BSides Idaho Falls 2024 - Badge Overview and Hot Wash

e

yeah he's got foam up and that and Jonathan k

Tune In The

[Music]

[Music]

Stream

e

e

for

e

for

e

e

e

for

e

e

e

e

e e

e

e e

B

that's yep that should yeah if you project well you could just do something like this I'll uh I'll real mic

way

oh we're live all right okay sounds good hi everybody uh my name is Corey uh I'm going to be walking through through some of the badge stuff I am not a creator of the badge contest uh but I am uh an expert at digging through logs and that's what we're going to be working off of now so the analysis is actually a little bit limited so the first thing that I need is a favor from everybody take out your badge if you participated in the badge contest if you didn't that's fine we're going to generate some logs uh because this uh that's what we're working on here is pure API logs uh not actually reaching into the

database so I need everybody to open their badge and go go to the store which will then generate the API logs that tells tells the uh tells the logs how much money you have which is what we're going to use to generate the scoreboard so uh so yes open up your badge go down to the store and then that will do that so while everybody's doing that uh there's a f there's a couple fun visuals that we're going to work through uh stuff so

where the player IDs are all these heximal things so some point as we go through here I'm going to ask you oh this actually why don't do while you're also on your badge thing if you haven't done it go to the info screen which will tell you your player ID which probably starts with 28 CDC uh and ends with these various things so uh keep that player ID in mind because we're going to start to poke at some of the aggregate uh about what happened in the contest and then we will have people raise hands uh in shame or Triumph depending on what we're talking about like this first chart that we're looking at right here uh this is the

number of times that a user has bumped into a wall uh which is another thing to say that they you couldn't move or they moved into a wall uh and uh I'm just going to like you know here's day one or so because this covers pretty much the whole time of the contest right the the levels are pretty steady as we go but then it was day two somebody turned on a bot or something a few people uh wrote some some scripts so I don't know who this person is uh 16 D4 is what it ends in is that person here out of curiosity 164 who is that okay so so so uh and for for the benefit of the

recording I'll try and repeat what people out in the audience so it sounds like it's this a individual over here who had a bug in did you write a script or okay so it was a script with a bug in the script that caused a bunch of uh ramming into walls okay so that explains that one uh you fixed it well let's okay so since you're here and we're concentrating on you we'll do this we'll do a little flash investigation into what you did overall uh so here's uh yeah this this is going to be skewed so the first chart is this is just endpoints hit in general so I'm guessing about here's where you

turn that script on which is what 8 AM this morning or so uh 9 9:30 or so this morning uh and then you're hitting U probably the move API most yep that's uh that's not unexpected uh you ended with $67,000 that's pretty good with 118 walls and here is your value uh over time uh as you uh so it looked like uh your script was effective uh because that's what jumped up your value uh as we went um but uh let's go back and actually let's do uh do you guys want to do the final reveal of who won first or last okay I heard a mix but I think most they last so we'll go with last uh so

we'll just explore a couple more other things so let's see uh so that one's interesting how about who is the uh let's see not that one who robbed the most oh who failed the most at robbing let's do that one okay so this is a chart of the a couple people had some really good uh some good tools running on the second day here um so this is yeah the the most uh robberies failed so let's see the first day I think the champion is probably this one which was consistently about here does anybody know what player is this do we have 3E 5f okay uh did you have a script running wow

here's your value over time uh which then value sometimes goes down if it gets spent on things honest that part a little unclear on because I didn't build it uh but um and then let's check over here for the Champions on day two 6 D4 is one of them uh 755 is anybody is anybody 755

of houses and failing only ending with $10 so that one uh that one didn't make it all the way um yes crime does not pay uh but actually it does in this game uh so most successful robbers let's do this one so this is a Triumph here these are the most successful robberies uh throughout the entire contest which this my crunch for a second uh three okay so the champion most successful robber by quite a bit compared to second place is 3 e5f which uh which is the uh the the one we were just talking about with a consistent application 164 and this is the number of successful robberies not the amount of money that

was taken uh in the robberies um is there uh let's Che a couple other ones that we had maybe oh yeah actually sure let's do that so um so for those who don't know so the logs that we're looking at let's just look at at a raw example um API requests so here's an example of uh give me just a second

uh it is uh not Apache logs do this [Music]

whoops it's just it's just

okay let's try again okay

so okay we'll just look at 10 of these as an example so here's yeah here's what the logs look like uh and I've pretty formatted them which if anyone was in the workshop I learned something about our own product uh and that we could even do this because I had no idea so uh so yeah so this is an example of the of the type of logs that we're looking we got to see the request uh which includes the method the endpoint and the path uh that the player was hitting where the request came from uh and then uh headers that they're put in uh the xapi token header uh is the security header which is reacted so

I'm going to Pro tip that I'm going to repeat from the logging Workshop don't put credentials in your logs that's pretty important so good job for the uh organizers to redact that and then you get some response information like the status code of the response some information coming back about that uh and then this is pretty much what're we're analyzing uh for all of the analytics that we're doing today uh or at least as as an end to the hot wash uh so like here's one where somebody what somebody attempted to leave a house and the server responded you aren't in a house so success false uh we can take a look and see if

there's a couple other ones so this is somebody moving and the response from the server is yep okay you're at this new location and there's some stuff around you uh type thing so that's what that's what we're doing when we're analyzing this so we're not connecting up to a database um that is uh uh mostly because the organizers of the badge contest aren't physically here uh due to some conflicts uh unfortunately so uh as we're doing this aspect of the hot wash and looking at how the game went it's pretty much just log analysis uh for how we're doing this so we're doing it all on the Fly which is why I had to ask you

all to open up your store and why don't we do that now let's go to the final scoreboard and see how things did so our top our top first place winner is 1686 anybody here over there on the right side uh stage stage right stage left there's our first place winner with almost $300,000 in total value which uh the value can be split between the actual raw cash that you have and the value of your walls that you have created uh and this one is par how many walls did you build okay so the script has a loop that goes through and places a wall absolutely everywhere that could be placed in fact why don't we take a look

at your at your dashboard uh so this is the first place winner uh with yeah a bunch 40,000 walls which is pretty good uh okay look at this though okay this I I I find this interesting uh and and your script so but you got all the dollars at the end so look your dollar count went way I'm just going to get total value out of here so we're looking at Dollar count so your dollar count went way up and then way down because you spent it all on walls and then you got a bunch of dollars again at the end because you because you just sold them all okay so at the very end liquidating the walls

maximize the cash value that's smart that's smart uh okay and then our second place which you know I'm kind of doing this opposite since really we're supposed to go second third place second place 164 who's 164 okay uh that was our same script that was bumping into walls uh aimlessly uh was beneficial for second place uh and then 16 BC is our third place winner here 16 BC looks like not present uh but that's okay um and did first place ever get robbed uh oh that's a good question and and I can answer that question uh let's see so especially if I go to uh I think we had like robberies most robbed players here let's

look at this one which players have been robbed the most uh so this one was a little tricky to put together from logs perspective because we had to so first we're going to search out the logs to find out which house is yours and then we're going to figure out which house got robbed because there's no actual direct connection between the people in the houses so whoever was 173b you were successfully robbed 15 times which is not very not very great um and then what wait I guess I'll just kind of do it the cheap way instead of the smart way here uh for oh what this isn't going to work oh I thought this i' be I thought

I'd be able to find that within here but that's not working okay so let's see so we want to see if the first place was ever rough just out of curiosity so then if I say uh I tell you what let's just do this oh wait that would be the players doing the robbing that's an interesting question uh that I will attempt to do not live on the stage right now uh and come up with the answer uh later um and I think yeah that's those are kind of the the fun ones uh there's a couple other ones like yeah uh poorest players ended up because there's a bunch of accounts that pretty much never got any money uh so then that

one's there but uh uh wealthiest players most movement totals by player ends up looking a lot like bumping into walls uh because uh that's there um but yeah if you so if anybody wanted to get in and play with these logs you are absolutely okay to do that if you go to this URL which uh I'm not sharing because this is full screen if you go to Graw well. bsid does uh you can log into gravel instance with the username of shared and the password of password uh this is this is however a kind of not all that big uh small instance uh so it doesn't have a lot of horsepower behind it so if everybody's

running search at the same time it'll be fine but if it uh if it's uh slow just give it time or press F5 or refresh or whatever uh but I don't know how long this is going to stay up but you can take a look at all the logs that occurred throughout the event yep was there an endpoint that reset the entire leader board uh not to my knowledge uh in fact why don't we just take a look at so last year yeah which is a great question informed by last year I think because last year there was a an API that if you hit the API it deleted like the entire contest database um and that is not present on here but

uh why don't we take a look at all apis that were attempted just to take a look and see or not just attempted but all apis that were seen anywhere in the last couple days so I'm going to type for a second we'll see if if something weird shows up in the

list okay so this gives us a count of all mpoints hit and the frequency in which they were hit and then I'll just get this out of the way so I get more real estate on the screen uh okay so yes move Rob house leave house so these are all kind of the the big ones uh evicting did anybody actually evict people out of the house I mean this API was hit Times show of hands anybody actually hit the eviction API who was using that nobody well that's interesting uh and then uh you can move your Vault around a couple people did that so let's go

or is the I don't know yep

52.1

okay okay so Todd says that we're going to attempt to keep the container uh and this whole instance up for about a week so you'll have uh that much time to look at the logs should you desire um and yeah so these are the more rare ones but there there is no API that says erase everything uh that anybody could hit this time doesn't look like

okay um so yeah so congratulations to our winners again hope everybody had fun with the [Applause] contest and uh and I think we can all thank uh Todd and MLS and Roman and who anybody else who I may not be aware of for for uh for a badge uh creation and contest activity so yes thank you to the organizers and we'll kick it over to

Tiffany woohoo thank you Corey hello everyone my name is Tiffany Keller I'm the event coordinator for this year um we are getting close to the end almost there um how's everyone doing are we tired or ready to be done yes I believe the presentations that we have live streamed we're going to make sure that they stay on the YouTube channels um I believe they were part of the Joe what do you think Joseph

sorry MH

she's behind

you I believe we have most of them anybody who has presented and would like to have their slides added to their videos can contact info at bsides Idaho falls.org with their

slides yep sounds good well I want to thank everyone who tended this year it's it's been a amazing turnout um we were hoping for 300 but also somewhat not thinking we were going to get 300 but we ended up with 272 badges who are registered and 280 283 who are actually registered with 20 Walk-Ons between the two [Applause] days um now we want to make sure that we actually thank our sponsors so we had University of Idaho office of techn ology office of Information Technology they actually allowed us to do an in-kind sponsor so we can actually have this campus for free so we didn't have to pay anything for this event this location um and the Wi-Fi um

yeah that's another topic um we also have grabwell who sponsored his gold which helped you know add some more coins Andor and um CompuNet was also a silver sponsor um University of Idaho Falls or University of Idaho Idaho Falls campus so both uvi campuses uh supported us they were also bronze um CI um sponsored as bronze as well CRI um sponsored as bronze as well and we ended up with 5,000 500 so um we give a round of applause for the [Applause] sponsors they are and the more money we have the more we can actually you know expand and put more within this this community so the cost for us to put on this conference this year came close to

$88,000 so to get an idea of what we spend to make sure that everybody has shirts badges um fun things to do in the workshops make sure we have enough AV Equipment so we're not running around with chicken tens on our heads so and if you know any of sponsors that may want to help support us next year have them reach out to us um on info bides if Idaho falls.org um and if you would like to volunteer and actually be part of the organizer group um we have a volunteer page on our volunteer tab on our website you can click on that and say you want to work behind the scenes and then we can be able to grow

the community and more options to have at the conference this year or next year not this year we so can I please have all of the or organizers organizers and volunteers to please stand

up sweet these people [Applause] helped these people have helped us in many ways to make this conference run and can we get around Round of Applause but you already did it you jumped the gun [Applause] woo sure

can we would like to thank our event organizer Tiff has kept everything running ensured that all of the talks and the services and every detail was attended to for nine months as we prepared for this conference so and came today with all of the data to describe how we did it and what we achieved so Tiff thank you so much [Applause] thank you now I'd like to actually have all the attendees stand up who showed up and decided to stay with hot

[Laughter] wash without attendees like you guys we would all be sitting here talking to ourselves wondering why we created a conference so thank you so much for showing up and enjoying everything that we offer Round of [Applause] Applause so now we want to make sure we get feedback we always do this every year the hot wash not many people actually know what the hot wash is so the hotwash is a chance for our attendees volunteers everybody to give us feedback on how we're doing so as you see up here on this board green is what did you like about besides Idaho Falls and you can fill out however many forms you want we can bring more

stickies over pink is something you want changeed or that you disliked about this year now if you're going to tell me that I didn't like the restrooms I'm sorry I can't help the that one give us something that we can actually change and how to possibly change it or how you would like to see it change

so and on that note we conclude besides Idaho Falls 2024 [Applause]

woo e

thank you

sir hold on Todd we got something for you

you're still here it's over the conference is over go home

e