![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
On Being a Bluetooth Wireless CTF Fox
Aug. 17th, 2018 02:47 pmWhat my day was like. Woke up, headed down to see @IHackedWhat up chattering at a panel and giving information about the particular challenge.
I wandered the room. Then wandered the hall and other villages. Then came back to see hte panel. Sitting there I then confirmed I was not active, snafu, something with the way I sat? Went to bathroom and activated and confirmed signal.
Vegas times below.
2:45pm contest went live on twitter
I came back chatted with friends and then was checking out each table asking questions, I honestly am interested in CTFs but also know not great signal from device.
Wandered through the wall of sheep, caught up with friends in hallway, wandered back in again, and out again.
3:15 PM - Got ID’d as “are you the fox” twice verbally, but they could not say which *type* of fox, so I said sorry doesn’t count.
3:30pm - Then while on phone texting I did get activated. I waited. No one claimed. Waited. Then went back to wandering.
4:00PM - Finally after wandering more got activated and IDd and then we headed up to the table for points. The contestant who found me was totally doing a search pattern and got like 4-5’ from me before activating and IDing me.
Why did we want to know:
Article by pentestpartners over exaggerated the risk of IOD devices.
IOD has been trying to get specific data and details around the actual threat model/risk so they can be prioritized correctly. The entire project is about finding and assessing vulnerabilities and getting device and app makes to fix/improve security. So obviously best to concentrate on the worst/most impact first.
Personal background:
Using a bluetooth headset and bluetooth toys I can say my headset works across the apartment and the toys barely work nightstand to corner of bed.
Wireless CTF Contest Context:
Fox and Hound is a standard CTF game and standard terminology. Read more here if you are unfamiliar. Note the idea is to use your devices to find a specific device. They might be stationary (in flowerpot) or mobile (on people). Usually something like a radbeacon or a tile.
Although one furry volunteered to be a fox, they are NOT related. @InternetOfDongs did sass it was a “fox tail” as the person/device being hunted is a fox, and this is a “tail” oriented (he was thinking the plus with actual tails because i want one and we talk about it). It can be taken other ways and did seem to rub people the wrong way, sorry about that,
Concerns expressed online:
Word choice
As noted above, OK maybe should not have used the word tail as it bothered some people. Sorry.
Boundaries/Consent
This was optional, those contestants uncomfortable with activating the device did not need to as there were many challenges and many different foxes. I am pretty sure some teams never even considered/wanted to participate in this specific challenge and so did not.
Me, as the fox, only participated because I was OK with it.
Participants (contestants, fox) all knew what the device was, what would happen when activated and could choose to participate or not.
Possible activation of similar device on non contestant/victim.
Likelihood of someone having the exact same device (which was specified in the challenge), active, at DEF CON convention space without knowing it was a risk (from contest or non contest attendees) was low.
In addition known attenuation and decrease of range also limited any attacks to close proximity (which is what we were trying to establish, the exact range).
Targeting people / Promoting predatory behavior against attendees
As stated contest goal is more about hunting devices not people. This was one tiny part of a much larger contest and I feel it is/was unlikely to have altered or influenced anyone's feelings.
We definitely thought about “who” would be willing in gender neutral way. Male would have been just as possible as fox. Douches would still have found alternate ways to be douches to women and make them unwelcome in the space.
I wandered the room. Then wandered the hall and other villages. Then came back to see hte panel. Sitting there I then confirmed I was not active, snafu, something with the way I sat? Went to bathroom and activated and confirmed signal.
Vegas times below.
2:45pm contest went live on twitter
I came back chatted with friends and then was checking out each table asking questions, I honestly am interested in CTFs but also know not great signal from device.
Wandered through the wall of sheep, caught up with friends in hallway, wandered back in again, and out again.
3:15 PM - Got ID’d as “are you the fox” twice verbally, but they could not say which *type* of fox, so I said sorry doesn’t count.
3:30pm - Then while on phone texting I did get activated. I waited. No one claimed. Waited. Then went back to wandering.
4:00PM - Finally after wandering more got activated and IDd and then we headed up to the table for points. The contestant who found me was totally doing a search pattern and got like 4-5’ from me before activating and IDing me.
Why did we want to know:
Article by pentestpartners over exaggerated the risk of IOD devices.
IOD has been trying to get specific data and details around the actual threat model/risk so they can be prioritized correctly. The entire project is about finding and assessing vulnerabilities and getting device and app makes to fix/improve security. So obviously best to concentrate on the worst/most impact first.
Personal background:
Using a bluetooth headset and bluetooth toys I can say my headset works across the apartment and the toys barely work nightstand to corner of bed.
Wireless CTF Contest Context:
Fox and Hound is a standard CTF game and standard terminology. Read more here if you are unfamiliar. Note the idea is to use your devices to find a specific device. They might be stationary (in flowerpot) or mobile (on people). Usually something like a radbeacon or a tile.
Although one furry volunteered to be a fox, they are NOT related. @InternetOfDongs did sass it was a “fox tail” as the person/device being hunted is a fox, and this is a “tail” oriented (he was thinking the plus with actual tails because i want one and we talk about it). It can be taken other ways and did seem to rub people the wrong way, sorry about that,
Concerns expressed online:
Word choice
As noted above, OK maybe should not have used the word tail as it bothered some people. Sorry.
Boundaries/Consent
This was optional, those contestants uncomfortable with activating the device did not need to as there were many challenges and many different foxes. I am pretty sure some teams never even considered/wanted to participate in this specific challenge and so did not.
Me, as the fox, only participated because I was OK with it.
Participants (contestants, fox) all knew what the device was, what would happen when activated and could choose to participate or not.
Possible activation of similar device on non contestant/victim.
Likelihood of someone having the exact same device (which was specified in the challenge), active, at DEF CON convention space without knowing it was a risk (from contest or non contest attendees) was low.
In addition known attenuation and decrease of range also limited any attacks to close proximity (which is what we were trying to establish, the exact range).
Targeting people / Promoting predatory behavior against attendees
As stated contest goal is more about hunting devices not people. This was one tiny part of a much larger contest and I feel it is/was unlikely to have altered or influenced anyone's feelings.
We definitely thought about “who” would be willing in gender neutral way. Male would have been just as possible as fox. Douches would still have found alternate ways to be douches to women and make them unwelcome in the space.
