NSA Codebreaker Challenge 2024

[nneonneo]

This has historically been a pretty fun challenge to do. Earlier levels are quite easy, but later levels can be quite challenging and require specialized skills (e.g. reverse engineering, binary exploitation, cryptography). There’s a decent focus on “realism” which makes the challenge series more interesting than a typical CTF. If you’re eligible to participate I’d highly recommend checking it out.

P.S. if you do well, the NSA sends you swag; I have a couple of very nice signed letters and NSA medals that look great in my office :)

[paulluuk]

After reading "Permanent Record" by Edward Snowden and "Cult of the Dead Cow" by Joseph Menn, I can't help but feel like the NSA is basically "the bad guys", and I assumed most hackers would feel the same. Are people really excited to do challenges like these for them?

I don't mean that in an accusatory way, just genuinely curious as my perspectives (one from a whistleblower and one from 80s hacker culture) are obviously not the same as those of a modern day hacker.

[jjtheblunt]

I'd recommend reading James Bamford for a more positive look at NSA and their charter...which is essentially math, math, and more math, and unrelated to politics within NSA anyway.

The Snowden stuff is extraordinarily excerpted to that which a contractor (Snowden) was seeing in a post 9/11 strange fiasco which did bring politics into play. Bamford predates that mess.

Here's a link, for example.

https://a.co/d/eMTidtP

[ziddoap]

While I don't really like the NSA, I certainly respect their expertise.

And their expertise is exactly what makes a challenge like this difficult and fun.

[tptacek]

I would love to hear more about how Menn's book about a clique of nerdy teenagers shaped your opinion of NSA. (Some of those nerdy teenagers are friends of mine; we were nerdy teenagers of the same vintage. I'm not dunking on them.)

[sneak]

You’re right. The US IC has shown time and time again that they have no moral compass, no regard for the US Constitution, and no regard for human rights or the rule of law.

That said, neither do a lot of hackers. There is a long history of collaboration between hackers and the military-industrial complex. Silicon Valley is Silicon Valley because of the DoD. And the director of the NSA once gave the keynote at DEF-CON.

Even the best hacker movie, from which I take my nick, ends with the hackers assisting the NSA as if they are the good guys. :(

Intelligent people like Snowden don’t become as deep into the NSA as they are without a whole lot of “good guys” propaganda for many years first.

[YinglingHeavy]

Someone isn't Comms Aware.

Biggest event of 2013: Snowden.

Biggest film of 2013: Frozen (Let I.T. Go)

Biggest game of 2013: Last of U.S.

The NSA was effectively blinded for a period of time. Do you think bad actors didn't take full advantage of this? Where did Snowden work prior to NSA? Why doesn't Julian Assange have a Hollywood film?

[diggan]

> Anyone with an email address from a recognized U.S. school or university may participate in the challenge.

Aww, that's not so fun :( Was kind of curious to participate, but seems it's US + students only. Kind of makes sense that it's US only I guess, but why only students?

[tptacek]

It's a recruiting event.

[bangaladore]

I completed the 2022 version of this and received some nice NSA memorabilia. It is a fun challenge, but it is pretty difficult to complete it all. Looking back at 2022, it looks like maybe 100 people completed the entire challenge.

[diggan]

> it looks like maybe 100 people completed the entire challenge.

It looks like (https://nsa-codebreaker.org/leaderboard_2022) at least 350 schools has a "School Solve Times" that isn't null, so unless some students are enrolled in multiple schools, it seems like way more than 100 people managed to solve it.

[sigma5]

I got this error while trying to register. Does anyone know a simple way to bypass this ?

"Sorry, that email domain is not recognized. -- An email address from a recognized U.S. school or university is required. If your school's domain is not recognized, please request it to be allowed by clicking HERE"

[Something1234]

It is kind of an issue because a lot of people lose their school email when they graduate.

Asking the same cause this is one I've never had time to do when I was in university and would like to do it now that I'm graduated.

[Horffupolde]

It’s part of the test.

[FanaHOVA]

If you need HN commenters just to bypass the signup, you will not have a good time in the challenge :P

[bitwrangler]

there's a good list of resources and lectures if you're curious to learn more:

https://nsa-codebreaker.org/resources

[quibono]

Anyone else getting a 403?

[sandworm101]

Is it cheating to use commonplace AI? NSA are a practical bunch, they probably dont much care how one solves the problems, but AI could change the nature of such tests. The rules say no getting help from persons, which leaves the AI door open imho.

(Fysa, there is a reasonable chance that someone involved in this competition is following this topic. HN is known in the more nerdy corners of the int/defense world.)

[not2b]

I think it would be unlikely to be much help beyond the easy problems they start with.

[Jerrrrrrry]

I would love to see you try to get Gemini to make corporate puns, 3-figures removed from practical phishing utility.

[lallysingh]

Might be more acceptable if you use a locally hosted version, instead of someone else's.

[artem_dev]

Is it possible to view tasks from the past challenges? Just curious how it looks like

[sleepyink]

I archived what I could from the years I participated: 2018-2021:

https://github.com/luker983/nsa-codebreaker-2018

https://github.com/luker983/nsa-codebreaker-2019

https://github.com/luker983/nsa-codebreaker-2020

https://github.com/luker983/nsa-codebreaker-2021

[proctrap]

Hah some networks just get a 403 forbidden accessing this

[cbanek]

VPNs seem blocked and return 403

[drexlspivey]

Maybe that’s the challenge

[m3kw9]

First thing people does is feed it into LLM

[lpcvoid]

They care about US citizens enrolled in university. Everybody else is not employable - so I guess they filter well here.