EHack : The Untold Story

We have been covering EHack soon after it was announced. Our team was present at the location and live blogged right from there.We told you what was happening, we posted pictures , we helped you stay updated with all the happenings inside the hall.We missed out on one thing though, what happened outside.Interestingly, one of our guys was among the many who were left out, high and dry.

— Jay’s Story

It was 8.10 am when I reached the location, the crowd was huge as expected. What else do you expect for a event that aims to grab a place in the Guinness book of world records?

Also, a couple of our guys got to go inside to do a live blog.Our team had requested for wifi prior the event; nothing was arranged and they had to rely on their own internet and for some reason, they never got any 3G reception there. While they were helpless, one of the organisers was kind enough to share his own internet which he tethered from his Mac. Midway through the keynote, their batteries ran out and they could not do any more of live blogging.

Within 10 minutes after the official start of registrations.Shockingly, the registrations were closed.  Anyways, the gates were locked around 1000 people standing out there looking for an explanation. I saw quite a few people who claimed to have travelled hundreds of kilometers to make it here. Tough luck, they were left high & dry. The only thing that could be heard from the organisers “Registrations closed, go back.”

I did not mind that personally and was preparing to go back home and then saw people starting to shout. Why? Well they claim to have travelled hundreds of kilometers. Anyways, I was getting back and after some good 2 and 1/2 hours, I saw tweets from the organisers claiming to have allowed in 6000 more people. Yes, they really did that. 9000 people in there. After being left out for almost 3 hours.

Now, what went wrong?

Everything maybe.
Well, 21000+ registrations were reported and tickets rolled out to all of them.  Yet, one of the organiser tweeted “We did not expect this crowd”. Seriously ?Only 50% turnout is expected? At least when you promise to give away certificates. Especially when you claim to grab a place in the Guinness book of world records.So that is the bitter truth, everyone was there to be a part of the history. Infysec must have rolled out tickets selectively and kept the count in check. They seemed to be skeptical about the registrations and hence all the frustration.

I hardly doubt if Microsoft ‘s record would be considered broken. Afterall, they had 3000 people who knew to hack under one roof!

One good thing to take away from the event is that, when we talked to the participants they said they really loved Vinod’s training part and it was really useful.

After waiting about 3 hours and getting inside the Auditorium, About 50% of the crowd seated on the chairs were having a nice nap.It looked like they had come just for the Certificates. We got to sit down on the floor for the time being and that they were making arrangements to get seats.We don’t know what arrangements they were trying to make cause we were sitting on the floor till lunch break which was for an hour. We managed to get some seats and waited out the lunch sitting on the seats. During the lunch one of the “Organizer” came on the mic and asked the people who hadn’t got registered yet to make  a Queue near the stage to get registered. There were  a lot of people who hadn’t made their registrations yet. The Queue was huge and people started to crowd the stairs to  the stage. The “Organizer” started shouting at the crowd.Yes,Shouting at the crowd to make a proper queue. He could have used a lighter tone.When the people didn’t listen.He starts to threaten that the Registrations will be closed if the crowd didn’t step down.Note that it’s been about 15 minutes after the lunch break was announced. After about 20 minutes he closes down registration and asks people to come after lunch. The participants had to leave.So they had 40 minutes left for the event to start. By the time they came back the “Organizer” was back on Mic and asked people to just throw the bags on the seats down and sit down on the seats for the event to start. The way they treated the participants was awful. The only reason most of the people stayed because they had spent a lot of time travelling to the place that they didn’t want to go empty handed.Once everyone settled down the event started with a DJ followed by Vinod Senthil’s Training and a break. Vinod’s Session continued and I must agree it was the best part of the whole event. The Dinner break came up and Mr.Organizer came back on the mic and started telling the participants that the Certificates were being distributed , when the participants got out of their seats he says ” People who get the certificates now will not be allowed to come back into the Auditorium”  .Hearing this most of the people sat back on the seats. Mr.Organizer was surprised at the number of people who didn’t mind staying back for the event. He then tries hard for another 30 minutes on the mic to get as many people leave the auditorium as possible by saying that the Certificates for the people who stay back are the same. People just refuse to move and then he says that the Certificates will be giving only at 2.30 PM the next day for the people who stay back. It did not sound professional at all.We didn’t feel welcome. The crowd outside to get the certificates was so huge and messed up, even the certificate distribution was poorly managed. After all that we still stayed back to take part in the Capture The Flag event. The link to the site was announced around 7 PM and we couldn’t even register in the event. We had to provide our Phone Numbers and the OTP’s weren’t working. After atleast two hours we were able to register but not able to access the Quests in the CTF. The CTF Dashboard was complete mess again. By the time the team members finished registering it was 10 PM and by then the CTF started showing 503 Errors. There were no announcements about what was happening. When we asked a Volunteer what the problem was he simply says  “I’m not part of the technical team” He doesn’t try to help us. He had a walkie talkie in his hand for god knows what. He could have used it to speak to the technical team and ask what the problem was they were very busy taking photographs with the DJ’s equipment and the walkie talkies while we were completey left in the dark. The server was not configured properly that it could not handle even 1000 Concurrent visitors to the website. Infysec is an Information Security organization, They know the CTF is going to be a world wide release and from what happened it looks like they did not even conduct a load test before the event. Even a simple blog can handle 1000 Concurrent users. The CTF was a complete mess. A few people had access to the CTF while some only got 503 errors. The lucky ones got a very good head start.While we only got 503 errors.They hosted the CTF on a different server with a different sub domain and announced it to the  particpants .We couldn’t login because they had to create a completely new app for oauth .The Sub-domains were different.  By the time we could see the first question of the event it was 1 AM Sunday and guess what it wasn’t a Capture The Flag event.It was know your history. The first question had nothing related to hacking we had to google the question and find a persons name,someone related to Akbar. We found the answer and hit Submit. Guess what . We got a 503 error again. The CTF wasn’t a CTF at all. It was just a typical Treasure Hunt like most of the Engineering Colleges these days have. In one of the level’s we had a question ” What would you do to escape ” it was a simple cookie injection level. We expected to get the answer by modifying the cookie .We tried and it didn’t work. Just for fun we just copied our cookie and entered it in our answer for “What would you do it escape” it worked! We got past the level. It was very pathetic the coders didn’t know how to actually make the page work so they just made us enter the cookie value in the answer field to get past the level. Well that was it. We lost our patience we left the event.

Photo Courtesy : KG Sriram

Update : We just received the official numbers, there were 14000 registrations off which 3800+ where international registrations. So, there has been a massive 90%+ turnout. Unexpected. We have personally seen many events were 100 ‘s of tickets are rolled out but hardly anyone would turn out. 60% is the maximum turnout any host would expect, But when you promise to get into the Guinness book this is bound to change.