4 ms·
This looks cool! > I've never understood why awesome CTF events are so eager to shut down. We actually were planning to leave the first Stripe CTF up indefini
by gdb 13y ago
This looks cool!
> I've never understood why awesome CTF events are so eager to shut down.
We actually were planning to leave the first Stripe CTF up indefinitely. We'd mostly just built it as a side project, and hadn't really expected anyone to take notice. But we were swarmed by thousands of users, and suddenly keeping everything running was a full-time job — Andy wrote a script to alert us to forkbombs, and every hour or two we'd have to go in and clear out the forkbombs from a machine. The runner for level5 would get wedged due to an exploit that hung it, and would require kicking. One of the machines would be overloaded with level6 password bruteforcers, and we'd have to spin up another or kill off runaway ones.
For the second CTF, we at least knew what we were in for and built a much more resilient architecture. It was successful in that it was much less work to maintain, but there still was a lot of maintenance, ranging from working around an EC2 security groups bug that would blackhole traffic from certain client IP addresses to spinning up more level2 boxes (since everyone was overloading them in their attempts to bruteforce the level8 passworddb).
Anyway, my tl;dr is that running any production system is hard, and we couldn't have kept them running without significant time investment.
- tptacek 13y agoIn other words, "we're going to keep this site up for a long time" sounds like famous last words to you. :) On the other hand, we're a security consultancy, so maybe we have lower, more tolerable standards for "up in production" than Stripe does. Nelson Elhage is a machine; he ripped through 9 levels in under an hour.
- gdb 13y agoYep, pretty much :). Also, fun fact: Nelson was our test solver for CTF2. He also ripped through all the levels there in a few hours. But then he got to level8 (PasswordDB, which was source port counting), and was stumped for a few days. He had a lot of hypotheses about the vulnerability, many of which were much cooler than the actual one. Given it had taken him so long, I decided the level was too hard and made it easier by adding some code that would log source ports. (It turned out to still be too hard, so launch day I released a bunch of hints until finally wgrant solved it, at which point I went home and got some sleep.)
- IgorPartola 13y agoIs there any place to download the code or the image to the original Stripe CTF? I would love to replay it again.
- gdb 13y agoYep: https://stripe.com/blog/capture-the-flag-wrap-up https://stripe.com/blog/capture-the-flag-wrap-up. I also recently learned that someone packaged our second CTF: https://github.com/e28eta/stripe-ctf-2.0 https://github.com/e28eta/stripe-ctf-2.0 Enjoy!