Coming soon: Stripe CTF3, distributed systems edition

Thanks for the kind words! As a note, this CTF is going to be a different angle — rather than being about security, this will focus on distributed systems engineering.

Yea, I definitely had fun as well, although my week dictated that I was in the ~600s for finishing level 8. I might try to put a little more time in up front for a higher finish this time.

The last level involved compromising one of the earlier servers iirc because the pw dbs only responded in-network. The "Password Database" was chunked amongst a few servers, requiring an increase in the port number on the response due to a waterfall type password check (ie: if chunk1 is correct, go hit chunk2 server and check). You also had to re-check your chunks because other people's requests were making the port increase as well. I had a huge rush when my script finally stopped and my "password" showed up on screen.

Definitely looking forward to one based in distributed systems as I've been researching that sort of stuff over the last year and such.

I also loved the last CTF. I got to the last level but by the time I'd worked out how to attack it port numbers seemed to be jumping all over the place. I figured that it was just that too many people were hammering it. Had a solution that worked locally, and I was pretty happy to have gotten that far. Really looking forward to the next round - especially now that I work for myself and can dedicate the day to it :)

I enjoyed the most recent one so much that I went back and did the first one and enjoyed it even more. They have images available for it here[0] if you're interested!

0: https://stripe.com/blog/capture-the-flag-wrap-up

The last stripe CTF literally changed my life. I've always been interested in security but didn't have the confidence and honestly thought I didn't have it takes to be successful in the field. I decided to try the CTF anyway just for fun and was able to finish everything much to my surprise. I had read about SHA-1 padding when it affected Flickr so I knew just what to do on the level that involved SHA-1 padding, which I thought was the hardest.

When I came to HN and saw a lot of people I admire talking about how hard it was, especially daeken [1], I remember thinking something along the lines of "well, I thought it was hard but not that hard", and decided to try to find a few security bugs in open source software... Best thing I ever did... In just a few weeks I found some nice bugs on both Drupal and Wordpress, got the first CVE credited to myself, and then I started to have fun (and some profit) with the various bug bounty programs around the web, most notably those run by Google (I'm currently 0x05 overall) [2] and Facebook (7th) [3].

After a year doing security work on the side I was able to quit my day job last august and now I make my living basically as a security consultant and also as a "bounty hunter". I also got multiple job offers from US companies (I currently live in Brazil).

And all of this happened only because the stripe CTF gave me the confidence to actually follow my dreams. Oh, and I still don't know if I have what it takes to be really successful in the field, but frankly security bugs are everywhere so I go ahead and keep on finding them. I'm learning a lot every single day and the mean time between bugs is getting lower and lower, which is great. So thank you Stripe. Thank you very much.

Shameless plug: BTW, I'm in the committee for the W2SP conference, so if anyone has some interesting discovery to share, please submit a paper.

[1] https://news.ycombinator.com/item?id=4424299 [2] https://www.google.com/about/appsecurity/hall-of-fame [3] https://www.facebook.com/whitehat/thanks [4] http://www.w2spconf.com/2014/

Yeah, I have both and I love them, can't wait for the third T-shirt :)

Cool, it'll be a good learning experience. The ones I mention in the blog post are a good start — revealing more than that would be telling, though!

I had little to no experience in the last CTF and managed to progress through roughly half the stages from memory. You can research as you go, and it's all good fun.

That's really interesting. They might use Bitcoin somewhere in the backend to move funds around. If it's cheaper and faster to route everything through Bitcoin than exchanging currencies and dealing with bank transfers, it might be a good solution.

I think it's because it's a high profile distributed system. I bet there's a problem that's similar to a toy bitcoin algorithm.

Nope, none planned. (We don't have any engineers based there.) I'd be open to a community-organized event if someone's excited about hosting though — ping me at gdb@stripe.com.

Absolutely -- though experience will definitely help you if you want to compete, we've tried to make the levels educational too. There'll be plenty of pointers and hints, and there will be lots of people around IRC. There are also IRL meetups if you're around SF, Boston, or London.

What do you mean by new algorithms? The post mentions Raft and Paxos. Only Raft is new. And Sebastian Kanthak said during his Google Spanner talk:

"Our Paxos implementation is closer to Raft algorithm than to what you'd read in Paxos paper which is… horrible."

http://www.infoq.com/presentations/spanner-distributed-googl...

> Why is the valley crowd treating distributed systems engineering like it's a new fad?

There's certainly been a lot more interest lately in building distributed systems, and in certain models mostly related to databases. I think a lot of this has been pushed by a few companies with an interest in either pushing these fields forward or being known as experts. A good example might be Basho, who've generated a lot of buzz around the Ricon conferences and the Think Distributed podcast.

To be clear, I think this is a good thing. I personally think distributed systems are a really interesting topic, and a big swell in interest generates discussion and lots of interesting reading material. :) Granted it also generates a lot of faddishness and crap, but that's the price of any kind of wide interest in a topic.

And really, while there's some crap out there, a lot of it's actually really good. I've been enjoying aphyr's recent blogging about Jepsen, a lot of the recorded talks from Ricon West were really interesting, and there's been some good discussion on Twitter and lobste.rs related to these topics.

So sure, the valley might be treating this like a fad. They also do that with *.js and obscure editor plugins. :) But in this case I think that's not a bad thing.

Do you get negative points so that the font color is light grey?

Is that because your words are a little bit challenging?

I'm with you. Distributed Computing is not new, especially it's not only about a couple of algorithms. But looks like folks here are only familiar with the algorithms, such as the algorithms used by Google.

Actually Distributed Computing means a lot more than that. I'm going to write some blog about that, but not quite ready yet.