6 ms·
NSA Codebreaker Challenge 2024
- sigma5 2y agoI got this error while trying to register. Does anyone know a simple way to bypass this ? "Sorry, that email domain is not recognized. -- An email address from a recognized U.S. school or university is required. If your school's domain is not recognized, please request it to be allowed by clicking HERE"
- FanaHOVA 2y agoIf you need HN commenters just to bypass the signup, you will not have a good time in the challenge :P
- seabass-labrax 2y agoJust because it's a computer security challenge doesn't mean you should start breaking into the website before the challenge begins. That's akin to suggesting that boxers who were deemed not to qualify for a competition should punching the referee to prove otherwise; what's normal inside the sport can be entirely unacceptable outside it.
- Jerrrrrrry 2y agoIf you don't have a family, the Air Force won't let you fly a plane. You think being Omni-potent in a modern world wouldn't bring its own shade of problems? It's more akin to the boxers who were deemed not to qualify cuz their deemed arbitrarily too old remind the judges of their youth, all in good fun. If you cannot get access to an @edu email for long enough to verify a 2FA between Facebook familiarity and now, you likely aren't of the caliber outside of the domain specialty that can be entrusted with that magnitude of information.
- tptacek 2y agoIf you don't have a family, the Air Force won't let you fly a plane. Can you cite a source for this? I'm acquainted with some USAF people and have close friends with fighter pilot siblings (I know, family) and I have never heard this before. If by "family" you mean "a spouse", the people going up in trainers are too young to have built families, so that can't possibly be a DQ.
- Jtsummers 2y agoThey can't because it's not true.
- tptacek 2y agoIt sounded weird af to me. In fairness: so too does the claim that this is a test of whether you can hack a .edu email address, like it's 1994 and the next test in their CTF is whether you can find an X.25 outdial. No, they're just recruiting from engineering schools, like everyone else! Career tip: if hoping for a GG-whatever role at NSA, recommend not committing crimes in the process of trying to impress them. They are a lot more boring than you think they are.
- Jerrrrrrry 2y agoCareer tip: if hoping for a GG-whatever role at NSA, recommend not committing crimes in the process of trying to impress them. They are a lot more boring than you think they are. well, its not a really a crime when you do it for the homeland. also not a crime if its boring.
- Jerrrrrrry 2y agoThat was kinda an obvious analogous exaggeration. Although, not too unbelievable for highly-sensitive contexts. A pilot with less obvious motivation to go AWOL institutionally could only benefit the context.
- 2y ago
- FanaHOVA 2y agoI agree, but it clearly says you need an edu email. Either you have an edu email, or by asking how to skip that check you're trying to circumvent the website limitations. So in spirit, you're already trying to break in, just through different means :)
- Something1234 2y agoIt is kind of an issue because a lot of people lose their school email when they graduate. Asking the same cause this is one I've never had time to do when I was in university and would like to do it now that I'm graduated.
- rtkwe 2y agoIt's for recruiting and they mainly want new grads. It's a filter not a bug. It is a shame you can't get access as a non recruitment target though.
- derbOac 2y agoIt's also a shame they only see recent grads as recruitment targets.
- tekla 2y agoThe people whom this is meant for are not the people who would complain about "needing" an EDU email and would just get one or figure out a bypass.
- carlmr 2y agoOptions I can see: 1. You can get one from Hafis: https://hafis.net/product-category/edu-email/ https://hafis.net/product-category/edu-email/, 2. or host your own mail server after registering an .edu address, 3. or maybe you can find someone in your network who still has a valid .edu address and is willing to register for you.
- rtkwe 2y agoJust looking at the site it seems they pull from an approved list of .edu domains so I think 2 probably wouldn't work unless you could social engineer you way onto the approved list. The ones sold by Hafis might not either, I didn't see a list of approved institutions readily available though.
- Horffupolde 2y agoIt’s part of the test.
- unethical_ban 2y ago[flagged]
- lpcvoid 2y agoThey care about US citizens enrolled in university. Everybody else is not employable - so I guess they filter well here.
- enjoyyourlife 2y agoThey do have some industry hires
- randunel 2y agoDo US universities offer their pupils email addresses forever, or many decades past graduation? Or is the challenge exclusively for current US students? I lost access to my (European) inboxes a loooong time ago.
- Jtsummers 2y agoIt depends on the school. Some have an "email for life" thing, one school I attended tied that to a (relatively low-cost) annual "donation". Many close your account once you graduate, though.
- Atotalnoob 2y agoAnswer is it depends. I transferred multiple times during my degree. I have had a couple schools offer indefinitely, others offer paid indefinitely, others a set amount of time.
- vharuck 2y agoI still have my email after graduating 11 years ago. I was able to sign up with it, selecting "Alum" as the best description of my relationship with the college.
- deleted 2y ago[deleted]
- bangaladore 2y agoI completed the 2022 version of this and received some nice NSA memorabilia. It is a fun challenge, but it is pretty difficult to complete it all. Looking back at 2022, it looks like maybe 100 people completed the entire challenge.
- diggan 2y ago> it looks like maybe 100 people completed the entire challenge. It looks like (https://nsa-codebreaker.org/leaderboard_2022 https://nsa-codebreaker.org/leaderboard_2022) at least 350 schools has a "School Solve Times" that isn't null, so unless some students are enrolled in multiple schools, it seems like way more than 100 people managed to solve it.
- Jtsummers 2y agoGo to Task 9 at the bottom. 40-someting schools had people score, about 102 people scored on that task (more completed it though, not sure what the difference is, hand counted so may have miscounted).
- bangaladore 2y agoCorrect, which is why I say 100-something. For some reason, they put all the schools in every table. Just a guess, but I assume "scorers" are only people who solved it in the limited time window.
- nneonneo 2y agoThis has historically been a pretty fun challenge to do. Earlier levels are quite easy, but later levels can be quite challenging and require specialized skills (e.g. reverse engineering, binary exploitation, cryptography). There’s a decent focus on “realism” which makes the challenge series more interesting than a typical CTF. If you’re eligible to participate I’d highly recommend checking it out. P.S. if you do well, the NSA sends you swag; I have a couple of very nice signed letters and NSA medals that look great in my office :)
- diggan 2y ago> Anyone with an email address from a recognized U.S. school or university may participate in the challenge. Aww, that's not so fun :( Was kind of curious to participate, but seems it's US + students only. Kind of makes sense that it's US only I guess, but why only students?
- tptacek 2y agoIt's a recruiting event.
- diggan 2y agoAha, that'd explain it. NSA only hire people fresh out of school?
- tekla 2y agoNo. They hire plenty out of school, but they generally are not the type to be filtered by an email domain requirement.
- Jerrrrrrry 2y agobut they generally are not the type to be filtered by an email domain requirement. They are exactly the type to filter by something as "trivial" - 99% of their target audience is Math nerds with .edu emails. The other 1% will go the other 99% of the way to acquire the needed materials to satisfy the target condition. Which in this case, is a room-temperature check compared to the challenges.
- tptacek 2y agoI do not think their audience is in fact mostly math nerds.
- Jerrrrrrry 2y agoThey hire more Math PhD's than the entire economy combined. If comparable had happened in any other field, to any other adversary, that very fact would not be as advertised.
- bitwrangler 2y agothere's a good list of resources and lectures if you're curious to learn more: https://nsa-codebreaker.org/resources https://nsa-codebreaker.org/resources
- quibono 2y agoAnyone else getting a 403?
- paulluuk 2y agoAfter reading "Permanent Record" by Edward Snowden and "Cult of the Dead Cow" by Joseph Menn, I can't help but feel like the NSA is basically "the bad guys", and I assumed most hackers would feel the same. Are people really excited to do challenges like these for them? I don't mean that in an accusatory way, just genuinely curious as my perspectives (one from a whistleblower and one from 80s hacker culture) are obviously not the same as those of a modern day hacker.
- tptacek 2y agoI would love to hear more about how Menn's book about a clique of nerdy teenagers shaped your opinion of NSA. (Some of those nerdy teenagers are friends of mine; we were nerdy teenagers of the same vintage. I'm not dunking on them.)
- ziddoap 2y agoWhile I don't really like the NSA, I certainly respect their expertise. And their expertise is exactly what makes a challenge like this difficult and fun.
- YinglingHeavy 2y agoSomeone isn't Comms Aware. Biggest event of 2013: Snowden. Biggest film of 2013: Frozen (Let I.T. Go) Biggest game of 2013: Last of U.S. The NSA was effectively blinded for a period of time. Do you think bad actors didn't take full advantage of this? Where did Snowden work prior to NSA? Why doesn't Julian Assange have a Hollywood film?
- ricksunny 2y ago>Assange film The Fifth Estate.
- jjtheblunt 2y agoI'd recommend reading James Bamford for a more positive look at NSA and their charter...which is essentially math, math, and more math, and unrelated to politics within NSA anyway. The Snowden stuff is extraordinarily excerpted to that which a contractor (Snowden) was seeing in a post 9/11 strange fiasco which did bring politics into play. Bamford predates that mess. Here's a link, for example. https://a.co/d/eMTidtP https://a.co/d/eMTidtP
- sandworm101 2y agoIs it cheating to use commonplace AI? NSA are a practical bunch, they probably dont much care how one solves the problems, but AI could change the nature of such tests. The rules say no getting help from persons, which leaves the AI door open imho. (Fysa, there is a reasonable chance that someone involved in this competition is following this topic. HN is known in the more nerdy corners of the int/defense world.)
- not2b 2y agoI think it would be unlikely to be much help beyond the easy problems they start with.
- lallysingh 2y agoMight be more acceptable if you use a locally hosted version, instead of someone else's.
- Jerrrrrrry 2y agoI would love to see you try to get Gemini to make corporate puns, 3-figures removed from practical phishing utility.
- artem_dev 2y agoIs it possible to view tasks from the past challenges? Just curious how it looks like
- sleepyink 2y agoI archived what I could from the years I participated: 2018-2021: https://github.com/luker983/nsa-codebreaker-2018 https://github.com/luker983/nsa-codebreaker-2018 https://github.com/luker983/nsa-codebreaker-2019 https://github.com/luker983/nsa-codebreaker-2019 https://github.com/luker983/nsa-codebreaker-2020 https://github.com/luker983/nsa-codebreaker-2020 https://github.com/luker983/nsa-codebreaker-2021 https://github.com/luker983/nsa-codebreaker-2021
- proctrap 2y agoHah some networks just get a 403 forbidden accessing this
- drexlspivey 2y agoMaybe that’s the challenge
- cbanek 2y agoVPNs seem blocked and return 403
- m3kw9 2y agoFirst thing people does is feed it into LLM
- madisonandrea 2y ago[dead]
- guadalupe4151 2y ago[dead]