Presentation

Due to the pandemic, the SSTIC conference will be held online for the second
time. One of the main consequences is that this year, again, no tickets will be
sold. Seeing that it is not possible to make money on the work of the French
infosec community anymore and looking to buy a new Mercedes car,
the Organizing Committee decided to take action! A new DRM solution has been
developed to protect the SSTIC presentations videos, which won't be free anymore.
As an infosec community member, you can't let that happen. You have to
analyze the DRM solution in order to find a way to extract the protected content
and share it freely with the world. (or give details to the Organizing
Committee for a nice bounty).
Luckily, the OC has been compromised and it has been possible to get a capture
made during data transfer to a USB stick. Hopefully, this may allow you to find
a copy of the DRM solution and to analyze it.
Good luck!

In order to complete the challenge, you have to extract a specific video protected with the DRM solution and find an email of the form xxxxxx@challenge.sstic.org.

Once you have found this address, you have to:

• Send immediately an email to the address. The rapidity ranking will be based on the delivery date of this email.
• THEN, in the 15 following days (and before the end of the challenge), send a detailed write-up. This will be used for the quality ranking.

Flags of the form SSTIC{...} can be found at different steps of the challenge. You can submit them at the end of the French page if you are logged in (https://www.sstic.org/2021/challenge/). It is not required to be ranked, only the final email is mandatory.

The challenge is available here: https://static.sstic.org/challenge2021/usb_capture_CO.pcapng

SHA256 : 36f3e5c98f7201ae967fd278c64b5601ecb298f37b5b7e2afcebaf3d64ef54be

No specific hardware is required to solve the challenge.

Prizes

Players can be ranked according to their rapidity of solving the challenge (rapidity ranking) or according to the quality of their write up (quality ranking). The quality ranking is based on the comprehensiveness and elegance of the solution, and the clarity of the write-up.

The prizes are:

• 1st: Switch lite + 1 game (you choose)
• 2nd: 3D printer Creality Ender 3
• 3rd: NFC/RFID Reader/Writer FONGWAH S9-BU-13-00

Rankings will be available on the French page of the challenge. The winner of the quality ranking will be able to present their solution, in French, at the SSTIC conference.

Rules

• The challenge is open to everyone, except members of Organizing and Program Committee, employees of Quarkslab, Thalium, and Apple Media Product RedTeam.
• To win, players have to find an email address (...@challenge.sstic.org) and send an email to this address, then their write-up in the 15 following days (and before the end of the challenge).
• This write-up must be in French or English and as detailed as possible.
• Write-ups will be ranked by challenge authors and OC
• The closing date is May 20th 2021, at 23:59:59 (UTC+2).
• It is possible to win a prize in both of the rankings.
• Each player must play alone, teams are forbidden. Occasional help from friends is allowed.
• By sending a solution, players agree that the write-up will be published with their name or a chosen nickname.
• For prize delivery, it's necessary to provide real identity to the OC (but it is not made public)
• The closing date can change if there are less than 3 solves at the end of the challenge.

Contact

Please send your questions to challenge2021@sstic.org.

Root

• Brice Berna (@__brendel)
• William Crookes
• Nicolas Surbayrole