could exploit and just then joined the
network using this uh this this um this
UDP multicast stuff so it was absolutely
perfect for that so what I implemented
actually is a buck in concatenated SMS
the phone only has two features it can
send SMS and it can it can receive SMS
and your task was uh to uh uh have a
phone somewhere on the network that you
can only interact with over in the
network so you can only send it SMS
essentially and um but you can send it
arbitrary SMS you can send whatever you
want you can adhere to the standard but
you can also send whatever you want and
not adhere to adhere to the standard and
too weird stuff and um on the old Nokia
phones on the the later ones uh SMS only
have 160 characters and on the later
Nokia phones you have this thing on the
right where told you how many uh
characters you have left for the SMS and
then a slash and then how many SMS you
already uh wrote essentially because
what it would do it would split uh is it
would split the SMS me message apart
every few hundred characters and then
put a header in front of the SMS send
one two or three SMS to the other phone
and then the other phone would start to
reassemble these SMS once they all
arrive and
um yeah so in in this case the SMS can
be split up into up to three parts but
the standard allows up to 254 SMS
actually um so and all these SMS contain
some data as I said in front in the
header and they um also contain an index
what part that actually is and it starts
from one and it goes up to 254 in this
case you can well use one two or three
and um the SMS content that I'm going to
reassemble is somewhere in a local stack
buffer and the location where the
decoded text from the from that one SMS
part is copied to when reassembled is
based on the
number uh of the part of that SMS and I
in in my challenge I'm never checking if
that number is actually 1 two or three
so you can set it to four five 6 7 8
whatever and you would write outside of
that buffer and because that buffer is
on a stack the way how um uh
uh processes work is they save some
information on the stack to keep track
of where they were before they called a
function to return that location once
they are done with certain tasks and you
can overwrite that value and hijack the
control flow um and um then use a
technique called Rob um to gain uh code
execution on the phone and execute some
some code there much like uh Z showed
with the with a browser where you open
the text edit you can um connect uh to
another host and get a Linux shell
essentially on the phone and then you
can open the
flag um with that um that's that that
was the talk I would like to thank the
whole CTF Community uh the players that
played off CTF other teams that
organized the ctfs um and and everybody
in the CTF Community for like being that
cool and putting that much effort into
uh not only playing our CTF but also
organizing
ctfs for us to play and um another I
also want to thank the assembly team
here at the C3 because it we got our own
area this year where all the CTF teams
that were locally uh could gather around
and it was absolutely perfect it looked
so cool seeing like 200 hackers sitting
on the tables in a space together and
just solving our challenges it was
absolutely amazing and uh yeah thanks
again to our Our Guest auth authors for
the challenges and um yeah we would be
open for questions and answers
now oh and um one one other thing uh if
you are interested in playing CTF here
are a few links with the resources that
I mentioned earlier check them out this
is Warg game is CTF time and it's life
overflows um uh YouTube channel uh check
it out if you're interested and uh yeah
we hope uh that you're part of the CDF
uh Community soon
maybe thank you very much also from my
side I can already see that there are
some questions in the audience so I
would like to start with microphone
number two uh thanks for the talk um
actually my University security course
was a a graded CTF we got the grades
based on our points on the CTF what are
your opinions about this kind of grading
how do you feel
about University learning places doing
ctfs for
grades I mean for for us it's it's it's
a hobby and also for us it's a it was a
great way way to learn new things so I'm
personally not completely opposed to
that I don't know if I would uh maybe
make uh uh the grading dependent on on
the points uh but I think it's a it's a
great thing to do just as a learning
experience so no matter if that's on a
university or if you do it in a private
life uh you if you if if you just play
you're always like we we also when we
solve some challenges from other teams
we always learn we are always learning
new tricks new stuff and so on so I I
don't think it's a bad
idea thank you for that question the
next question is coming from microphone
3 over
there what do you do when you are stuck
on the on the the task oh good question
um um often it helps to get somebody
else from the team just take a break and
um go with somebody who is completely
unaware of what the challenge looked
like through your findings and just talk
about the challenge either the other
person still has some more ideas to try
even though that person might have never
looked at the challenge or you are
reiterating everything that you have
done over the last few hours to by by
just explaining it to somebody else and
maybe then you get another idea where to
look out or I don't know just start
Googling stuff maybe maybe there was a
similar bug in in some other software
there there are multiple uh things to do
but it also happens a lot of times that
we are not able to solve a challenge uh
so CT playing CTF can actually also be
frustrating because you're sitting for
12 hours on a challenge and you just
can't make this thing work and you you
you have no idea how to solve it that
happens as well because you're just
missing a trick but what you then do
afterwards is you you ask other teams
you ask in the ISC channels uh of the of
the CTF you uh how that was solved you
uh ask for writeups you read the
writeups uh you ask other people from
the team when you uh when you see each
other next time in person for example
here at the Congress and so on and
that's how you gain more and more
knowledge and experience over time and
uh learn new
stuff we can take one more question
there's someone waiting at microphone
number two again I uh first of all I
think is this work okay yeah okay uh
sorry first of all thank you very much
for hting the CDF it's highly
appreciated also that you're doing
browser exploitation challenges given
that it's really hard to set them up and
host them for everyone um my question is
what's your take on um on having people
solve challenges in real world software
that you didn't modify as in like dis
implicitly disclosing bugs in in
software um I'm not sure if I got the
question so you mean people use using
zero days for solving our challenge is
it B days no we we are not I mean all
the challenges had modifications that so
they had an intended solution that's not
an OD um it's it's real world challenges
right so it doesn't really get more real
world than using an OD so we are not
against that except if it's against
challenge infrastructure which is which
is not the case here uh so it's fre game
for us um I guess the the players they
trust us and they trust that nothing
happens to their OD days that's why they
do it um or some of them uh but yeah so
also I think I think we can all agree
that even if we have an OD day it's
still the right thing to do would still
be to responsibly disclose and not put
it out on the internet to put other
people in danger I mean that's that's
just I mean I never saw that actually
happen during a CTF that that there was
some some leaked to that suddenly got in
the wild and um and and endangered like
normal users that so far this never
happened let's hope that stays that way
I mean it would be bad if it if it would
happen you're
right thank you very much unfortunately
the time for question and answer is over
but I'm pretty sure the speakers will
answer all your other questions after
the talk please give a large round of
applause for Andy Mal and Sayo thank
[Music]
you
[Music]
oh