skip to main content

DEF CON Hacking Conference


Call for DEF CON Capture the Flag Organizers (CFO) Version 4.1

2021 September 28

The Call for Organizers is Closed, Congratulations to Nautilus Institute for being selected!

WANTED:

A dedicated team of CTF hackers to organize the DEF CON Capture The Flag competition.

WHY:

To keep the DEF CON CTF fresh ever evolving, the Organizers commit to running it for 3 to 5 years. With Order Of the Overflow retiring after four years at DEF CON 29 it is now time to open the CTF Call for Organizers.

WHAT YOU GET:

  • Everlasting fame and undying glory, helping craft the future of CTF competitions.
  • The respect of your peers for helping build the community.
  • The priceless stories of lessons learned and of how you revolutionized CTF.
  • Insight into how the best teams in the world approach problems.

DO YOU KNOW WHAT WE ARE TALKING ABOUT?

OOO, LegitBS, and DDTEK helped cement the DEF CON CTF as the World Series of CTF contests. They each tried something new, with OOO recently running the 1st all virtual CTF at DC 28 Safe Mode, and a full hybrid CTF at DC 29, adapting to the COVID-19 era while experimenting with new concepts in gameplay.

Here is your chance to step up to a global stage, show off your concepts and skills by crafting unique gameplay challenges designed to test the world's best CTF teams.

YOUR CONSTRAINTS:

We offer a lot of flexibility for the organizers to create as they see fit: you design the network topology, you make the rules, you decide who wins. We want you to do a lot more than just reproduce any past CTF contest, we want you to think big, push the envelope and change the game.

That said, there are some important constraints. Here is a short list:

  • The contest must include head to head combat, not jeopardy style, with a multitude of skills needed to be successful.
  • The competing teams will need to come from a mix of pre-qualification and pre-determined CTF contest winners.
  • No less than 10 teams, no more than 20 due to physical space constraints, with space for 8 players at a time.
  • Take into consideration how to make the contest interesting to spectators.
  • Clearly be able to explain how scoring works and be as transparent as possible.
  • Provide pcaps of the contest that will be shared with the community.
  • Clearly communicate the rules to the participants before the contest, set up clear eligibility requirements (if any) before the conference, set up the network, provide any infrastructure that you wish to be part of the game, referee the game while it is taking place, create a scoring system that observers can view to get an idea of what is going on, and determine winners. The easier it is for contestants to understand how to win, the more fair the contest will feel.
  • The contest must end no later than 15:00 Sunday at DEF CON in order to provide time for final scoring and the awards ceremony, you would need to determine the winning team by 16:00 Sunday evening.

YOU MUST NOT:

  • Interfere with the DEF CON networks (CTF must be a separate network), the 'live Internet', or involve non-consensual parties (i.e. anyone who hasn’t explicitly agreed to take part in the contests)
  • Take sides - you must be totally neutral and fair.
  • Be a black box. You don't have to give away your secret sauce source code, but must be transparent to build credibility and prevent a result from being cast into doubt.
  • Harm the reputation the CTF contest by cheapening the experience.

YOUR SUBMISSION WILL BE JUDGED:

  • On any innovations or revolutionary enhancements to the game.
  • On the feasibility of your team getting all the work done.
  • On the amount of fun that participants will have.
  • On how your contest contributes to the "World Series" aspect of the contest.
  • On how well the winning team represents those with the best skills, and not just luck, to come out on top.

CAN YOU SUBMIT MORE THAN ONE CONCEPT?

Yes, but please submit them separately so as to minimize confusion.

WHAT HAPPENS NEXT?

Once you submit your ideas we will start communicating with you to clarify anything we don't understand. Feel free to ask us questions so you know what you are getting yourself into. Past organizers did very well because they had a large pool of talent when building their automated systems, and the time to test them in advance.

RESOURCES WE CAN PROVIDE:

  • Badges to the conference and access to the CTF area for setup beginning Tuesday before the con.
  • Physical space roughly equal to that which has been provided at past DEF CONs.
  • Some network gear and power strips - please let us know early what you need so we can plan for it.
  • Prizes for the winning people or teams, 8 black badges maximum, 8 exclusive DEF CON CTF leather jackets.
  • Hotel accommodations for the organizers and the qualified teams. The hotel will be at the DEF CON Venue properties, and of DEF CON’s choosing.
  • You may want (and are highly encouraged) to leave game clues in custom art, Easter eggs in the printed program, website, etc. Few DEF CON contests are given these exclusive benefits.
  • Social Media & Promotional support, your team will be asked to compose a schedule for regular online updates and promotion. Support from us will be via scheduled tweets, website updates, printed signs, and the official DEF CON printed program.
  • Money to help pay basic costs. While we don't have a fortune for CTF we can make life easier for the organizers and contestants.

RESEARCH POINTERS:

If you haven't been to DEF CON before, you should understand the environment your contest must operate in! https://www.defcon.org/ will get you started. These may help give you an idea about past contests, what has worked, and what hasn't.

DEF CON CTF Website:
https://www.defcon.org/html/links/dc-ctf.html

-> Please Read the winning submission from OOO to see what worked for them:
https://oooverflow.io/ooo-dc-cfo-proposal.pdf

Order Of the Overflow has complete archives of their past contests, puzzles, and packet captures:
https://oooverflow.io/
https://archive.ooo/

LegitBS has documented a lot of their process, and it’s a great resource for learning what goes into making a great CTF.

LegitBS website:
https://legitbs.net/
https://blog.legitbs.net/search/label/Building DEF CON CTF

While you’re on the LBS site, make sure to check out their blog (blog.legitbs.net). They talk about their scoring policies, commitment to transparency and many of the behind-the-scenes challenges in a way that is sure to be useful to first-time CTF hosts.

There’s also a bunch of goodies like LBS’s scoring architecture, qualifications back-end, and some previous challenges:
https://github.com/legitbs

Other Resources:

DDTEK website:
http://ddtek.biz/

Worldwide CTF tracking site:
http://ctftime.org/

Online repositories of various CTF related data:
http://repo.shell-storm.org/CTF/
http://captf.com/

DEF CON 25 CTF Organizer Panel:
https://www.youtube.com/watch?v=MbIDrs-mB20

Psifertex' Defcon 17 Presentation - Maximum CTF:
http://www.youtube.com/watch?v=-6mI3tp6RxI
https://media.defcon.org/DEF CON 17/DEF CON 17 video and slides/DEF CON 17 - Psifertex - Maximum CTF Getting the most out of Capture the Flag - Video and Slides.mp4

Ceazar gave a presentation on running hacking contests at Black Hat Asia (learn from a master):
https://www.blackhat.com/presentations/bh-asia-04/bh-jp-04-pdfs/bh-jp-04-eller/bh-jp-04-eller.pdf

A rundown of DEF CON 16 CTF by atlas of team l@stplace (DEF CON 14 and 15 CTF Winners):
http://atlas.r4780y.com/cgi-bin/atlas/2008/08/12

Walkthroughs of the last 2006-2009 CTF Competitions:
http://nopsr.us

Interview with Def Con CTF Winning Team Member Vika Felmetsger (2005):
https://taosecurity.blogspot.com/2005/08/interview-with-def-con-ctf-winning.html

So you want to build a game? Welcome!

  1. Fill out the application below. You will receive an acknowledgment that your submission was received within three business days of us receiving it unless we are snowed in and the interwebs are broke. If you don't hear back, something went wrong so try reaching out again. Some servers pick on us, please whitelist *@defcon.org.

  2. We will use relatively simple criteria to judge your entry:
    • Has your team done this before? Are you mostly players, organizers, or a mix of both?
    • Feasibility of your team pulling it off, taking into consideration who is involved in your team, resources you have, ambition of your 1st year vision.
    • The amount of fun we imagine the participants will have with your contest.
    • Does winning your contest represent real elite hacking skills, or efficient automation?
    • How does your concept embrace DEF CON as the "World Championship" of CTF idea?
    • The coolness or innovation you bring to the contests.
    • Respect your team has for the DEF CON community at large. Your team's reputation should also be in good with our community's code of conduct.
  3. We will contact finalists and ask them further questions, and talk over any questions that we will inevitably have. Please rest assured that we will help get a really good idea over the finish line. You’re not alone in this.
  4. We will announce the winner(s) as soon as we can after the close of the CTF CFO date.
  5. We will work out details over the phone, participating in your game creation (not interfering with it, just ensuring everything is going smoothly). We will conference call with you and may fly you out for an in-person meeting with us to discuss planning for the event. Primary & secondary contacts will also be added to an official DEF CON CTF planning project on Basecamp to coordinate with us. We will use the email addresses you included on your application (unless stated otherwise).

  6. OOO, just like LegitBS and DDTEK, have offered to spend time working with the selected team, answering their questions, explaining their process and what they learned in designing their games. This is a pretty awesome resource - you should consider taking advantage.

APPLICATION:

All contact information will be kept private, and not disclosed outside the DEF CON planning organization.

Name of your organization:
Name of primary contact:
Email Address of Primary contact:
Phone number of Primary contact:
Social Media of Primary contact:
Email, phone and social media of your Backup contact:

Are you affiliated with a company, and if so will the company influence or control your work? How?

The number of people in your organization that will actively be participating in creating the CTF.

Who are the team members?

Experience the team members have had in planning events, and CTF participation experience.

Technical ability of your team. This would include a general list of people's abilities such as networking, hardware, web app, reversing, etc. and support the idea you can pull this off.

Physical resources, if any, that you will be bringing to help run CTF such as a disco ball, robots or enigma machines to help us plan to accommodate it with the hotel if you require extra power or special fire marshal approval.

Please disclose any possible conflicts of interest.

EXPLAIN YOUR VISION:

  • Explain in a general manner, your vision for the CTF.
  • Talk about your motivation for wanting to put in thousands of hours and take the risk of organizing the DEF CON CTF.
  • Explain how you hope the contestants will experience it. For example do they sign up on-line, get a secret package in the mail, start blindfolded with an unusual laptop? Are there certain crisis points you will introduce during the game to confuse or add to the pressure?
  • How do players or teams qualify?
  • Is it multi player or single-player, or a combination?
  • What innovations or new ideas are you bringing to CTF?
  • How long will the contest take, will it be 24x7, 8 hour shifts, etc.?
  • Explain what you believe is the best way to gauge a hacker's abilities, and how your vision of the contest could do this?
  • What technical work is required to execute your plan. This includes setting up environments beforehand, pre-qualification work if any, writing a scoring system, etc.?
  • Give an outline of the rules that will be presented to the participants:
  • What hardware resources do you request or need from DEF CON?
  • Tell us anything else that you think may be important or that we might consider in choosing your group to host CTF.

SEND ‘EM IN!

The submission deadline is November 15, 2021. Email Submissions to ctf [at] defcon [d0t] org

If you need to encrypt it please use DTs keys from here:
https://defcon.org/html/links/dtangent.html
http://g7ejphhubv5idbbu3hb3wawrs5adw7tkx7yjabnf65xtzztgg4hcsqqd.onion/html/links/dtangent.html

New announcements will be on the main DEFCON web site as well:
https://www.defcon.org/

Thank you!
The Dark Tangent