full-disclosure - [FD] t2'17: Challenge

Open Source and information security mailing list archives

Message-ID: <97009BF0-47F7-4077-A709-B50D1A036A71@t2.fi>
Date: Thu, 03 Aug 2017 14:26:34 +0300
From: "Tomi Tuominen" <tomi.tuominen@...fi>
To: fulldisclosure@...lists.org
Subject: [FD] t2'17: Challenge – a break from tradition

This year’s pre-conference challenge will be a t2 exclusive bug bounty. For more information on how to participate, please see:
https://t2.fi/challenge/t217-challenge/

As we’ve been organizing challenges for over a decade, you might wonder why change now? For several years in a row, the challenge participant numbers have been steadily declining, despite increased efforts put into creating the technical puzzles, challenge descriptions and back stories, and actual promotion. It’s not just the number of submissions, but also the downloads and page views. Thomas Malmberg[0] kindly pointed out that with conference challenges we’re competing for people’s time – this is the arena where also bug bounties play.

It was time for us to either adapt or perish. This being t2, failure was not an option and quitting is something you do for apps, not in real life. With conference budgets one simply does not organize a bug bounty – you need friends’ help for that. That is the reason we partnered up with LocalTapiola[1] to provide you a t2 exclusive bug bounty, targeting a real world business application running in production environment. To make sure the spirit of t2 challenges is still there, we are emphasizing the vulnerability quality and proof of exploitability. The challenge is not a speed competition – the most elegant and meaningful vulnerability submission will receive the free ticket, and we have adjusted the whole bug bounty process to reflect that.

Once you convert someone else’s medium severity local file read into unauthenticated remote code execution, you start to value proper analysis and investigation into the technical details of a vulnerability. In other words, 2002 called – they want their apache-scalp.c[2] back. The 15 year anniversary is a pure co-incidence, as is Dave Aitel’s headline keynote[3] at t2’17, the stars just happened to align the right way, like good exploitation primitives after putting in the time and effort.

The challenge is dead. Long live the challenge.

We hope you enjoy the reinvigorated format!

[0] https://twitter.com/tsmalmbe
[1] https://www.lahitapiola.fi/en/information-on-localtapiola/localtapiola-group/information-on-localtapiola-group/history
[2] https://github.com/perlancar/exploits/blob/master/apache/scalp/apache-scalp.c
[3] https://t2.fi/2017/06/14/dave-aitel-keynote/

-- 
Tomi 'T' Tuominen | Founder @ t2 infosec conference | https://t2.fi

Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives