Capture the flag with the Norwegian Police Security Service

Here's a write-up showing how to solve the challenges of the Norwegian Police Security Service's CTF advent calendar.

Published: Thu, January 2, 2020, 16:10
Updated: Thu, January 2, 2020, 17:45
Behind the news

Background 👮 🔗

The Norwegian Police Security Service (with the Norwegian abbreviation PST which I'll use for this write-up) is the police security agency of Norway. Once in a while they have job ads with some more or less hidden challenges - almost Capture the Flag (CTF) style. I've done posts on them back in January and in October 2019. This time they went all in with a CTF advent calendar.

The theme 🎅 🔗

PST added an N in front of their name and created the imaginary Northern Polar Security Service (Nordpolar sikkerhetstjeneste = NPST). NPST's role is supposedly to protect Santa Claus, his elfs and Christmas itself. PST posted a fake job ad where they said to be looking for elf officers (="alvebetjent") for a temporary position to help out NPST. Of course big and small media sites took notice and published stories on this (NRK, TV 2, VG, Politiforum). Everything went down on from December 1st to December 24th.

Challenges and solutions 🔗

Let's jump straight in. Click on a challenge to expand it.

Credits 🔗

While I worked on all the challenges alone there were a few times I was stuck long enough to discuss or ask for hints from Frank Karlstrøm (Twitter, blog). I'm pretty sure I wouldn't have nailed all challenges otherwise.

Scores 🔗

The CTF closed by the end of New Year's Eve. Looking at the scoreboard there were 19 users who managed to get all 274 points. 39 users managed to solve challenge 24 (18 by the end of Christmas Eve). The "problem" that stopped many from full score was challenge 23 which neeed 3 hints from PST before it was solved. There were 1048 users that successfully submitted at least 1 correct flag, though I suppose there's quite a few non-real users among them. Still, there have been several hundred persons trying out the challenges. I think that's pretty good.

Enjoy reading about IT security? Check out more of my posts.

Some final thoughts 🔗

This was actually my very first CTF. I don't think the intention was to have a very beginner friendly CTF, but at the same time the challenges generally weren't very hard. I think it's really cool that PST did this. This and previous job ads is a great way of showing off some of the expertise they are looking for. They sure get a lot of both media attention and awareness in the IT industry. I'm pretty sure this can - at least in the long run - help them hire the right people.

I wish that the challenges weren't published at midnight. I mean, it's fine if it was PST's way to map out who's got no commitments, no family, no job, no school. Otherwise it was a bit harsh with 19 out of 24 days like this. I'm happy that I was able to stay away most midnights, but it was hard not to check out the new challenge on the mobile when waking up in the middle of the night. Personally I'd like the challenges to be published like 6 p.m. I'm not sure if I'd give away that many hours of next December.

I saw some minor critisim of the hints being suddenly published instead without having the release time published up front. I think that is a valid point for those really competing in staying and ending on the top of the scoreboard.

It feels good that it's over now. You know your brain is working overtime when you immediately start looking for clues when you see toy penguins at the store, or you have dreams where you are trying to figure out the charset of some binary data.. 😅

All in all, I think it was a great and very fun CTF. I think it was entertaining with the theme and storyline. I'm impressed by PST and I hope they continue with this and similar things in the future. It's good for them and it's good for all of us if we can increase the expertise in our industry.

Request for comments 🔗

If you have thoughts about my solutions, the CTF, or if I have missed something cool; don't hesitate to comment here or contact me in some other way. 🙂

Get notified when there are new posts! :-)