GeekPwn 2018 Cybersecurity and AI Contest

Las Vegas, U.S.     Aug.10 2018            ShangHai     Oct.24 2018

Hall of Fame
FAQ
Contestant Registration

Frequently Asked Questions

Q:  Who can sign up for GeekPwn? How?

A:  Anyone can sign up, as long as they’ve submitted projects, meet the required laws and ethics, and are accepted by the committee. Please find corresponding application forms here and submit. The committee will issue 2 rounds of reviews then decide if the application is accepted.

Q:  What kind of vulnerabilities will be accepted by GeekPwn?

A:  Everything from IoT, smart devices, AI to any successful security compromise have the chance of being accepted. You can learn more about our past winners and their targets through our Hall of Fame.

Q:  Who will provide the devices for the project?

A:  All the target devices (or AI products) are provided by the GeekPwn committee. The committee will purchase the target devices according to the contestants' request. The day before the contest, contestants can upgrade target devices under the supervision of the judging panel, to ensure its software/firmware meet the requirements of GeekPwn. All attacking devices are taken by the contestants themselves, including computers, software tools, hardware tools, etc.

Q:  What's the requirement for the target devices' software/firmware version?

A:  The device should be patched with official updates, and the version should be equal to or newer than the version 30 days before the contest.

Q:  Is network access provided at the contest?

A:  Yes, GeekPwn will provide a dedicated network for the project through both wired and wireless access. The dedicated network is specified for a certain project, and isn't shared with other projects or spectators. The contestant can determine whether the network is connected to the internet. Contestants can bring their own network devices as backup but they are only allowed to use them once they’ve received permission from the panel of judges.

Q:  Is there a limit on the number of submissions for a single contestant/group? Can a contestant submit multiple exploits for different products?

A:  There is no limit. You can submit as many as you like.

Q:  What if my target is not listed in GeekPwn's scope on the official website?

A:  The targets listed on the page is solely for reference/information. Any new pwning ideas are welcome.

Q:  I cannot participate this time, but I know someone who can.

A:  If the recommended application wins at GeekPwn, you will get an extra 10% of the prize as a reward.

Q:  Where can I get a ticket as an audience member?

A:  Registration is not currently available. You can follow us via Twitter(Account)/Facebook(Account) for the latest news

Q:  What's new in GeekPwn 2018?

A:  You can see the latest achievements in the cybersecurity and AI fields where extraordinary leaders in security blow your mind on the art of PWNs.

GeekPwn 2018 Contest Rules, Upgraded

Initial Prize Pool:$800,000 USD

As one of the world's leading platforms for cybersecurity researchers, GeekPwn enables security researchers and geeks around the world to share their thoughts and findings.

GeekPwn2018 will have two competition events, August 10th in Las Vegas and October 24th in Shanghai. The initial prize pool is $800,000 USD. We welcome talented researchers and geeks around the world to come to GeekPwn, and present their research results.

In 2018, GeekPwn has set up Special Challenges and PWN Everything Challenges.

Special Challenges

GeekPwn Special Challenges include CAAD Competition on Adversarial Attacks and Defenses (Las Vegas), Robot Agent Challenge (Las Vegas/Shanghai), Hacker Room Challenge (Shanghai) and AI Data Tracker (Shanghai). These competitions cover many fields like Machine Learning, Mechanic, Security, etc. We welcome participants from different fields to fulfill those tough tasks.

CAAD, Competition on Adversarial Attacks and Defenses, Las Vegas

Attack Classifiers or create Classifiers to defend attacks.>>>

AI Data Tracking Challenges (Shanghai)

Participants design AI algorisms and train them with privided data, to fulfill tasks.>>>

/  Prize  /

Prize Pool $100,000 USD

/  Description  /

CAAD (Competition on Adversarial Attacks and Defenses) is organized by GeekPwn committee, Alexey Kurakin, Ian Goodfellow from Google Brain and Professor Dawn Song from UC Berkeley EECS. The competition will open in May. It's purpose is to accelerate research on adversarial examples therefore make AI more secure.

This year, CAAD is focusing on image recognition, which consists of three sub-competitions as below. Participants can select any one to three of them to join. The 3 sub-competitions are:

Non-targeted Adversarial Attack
Targeted Adversarial Attack
Defense Against Adversarial Attack

/  Schedule  /

Registration Time:May 10th - Aug 31st, 2018

CAAD CTF Invitational will be held at the GeekPwn(Las Vegas) in August 10th. Please check rules at:CAAD CTF Rules, version 1.1If you are interested in it, please send email to us at caad@geekpwn.org before June 30th, please also introduce what you did in the area of Adversarial Examples in the email. Judges will decide the invitation list.

*More details please check CAAD official website (caad.geekpwn.org)

/  Description  /

In the age of AI and Data, we can link data from different sources together to get more useful information. For example, we can track bomb builder by analyzing location of explosions, anonymous phone calls, posts on social media, etc; we can track financial scams by analyzing historical financial records; we can track programmer by analyzing lots of codes.

AI Data Tracking Challenges will have both online and offline competitions. The results presentation and awards ceremony will be held at the GeekPwn(Shanghai) in October. Participants will need to design AI algorisms and train them with provided data, to fulfill tasks.

*More details will be updated soon

Hacker Room, Shanghai

Organizer will set up an environment with smart devices. Contestants can find vulnerabilities of these devices and attack the devices remotely to complete tasks.>>>

Robot Agent Challenges, Las Vegas/Shanghai

Make a Robot to fulfill tasks in complex simulated environments.>>>

/  Prize  /

Maximum Prize for winning team $140,000 USD

/  Description  /

The organizer has built a cyber environment consisting of smart devices. The constants can freely design an access scheme based on the given list of target devices (target device list (version 1.0)). The qualified contestants will attend the online contest session according to the order automatically decided by the preset formula. They will be required to complete the chained hacking tasks within the specified time.

The contestants can choose between the following three attack conditions:
    1. External network conditions: the contestant only has the network access to the WAN port of the target network, that is, simulating the attack conditions in which the attacker hacks into from the Internet directly into the home network.
    2. Intranet mobile phone: the contestant is allowed to install an APP of their own into the mobile phone inside the target network.
    3. Intranet computer: the contestant has full control of the computer inside the target network.

/  Example: Scene and attack chain  /

Compromise the laptop by exploiting the vulnerabilities of the browser, get control of the cell phone connected to the laptop, and then control the smart bulb.

By compromising the webcam, observe sensitive and confidential credit card information located on the tea table in the living room to realize credit card fraud.

Compromise the router to hack into sweeping robot and take photos of the owner sleeping.

Control the Bluetooth speaker and play the horror sound effect.

Control the Bluetooth speaker and send voice commands to another smart speaker.

After hacking into the intranet, project the horror video to the TV through DLNA.

Control the gateway of smart door lock and open the lock remotely.

Control the coffee machine to spill out in high temperature.

Hack into the printer, get shell, implant Trojan horse, make it a jump server to attack others, modify the content of printing.

Control the sweeper robot to knock over the objects in the scene and cause losses.

Compromise the TV, control the camera on the TV, and take pictures or videos.

/  The principle of evaluation  /

1. The GeekPwn judge panel will score and screen according to the registration information provided by the contestant, regarding the brand popularity, harm of the vulnerability, the technical difficulty, the demo effect, the length of the attack chain and so on.

2. Duplicate vulnerability judgment: the judge panel decides whether the vulnerability is duplicated according to the vulnerability details that the contestant submitted. In case of duplication, the first contestant who successfully exploited the vulnerability gets the scores and prize.

3. In order to achieve a complete attack chain, contestants can use non-0day vulnerabilities, but they are not taken into account in the prize.

4. The contestants cannot repeatedly submit registrations with the same combination of vulnerabilities or entrust others to repeat the registration. The organizer will monitor the repeated registrations of this kind. Once found, the contestants’ qualification of the competition will be canceled.

5. If the contestant fails to complete the attack in the online stage, the contestant will not be required to submit the vulnerability details to the organizer, and the organizer will clear any records in the online environment. The sponsor will not preserve any information in this project or send it to any third party.

6. In the case of finding some specific vulnerabilities, score and prize of the project can be promoted through the following ways:
    A. Reduce attack conditions.
    B. Combine a longer attack chain. The attack chain includes two aspects, the technology and the scene chain in technology:
        i. attack the router and hack into the LAN -> attack the camera in the LAN, see the password chain in scene
        ii. attack the smart door lock, lock the person indoors -> attack the smart bulb, flash the bulb -> panic the person.
    C. Design an attack scene that has more danger.
    D. Design a demonstration with better effects.

/  Contest process  /

Deadline for registration: September 10, 2018 Contestant registration: submit the registration form online.

Offline research phrase: The organizer announces the target devices list and attack scenarios examples. The contestants purchase devices to research and find zero-day vulnerabilities of target devices. The registration is open, and the contestants submit the online registration. The organizer reviews and screens the registrations and sends the results to the contestants.

Online attack phase: Registration ends. The organizer opens the online environment. The organizer calculates the order of the contestant in online phase. The organizer deploys the target devices selected by the contestants. The contestant enters the jump server provided by the organizer and enters the online environment. The jump server is Kali 2018.2, and the contestant has the root privilege of the system. The contestants are unable to physically contact or approach any devices in the online environment. The contestant attacks the target devices in the online environment, and finishes compromising the predetermined attack targets within a limited time. The prescribed time is 30 minutes, and the contestant will get extra 5 minutes when he hacks into each node.

Vulnerability submission phase: If the online attack is finished successfully, the contestant will be required to submit details of the vulnerabilities to the organizer. The organizer replicates attacks in the environment using the code submitted by the contestants. The organizer checks whether there are any duplicate vulnerabilities or irregularities (whether the vulnerability description is consistent with the attack code). The judge panel will review and determine the prize.

**If there is any question in the process of registration, please mail to: cfp@geekpwn.org

/  Prize  /

1st place $15,000-$30,000  USD, Second Place $8,000-$15,000  USD, Third Place $3,000-$8,000   USD

/  Description  /

Nakamoto is a top Cryptographer and a Digital Currency player. He mainly stays in his lab everyday. In order to protect himself from theft, he designed a guard system to protect his lab. He also hide his BTC wallet address, keys in different locations in the lab. One night, some special "people" arrived ......

In this contest, each team is required to make a robot, which can enter a simulated lab. Players can remotely control the robot or let the robot move by itself. In scheduled time, if the robot fulfill tasks, it can get corresponding points. The final result is based on the total points.

/  Rules  /

Each team will make their robot, then remotely control it or let the robot move by itself. The robot will sneak into a simulated lab environment and get secret information. The robot can enter the lab through door, window or ventilation pipe. After that, it needs to shutdown the laser net or go through it carefully without triggering alarm. Then the robot can place a covert listening device in the lab, open safe to get secret information on card, open a book to get secret on card or plug a malicious USB device to computer... If a robot can retreat to outside of the lab in reasonable and safe way, it can get extra points.

Please download and check detailed rule document from here:Robot Agent Challenge Contest Rule Document (Version 2.2, June 14)

/  Schedule  /

Registration deadline:  July 15th (Las Vegas), Sept 30th (Shanghai)

Registration: Please submit your online registration here Registration Form

*If you want to get detailed explanations on the contest field and evaluation standards, please send email to:cfp@geekpwn.org



PWN Everything

GeekPwn will continuously accept PWNs on various targets. This time we divide the PWNs into two kinds, vulnerabilities and non-vulnerabilities based. We encourage our contestants to find more security vulnerabilities of target systems, we also encourage contestants try new creative PWN methods.

Vulnerability based PWN, Shanghai

Attack target system by exploiting security vulnerabilities.>>>

Non-Vulnerabilities based PWN, Las Vegas/Shanghai

Attack target system NOT by exploiting security vulnerabilities, but by using new creative attack method.>>>

/  Prize  /

The maximum individual prize awarded will be $150,000 USD for each PWN.

/  Description  /

Smart devices, AI products, libraries, frameworks and IoT products, that are commercially available or widely used are all acceptable PWN targets. By exploiting security vulnerabilities, the attacker without privileges can get system control, access private data or break through original security mechanisms in reasonable attack conditions.

/  Examples  /

Pass face recognition door control with one vulnerability: Contestant exploited a vulnerability to get system control privilege. Modify the face data so pass the control with other person's identity. (GeekPwn2017 Shanghai)

Exploit Home Router vulnerabilities: Contestant exploit vulnerabilities in home router remotely to get admin privileges. (GeekPwn2014 - 2017)

Exploit 9 vulnerabilities, attack Trustzone: Contestant asked user install a malicious app, then the app attack TrustZone, everyone can unlock the phone with finger print. (GeekPwn2016 Shanghai)

*More vulnerability based PWN, like Camera, POS, Robot, Smart Watch, Smart Lock, Shared Bike, etc , please check Hall of Fame

/  Evaluation and Judgement  /

1. The PWN target (device, application or security module) should be in factory shipped state with official updates and default settings. The ROM and/or software versions should be >= the latest version 30 days before the GeekPwn event.

2. All the technical approaches must be contestant's original work. All the public known PWN approaches could not be used and win the contest. Winning contestants need to submit technical details report.

3. Awards will be offered by GeekPwn committee based on the PWN technical difficulty, creativity and demonstration effects.

/  Schedule  /

Registration: Please submit your online registration Registration Form

First round evaluation: GeekPwn Committee will evaluate according to the submit form in 5 business days.

Second round evaluation: GeekPwn Committee will determine if the registration is accepted. Once accepted, GeekPwn Committee will prepare device (or AI products) and presentation environment.

Registration deadline:  Sept. 30th, 2018

*For any questions, please send an email to: cfp@geekpwn.org

/  Prize  /

The maximum individual prize awarded will be $150,000 USD for each PWN.

/  Description  /

Smart devices, AI products, libaries, frameworks and IoT products, that are commercially available or widely used are all acceptable PWN targets. Or, there may be no direct PWN target at all, but only a security scenario. The attack is NOT necessarily exploiting vulnerabilities, but using new creative method.

/  Examples  /

Wombie Attack: a new model of worm spreading. (GeekPwn2017 HongKong)

Recognize CAPTCHA images by using DNN: Contestant used trained DNN to crack Google reCAPTCHA (GeekPwn2017 Sillicon Valley)

Attacker uses Machine Learning to learn human voice, then simulate it to pass a voice recognition system. (GeekPwn2017 Shanghai)

*More Non-Vulnerability based PWN, please checkHall of Fame

/  Evaluation and Judgement  /

1. The PWN target (device, application or security module) should be in factory shipped state with official updates and default settings. The ROM and/or software versions should be >= the latest version 30 days before the GeekPwn event.

2. All the technical approaches must be contestant's original work. All the public known PWN approaches could not be used and win the contest. Winning contestants need to submit technical details report.

3. Awards will be offered by GeekPwn committee based on the PWN technical difficulty, creativity and demonstration effects.

/  Schedule  /

Registration: Please submit your online registration Registration Form.

First round evaluation: GeekPwn Committee will evaluate according to the submit form in 5 business days.

Second round evaluation: GeekPwn Committee will determine if the registration is accepted. Once accepted, GeekPwn Committee will prepare device (or AI products) and presentation environment.

Registration deadline:  July. 15th, 2018 (Las Vegas), Sept. 30th, 2018 (Shanghai)

*For any questions, please send an email to cfp@geekpwn.org

Apr.




10



Registration start:
Vulnerability based PWN (Shanghai)
Non-vulnerability based PWN (Las Vegas/Shanghai)
Robot Agent (Las Vegas/Shanghai)

May




10



Registration start:
CAAD (Las Vegas)
Hacker Room (Shanghai)

June





July




10



Registration Deadline:
CAAD (Las Vegas)

July




15



Registration Deadline:
Non-vulnerability based PWN (Las Vegas)
Robot Agent (Las Vegas)

Aug.




10



GeekPwn (Las Vegas)
CAAD Awards Ceremony

Sept.




10



Registration Deadline:
Hacker Room (Shanghai)

Sept.




30



Registration Deadline:
Vulnerability based PWN (Shanghai)
Non-vulnerability based PWN (Shanghai)
Robot Agent (Shanghai)

Oct.




24



GeekPwn (Shanghai)

Nov.





 

Dec.





 

... 2019

Restrictions & Notifications

1. GeekPwn organizing committee ("the committee" in below description) recognizes the technical capability of the winner individually, but doesn't acknowledge that it has linkage to winner's working organization.
2. The committee doesn't acknowledge the contest result directly reflect the security level of the smart devices.
3. The committee restrictedly follows the responsible disclosure to device manufactures. All the details of Pwn technical approaches will be disclosed to the representatives from the according device manufactures privately by committee and contestant. If no representatives from the manufacture is at the scene, all the information will be disclosed to manufactures offline after the contest. The committee and contestant commit not to disclose any details to third-party before manufactures fix the issues.
4. The committee commits that foreign judges will only participate the judgment of devices categories of foreign manufactures.
5. The committee guarantees that contestant's private personal information will not be disclosed to third-party or used for commercial activities without contestant agreement and authentication.

* GeekPwn organizing committee reserve the right of explaining all GeekPwn rules and standards

KEEN Cloud Tech endeavors to help the world's leading software manufactures who have adopted advanced cybersecurity engineering methodologies to discover and fix cybersecurity vulnerabilities. Over years, KEEN has discovered and reported hundreds of high-priority vulnerabilities to Microsoft, Apple, and Google etc.

As one of the world's leading platforms for cybersecurity researchers, GeekPwn enables security researchers and geeks around the world to share their thoughts and findings. Since 2014, GeekPwn has successfully held 8 sessions in Beijing, Shanghai, Macau, Hong Kong and Silicon Valley, and responsibly disclosed hundreds of critical security vulnerabilities and awarded over millions (USD) to contestants.

Contestant Registration: cfp@geekpwn.org Business Cooperations: business@geekpwn.org
Consulting Tickets: ticket@geekpwn.org Media Cooperations: marketing@geekpwn.org

© 2018 GeekPwn Committee

KEEN All Rights Reserved

沪ICP备12003057号-3