VMs Posted and The Future

The VM used for the game has been posted. Included in the distribution are the PDFs handed out to players and a README which has the username and password needed to login. There is also a bug in the VM that we never got around to fixing that requires one command to be run to start up all the jails on the VM. Please seed the torrent if you can.

With the VM posted our work for this year is pretty much done. With nothing left to do for this year I've been thinking about the future of Hack. I really don't know how much further we can take the puzzle concept while still keeping the game fresh. One idea I had is to change the game completely - instead of one VM with people hacking on it we would give out one VM per team and we hack it while others defend it (an idea inspired by something done years ago at Defcon by the Ghetto Hackers). The idea is that they can't just drop all traffic to the VM. Our code would make sure it's the VM and then exploit it using custom exploits we come up with. The defenders have to either patch the vulnerability or manage to convince our code that the VM is there while it's actually a replacement. I'm not sure this will work since our goal has always been to provide a short (2 hour) burst of fun and easy entertainment before we go drinking. The kind of work I'm talking about would be fun but may be a bit much for the goals we have.

The other piece that has been discussed internally has been the scoreboard. This year we got slammed with attendance and getting scores recorded was more difficult than it should have been. There is talk of expanding the scoreboard to work on mobile phones so that we can easily update scores during the game.

Of course, this is all just talk at this point. We want to encourage people to give us new ideas so please mail me your ideas and I'll make sure they get out to our mailing list.

One last thing is that while I will remain on the HoH list (unless Chris removes me) I do not intend to participate beyond forwarding any mails I get. I'm going to take the couple of months leading up to next years conference and enjoy them by working on other projects. I'm not sure what this means for the future of the game but with this post I've made my ideas known and leave it up to the rest of the team to figure out where to go from here.

So Long, and Thanks for All the Fish.

-- WXS

The Good, The Bad and The Ugly

I had a nice post written up that listed everyone individually and thanked them for all their hard work this year, but then my browser decided that crashing was a better thing to do than posting. I'll just say thank you to everyone who helped prepare/run the game this year. Thank you to anyone who played in it this year. In the upcoming week I hope that the VM will be cleaned up a bit and a torrent posted. When that happens I'll be sure to post a link here. I also plan on putting together a post which details my thoughts for the future of HoH and hopefully encourage some kind of discussion on it.

The Good:

This year we had some new things to the game. I think the wireless webcam (not sure if anyone actually cracked it) was a great touch, as was the phone and player attempts to social engineer their way into the building. A few hours before we went live with the game we decided to expand to allow everyone who signed up to play (the waitlist was 20+ people long). Besides some user error during the quick reconfiguration of the systems things went amazingly well with the last minute changes.

The Bad:

From my perspective I only noticed a few minor bugs. The entire "Binary Analysis" section was supposed to be on the www.evil.corp box. It ended up on ns1.evil.corp because that had a web server running on it a few weeks prior to the conference, and I had put the binaries there. When Fotios moved from ns1.evil.corp and set up www.evil.corp he moved everything over except my binaries (since he wasn't sure what they were). I didn't notice this until the game was started and I didn't feel like moving them during the game.

We had a minor problem with the link between the two switches going off-line for a few minutes while we tracked it down. This wasn't such a big deal.

Because we expanded the game to 40 people we had no way to fit that many people - plus team members in some cases - around a few tables. As such we just decided that sitting on chairs would be the best option. It turned out that we got absolutely slammed with people and we will have to reconsider how to configure the physical layout better for next year.

The only other bug I'm aware of was involved with the last row of the scoreboard not being saved properly. I believe Gentooooooo9er (he wrote the scoreboard entirely on his own and I liked it so much that we went with it during the game) has fixed this bug already.

The Ugly:

Jordan's Tequila Face

How'd They Do That?

First, we all put on our white lab coats and safety goggles, and retreat for several months into our secret laboratory (pronounced luh-bor-uh-tree) to concoct devious puzzles, scheme, and generally test our plans for hax0r gaming domination.

Well, not everyone wears a lab coat, they're optional. But safety goggles are a must. We don't want OSHA shutting us down.

Alright, alright, I'll tell the truth, but only because I'm feeling truthy this evening.

We do start planning several months in advance, that wasn't an exaggeration. An event like Hack or Halo doesn't just come together in a couple weeks time. We are all pretty hardcore about learning from past experience, so after HoH4 we started discussing what went well and what we'd like to see us do differently the next year. And as early as July wxs was kicking around new ideas on how to structure the Hack side of the game with folks.

In October, Compton officially put together the HoH5 team - several familiar faces as well as welcoming a new member to the Hack side of the house and we started planning in earnest. wxs and his team are hard at work on Hack. a few months ago Compton and I met with a member of the XBOX team at Microsoft to learn more about how the NXE is going to impact Halo 3, so we can start planning tournament structure and implementation. At present we are still planning for a bracketed tournament starting with 64 players in 5 minute 8 person slayer elimination rounds until we are down to the final four Spartans… And mjxg cranked out a new tshirt design and a totally badass poster for HoH5. Remember how awesome our posters and t-shirts were last year? Yeah, that was mjxg's handiwork too. Who knows what else we had him design this year...

So all this work goes in before any one of us boards a plane for DC (or hops on the Metro, as the case may be). Once ShmooCon starts, we are all working like crazy at the booth to make sure HoH recruits players and runs without a hitch. You'll find me, mjxg, and compton signing people up for HoH. The Hack crew are all behind the booth making last minute tweaks to the puzzles and testing everything again. And again. And sometimes again. We do a dry run of the event Friday night, where we load all the gear into the room and light it up, testing to see that it works as expected and iron out any execution wrinkles that will cost us precious time on game night.

What's that? You don't know how game night runs? Oh my, we haven't really explained that at all yet, have we? There will be some changes this year, but the basics remain the same. HoH is Saturday evening, after the talks are done and before the party. You can Hack or Halo. If you want to sign up to do both that's fine, just don't whine to wxs about how you lost time on the Hack puzzles because you were busy shooting it up in Halo, or make excuses to me about why you missed your Halo timeslot because you were so engrossed in the DDA exercise in Hack. Only a master of time management can transcend the Hack or Halo experience, turning it into Hack AND Halo, young Padawan. Announce winners at end of game we do*. However, our fabulous prizes are not handed out until ShmooCon closing ceremonies on Sunday. Oh yeah, one other thing… Spectators at HoH are encouraged, but so help me, if you walk in front of one of the Halo game screens while people are competing I will subject you to the verbal equivalent of a gravity hammer and mercilessly berate you and say not nice things about your intelligence.

Game on...

-KxP

*DISCLAIMER: Last year (Or maybe it was the year before. I'm not sure) we didn't know the winner until Sunday morning because we had to figure out who had the most boxes, and then when we looked at the score sheets we saw there was a 4-way tie. We had to determine when each player solved each puzzle in order to calculate who did it fastest. So we may not announce the Hack winner Saturday night, even though I just said in a bad Yoda impression that we would. Not valid in AK or HI. Batteries not included. Your mileage may vary.

I hinted in an earlier post about some changes going into the game this year. I've already mentioned that we are going with a single round of 1 hour and 50 minutes. The game will support 40 simultaneous people this year, which is double our usual capacity. We've also gone with the same number of obstacles/goals/puzzles so people won't feel as pressured as before.

We are throwing in things that we have done in the past but are putting new spins on them. One thing we are making sure to do this year is to get more of an interaction between the staff and the players. The staff are no longer just judges but are fictitious people involved in the storyline whom you can try to social engineer information out of. Doing so may get you an answer to something but it will not get you a point for it, so use it only as a last resort.

There's a lot more in store for this game so remember to come prepared for anything (and I do mean anything).

-- WXS

What to Get the Geek Who Has Everything

Tickets to ShmooCon of course.

Round 2 sales start Monday December 1st at noon EST (that's 9am on the west coast, you hippies) with 520 tickets being made available. All 510 first round tickets were gone in under 48 hours, and if you miss Round 2 you will be locked in browser refresh hell on January 1st competing for one of the final 220 tickets (Round 3 sold out in < 5 minutes in 2008).

-KxP

Thanks.

HoH has an official crew of 9 hardworking volunteers, but every year lots of other people on the ground at ShmooCon help make the event happen, and lots of people have helped build it over the years.  Special thanks to Guido, Janitor, Dandar, Hash, Carson, Shroeder,  Schmitty, Stepto, Little Bobby Tables (yes, again), Gentoo, the legendary Freshman and the one and only Heidi Potter.

I'd also like to thank all of the HoH 2009 staff, who are all already hard at work on this year's event.  Each year the staff really goes above and beyond, and if you enjoy the games, you should make a point of stopping one of them and thanking them.

And finally, I'd like to thank you.  We've had years of great support and participation, and I want to thank everyone who's been a part of that.  You're what makes HoH what it is.

Happy Thanksgiving.

-c

A Brief History of HoH (Sorry Mr. Hawking)

Hi. My name is Wesley Shields (WXS) and I happen to be the guy who has inherited the Hack side of Hack or Halo for the past few years. I should probably give you some long and boring post about me but instead I'll give you a brief summary of the history of HoH and where we are taking it this year. In future posts I will be giving information about what you can expect from this years game.

Hack started off as a drag-race: plow through as many targets as possible in a very short time period. We had a lot of hacks in place to make this work seamlessly and it wasn't sustainable nor very interesting for our players. I mean, honestly, who the hell wants to maintain some patch to Linux (or was it VMWare) to do some of the insane tricks we did? The scoreboard code ran only once and has never been able to work properly since, and the whole concept just seemed very rushed. My contribution was to port some of the trigger mechanism over to Win32.

When I took the reigns at Shmoocon III I decided to advocate for a longer game using something I was inspired by at Defcon 7 (a series of puzzles). This worked well for Shmoocon III. The reaction to the change was very positive and many people commented on the fact that we made the game fun instead of overly challenging. For Shmoocon IV we repeated the puzzle-based system but this time got some gear and help from our friends at Whitewolf Security. One interesting that we noticed was that because we had released as much of the puzzles (read: everything that wasn't Windows - which was like 95% of the puzzles) to the world some people had studied the unsolved ones. If there is one thing you can expect from a group of hackers it is that we are lazy. So studying the previous years system turned out to be a good one because we repeated the unsolved puzzles for Shmoocon IV.

So that brings us to this year: Shmoocon V. We are going with a puzzle based game again, but this time it will have a twist. We are loosely tying things together with a story. I hesitate to call it a series of puzzles because they are all loosely related; as opposed to our previous two incarnations where none of the puzzles had anything to do with each other. I think going with "goals" is a much better description of this years system. This one has a clearly defined starting point, any number of ways to go about reaching your goals and a clearly defined ending point. To further make things interesting we will be going with a single round for hack, instead of the two rounds we were doing before. No longer will you have 55 minutes to go through our game. You will now have 1 hour and 50 minutes (we need 10 minutes to clean up before we get our drink on) to go through roughly the same amount of work. We will continue to focus on making it a fun event for all skill levels. We are also going to include some interesting new challenges and possibly some things you may never have thought you would see at a hacking competition.

We will begin to build things up starting late November so you can likely expect more from me in a couple of weeks. I hope to see everyone at this years HoH. Stop by the table and say hi and join us for the best HoH ever.

Robot Roll Call

Hack or Halo crew come from all over the country, representing six states on opposite ends of the continent. We are:

Compton - Looking for the responsible adult around here? All HoH Crew answer to Compton. He has run HoH ever since year 2. HoH I-V

Dwight - Hack crew. White Wolf. HoH IV-V

Jon - Hack crew. Best hair. HoH IV-V

Jordan - Hack crew. Code Ninja. HoH III-V

KxP - Halo lead. HoH Communications Dictator. HoH IV-V

Little Bobby Tables - Hack crew. Destroyer of Web Apps. HoH V

mjxg - Halo crew. Graphic designer for uber-badass HoH t-shirts and posters. HoH III-V

Tim - Hack crew. White Wolf Security provides critical infrastructure and hardware for Hack. HoH IV-V

Tom Servo - Pithy commentary. Gumball dispensery.

WxS - Hack lead. Tasked with building the best hacking game in the world that will be both fun and challenging for every skill level from n00b to Chris Eagle. HoH II-V

We are all geeks.

In The Beginning...

...the heavens opened up and offered forth an idea: a hacker conference in DC! But what to do at this conference? Talks, of course, but perhaps there should also be some recreation that didn't punish the liver for attendees to enjoy. And yea, Hack-or-Halo was created!

On the First ShmooCon, HoH was created in the image of the King-of-the-Hill. Rounds were short, with only 7 min for each Hack round. Each hacker was given the same string of easy machines, and the one who pwned the most in their round got to keep their chair for the next round. At the end of the night, the person who'd crushed the most boxes was crowned the champion of Hack.

Halo at ShmooCon 1 was similar, with short slayer rounds of the original Halo, and the winner staying on for the next round. However, the final round was set up as something different: a one-on-one match between the player that'd won the most rounds during the night against the player who'd won the last round before the final. Confused? So were a lot of people that night.

And thus, unto the format changes were made, and they were good.

On the Second ShmooCon, the format for Halo was switched to a classic bracket-style tournament. This was easier to explain to players, and easier for HoH staff to administer. We also stepped up to Halo 2. Hack was kept mostly the same this year, but rounds were lengthened to 15 min to give people more time to break things.

On the Third ShmooCon, additional changes were made unto the Hack format. Players were divided up into two 1-hour rounds and set loose to flex their big brains in a Puzzle Box format: a large number of puzzles, attackable in any order, testing skills ranging from reverse engineering to the ability to sing "I'm A Little Teapot" in order to authenticate into a box.

Halo continued on the Halo 2 platform, but was played on shiny new Xbox 360 hardware. The graphics were improved, but so was hardware security. We discovered that moving player profiles on original Xbox games across 360's wasn't possible, leading to some tense moments and pleas for help (which thankfully prevented us from bricking the boxes - fyi, you can't just crack the hard drives and use a forensic file-copy to manually move the individual files across to the other box. Evidently files are individually signed by the box on which they're created), a lot of mid-game profile creation, and ultimately, a new staff member for HoH4.

On the Fourth ShmooCon, Halo 3 had been released. And verily I say unto you, there was much rejoicing. And high-definition head shots. The final round was utterly amazing. The last spartan standing out of an original field of 64 players, 'Zeff' was an absolute animal and set a new HoH record for number of kills in 10 minutes. With just four players, he got 34 kills in a 10 minute final round. That means he killed each of the other three players an average of 11+ times each - more than 3 kills a minute. And if that weren't enough carnage, the second place contender had 29 kills. Bodies everywhere.

Hack continued along the same format as HoH 3, with 23 puzzles and a hotly contested win. Three players all completed 8 puzzles (not the same 8 puzzles, either) so judging the winner came down to determining who solved the puzzles fastest.

For the Fifth ShmooCon, there is no resting! The Hack-or-Halo team is creating a whole host of new excitement for our latest outing. But we won't be giving away those details just yet....

-compton

First Post!

In a world where moose roam free, where people are generally encouraged not to shoot each other, where breaking things is still frequently illegal, one competition dares to buck the trend...

Hack-or-Halo is returning for a fifth year, and this will be the biggest, most puzzling, most destructive, highest body count version yet.  and of course only ShmooCon offers the #1 hacking-plus-gaming event in the galaxy.

So start working on your puzzle solving skills, and get your trigger finger back into shape, because Hack-or-Halo is coming...  and over the next few months, watch this blog to learn more about how this year's event is going to work, as well as learn more about the behind the scenes preparation for HoH.  And if you keep your eyes sharp, you may even notice a clue or two that'll help you out for this year's game.

As for me, I'm compton, ringleader of this circus.  I've been involved with running HoH since the beginning, and been in charge since year 2.  I'll be working with our crack team of miscreants to bring you yet another year of misbehavior.

As always, remain vigilant against threat of moose.

-compton

Director of Misbehavior & Chief Kitten Herder

Hack-or-Halo