5 ms·

Finnish Defence Forces' Cyber Challenge

67 points by mdf 11y ago

brunnsbe 11y ago
In Finland we have a mandatory army service, this is the test you need to take and send in your answer before 20th of July if you want to apply for the army's cyber security division. More info here in Finnish: http://erityistehtavat.puolustusvoimat.fi http://erityistehtavat.puolustusvoimat.fi
- airza 11y ago
  Too bad I can't apply from the US, it's fun :D
- Finishline 11y ago
  I've proven in open/public court that the military & police are completely compromised around the world, and are not allowed to act as or say they are the military or the police anymore. They are completely compromised, so any mandatory service requirements are simply taking you too your deaths, in an age where one simple information saturation event will cause the triggering of multiple directed/manipulated energy weapons, and potentially end the world. Please, fight them at all costs, and deny the mandatory service. I will do my best in life to stop mandatory service, and military recruitment around the world. Other have proved this as well, and someone, somewhere has intentionally scrubbed it each time. The people need to know. Its compromised.
bagosm 11y ago
Lorem~Ipsum )87*;+xorXOR
jakozaur 11y ago
Spoiler alert! Answers below: === === === === === Ad 1. Someone tries to exploit Internet Explorer. You see a command line which is subprocess of web browser (unlikely normal). Ad 2. a) 16 days ~= (31337 4) / (700 * 109 * 3600 * 24) b) 10 days ~= 95 9 / (700 * 10 9 * 3600 * 24) Ad 3. Lorem~Ipsum (Base64) Ad 4. Yes. One of the programs guess the same as random, the other guess the opposite of random. Ad 5. QWErty
- infinitone 11y ago
  Can you explain answer 4 and 5 please? Thanks.
  - green7ea 11y ago
    Number 4 is pretty cool because the programs use the fact that they know how the other program guesses to make sure they win. If I'm Program 1 and I see a 0, I will guess 0. If Program 2 sees a 0, Program 1 guessed correctly and it doesn't matter what he guessed. If Program 2 sees a 1, he will guess the opposite (0) and this means that Program 1 was wrong but Program 2 was right. If Program 1 sees a 1, he guesses 1. If Program 2 sees a 1, Program 1 is correct. If Program 2 sees a 0, he guesses 1 and is correct. The above is a truthtable in words that shows they are always right. For number 5, I translated the binary numbers to decimal and used an ASCII table to convert them to ')87*;+xorXOR'. This is a different answer than grandparent. The following C++ code does the conversion: http://pastebin.com/ThxdHHwu http://pastebin.com/ThxdHHwu
  - bryondowd 11y ago
    4 is pretty simple if you look at all possibilities. Program A will receive a 0 or a 1 and will guess the opposite of this value. Program B will receive a 0 or a 1 and will guess this same value. So, you have 4 possibilities: (A/B is the bit received, a/b is the guess, you 'win' if b == A || a == B) (In other words, if B's guess is equal to what A received, or vice versa) A|B|a|b 0|0|1|0 (b == A) 0|1|1|1 (a == B) 1|0|0|0 (a == B) 1|1|0|1 (b == A) Another way to think of it is that A is guessing that they will receive different values, and B is guessing that they will receive the same value. One must be right.
- Retr0spectrum 11y ago
  8. "password" $6$saltsaltsaltsalt$bcXJ8qxwY5sQ4v8MTl.0B1jeZ0z0JlA9jjmbUoCJZ.1wYXiLTU.q2ILyrDJLm890lyfuF7sWAeli0yjOyFPkf0 11. (1/3)^3 + 3 * (1/3)^2 * (2/3) = 0.2592592 (can someone else please verify this?) 26. An attacker could work out the password reset token using the time. Multiple SQL injection vulns. Not a vuln, but a mistake - Line 6 of passwordRecover.php should be if ($_GET['token'] == $result[0]['pass_recover']){
sampo 11y ago
Link to Google cache: http://webcache.googleusercontent.com/search?q=cache:tPfs4yOPZXQJ:erityistehtavat.puolustusvoimat.fi/cyberchallenge.html http://webcache.googleusercontent.com/search?q=cache:tPfs4yO...
green7ea 11y ago
That is pretty cool. I liked q9 since they named the characters after the RSA creators (Ron Rivest, Adi Shamir, Leonard Adleman) and the question is most likely modular exponentiation.
bryondowd 11y ago
Anyone get a solution to 7 that doesn't involve a whole lot of steps? I did it in 44 steps, with the same 4 step combo being repeated 10 times in a row to work down to 0.3 liters.
- deckar01 11y ago
  My breadth first search found that the shortest solution was 44 steps. https://gist.github.com/deckar01/beb96fc0afc0715f01bb https://gist.github.com/deckar01/beb96fc0afc0715f01bb
  - metafunctor 11y ago
    Most buckets are shaped like a truncated cone, so with a steady eye one should be able to fill a bucket to exactly half (2.15 or 2.35 liters). However, in this puzzle, this little trick doesn't help and the shortest solution is indeed 44 steps.
    - thaumasiotes 11y ago
      How does being shaped like a cone frustum help?? Even if the bucket were a cylinder (so filling it to half height got you half the volume), that would be crazy difficult. With slanted sides, how could you possibly know how high to fill for half the volume? Did you bring a protractor? Sextant?

67 points by mdf 11y ago

In Finland we have a mandatory army service, this is the test you need to take and send in your answer before 20th of July if you want to apply for the army's cyber security division. More info here in Finnish: http://erityistehtavat.puolustusvoimat.fi http://erityistehtavat.puolustusvoimat.fi

airza 11y ago
Too bad I can't apply from the US, it's fun :D
Finishline 11y ago
I've proven in open/public court that the military & police are completely compromised around the world, and are not allowed to act as or say they are the military or the police anymore. They are completely compromised, so any mandatory service requirements are simply taking you too your deaths, in an age where one simple information saturation event will cause the triggering of multiple directed/manipulated energy weapons, and potentially end the world. Please, fight them at all costs, and deny the mandatory service. I will do my best in life to stop mandatory service, and military recruitment around the world. Other have proved this as well, and someone, somewhere has intentionally scrubbed it each time. The people need to know. Its compromised.

bagosm 11y ago

Lorem~Ipsum )87*;+xorXOR

jakozaur 11y ago

Spoiler alert! Answers below: === === === === === Ad 1. Someone tries to exploit Internet Explorer. You see a command line which is subprocess of web browser (unlikely normal). Ad 2. a) 16 days ~= (31337 4) / (700 * 109 * 3600 * 24) b) 10 days ~= 95 9 / (700 * 10 9 * 3600 * 24) Ad 3. Lorem~Ipsum (Base64) Ad 4. Yes. One of the programs guess the same as random, the other guess the opposite of random. Ad 5. QWErty

infinitone 11y ago
Can you explain answer 4 and 5 please? Thanks.
- green7ea 11y ago
  Number 4 is pretty cool because the programs use the fact that they know how the other program guesses to make sure they win. If I'm Program 1 and I see a 0, I will guess 0. If Program 2 sees a 0, Program 1 guessed correctly and it doesn't matter what he guessed. If Program 2 sees a 1, he will guess the opposite (0) and this means that Program 1 was wrong but Program 2 was right. If Program 1 sees a 1, he guesses 1. If Program 2 sees a 1, Program 1 is correct. If Program 2 sees a 0, he guesses 1 and is correct. The above is a truthtable in words that shows they are always right. For number 5, I translated the binary numbers to decimal and used an ASCII table to convert them to ')87*;+xorXOR'. This is a different answer than grandparent. The following C++ code does the conversion: http://pastebin.com/ThxdHHwu http://pastebin.com/ThxdHHwu
- bryondowd 11y ago
  4 is pretty simple if you look at all possibilities. Program A will receive a 0 or a 1 and will guess the opposite of this value. Program B will receive a 0 or a 1 and will guess this same value. So, you have 4 possibilities: (A/B is the bit received, a/b is the guess, you 'win' if b == A || a == B) (In other words, if B's guess is equal to what A received, or vice versa) A|B|a|b 0|0|1|0 (b == A) 0|1|1|1 (a == B) 1|0|0|0 (a == B) 1|1|0|1 (b == A) Another way to think of it is that A is guessing that they will receive different values, and B is guessing that they will receive the same value. One must be right.
Retr0spectrum 11y ago
8. "password" $6$saltsaltsaltsalt$bcXJ8qxwY5sQ4v8MTl.0B1jeZ0z0JlA9jjmbUoCJZ.1wYXiLTU.q2ILyrDJLm890lyfuF7sWAeli0yjOyFPkf0 11. (1/3)^3 + 3 * (1/3)^2 * (2/3) = 0.2592592 (can someone else please verify this?) 26. An attacker could work out the password reset token using the time. Multiple SQL injection vulns. Not a vuln, but a mistake - Line 6 of passwordRecover.php should be if ($_GET['token'] == $result[0]['pass_recover']){

sampo 11y ago

Link to Google cache: http://webcache.googleusercontent.com/search?q=cache:tPfs4yOPZXQJ:erityistehtavat.puolustusvoimat.fi/cyberchallenge.html http://webcache.googleusercontent.com/search?q=cache:tPfs4yO...

green7ea 11y ago

That is pretty cool. I liked q9 since they named the characters after the RSA creators (Ron Rivest, Adi Shamir, Leonard Adleman) and the question is most likely modular exponentiation.

bryondowd 11y ago

Anyone get a solution to 7 that doesn't involve a whole lot of steps? I did it in 44 steps, with the same 4 step combo being repeated 10 times in a row to work down to 0.3 liters.

deckar01 11y ago
My breadth first search found that the shortest solution was 44 steps. https://gist.github.com/deckar01/beb96fc0afc0715f01bb https://gist.github.com/deckar01/beb96fc0afc0715f01bb
- metafunctor 11y ago
  Most buckets are shaped like a truncated cone, so with a steady eye one should be able to fill a bucket to exactly half (2.15 or 2.35 liters). However, in this puzzle, this little trick doesn't help and the shortest solution is indeed 44 steps.
  - thaumasiotes 11y ago
    How does being shaped like a cone frustum help?? Even if the bucket were a cylinder (so filling it to half height got you half the volume), that would be crazy difficult. With slanted sides, how could you possibly know how high to fill for half the volume? Did you bring a protractor? Sextant?