Capture the Flag

9 – 10 May 2023

This Capture the Flag-style event, powered by DELOITTE, is free!

Participants Must Register for the AFCEA Tidewater TWICS 2023 separately.
***Your registration is an acknowledgment of the entire official Deloitte rules outlined below***

Onsite participation will be at Hampton Roads Convention Center in downtown Hampton. We will have onsite cyber specialists from Deloitte to assist as needed. We are not capping registration at this time, but please know if we reach more than 100 participants, Deloitte has the ability to decline participation, so register ASAP to ensure you have a spot.

Please register your team in its entirety; teams can be made up of 4-5 individuals. No individual participation is allowed. Remote participation will be allowed; you can participate from anywhere! Registration is below for team leads/team members. Teams should consist of no more than 5 members.

Bring Your Own Attack Platform. All teams need to bring their own attack platform(s). We recommend Kali Linux, but this is not a requirement. Laptops Must be capable of connecting to an unsecured Wi-Fi network or an Unsecured Ethernet Link. Administrative Privileges are recommended. A limited number of Power Strips and Extension Cords will be available, but please bring some if available.

Sponsorships Are Available!

Please Contact Sean Dyer at seandyer2032@gmail for additional Details!

  1. Register using your .mil email (preferred) and complete the fields in the registration form. 
  2. Use the following group code: twics23 (all lowercase and no spaces)
  3. Check your email to validate your account.
  4. Log into the platform using the account you just created.
  5. Select “Play as a team”  to create/join your team – Each team must designate a team leader to create the team and send the Team Invite Code to all teammates. (invite code is found under Team Settings and is NOT the same as the group code used for registration)
  6. Watch the countdown timer and get ready to play!

TWICS 2023 CAPTURE THE FLAG COMPETITION
OFFICIAL RULES

NO PURCHASE NECESSARY TO ENTER OR WIN.

The 2023 CYBER CAPTURE THE FLAG Competition (the “Competition”) is sponsored by Deloitte & Touche LLP (the “Sponsor”). Competition participants agree to be bound by these Official Rules and the decisions of the Sponsor and the judges, which are binding and final on matters relating to this Competition. The Competition is subject to all applicable federal, state and local laws. Void where prohibited by law.

WHO MAY ENTER:

Open only to legal residents of the fifty (50) United States and the District of Columbia who are of legal age of majority in the jurisdiction in which they reside (and at least 18 years old) and who are registered for the Competition at the 2023 AFCEA TWICS, in Hampton Roads, Virginia on May 9-10, 2023 (“Conference”) and are active duty Military and government civilians. Partners, Principals, and employees of Deloitte LLP and its subsidiaries are not eligible to enter and win.

COMPETITION OBJECTIVE:

The objective of the Competition is to solve practical cyber challenges in a simulated environment. The goal of each challenge is to find a “flag,” which is a string of text. The flags for each challenge are submitted to the Administrator on https://us.hackazon.org/ (“Competition Website”) in order to receive points. Challenges award varying amounts of points depending on difficulty. The participants with the most points at the end of the Competition wins. The scoreboard is automatically updated to reflect the current state of the Competition. The scoreboard will reflect the final rankings when the Competition ends. In the event of a tie for points, the fastest participant wins. Competitors can participate either virtually or in-person.

HOW TO PARTICIPATE:

This is a team event and eligible participants must form a team as provided below. In-person participation is limited to 20 teams not to exceed 80 players. An individual may not participate in the Competition on more than one team.

For the purpose of these Official Rules, a participating individual and a participating team will each be referred to as a “participant.”

REGISTRATION

  • For in-person participation in the Competition, all eligible participants must send an email to seandyer2032@gmail.com by May 1, 2023. In-person participation will be granted on a first-come, first-served basis. Following confirmation of in-person participation, in-person participants must also register for TWICS at https://afcea-tidewater.org/ (“Registration Site”).
  • Both virtual and in-person participants must register for the Competition at https://us.hackazon.org/ (“Competition Site”) using the invite code “twics23” by May 1, 2023. • The team leader will create a team on the Competition Site and share that team code with the team members. After registering on the Competition Site, each team member will join the team using the team code.
  • By registering on the Competition Site, each participant acknowledges and agrees to these Official Rules.
  • Participants:
    • Participants must be on a team and not as an individual and all such teams may have 2-6 team members.
    • Virtual team members may be from different geographic areas and on the same team.
    • Multiple teams may be from the same military unit.
  • In-person Participants must bring their own laptops with them. Laptops must be capable of connecting to an unsecured Wi-Fi network or an Unsecured ethernet link. Administrative Privileges are recommended. A limited number of power strips and extension cords will be available, but please bring some if available.

CYBER CAPTURE THE FLAG COMPETITION

Both the virtual and in-person Competition will begin on Tuesday, May 9, 2023 at 9:00 a.m. ET and conclude on Wednesday, May 10, 2023 at 2:00 p.m. ET (“Competition Period”). The Competition will be completed in one (1) twenty-nine (29) hour period over two (2) days at TWICS or virtually. In-person competitors are invited to continue the Competition from another location while the TWICS exhibit hall is closed.

COMPETITION STRUCTURE

The top three (3) participants with the most points at the end of the Competition will be the 1st, 2nd, and 3rd place winners. In the event of a tie for points, the fastest participant wins. The scoreboard is automatically updated on the Competition Site to reflect the current state of the Competition. The scoreboard will reflect the final rankings when the Competition Period ends. Winners will be recognized during the day after 2:00 p.m. on May 10, 2023.

GROUND RULES:

  • No Outside Help – Participants are not allowed to use outside help during the Competition Period (i.e., no remote and/or unregistered players are allowed). Google/internet research is allowed.
  • No Collateral Damage – Only attack systems for which they have explicit permission and are running in the Competition infrastructure (these will be clearly indicated) provided by the Sponsor. No attacks on any systems or equipment outside of this environment are allowed.
  • Competition Area – Participants are not allowed to take any of the equipment outside of the Competition area unless explicitly permitted by the Sponsor. Also, please take any phone calls outside the area.
  • Brute Forcing – Avoid generating large amounts of traffic and/or brute forcing; none of the challenges can be solved by running automated scanners, so please do not do so. This includes scanning with Nikto, Skipfish, Vega, Nessus, etc. (Nmap and Sqlmap are fine!)
  • No Fratricide – Sabotaging or in any way hindering the progress of other participants is strictly not allowed. This includes attempting to alter or disrupt a challenge or service after you have completed it.
  • One Team/Multiple Challenges – Each participant may work on multiple challenges at one time, with some restrictions, based on the portal backend software.
  • Challenge Progression – Challenges may be attempted in any order. If you are stuck on a challenge, move on to a different challenge.
  • Bring Your Own Attack Platform – All teams need to bring their own attack platform(s). We recommend Kali Linux, but this is not a requirement.
  • Team Swaps – Only registered participants may swap from one team to another one time from day 1 to day 2 as coordinated with the AFCEA HR staff.

Sponsor reserves the right to disqualify any participant for any reason, in its sole and absolute discretion. Sponsor reserves the right to remove any participant from the Competition who does not conform to the ground rules for any reason, in its sole and absolute discretion. Sponsor reserves the right in its sole discretion not to choose winners for the Competition.

The decisions of the judges and Sponsor are final and binding on all matters.

PRIZES:

No prizes will be issued.

RECOGNITION

The first-place team will receive a trophy and/or certificate (with no intrinsic value) for each team member. In addition, second and third place teams will be verbally recognized. Winners do not need to be present to accept their trophy/certificate.

Each winner may be required to execute and return an Affidavit of Eligibility and Liability and, unless prohibited by law, Publicity Release (“Affidavit/Release”), which must be received fully-executed within seven (7) days of date printed on notification or be disqualified. In the event it is determined that any winner has not complied with these Official Rules, or has failed to execute and return any required documents within the specified time period, or has made false statements in any document required by Sponsors, then winner will be disqualified and required to promptly return to Sponsor the prize. If a winner is disqualified for any reason, at Sponsor’s discretion, the prize may be awarded to another participant. Prize is awarded “as is” with no warranty or guarantee, either express or implied by Sponsor. Prize awards are subject to verification of eligibility and compliance with these Official Rules. A winner may not substitute, assign or transfer their prize, but Sponsor reserves the right, at its sole discretion, to substitute a prize of comparable or greater value. Winner is responsible for all federal, state and local taxes associated with acceptance and use of a prize as well as any other costs and expenses associated with prize acceptance and use not specified herein as being awarded. All prize details are at Sponsor’s sole discretion.

WINNERS LIST:

For the names of the winners (available after 6:00 p.m. ET on May 10, 2023) send an email request to seandyer2032@gmail.com.

CODE OF CONDUCT / HONOR CODE:

Professional behavior is expected. Each participant is required to maintain the highest standards of integrity throughout the Competition and Conference. Any violation of these Official Rules, including but limited to, the ‘ground rules’ or breaches of integrity will subject a participant to immediate disqualification.

DATA COLLECTION:

All personal information submitted to Sponsor in relation to this Competition will be handled in accordance with the privacy policy of Deloitte and Touche LLP, which may be found at https://www2.deloitte.com/us/en/legal/privacy.html. Your personal information will only be used in connection with the Competition and as provided for in these Official Rules.

GENERAL CONDITIONS:

Released Parties (as defined below) are not responsible for any lost, late, incomplete, inaccurate, stolen, misdirected, undelivered, delayed or garbled entries or email; or for lost, interrupted or unavailable network, server, Internet Service Provider (ISP), Competition Site, Registration Site, or other connections, availability or accessibility or miscommunications or failed computer, satellite, telephone or cable transmissions, lines, or technical failure or jumbled, scrambled, delayed, or misdirected transmissions or computer hardware or software malfunctions, failures or difficulties, or other errors or malfunctions of any kind whether human, mechanical, electronic, network typographical, printing or otherwise relating to or in connection with the Competition, including, without limitation, errors or malfunctions which may occur in connection with the administration of the Competition, the processing or judging of entries, the announcement of the prizes or in any Competition-related materials.

Released Parties are also not responsible for any incorrect or inaccurate information, whether caused by site users, tampering, hacking, or by any equipment or programming associated with or utilized in the Competition.

Released Parties are not responsible for injury or damage to participant’s or to any other person’s computer related to or resulting from participating in this Competition or downloading materials from or use of Registration Site and/or Competition Site. Persons who tamper with or abuse any aspect of the Competition or Registration Site, as solely determined by Sponsor, will be disqualified.

Should any portion of the Competition be, in Sponsor’s sole opinion, compromised by virus, worms, bugs, non-authorized human intervention or other causes, or in the event the Competition is unable to run as planned for any reason, which, in the sole opinion of the Sponsor, corrupt or impair the administration, security, fairness or proper play, or submission of entries or comments, Sponsor reserves the right at its sole discretion to suspend, postpone or modify the Competition to address the impairment and resume the Competition in a manner that best conforms to the spirit of these Official Rules, or terminate the Competition and select the potential winners from all eligible, non-suspect entries received prior to action taken.

Participants, by participating, agree that Deloitte LLP, Deloitte & Touche LLP, Deloitte Tax LLP, Deloitte Financial Advisory Services LLP, Deloitte Consulting LLP, Deloitte Transactions and Business Analytics LLP, Deloitte Services LP, Deloitte USA LLP, Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), and any and all DTTL associate and member firms, all their respective, past, present and future parent companies, subsidiaries, affiliates, divisions, related entities, joint venturers, subcontractors, agents, attorneys, insurers, subrogees, co-insurers and reinsurers, all their respective, past, present and future officers, directors, employees, members, partners, principals, shareholders and owners, and all their respective heirs, executors, administrators, personal representatives, predecessors, successors, transferees and assigns (collectively, the “Released Parties”) will have no liability whatsoever for, and shall be held harmless by participants against, any liability for any injuries, losses or damages of any kind, including death, to persons, or property resulting in whole or in part, directly or indirectly, from acceptance, possession, misuse or use of the prize or participation in this Competition.

Each participant in the Competition, except where legally prohibited, grants permission to Sponsor and its designees to use their name, address (city and state), photograph, voice and/or other likeness and prize information for advertising, trade and promotional purposes, in any manner, without further compensation, in all media now known or hereafter discovered, worldwide, and on the Internet and world wide web, in perpetuity, without notice or review or approval.

In the event of a dispute regarding entries received from multiple users having the same e- mail account, the authorized subscriber of the e-mail account at the time of entry will be deemed to be the entrant and must comply with these rules. Authorized account subscriber is the natural person who is assigned the e-mail address by the Internet Service Provider (ISP), on-line service provider, or other organization responsible for assigning e-mail addresses by or on behalf of the Sponsor or any Released Party or recognized by the Sponsor or any Released Party.

GOVERNING LAW/DISPUTES:

By entering the Competition, participants agree that (i) any and all disputes shall be governed by the laws of the State of New York to the extent permitted by law; (ii) any legal action or proceeding relating to the Competition shall be instituted in a state or federal court in New York, New York; (iii) they will submit to the exclusive jurisdiction of, and agree that venue is proper in, these courts in any such action or proceeding, to the extent permitted by law.

SPONSOR

Deloitte & Touche LLP 30 Rockefeller Plaza, New York, NY 10112.