Cybersecurity Challenge Ireland

We have a final result – Ireland have achieved 15th place! A huge achievement and a big improvement on previous years of 2016 and 2017. Onwards and upwards! You can read more about the final day of the competition in our post here

Many thanks to our fantastic financial sponsors for their support this year. ECSC is a wonderful experience and an excellent way to train young talent in cybersecurity and co-operation between European nations. We look forward to developing an even stronger Irish team for ECSC 2020 in Austria!

Day 2 of the competition started in the Bucharest’s Palace of the Parliament with an entirely new set of challenges for the teams to solve, with the previous day’s 18 challenges now closed for submissions.

The format of the challenges was largely the same as the previous day, covering a broad range of categories. This morning each team found an ESP8266 chip with an antenna on their tables. This is a so-called “hardware challenge” and required the contestants to reverse the custom wireless protocol being used by the chip. The team strategised and decided to leave this challenge aside, as it is not something anyone was familiar with.

On Day 2, one person from each team was required to present the solution to one of the challenges their team had solved on Day 1. They presented to 5 Jury members who scored each presenter on their speaking skills and the difficulty of the challenge. Ryan Harrison gave a charismatic presentation on how Ireland found a Python deserialization bug in the “Random Dice” challenge.

Ireland was later announced as one of the Top 5 presentations who would present again at the end of the conference to all the contestants. Well done Ryan! That glorious Belfast accent won over the jury and earned the team a rakeload of points.

Ireland had made serious gains in the first few hours of Day 2, solving Cryptography (ECC & ElGamal) and Web (PHP) challenges, enabling the team to reach 10th ranking on the scoreboard on two occasions. Other challenges solved included Incident response and Log analysis (write-ups to come on this blog – stay tuned!).

At 4 pm the scoreboard was frozen, and the team began to feel the heat, as several teams around began celebrating very audibly as they submitted last minute flags. With 20 mins to spare, Ireland solved a C# reversing challenge correctly, and felt a touch of relief. With just 15 mins to go, the team finally had a correct method (on paper) to solve a block-cipher hash collision challenge. Unfortunately, the team was unable to implement the Python code required to solve it in time.

The competition ended just after 6 pm with sustained applause from all of the teams. The huge effort was over, and the teams were able to relax and socialise, sharing solutions with each other. A buffet dinner was laid on for the teams in the Crystal Ballroom. The Irish team, in typical fashion, led the after-party to the Oldtown of Bucharest.

With the scoreboard frozen, no-one knew how the final standings would end up, with the result to be announced at the awards ceremony on Day 3.

Frozen leaderboard (2 hours before end of competition:)

The first day of competition kicked off today in Bucharest. It was an early start to get breakfast and over to the Parliament building in time for the 8.45 am start. Our Uber driver Vladimir managed the morning rush-hour traffic with cool professionalism to get us there just in time for the opening speeches by ENISA and our Romanian hosts, who walked us through the rules for the competition.

Each team at the competition has a gigabit Ethernet switch which gives wired internet access to the interactive web or exploitation challenges. It’s a conscious choice by the organisers which avoids the WiFi issues that appear with >200 individual competitors’ devices present in the competition room.

Team Ireland got off to a good start, solving a malleable AES-CTR challenge and a binary serial number generator challenge, followed by numerous crypto and web challenges. Although we had one or two issues with the platform not accepting our flags, we overall really enjoyed the difficulty level of these challenges put together by the Romanian organisers. Creating challenges at an appropriate skill level is a challenge in and of itself!

Further challenges solved by Team Ireland included PHP backdoors and Python deserialisation bugs. The team’s communication skills were really put to test later in the day by the escape room challenge, which was put together by BT’s security team. Ireland successfully completed all 6 parts of this challenge.

The remainder of the day was spent writing up the solution for each challenge solved, and preparing a PowerPoint presentation for tomorrow. Ireland are currently placed 16th out of 20 countries, with another full day of competition tomorrow.

Stay tuned for more photos and updates on Day 2 of the competition!