feat: add jpeg_comment_steg, policy_derived_credential and decoy_artifact_set atoms - #11
Open
eastmadc wants to merge 1 commit into
Open
feat: add jpeg_comment_steg, policy_derived_credential and decoy_artifact_set atoms#11eastmadc wants to merge 1 commit into
eastmadc wants to merge 1 commit into
Conversation
…fact_set atoms Three patterns from a hardware CTF run at DEF CON 34, written to the existing atom format and verified to load through goe.construction_crew.atoms. jpeg_comment_steg hides a route in a JPEG COM segment as base64. Its testing guidance says explicitly that a plaintext search of the image finds nothing on a healthy artifact, because a procedure that greps the raw bytes will otherwise report a false negative. policy_derived_credential publishes a construction rule rather than a password, so the credential exists nowhere as a literal and has to be synthesised from the rule plus a discoverable account. decoy_artifact_set places several convincing artifacts where one is genuine, so the step is discrimination rather than access. Its testing guidance requires asserting that each decoy does NOT satisfy the edge -- the check that decides whether the set works, and the one that fails silently.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three atoms from a hardware CTF we will run at DEF CON 34 this month. Written to the
existing format and verified to load through
goe.construction_crew.atomswithall four sections extracting.
jpeg_comment_steg— hides a route in a JPEG COM segment as base64.policy_derived_credential— publishes the password construction rulerather than a password, so the credential exists nowhere as a literal.
decoy_artifact_set— several convincing artifacts, one genuine, so thestep is discrimination rather than access.
Each one's Testing Guidance names the measurement mistake it will cause, because
we made them. For
jpeg_comment_stega plaintext search of the image findsnothing on a perfectly healthy artifact — the note is base64 — which cost us a
false "the box is broken" call. For
decoy_artifact_setthe load-bearing checkis asserting each decoy does not satisfy the edge; a decoy that happens to work
turns an inference step into a guessing game and nothing else reports it.
uv run pytest -m 'not docker and not llm'— no new failures. (14 fail beforeand after on my machine, all pre-existing and Bedrock-related.)