Description

The year is 2022. Gunshots shattered the night. A witness caught a glimpse of a vehicle at the scene — a Tesla, they claim? The investigators on the case firmly believe this incident is affiliated with a clandestine criminal group that has eluded them for years... You are given the police reports and a backup of the car's logs. Your technical expertise is needed to move the investigation forward!

Download the challenge files (prologue) (sha256: e95deeb7202cc10786f767f83644291bd76958d86e2d311c4e93efade85b75cd)

Your are mandated to conduct an investigation on this group and ultimately retrieve a validation e-mail ([0-9a-f]{16}@sstic.org).

Once you have found this address, in order to confirm that you solved the challenge, you must:

• first, send an e-mail with the name you want to see appear in the speed leaderboard;
• after that, send a write-up to the same address before the end date.

Intermediate flags (SSTIC\{[0-9a-f]{64}\}) can be found after solving each chapter (step). You may submit them on this page if you're logged in, although this is not a requirement for entering the final leaderboards.

Important advice regarding the prologue: don't overthink it! Just carefully read the elements you are given — these clearly suggest what you should look for in the context of the investigation. As mentioned right above, an intermediate flag can be found after you solved the prologue; you are not necessarily looking for a SSTIC-formatted flag right away. Immerse yourself and try to answer what you're asked!

Update (2024.06.24): we released a static build of the challenge's website (which was supposed to be found at the end of the prologue) where you can find all challenge descriptions and files for offline solving:

• Step 1
• Step 2
• Step 3
• Step 4
• Step 5

Prizes

There are two distinct leaderboards: speed and quality. The speed rankings will be updated over time as we receive validation e-mails.

The quality leaderboard will reward the most detailed, elegant and best-written solutions. Therefore, even if you are not among the fastest finishers, you can still aim to win a prize by writing a high quality report. The winner of the quality category will also be offered the opportunity to give a talk about the challenge solution during the SSTIC conference.

The top three of each leaderboard will win the following prizes:

• 1st place: Gigabyte G27QC + an entry ticket for SSTIC 2024
• 2nd place: Steelseries Apex 5
• 3rd place: JBL Flip Essential 2

Please note that in order to be eligible in the speed category, you must still provide a write-up for the challenge, even if you do not wish to take part in the quality category.

Important update (2024.05.07)

Exceptionally this year, in an effort to give more participants a chance to compete in the quality leaderboard and showcase their work, we will accept incomplete solutions as long as they cover at least up to Chapter 3 (included). Solutions that also cover chapters 4 and 5 will be favorably considered. These can be sent to challenge2024 at sstic.org.

Leaderboards

All dates are GMT+2.

Speed category

Quality category

Additional solutions

• Jean-Bernard Beuque: 2024_WriteUp_jbbeuque_Step1-3.pdf (steps 0 to 3)

Rules

• The challenge is open to all individuals, except members of SSTIC's steering and program committees, as well as members of the Thalium team.
• In order to be eligible, participants must find an e-mail address ([0-9a-f]{16}@sstic.org), send an e-mail to this address, and then send a write-up of their solution to the challenge before the end date of the challenge.
• Write-ups shall be written in either French or English, and be as detailed as possible. They will be evaluated by a judging panel consisting of both the challenge authors and SSTIC's steering committee.
• The challenge runs from 29/03/2024 16:00:00 GMT+1 to 21/05/2024 18:00:00 GMT+2.
• A participant may compete in both categories and win multiple prizes.
• This is an individual challenge: teams are not allowed to participate. However, the "call-a-friend" option is tolerated.
• By submitting an entry, participants agree on having their solution published on this page and associated to their name (or pseudonym).
• In order to claim prizes, winners are required to share their identity with the STIC association.
• The challenge may be extended if there are less than three valid solves.
• Do not attack the challenge infrastructure in any way. There is no need to run automated tools such as scanners.

Contact

Please write to challenge2024 on domain sstic.org for any question or issue.

Root

Challenge made by the Thalium team (part of Thales group):

• Valentino Ricotta
• Anthony Remy
• Tristan Loaëc
• Maxime Turlure
• and a few other anonymous collaborators ;)