All vulnerabilities are welcome, but winners will be determined based on various criteria.
Damage (Scoring). Attacks that demonstrate significant damage are scored higher than weaker attacks.
- Full device control: 5000 points
- Unprivileged/partial control: 4000 points
- Corruption/compromise internal network: 4000 points
- Modification of router behavior or controls: 3000 points
- High-value* information leakage: 3000 points
- Bricking: 3000 points
- Denial of Service: 1000 points
- Low-value** information leakage: 1000 points
**High-value information may include administrative or other passwords, user files, network information, etc.
**Low-value information may include router-specific information, such as router name, user names, etc., but nothing that would ordinarily have value on its own.
Penalties. Attacks that require special conditions and caveats are subject to point reductions.
- Non-remote attack: -1000 points
- Requires human interaction: -1000 points
- Requires authenticated session: -1000 points
- Requires administrative password: -1000 points
- Requires other system/network information: -500 points
- Requires special system configuration: -500 points
- Relies on other special circumstances: -500 points
- Exploit is unreliable: -500 points
- Lack of post-exploit control: -500 points
Guru compromise. Must score 5000 points
- demonstrate the most powerful attack in all categories with no caveats.
- Hotel accommodations for two (2) people for DEF CON 26
- 2 DEF CON 26 Badges (Cash Value*)
- $500 Cash
- Trophy
1337 compromise. Must score 3000 points
- pretty damn close to grand prize, but constrained by falling short from most powerful in any category, or having sufficient caveats to make the real-world application of this attack less likely.
- 1 DEF CON 26 Badge (Cash Value*)
- $250 Cash
- Trophy
Rabble rouser compromise. Must score 1000 points
- less damaging attacks than full control, but still represent significant security compromises.
Still good compromise. Must score 100 points
- weaker attacks, but exploits nevertheless.
You may submit multiple exploits, compete multiple times, and win multiple and duplicative awards.
Prizes are limited.
Aug 9th-11th, 2019
Eldorado Ballroom in the Flamingo
