For the last 2 years, I has been invited to partipate to the SPIRITCYBER Hackathon organized during the Cyber Week in Singapore. This Hackathon/CTF is organised and sponsored by the CSA, in 2 phases: Qualification during 1 month and the finale (2 days) on site. With my team SaltedEggChicken, we have been qualified for the finale and had fun to participate but also to meet all the competitors.
Targets and bench#
Targets were hardware devices / IOTs : CCTV, smart devices, routers, Wireless/BT Access points. This year during the finale they allow us to assess Military Drone. They give us the list of the devices including names/models, versions and admin accounts but no firmware has been provided. We did not buy some targets like last year to extract firmware but some teams did it. We shared the bench, where these devices were connected, with all other participants; so time to time it was a mess :) Devices didn’t answer anymore, plenty of payloads in all fileds on each web interfaces (kikoo Peenoise team). And finally Internet was unstable but what I could expect with 10 hackers on the same network…
Bug reports and triage#
This year, YesWeHack has been also involved to handle all bug reports and interaction with vendors. They created a dedicated program where all information where shared and we use their platform to report bug, easy peesy :D I should receive some CVEs for some vulnerabilities I reported, so I hope to be able to share more details later when the bug will be fixed.
Summary#
As the previous years it has been nice to participating to such event. My job does not give much opportunity to assess these kinds of devices which is always intelectually interesting to dig in.
Congratulations to all teams; it was fun and I hope to see you next year; to organizators CSA & YWH who did a wonderful work to setup things.
Last but not least, Big up to my team members Nico and CheerBoon
