They probably learned routing algorithms and buffer overflows way before they started reverse engineering firmware; they’d have to actually.

Posted at 7:31 am on Dec 30th, 2008 by TJHooker

amazing bootmii demo video:

Posted at 7:37 am on Dec 30th, 2008 by Zamadatix

Impressive, seeing the focus of there groups, I’d bet these guys might also be younger then the rest of the other folks attending. I’ve seen both groups work and I’ve yet to be disappointed.

Posted at 6:20 pm on Jan 1st, 2009 by blizzarddemon

There were no buffer overflows.
Challenges / services:
- insecure setups / “trojaned” configs
- An Ada service with a rather obvious backdoor (and some less obvious) + a search flaw which led to revelation (and therefore retrieval) of flags.
- A real funny perl implementation of BASIC as a CGI-handler. It had some unsanitized open()-calls which enabled arbitrary file reads, command execution through pipes, etc.
- Some Ruby web service which I must admit I didn’t understand much of.

[I might have missed one or two there, but you get the concept. There wasn't any "real" overflow-stuff]

Your age comment is ridiculous, blizzarddemon. Those guys won because they were quick to grasp the system setup and develop methods for systematically collecting the “flags” (hashes) from the other contestants and because of their ability to navigate through the treacherous config files (those were causing our team, the Janet Reno Redemption Fund, real problems – I think three hours passed before we *found* the last two services), not because of their age. I’m 15, and I think the oldest person in our team was 40-something, so we had the whole range covered – so why didn’t we win?! ;o)

Posted at 11:17 am on Jan 18th, 2009 by Pragmatk