4 ms·
How do these competitions declare a winner? Snippets like "it only took 4 seconds" suggest they use the total exploit running time as the only criteria?
by old-gregg 10y ago
How do these competitions declare a winner? Snippets like "it only took 4 seconds" suggest they use the total exploit running time as the only criteria?
- devsquid 10y agoI don't think time has anything to do with the competition, it just made a catchier title.
- wepple 10y agothey go into a randomized lottery which decides who gets to run their exploit first. They then have a set time to exploit the device (commonly 2 minutes), and if they can't do it the next team in gets to go. Generally once a target has been compromised, no other teams are allowed to use the same vulnerabilities. this prevents a team from sharing an exploit/vuln to others who run it again. The downside is that if you've been working on an exploit chain for 6 months but a team runs a similar bug ahead of you, your work is worthless.