OSINT Teamwork: How We Won The Trace Labs DEFCON29 Black Badge

  • Start scouting your team well ahead of the event date
  • Choose a team that has varying skillsets
  • Don’t discount new players, they might look at things from a new angle
  • Choose committed players so you aren’t down a member on game day
  • Meet ahead of the event to formulate a plan
  • Pick a communication method (Discord, Teams, Slack, Zoom)
  • Pick a method for keeping track of submissions (Coggle, Google Sheets)
  • Check-in often and share findings with the team
  • Ask for help from your team and switch subjects as needed
  • Plan for who will be the main communicator with the judge
  • Set clear expectations for tasks
  • When the game opens, divvy up the subjects according to player skillsets (some players are better at finding U.S. based subjects, some are better with teenagers, etc)
  • Be sure to introduce yourself to your judge
  • Be kind, some judges are new and trying to understand the rules
  • Don’t hesitate to escalate an issue to a senior judge for review
  • Remember most judges are judging more than one team at a time
  • When submitting flags, provide enough context that the judge is able to make a determination without working too hard
  • Submit the small things (tattoos, ear piercings, hair color, necklace that is always worn)
  • Have the person who communicates with the judge check the rejected flags often for any that may need a second review
  • Many high-value dark web submissions come from breach data, be sure to pivot appropriately from emails and usernames
  • Be sure your team is on the lookout for an intriguing story before the game starts
  • Can you tell a story through flags or imagery that would be compelling?
  • Example: A person takes a photo in a store, your team geolocates the building based on the signage in the background and the proximity to the subject’s work. Put this in a report and submit it.
  • Don’t be afraid to spend extra time on a detailed overview of your submission explanation, especially for the information you may believe to be crucial. In this case, Chase spent nearly 30 minutes piecing together an explanation that consisted of a detailed overview and relevant imagery.

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store