Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Building Engineering Culture Through Capture th...

Building Engineering Culture Through Capture the Flag Activities

More Decks by LINEヤフーTech (LY Corporation Tech)

Other Decks in Business

Transcript

  1.  3FTQPOTJCMFGPSEFWFMPQNFOUBOE PQFSBUJPOPGUIF4UJDLFSNFTTBHFGFBUVSF JOUIF-*/&"QQMJDBUJPO  -*/&$PSQPSBUJPO 4FSWFS4JEF&OHJOFFS  -*/&$PSQPSBUJPO &OHJOFFSJOH.BOBHFS

     -:$PSQPSBUJPO &OHJOFFSJOH.BOBHFS  -:$PSQPSBUJPO 4FOJPS&OHJOFFSJOH .BOBHFS "CPVU .F .BUUIF X #BJMFZ
  2. • *OWFTUJHBUFBTBNQMFBQQMJDBUJPOPS GFBUVSF • &YQMPJUBTFDVSJUZWVMOFSBCJMJUZUPGJOEB TFDSFUTUSJOHDBMMFEB GMBH • *GUIFEJTDPWFSFETUSJOHJTDPSSFDU UIJTJT

    QSPPGUIBUUIFQBSUJDJQBOUTVDDFTTGVMMZ GPVOEBOEVTFEBTFDVSJUZWVMOFSBCJMJUZ • 5IJTJT)BDLJOH1SBDUJDFBOEDBOCF VTFEUPUSBJOBXBSFOFTTPGTFDVSJUZ DPODFQUT 8IBUJT$BQUVSF5IF'MBH $5' 4FDVSJUZ4LJMM%FWFMPQNFOU
  3. &YBNQMF$5' - The flag is displayed after successful login -

    In CTF events that contain multiple challenges, there is often a common prefix for flags, in this case "techverse_", and this prefix can serve as a hint to participants
  4. &YBNQMF$5' - The flag value is confirmed by the facilitator,

    or by a judge server - In the case of a judge server and multiple teams participating in the event, you can make a scoreboard etc. - If there is a scoreboard, it's common to reward more points for more difficult challenges Facilitator Judge Server
  5. &YBNQMF$5' What do we learn as engineers? - View Source

    feature - Develop in a way that prevents testing code from going into production
  6. CTF as an equalizer • No matter how much experience

    you have, there's always something you haven't learned or tried before • Experienced team members don't have all the answers • CTF can demonstrate this • Experienced team members can guide about how to learn and investigate Preparation •CTF can help us be prepared for real work scenarios Creativity •Not only solving, but also making interesting CTF challenges requires creativity $POOFDUJPOUP&OHJOFFSJOH$VMUVSF
  7. • Capture the Flag events are active and represent "do"

    as compared to "tell" • The facilitator learns how to give hints and guidance without giving the answer • Effective hints are often given as questions that need to be answered, rather than as statements about the challenge • Participants learn the engineering and security concepts needed to solve the challenge, and also learn "what questions to ask" when doing an investigation $POOFDUJPOUP&OHJOFFSJOH$VMUVSF
  8. 4VNNBSZ - 4UBSUXJUIBQBDLFUDBQUVSF GSPNBTFSWFS"1*XIJDI DPNNVOJDBUFTPWFS6%1 XJUIEBUBUIBUJTOPUIVNBO SFBEBCMFJOUIFQBDLFU - *EFOUJGZUIF"1* QSPUPDPM

     BOEXIBUJUJTEPJOH - $SFBUFBDMJFOUUIBUXJMM DPOOFDUUPUIF"1*BOE EPXOMPBEB1%'GJMFXJUIUIF GMBHJOJU 1BDLFU"OBMZTJT -FBSOJOHT - 1BDLFUDBQUVSFBOBMZTJT - 6%1CBTJDT - $SFBUJPOPGBDMJFOUUIBUVTFT B6%1DPOOFDUJPO - "HHSFHBUFEPXOMPBEFEEBUB JOUPBGJMF
  9. 4VNNBSZ - 4UBSUXJUIBCJOBSZUIBUDBOOPUCF SVOPOZPVSPXODPNQVUFS - "TBIJOU QBSUJBMTPVSDFDPEFJT QSPWJEFECVUBLFZNFUIPETDPOUFOUT BSFPNJUUFE -

    *EFOUJGZUIBUUIFCJOBSZJTGPSBO*#. 4ZTUFNNBJOGSBNF - 6TFWJSUVBMJ[BUJPOUFDIOPMPHZUP DSFBUFBOFYFDVUJPOFOWJSPONFOUGPS UIFCJOBSZ - 6TFBEFCVHHFSTVDIBT(%#UP JOTQFDUUIFNFNPSZPGUIF BQQMJDBUJPOBOEFYUSBDUUIFGMBH 7JSUVBMJ[BUJPO -FBSOJOHT - 6TFPGWJSUVBMJ[BUJPOUFDIOPMPHZUPTFU VQB7.XJUIBEJGGFSFOUBSDIJUFDUVSF - 6OEFSTUBOEIPXBOEXIZUIFSFBSF EJGGFSFOUCJOBSJFTGPSEJGGFSFOU BSDIJUFDUVSFT - 6OEFSTUBOEUIBUUIFGMBHJTJONFNPSZ BOEIPXUPJOTQFDUBOEBDDFTTJU
  10. 1BSUJDJQBUF • +PJOUIF$5'TBTBQBSUJDJQBOU • 4USVHHMFXJUIUIFDIBMMFOHFT MFBSO BOEIBWFGVO • 4IPXUIFUFBNUIBUJUT0,UPOPULOPXUIJOHT &ODPVSBHF

    • 1SFQBSJOHBOEKPJOJOH$5'TUBLFTUJNFBOEFGGPSU • 3FDPHOJ[FUIFWBMVFJOUIJTBOEFODPVSBHFNFNCFST • 1SFTFOUDPOUSJCVUJPOUPPSHBOJ[BUJPOBMDVMUVSFBTBDBSFFSPQQPSUVOJUZ $POUSJCVUF • %FWFMPQDIBMMFOHFTZPVSTFMGBOEHVJEFUIFUFBN 8IBU4IPVME8F%P"T.BOBHFST
  11. .BOBHFST • 5SZJU.BLFBTJNQMF$5'XIJDIJTSFMBUFEUPZPVSPSHBOJ[BUJPOPSUIFUFDIOPMPHZ ZPVVTF • (FUUFBNNFNCFSTJOWPMWFE • 4FUUIFFYQFDUBUJPOUIBUJUT0,UPVTFUJNFGPSMFBSOJOHJOUIJTXBZ • &ODPVSBHFUIFUFBNUPTUBSUUPEFWFMPQBOEGBDJMJUBUFUIFJSPXO$5'T5IFJS

    DSFBUJWJUZNBZTVSQSJTFZPV BOEZPVXJMMQSPCBCMZTUSVHHMFUPTPMWFXIBUUIFZ DSFBUFEr BOEUIBUT0,?@? /PO.BOBHFST • 5SZJU • 5FMMZPVSNBOBHFSZPVUIJOLJUTJNQPSUBOU PS UFMMZPVSNBOBHFSXIBUZPVUIJOL JTJNQPSUBOU 5IFZXBOUUPLOPX 8IBU4IPVME:PV%P/FYU