Summary: A hands-on review of Abhinav Pandagale's full-color PCB conference badges for RSA Sandbox and BSides SF. The BSides badge includes an embedded Arduino-based capture-the-flag (CTF) challenge activated via Serial Monitor. The author completed five themed puzzles that light badge regions, shared tips (bring a coding buddy, spaces allowed, hints helpful), and praised the approachable difficulty and fun reward (a UFO abducting a cow). Links to tutorials and more badges are on Hackster and hackerwares.in.
Parts used in the BSidesSF Badge Project:
- Full-color PCB badge (BSides CTF badge)
- Micro USB connector/cable
- On-board LEDs (various regions)
- Embedded microcontroller compatible with Arduino IDE
- UV-printed artwork on PCB
- Optional custom remotes (compatible with RSA badge)
- Personal computer running Arduino IDE
- Standard web browser (for hints and website)
A cozy night in with a hardware capture-the-flag challenge, embedded in a gorgeous PCB conference badge!
This year, I had the pleasure of interviewing Abhinav Pandagale about his full-color PCB badges for this year’s RSA Conference and BSides SF security events in San Francisco. He showed me some cool demos and info about the UV printing used on both badges:
Abhinav has posted tutorials for both badges on his Hackster profile:
- RSA Sandbox badge, with remotes
- BSides CTF badge
As he mentions in the interview, the RSA badge is compatible with a set of custom remotes that activate LEDs corresponding to different villages, while the BSides badge contains an embedded capture-the-flag challenge (CTF). Plus, if you completed the CTF during the conference, you got a little add-on with a UFO abducting a cow! It took me until this November to actually try it out, but it made for a great evening of nerdy fun with my partner, T.
We started by turning the badge off, plugging it into my computer over Micro USB, and firing up the Arduino IDE. Then, we launched the Serial Monitor with the required settings and sent three stars (***) to start the challenge. Immediately, we were greeted with the first piece of ASCII art and a “system error”: the first of five challenges. With each completed challenge, a different area of the badge lit up, which was thematically linked to that challenge. I love that little design tie-in!
Here are my tips for anyone attempting the CTF:
- Bring a code buddy. Since T has a lot more programming experience than me – which came in handy several times – he recognized the initial “error code” as a particular type of encrypted text… and that’s all I’ll say about that.
- You may use spaces in your answer.
- The hints were perfect – we did end up using the last three, especially because it was getting late near the end! If you’re kinda stuck but don’t want to use the hints yet, try poking around the website a little.
Difficulty-wise, the challenge was very approachable. It took us about 3 hours, from 11pm to 2am, including a bit of a side quest where we decided to try installing Kali Linux on a Raspberry Pi in case it came in handy. (It did not – you really only need the board, the Arduino IDE, and a standard browser. But don’t let that stop you!)
If you can’t get your hands on this board, you can try similar challenges at conferences like RSA, DEF CON, and Hardwear.io (a dedicated hardware security conference). I tried one a few years ago at Hardwear.io that involved using thermoformed plastic beads to create a simple utility key, dumping the program flashed to an Arduino board, and re-balling a BGA chip… which is a great way to learn how to blow tiny silver solder balls everywhere with a heat gun.
As for this challenge, the art alone was well worth the effort! I learned a few techniques, and it was satisfying to contribute a bit of non-programming knowledge to the team. Plus, it feels like I’ve finally earned my little UFO cow.
I hope Abhinav does another CTF; you can see more cool badges on his Hackster profile, and follow more of his work over at hackerwares.in and on social media.
Source: A Hardware CTF on Arduino: Abhinav Pandagale’s BSidesSF ’23 Badge (No Spoilers!)
- How do you start the CTF on the badge?
Turn the badge off, plug it into a computer over Micro USB, open the Arduino IDE Serial Monitor with the required settings, and send three stars (***) to start. - Can you use spaces in your answers?
Yes, you may use spaces in your answer. - What tools are required to attempt the badge CTF?
You really only need the board, the Arduino IDE, and a standard browser. - How many challenges are in the badge CTF?
The article mentions five challenges. - Are hints available during the CTF?
Yes, hints are available and the author used the last three hints during their attempt. - Is programming experience helpful for the challenge?
Yes, having a code buddy with more programming experience was helpful for recognizing encrypted text and solving puzzles. - How long did it take to complete the CTF?
It took the author about 3 hours, from 11pm to 2am. - Does completing the CTF give any reward?
Yes, completing the CTF at the conference awarded a little add-on showing a UFO abducting a cow. - Where can I find tutorials for these badges?
Abhinav posted tutorials for the RSA Sandbox badge and the BSides CTF badge on his Hackster profile.
