Effects of a Honeypot on the Cyber Grand Challenge Final Event

Abstract

Listen

Translate article

Throughout much of the Cyber Grand Challenge (CGC) Final Event (CFE), one team deliberately included a honeypot in the form of a simple buffer overflow within most of their “patched” services. This vulnerability could not be reached while executing on the CGC infrastructure but was trivially reachable when executing on other platforms, for example, an instrumented instance of the CGC execution environment used by a competitor during the competition to analyze software for vulnerabilities. This ruse fooled some competitors into abandoning working proofs of vulnerabilities (PoVs) to instead attack the honeypot. However, logic within the patched service designed to control execution divergence toward or away from the honeypot appears to contain a flaw, which led to the service crashing. These crashes occurred many times, to the detriment of the availability score of the honeypot’s author.