13 ms·
Hacking Google
- thom_ 4y ago
- rnotaro 4y ago> CONTEST IS OPEN TO RESIDENTS OF THE 50 UNITED STATES, THE DISTRICT OF COLUMBIA AND WORLDWIDE, EXCEPT FOR QUEBEC, CRIMEA, CUBA, IRAN, SYRIA, NORTH KOREA, and SUDAN. Ah yes, Quebec, excluded of most contests. https://capturetheflag.withgoogle.com/rules https://capturetheflag.withgoogle.com/rules
- Thorrez 4y agoHmm, I don't know whether that applies to H4CK1NG G00GL3 or just to the main CTF (which took place from July 1 to July 3).
- jrockway 4y agoQuebec has a lot of rules for contests; advance registration with the government, providing them with a % of the prize value in advance, etc. Probably not worth the paperwork when dealing with them internationally.
- deleted 4y ago[deleted]
- bombcar 4y agoIsn’t that where you have to answer a math question if you win?
- wk_end 4y agoThat's not Quebec specific [0] - in fact, growing up in Ontario, it wasn't until just now that I learned that this was a Canadian thing at all. [0] https://en.wikipedia.org/wiki/Skill_testing_question https://en.wikipedia.org/wiki/Skill_testing_question
- Sirened 4y agoI love that the image in the article also includes parenthesis, you just know that someone had to point out that a lot of people would manage to get it wrong without them.
- dmix 4y agoNo it's much more byzantine than simply the skill testing question. Classic Canadian bureaucracy. https://www.quora.com/Why-do-Canadian-contests-exclude-Quebec https://www.quora.com/Why-do-Canadian-contests-exclude-Quebe...
- daniel-cussen 4y ago
- mechanical_bear 4y agoAre you ok?
- Izikiel43 4y agoI’m doubting if this guy is a person or an AI
- sebzim4500 4y agoSeriously. If GPT-3 produced this I would assume it had been horribly misconfigured.
- jrockway 4y agoIt doesn't seem like an AI to me. Seems like a human that might have had a couple three beers on Friday night after work, and then wrote an HN comment. I've done it before. It can be weird ;)
- daniel-cussen 4y ago
- dlord 4y agoIt's not required to do so anymore for internationally based contests. https://www-racj-gouv-qc-ca.translate.goog/communications/nouvelles/detail.html?tx_news_pi1%5Bnews%5D=643&_x_tr_sl=fr&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp https://www-racj-gouv-qc-ca.translate.goog/communications/no...
- bombcar 4y agoVery weird way of wording it. Also Quebec is finally on the axis of evil where it belongs, I guess.
- robobro 4y agoSurprised Russia isn't on the list..
- arthurcolle 4y agoPayoff was 2 potatoes, only had 1 to spare.
- pluc 4y agoIt's because we've nationalized gambling[1], and so all gambling/contests need to be approved by the government. 1: https://portail.lotoquebec.com/en/home https://portail.lotoquebec.com/en/home https://en.wikipedia.org/wiki/Loto-Qu%C3%A9bec https://en.wikipedia.org/wiki/Loto-Qu%C3%A9bec https://en.wikipedia.org/wiki/Gambling_in_Quebec https://en.wikipedia.org/wiki/Gambling_in_Quebec
- jbglenn 4y agoNationalized lol
- gruez 4y ago> It's because we've nationalized gambling[1], and so all gambling/contests need to be approved by the government. What you're describing (the state has a monopoly on gambling) is applicable to many other jurisdictions in US/Canada that aren't excluded from the website.
- Thorrez 4y agoYeah, it doesn't have to do with nationalized gambling. It has to do with strict sweepstakes laws. * Register the sweepstakes rules and all advertisements used to promote the contest with the Quebec government at least 30 days ahead of the sweepstakes' launch. * Pay a fee of up to 10% of the sweepstakes' value, depending on who is allowed to enter. * Offer the sweepstakes rules in French as well as English. https://www.liveabout.com/why-are-so-many-competitions-void-in-quebec-896835 https://www.liveabout.com/why-are-so-many-competitions-void-...
- deleted 4y ago[deleted]
- Justin_K 4y agoTheir laws are so terrible it's not worth the trouble. Their citizens need to vote for change.
- speed_spread 4y agoFunny cause Quebec elections are ongoing right now and it looks like the do-nothing party is gonna stay in charge.
- hulitu 4y agoThey didn't upset anyone or the alternative is worse. Just normal politics.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- 29athrowaway 4y agotl;dw: The videos are essentially a Google infomercial.
- ehsankia 4y agoI thought it was a fascinating and well produced history of Project Aurora and how it went down at Google. It was a massive attack, and the reason Google pulled out of China.
- syrusakbary 4y agoThis is a clever way to recruit hackers into the Google Security team. Here's some of the most useful content from the webpage: * Episode 0: https://www.youtube.com/watch?v=przDcQe6n5o https://www.youtube.com/watch?v=przDcQe6n5o * Challenge 1: https://hackerchess-web.h4ck.ctfcompetition.com/ https://hackerchess-web.h4ck.ctfcompetition.com/ * Challenge 2: https://aurora-web.h4ck.ctfcompetition.com/ https://aurora-web.h4ck.ctfcompetition.com/ * Episode 1: Coming soon
- wnevets 4y ago> * Challenge 1: https://hackerchess-web.h4ck.ctfcompetition.com/ https://hackerchess-web.h4ck.ctfcompetition.com/ is the goal to hack the chess game or the admin panel? I never know how to do these things
- bombcar 4y agoI would guess the goal is to beat a world champion while playing black and get accused of cheating.
- eyegor 4y ago
- marcofatica 4y agoIt's a pain in the ass
- gpm 4y agoSo, I solved this challenge the "intended" way instead of just using an engine. But I'm pretty sure that you could just use an engine for longer than they are. Behind the scenes it appears to just be running stockfish with a timeout of "10" (10s? Didn't check what units, seems faster than 10s so maybe 10ms or something).
- 4y ago
- bushbaba 4y agoMaybe if google spent this much time on their products they wouldn’t need to cancel nearly everything they launched over the last decade.
- hulitu 4y agoThe only product of Google is data from other people. Everything else (search engine) are just side projects.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- zerocrates 4y agoIs that Spencer Grammer (Summer from Rick and Morty) doing the voiceover?
- tsol 4y agoI'm pretty sure it is. I honestly have a hard time taking it seriously when I'm imagining a sarcastic teen saying all of this
- Nition 4y agoThat URL reminds me of https://www.google.com/webhp?hl=xx-hacker https://www.google.com/webhp?hl=xx-hacker
- deleted 4y ago[deleted]
- keepquestioning 4y agoCan i register my own .google domain name?
- njsubedi 4y agoYes/No? Yes. The only catch is that you mist be a Google employee, and you need a .google domain for a reasonably cause. Practical answer: of course, not!
- qbasic_forever 4y agoWould love to see a googler brave enough to register and publish http://unionize.google http://unionize.google
- _nhynes 4y agoThey use this honeypot to weed out all of the non-security people.
- deleted 4y ago[deleted]
- missblit 4y agoWeird, it's not letting me promote my pawn even though it looks like a valid move (unless I suck at chess and it's not valid for some reason). The first challenge was fun, but I'll probably stop there since I really don't have the patience to do the more complex stuff (at some point debugging computers just feels like work even though I don't work in security at all haha).
- bratsche 4y agoAre you ready? [Y/N] Only the Y seems to work. I guess they didn't consider that someone might hit N. :)
- solardev 4y agoit's funny, i hit n a few times and then entered gibberish commands and the command line just died after that. Maybe it's another exploit path...
- fendy3002 4y agoThis man (or woman) QA
- deleted 4y ago[deleted]
- frankzander 4y agoI had the same thought
- deleted 4y ago[deleted]
- zppln 4y agoIt's funny how cyber security appears to marinate itself in an aesthetic we used ironically 15-20 years ago. These people are trying really hard to become the stock photo hooded hacker. To me it's as ridiculous today as it ever was and doesn't exactly inspire confidence in the industry.
- hayst4ck 4y agoAre you from the east coast?
- mechanical_bear 4y agoWell… I wear a hoodie most days.
- kennyloginz 4y agoWhat fashion has started from hackers? They have bad posture, and they don't go out. I wish I had a hacker boyfriend - they stay at home up in the bedroom. John Waters
- saagarjha 4y agoWhat makes you think the people today don’t enjoy the irony just as much as you did all those years ago?
- zppln 4y agoI just get the impression that it's lost on a lot of people new to the industry. The industry use this aesthetic (for lack of a better word) to market itself and attract talent (as evident by TFA). There's almost a subcultural element to it. I've seen perfectly dull boomer engineers go away on security conferences and come back with stickers on their laptops and looking like Lisbeth Salander.
- suction 4y ago
- rmetzler 4y ago
- deleted 4y ago[deleted]
- lrvick 4y agoAs an infosec professional my job is to protect end users from threats to their digital security, privacy, and sovereignty. To show them how to meet their digital needs without being manipulated or exploited. This ethical model is simply incompatible with surveillance capitalism. Google has the hard job here of finding people highly experienced in security that lack strong ethical convictions yet also do not have a strong history of criminal behavior. Probably not many of those left to hire.
- deleted 4y ago[deleted]
- esjeon 4y agoThanks for the link. Just finished Episode 0. Those were some solid classic puzzles based on PHP and Perl. I'm not sure if they are still relevant thou. Unfortunately, I don't have time for the contest. Gotta go for a dinner with my family. I'm not a guy who aims for speed, so it's unlikely that I would win a prize anyway.
- lmarcos 4y agoIf you think you are that smart, you shouldn't work for Google and similars. Reminds me of the ending of Will Hunting (the movie).
- saagarjha 4y agoIf you're smart you'd make Google work for you ;)
- deleted 4y ago[deleted]
- O__________O 4y agoWay more likely US hacked Google way before China via insiders, networks, legal pressure, etc.; my response to watching the first episode: https://www.youtube.com/watch?v=przDcQe6n5o https://www.youtube.com/watch?v=przDcQe6n5o ___________________ Links related to video: Tech Model Railroad Club - https://wikipedia.org/wiki/Tech_Model_Railroad_Club https://wikipedia.org/wiki/Tech_Model_Railroad_Club Operation Aurora - https://wikipedia.org/wiki/Operation_Aurora https://wikipedia.org/wiki/Operation_Aurora
- yreg 4y ago*Zeroth episode :)
- ren_engineer 4y agocan you really be hacked if you were a DARPA funded honey pot from day 1? I'd say the main reason Google and many of the other big tech companies haven't faced much effort from the US government to be broken up is because federal agencies love being able to get a bunch of info on people through a single subpoena
- jspann 4y agoIs that Spencer Grammer narrating the video? The narrator's voice sounds incredibly familiar.
- O__________O 4y agoEpisode 2: Google Threat Analysis Group (TAG) - https://www.youtube.com/watch?v=N7N4EC20-cM https://www.youtube.com/watch?v=N7N4EC20-cM Summary: Google covers how they use Google’s web crawler to build a threat analysis database, then cover how they protect users from government backed attackers using phishing by providing two-factor authentication. Response: Strange, seems like offering end-to-end-encryption would likely protect more users from government backed snooping — but then I guess that would mean Google on was not able to snoop on billions of users. Links related to video: "Government backed attackers may be trying to steal your password" - https://www.google.com/search?q=%22government+backed+attackers+may+be+trying+to+steal+your+password%22&tbm=isch https://www.google.com/search?q=%22government+backed+attacke...
- aqwsde 4y agoAre you ready? [Y/N] > N command not found: N
- sva_ 4y agoReminds me of Google Foobar