Last weekend saw the year’s CTF competitions begin with our very own Insomni’hack teaser. Given some of the recent absurdities (http://weputachipinit.tumblr.com/) we decided to go with the Internet of Things as our theme this year.
Before going into some of the details, we’d like to congratulate Dragon Sector for taking the first place once again, finishing in front of Tasteless and KITCTF who complete our podium.
The full scoreboard can be found here: https://teaser.insomnihack.ch/scoreboard, and also on CTFtime.
When entering the contest, participants were greeted by a kitchen, where several connected objects (tasks) could be attacked.
Nearly 850 teams registered for the teaser, with 245 of them scoring at least once.
Overall, 8 tasks were given in Web, Crypto and Pwning fields, and teams had 36 hours (from 9h UTC, the 16th of January until 21h on the 17th) to complete as many as possible (and as quickly as possible) to get the top spots.
To give an idea of the complexity of each task, the following list shows which team was the first to solve it and at what time:
- smartcat1: solved by dcua after 16 minutes
- Bring the noise: solved by 217 after 27 minutes
- Greenbox: solved by Dragon Sector after 1 hour and 7 minutes
- smartcat2: solved by dcua after 1 hour and 10 minutes
- Fridginator 10k: solved by n0n3m4 after 3 hours and 32 minutes
- toasted: solved by 0x8F after 6 hours and 1 minute
- rbaced1: solved by Dragon Sector after 6 hours and 25 minutes
- rbaced2: solved by Dragon Sector after 20 hours and 19 minutes
We quickly notice that smartcat1 and Bring the noise were the easiest tasks, while the two rbaced tasks were the toughest. This also shows with the number of times each task was solved over the course of the weekend:
- smartcat1 (Web): 209
- Bring the noise (Crypto): 173
- smartcat2 (Web): 132
- Fridginator 10k (Web/Crypto): 52
- Greenbox (Web): 33
- toasted (Pwning): 15
- rbaced1 (Pwning): 12
- rbaced2 (Pwning): 2
After completing all the tasks, your kitchen looked like this:
Writeups for some of the challenges can be found here:
The event ran rather smoothly, with only a few services needing to be restarted every now and then.
Do note that this is not a qualification round, as anyone can participate in the finals (18th of March, Geneva, Switzerland) and it is entirely free. We’re looking forward to seeing you there!