Back to Back | KOM Cloud Service

Wednesday we won the day by 5.3 seconds. Thursday we won it by 26.9, and we stayed on top of the whole event.

09:00

The four file lanes went like this:

Root of Trust (mobile): all three modes by 7.9 seconds. 1st on all three boards.
Deflated Ego (warmups): the new layer was Base64 over zlib. All three by 9.0.
Next, Next, Finish (script): all three by 11.9.
Main Character Energy (metadata): the question asked for a Java archive’s main class, a field we had never been asked for before. Right on the first try, all three by 12.7.

Twelve of twelve on the first try, done in under 13 seconds. On Monday the file lanes took 293.

The web

Two web challenges, and both were techniques this event had not shown us before: Forged With Care was cross-site request forgery, and Uploading Expectations was a file upload. Uploading Expectations’ Single Solve was CORRECT at 22.1 and Forged With Care’s at 33.1, and both were done with all three modes by 56.3 and 62.7. First blood on five of the six web boards; OscarsWorld beat us to the upload Mastery by 2.2 seconds.

The binary

Bridge Troll was the critical path, for a reason that still makes me laugh. Of its 27 open questions, 26 asked about things we had already solved on Days 15, 16 and 21. But the wording had changed, so none of them read as familiar. The one truly new question asked for the file’s format from a fixed list of choices, and the right choice was spelled differently from the answer an earlier day had accepted for the same fact. The Single Solve was CORRECT at 52.8, the Time Trial at 78.6, and the last check of Day 22 was the Mastery at 89.8.

team.dev did Bridge Troll in 25.3. We were 3rd on all three of its boards.

At 09:03 I wrote: “Great job though, we’re in 1st again!”

The record

From the public scoreboard, Day 22, all 21 checks:

Wizdumb 89.8 seconds, 1st of 91 teams that finished everything.
OscarsWorld 116.7, NyaSEC 212.5, im1ssher 252.6, ampinfosys 273.0.
First blood on 10 of 21 boards: all three on Root of Trust and Forged With Care, the upload Single Solve and Time Trial, and the warmups and script Single Solves.

And overall, 1st of 1,476. 88 teams have all 1,220 points, so it goes to whoever banked their last flag first. Ours landed at 09:01:29.8 and OscarsWorld’s at 09:01:56.7. Wednesday night our overall lead over crash was 5.2 seconds; tonight it is 26.9 over OscarsWorld. Nine days to go.

The afternoon

At 10:23 I said what the afternoon was for: “Make no mistake, we are laser focused on the same primary goal, that hasn’t changed. I’m just looking to try to get near the top on some of the leaderboards again.”

So in the evening I went after the individual boards with ranked Time Trial and Mastery reruns. The first ten were all CORRECT, from 0.66 seconds on our clock for Deflated Ego’s Time Trial to 5.6 for Stored for Later’s Mastery, whose board time was still 65.6 seconds from race day. More of that tonight.

Tech tips

Cross-site request forgery

A site that changes a setting on a logged-in user’s request, without checking that the request came from its own page, can be made to change it from anywhere. The attacker’s page sends the same form, and the victim’s browser adds the session cookie. The defences are an unguessable token in the form plus a check of the Origin, Referer and Sec-Fetch-Site headers.

File upload

An upload form that trusts the file’s name or type, or renders what you send it, lets you put content on the server that the server then treats as its own.

The answer has to be on the list

Some questions come with a fixed list of accepted values. Day 3’s format question took free text, and PE32_CLI was right. Day 22’s took a choice from a list, and the right choice was pe_cli. Same fact, different spelling.

JAR manifests

A Java archive is a zip with a text file at META-INF/MANIFEST.MF: Name: value lines, with long values wrapped onto lines that start with a space. Main-Class names the class the JVM starts. The new reader joins the wrapped lines, keeps the main section, ignores the per-entry sections, and turns every attribute into a field the lane can answer.

Same question, new words

Bridge Troll asked 26 questions we already knew, in words we did not recognize at first. The fix was not 26 new readers. It was teaching the matcher both phrasings, so the old readers answer. When a lane suddenly knows nothing, check whether the questions are new or only the wording is.