We're Baaaack! OSINT CTF @GrrCON
After a year of sitting inside, fighting off germs with gallons of hand sanitizer and the security expert approved N-95 mask, the light at the end of the tunnel was finally in view. With our official vaccination cards in hand, Kris and I packed our bags to head to Michigan for one of our favorite conferences. GrrCON 2021 was back on, in person, and we were ready to get right back into the swing of things with our OSINT CTF.
Post Pandemic - Learning How to Socialize all over Again
Admittedly, jumping back into this state of normalcy after quarantining away for so long was a bit daunting. I think everyone can understand the anxiety that comes with big crowds and even bigger germs as we navigate this semi-post pandemic society, but I swore to myself that I would get out of my head and enjoy this bit of freedom that we have so long awaited. This conference I was going to do three things: reconnect with friends I hadn’t seen for over a year, make new connections with people I recognized in passing from previous years but never really got to know, and just connect with new people. If anything was to be taken away from this pandemic, it is that life is too short, and being stingy with my time is just another way to waste it.
Now everyone who goes to GrrCON knows that the unofficial-official bar of the conference is Z’s. During dinner one night, one of our friends mentioned that they were going to hang out at Z’s later in the evening. After getting Kris back to the hotel, I circled back to Z’s to meet up with the friend. I was, of course, early, and it seemed as though I had arrived during a dead time. I didn’t see many people from the conference there, it was too late for those eating dinner, and a tad early for those wishing to enjoy nightlife.
As I waited for my friend, I noticed a table of guys wearing GrrCON T-shirts. Now I would like to preface this by saying I know that it is entirely normal to walk up to people in a bar and start a conversation – but security people are not usually the type that are willing to pour their heart out to you over a pint of Guinness. Even as I felt my feet taking me toward them I felt nervous and awkward – like a freshman approaching a group of friends on their first day of school. But I would not let that stop me. I introduced myself, said I noticed they were from the conference, and asked if I could join them. We hit it off right away, and at once I felt my nervousness fade away as networking instincts took over. I can’t say I’ve ever really been the type to put myself out there like that, but if I’m being honest it felt really good. When my friend finally arrived, it turned out that he knew the guys I was with, and pretty soon we were all caught up in catching up, talking security, and sharing covid horror stories. One thing I can say about the security community, we may not be the most social bunch but within our niche everyone knows someone who knows someone who knows someone else. There are no true strangers among us as we are just one big web of criss crossing lines that somehow connect us all. You start putting faces to names and names to faces and I think that is one of the things I missed most about this past conference-less year.
The Game Itself
On to the reason for the season, and gettin’ back into our annual GrrCON OSINT CTF. Those of you who have followed our blog posts know the basic idea, but to those of you who may be new, every year since 2015 I have run an open source intelligence capture the flag at GrrCON. This year, we had two volunTARGETS who offered themselves as bait for the contest. The goal is to get as much information as humanly possible within the time allotted about these targets without using any pay-services, with each question ranging in difficulty and points awarded.
This year we changed it up a bit, cutting the time of the contest in half. Initially we were concerned this wouldn’t be enough time to get any substantial point differences between teams, but we could not have been more wrong. Those competing this year went above and beyond, the winning teams racking up just as much as those in years past. Honestly, based on the results, those two extra hours would not have made much of a difference in scores anyway, because the majority of points were scored in the first half of the contest. Not only did this time crunch motivate our teams to move faster, it also gave Kris and I more time before and after to actually enjoy the contest, network, and see some of the other events on the agenda.
Next year we hope to advertise more of the post contest results, and add an official winners panel to the agenda of the conference. While we had an informal one this year, we want to increase the turnout so that the panel becomes more of a discussion, that way we can hear from not only the winners but all those who participated. Overall, though, Kris and I had a great time. We want to say a special thank you to our volunTARGETS, Mark Kikta and Thomas Somerville for letting themselves be bait, and give a shout out to our top three teams, RedTeam at Michigan Tech, Ramrod, and Cold_Root. We hope to see you all again next year at GrrCON 2022!