K.L.M

Registrations for crewCTF 2025 are now open 2025.crewc.tf/register Thank you to our generous sponsors who made our event possible : @osec_io @googlecloud #crewCTF2025 #CTF

This weekend we participated in TFCCTF by @TheFewChosenTFC & NSSCTF by @nnsctf and placed 🥇in both! Winning TFCCTF we also qualified for @DefCampRO finals in Bucharest, Romania. Huge thanks to both teams for organizing wonderful event and congratulations to other winners🥳

Proud ;))

🎉Victoire au DaVinciCTF 2025 ! 🎉 Le week-end du 24 mai, notre club GCC-ENSIBS a remporté la première place 🥇du DaVinciCTF, organisé par DaVinciCode Bravo à notre équipe ! : @50mgDrahoxx @Clemhate2 Théo "Shynif"

We did Pretty good, again 😋

Proud ;)) managed to solo the data recuperation and rank third !

Sans infra ⚒️, pas de challenges ! Courage à nos Infra-makers pour la dernière ligne droite 💪! @adam_le_bon, @HGSlinky, Raphael (from @icodia), @_Ionniz_, @__Sp4rKy__ (from @Claranet_Fr) et @Zeecka_ !

Hope you will like my challenges ;))

Some thoughts on the recent hack(s). There is a pattern where hackers were able to steal large amounts of crypto from multi-sig “cold storage” solutions, as with ByBit, Phemex, WazirX and potentially others. In the most recent ByBit case, the hackers were able to make the front-end user interface show a legitimate transaction while the actual signing was for a different transaction. I am less familiar with the other cases, but they sound similar based on limited available info. What’s more scary is that the affected exchanges used different multi-sig solution providers. The hackers, the Lazarus Group, are highly advanced and broad in their abilities to penetrate. It is still unclear whether the hackers were able to penetrate multiple signing devices, or the server side, or both in each of these cases. Some people questioned my suggestion of halting all withdrawals as a standard security precaution (in a tweet I posted from a shuttle bus to the plane). My intention was to share a practical approach based on my experiences and observations, yet there is no absolute right or wrong in either approach. My guiding principle is always to lean on the safer side. After any security incident, pause everything, make sure we fully understand what happened, how hackers penetrated the systems, which devices were compromised, triple-check all is safe, and then resume operations. Pausing withdrawals could cause more panic, of course. In 2019, we paused withdrawals for a week after a massive $40 million hack. When we resumed withdrawals (and deposits), we saw more deposits than withdrawals. Not saying this is a better approach. Every situation is different. It’s a judgment call. My tweet was to share what might work and my intention was to show support in a timely manner. I am sure Ben made the best decision based on the info he had. Ben did a good job maintaining transparent communication and calmness in dealing with a challenging situation. That shows a sharp contrast to other less transparent CEOs, like WazirX, FTX, etc. The cases mentioned here are all different. FTX was fraud. WazirX, I will refrain from commenting as there is an ongoing lawsuit. Most importantly, we should never take security for granted. It is important to learn about security yourself so that you can choose the right tools for your needs. For this, I will share an article I wrote a few years ago. It’s a little outdated, but the fundamental concepts still apply. Stay SAFU! binance.com/en/blog/from-o…

Gg @50mgDrahoxx for the top 10 !! Thanks @zigtur for the race ;))

✳️ In the vast Khugaverse, only the mightiest warriors will rise to claim their destiny in the highest realm. ENGAGE = POINTS 🔗 Join the journey: premint.xyz/khugaverse-x-a…

🚨 Save the Date 🚨 Dive into the world of blockchain and smart contracts with Web3 Month this January featuring 4 live conferences (held in Frnech)! 🔥 🔍 January 3: "Autopsy of My First Audit" by @xmikb 🖥️ January 10: "An Immutable Blockchain, Really?" by @Clemhate2 🛠️ January 24: "EVM vs SVM: What Are the Differences Between Smart Contract Platforms?" by @zigtur 🏳️ January 31: "Reverse/Pwn Smart Contracts in CTF" by @m4k2_0x 🕗 Conferences start at 8 PM on our Twitch channel twitch.tv/rootme_org!

🚨📢 Last day of Root-Xmas For this last day we wanted to make something a bit special, no tryhard needed (or maybe a bit 👀). Our final gift for all the community is not one but two challenges on xmas.root-me.org 🎄 - 1 feedback form (quick'n easy) - 1 Santa's Root-Xmas quiz (be ready to sweat a bit) 🚩 1 flag will be rewarded for each challenge. Also, we would like to thank you all for your enthusiasm and dedication towards this event, we have rarely encountered such engagement from the community for this long of a period. You are the real heroes that fuel us the will to build such events ❤️. Be assured that we'll soon enough be announcing new events 🤫.

Made by me with love for this advent CTF :)

As Always, very good score, proud of my team ! I managed to clear all the blockchain challenges with my friend @50mgDrahoxx !! GGs

🎅Join in the Root-Xmas !🎅 🎄24 days, 24 challenges! From Dec 1, discover a new challenge every day at noon. For all skill levels! 🎁Earn points for each challenge solved-the top scorers will win surprise gifts to keep the Christmas magic going! 🔔Join here: xmas.root-me.org #RootXmas #AdventChallenge #RootMe

Thanks @gcc_ensibs ! Congrats to everyone ;) really proud of my team !

📌Après 7h intenses de compétition, l’#EuropeanCyberWeek CTF 2024 se termine pour nous avec la 2ème et 4ème place ! 🥈🏅 Un grand bravo à nos deux équipes et toutes les autres ! 🔥 Bravo à L’@EsnaBretagne pour la première place ! On se revoit au @hackthebox_eu University 😋

@shunduquar Reentrancyyyyyyy

Proud to be amongst the organizers of this wonderful event sponsors by @rootme_org ! I managed to create a speed run round where players had to escalate privileges on multiple users 😋 Thanks everyone !