[Music]
Hello, welcome back to the education
track. Uh it is my absolute pleasure to
introduce Edwin uh talking about
capturing flyers fly capturing flags
with microbus. I have known Edwin
Griffin for about a decade and he became
my hero
about a decade ago when you unwaveringly
went above and beyond in the cause of
supporting students and helping
volunteers communities. Um I noticed
that that you do have a bit of an honor
guard at the back there like a row of
students.
I'm not I'm not sure whether they're
waiting to judge or here to support.
Will judge. They've qualified judge. Um
Edward's been teaching for uh a decade
more. Um every year I am absolutely
blown away by the quality of the
students that I hear about. Um just
mind-blowing things that if another
teacher came and said, "Hey, I think I
want to do blah machine learning and
this and that." I'd be like, "Great. Um
have fun with that." uh and somehow you
make it work and it is amazing and
unbelievable and a credit to um the
community that you bring them here as
well for us all to enjoy. Um
thank you. We're going to hear about
Flags with Micro Bits. Yep.
Um Edwin, make Edwin, welcome. Thank
you.
Um hello speaking. Hello. Uh who am I?
Uh Nikki just gave me a wonderful
introduction. Um, but that is my name.
My name is Edwin Griffin. Um, I am a
digital technologies teacher. I
primarily operate in the 9 to2 range.
Um, I currently work at the Bergman
Anglican School in the ACT. Um, and I
have poor impulse control. This is going
to come up several times. Um, this is a
photo of me. I'm the one in the red
circle, which is hopefully obvious at
this point. Um, that photo is a decade
old almost. It's from a previous python
actually, which is pretty cool. Um, I
have lost a lot of hair since then. But
anyway, um why am I here? Um I used
microbits to make a dodgy
uh capture the flag competition.
I have brought with me what I like to
refer to as my exam box. It's a jumbled
mess of about seven micro:bits. But
within this box plus some cloud storage,
there is sufficient suppliers to run a
cyber security exam um using a
surprisingly small number of small
volume of equipment. Um so I did this
thing. It went significantly better than
I ever expected it to go. Um and I
thought this would make an interesting
story and someone at PyCon agreed that it
would also make an interesting story. So
um I'd come and talk. Also, if anybody
wants to talk about the box or just
wants access to all of the code that I
use to make this exam, plus the actual
exam itself, please talk to me. Um,
anyway, before we get to that, I figured
I'd do some little overviews on exactly
what's going on here and answer some
questions like, what is a micro:bit and
why do we care about this thing? Um, how
do we use the micro:bits? Do we use
software? Why is the fnt a different
font? That is a
very good question. Um, I don't know how
that happened. Um, and then does this
entire thing work on Chromebooks? Um,
which, uh, a large number of teachers
repeatedly ask me, can we do this on
Chromebooks? And it turns out, yes, you
can do the entire thing on Chromebooks.
Um, all you need is browser access. Um,
so what is a microbit? Microbits are a
wonderful piece of tech. They are an
embedded system much similar to an
Arduino. They are cheap. They have a
bunch of components baked in and they
work entirely with Python. Um, this is
wonderful. And the part that I really,
really love is this thing here where it
says radio antenna. Um, I make extensive
use of that. So, how do we use these
things? Um, I use this wonderful piece
of software called code with MW. You
might notice at the top there is a giant
red banner that says MW is no longer
maintained and the project has been
archived here. I discovered this two
days ago when I put these slides
together. As of the start of the year,
it was fine. Um, as of right now, it
still works and still does the job it
needs to do. I am now searching for a
different piece of software, but
fortunately, um, it also works
completely in the browser. Um, if you go
to python.microbit.org, you will get a
Python um, browserbased editor. Uh, you
can write code in the middle, there is
suggestion code on the side, which is
super useful for helping students learn
how to program in the first place. Um,
you have a simulator on the right hand
side and a really, really critical
button that I love, which is the show
serial button, um, which is again how I
power most of this thing. So, there's
also a send to micro button. So, if
you've got a micro plugged into your
computer, you can upload code directly.
Um, and then you can observe the serial
on that microbit that's running over
your USB port um, in real time. And you
can use this to allow communication,
which again what I used extensively
here. So,
we're going to start in 2023. Um, most
of this takes place in 2023. Uh, so
we're going to pretend right now that
it's 2023. Um, I at this point I've been
teaching 910 for two years. Um, I get
told at the start of the year that, hey,
the V9 curriculum is a thing. I should
be using the V9 curriculum to teach. Um
I decide yes sure let's do that. I go to
look at the V9 curriculum and I get this
um achievement standards students
explain how to manage digital sorry
students explain how digital systems
manage control and secure access to data
and model cyber security threats and
explore a vulnerability and I thought
cool
um I don't know that uh so I love
cryptography um cryptography is a
beautiful merging of math and language
it is a wonderful area and it just makes
my brain Happy happy. Yes. Um
I don't know much else about cyber
security. This is a bit of a problem
when I've got to teach cyber security.
Um I wasn't exactly sure how to get help
around this stuff. Um fortunately I live
in CRA and here we have lots of
different kinds of local competitions.
Um also the internet exists which is
nice. Um and there's a bunch of online
coms too that my students found and were
able to make use of. So I found about
these things called capture the flags.
These people helped me out a great deal.
um the Pan Plus programming competition.
Um uh originally Perth and CRA, hence
the name Pan.
Uh but that eventually became pretty
much in every capital city in the
country. They run an incredible two-day
comp and one day is purely learning. Um
was a fantastic way for me to learn a
bunch of stuff about this, but also my
students to attend and learn a bunch of
stuff about it as well. Um we did the
Locky Martin Cyber Quest competition. Um
back in 2023, Cyber Taipan was still a
thing. I believe it's rebranded in
significantly since then. Um, also
online competitions like Pico CTF, uh,
there's Try Hackme, there's Hack the
Box, there is Over the Wire Games. Now,
my students said they really loved doing
these things. They had lots of fun doing
these things. They enjoyed it more than
doing some of their other subjects,
which the other teachers complained to
me about, but I said, I'm just cooler, I
guess. Um, and on that topic, I looked
at all this and I said, I could do that.
At this point, I'd like to remind
everyone that I have poor impulse
control. So,
um, it is 2023. It's February. It's week
one. Um, I put together my unit outline.
I am going through it with my new batch
of year 10. Those year 10s are the ones
sitting at the back, by the way. Um,
great. Um, I get to the part where I
slotted in the cyber security unit and I
look around this class and I'm thinking,
man, I've learned all these cool things.
I have all these cool topics to talk
about and they seem bored. Um, and I'm
like, wouldn't it be cool if we finish
the unit with a cyber security exam
that's run as a CTF? And they go crazy
and they love it. And I realize I have
poor impulse control.
Um, cuz I haven't haven't thought about
this yet. Anyway, um, scheduling, it's
fine. It's still fine.
It's still fine.
It in fact might not be fine. Let's go.
Yay. It's still fine. It's February. Um,
yeah, cyber security I've scheduled for
week 2, term two. I don't have to worry
about that. I got three months to
prepare. I blink. It's term two. Oops.
I haven't started yet. Um, and I remind
myself I have poor impulse control.
So, we need to come up with sorry, we
need to come up with a plan. Um so one
I'm going to use microbits I can form a
network with those microbits. Uh one the
numbering system is going to seem
unconventional but it'll make sense
later. Um students will have to map that
network and find the bots. Two students
will use the microbits to monitor and
then speak to the bots. While doing this
they're going to find bots that speak in
a cipher. They can crack the cipher and
receive a suite of instructions. By
following the instructions that will
lead them to another set of ciphered
text. If they solve all of these things,
they'll get something steganography
related like a Morse code and that will
conclude the exam and everyone will
think this is really cool. Now you might
have noticed the numbering is a bit off.
Each one of these stages I broke into a
se separate section of the exams. So
stage one, stage two, stage three and
stage four. Each one of these stages
actually really conveniently meets a
different elaboration of the achievement
standard that is required for the cyber
security component. And I realized this
would actually make it super easy to
mark too because I can just say, "Hey,
you finished stage one, you get a D. You
finish stage one and two, you get a C."
Yeah, that's the next letter. Uh, you
finish stage one, two, and three, you
get a B. You finish stage four, you get
an A. Um, so I now have a mapping of
what I want to do with the achievement
standards and I've I've I've taught I've
done a pedagogy. It's great. Um,
eventually I construct this and this is
this is when I take that box and I lay
it out and this is what I get. Um, due
to the glory of cameras, you can't see
the LEDs flashing because timing and
physics. But each of those LEDs has a
different letter on them. Um, we have
ABCDE E F and then R. This corresponds
to
a microphone that's falling. This
corresponds to um Alice,
the one that comes after Alice.
Bob. Thank you. Um, Charlie, Dan, all of
our normal wonderful
cyber security things. Sorry, microphone
is not playing nice today. Um, and so I
put together um a suite of code that I
can then shove onto each individual
micro bit and they can all start
chatting with each other. Um, you may
notice that some of the names don't
exactly line up with our traditional
thing. Uh, as I said earlier, I work at
a school called Bergman and I like to
shorten names. So Bergman very rapidly
became burgers for me. Um, which is why
we have the chips agent and the aclair
agent and then fries spelled wrong. Um,
or just mispronounced, I don't know.
Anyway, I am then faced with the problem
of how do I actually get all of these
students to learn this information.
When I when I was preparing for this
presentation, um I was told that perhaps
zooming in on the Grock logo um to this
degree uh on a big screen might seem a
little weird. Um but I stand by my
decision. Um
Grock Academy has two courses that
simplify things immensely. Here we have
the cryptography Python course and the
network security course. Um these two
courses are super useful. Uh they cover
data representation, single key ciphers,
frequency analysis and a visionire
cipher. uh basically everything students
need to be able to crack basic ciphers.
Um the network and cyber security course
covers communicating through networks,
addressing in a network, routing packets
through networks and network security.
All of this is done on a micro:bit as
well. This was perfect for everything
that I needed to do. So my prep is
sorted. I have all the content the
students need to do. I bought myself
three weeks of time. I need to actually
write an exam now. Actually, I need to
write two exams because I was terrified
that if I took all of these concepts and
shoved the students in an exam, they
would panic and freak out and would have
no idea what to do. So, I had to run a
pass exam first. And that was very
literally what happened. Um, I have
students sitting at the back of this
room who will today present on
absolutely incredible um intense
computer science topics. Um, and on the
first run of the practice exam, some of
them failed miserably. Um, as it turns
out, panic is a thing. So, what we have
here is definitely the real exam. Um,
I'm going to add a caveat here that I
have some enterprising students who have
in the past um, understood that I go to
conferences sometimes and I present
about my assessment and um, they have
Googled my name and assignment titles
and found copies of me talking about the
answers to exams and assignments at
conferences. Um, and so what I presented
here is a link to uh the practice exam.
And I am sincerely hoping there's a
student who will at some point watch
this on mute and will painstakingly type
out every one of those letters
and we'll get access to the exam that
they already have. Um,
now um what I have dotted around this
wonderful thing is actual quotes from
students. Um, I was being the mature
individual and decided to anonymize
these names. Some of the students are
sitting in the back of the room and they
were upset that I anonymized their
names. So I will reveal them at their
request. Um so we have uh Alex at the
back who when I asked how the exam was
going, he said, "Please stop trying to
make learning fun." Um
uh another student who is not here but
his name is Ren. Um said, "Wow, I never
thought I'd look forward to an exam
before." Um Mashia, whose real name is
Shri, um who will be presenting today as
well, uh said, "I loved moving around
during the exam."
Yeah, let's let's swap. This thing is
unfortunately
I think it looks better this way.
Anyway, um and then we have Jeff um who
when I asked how did you find the exam?
He said, "Why are you talking to me
about this? Please leave me alone." Um
he was
hoping
pointing at my face. Are we good? Thank
you.
Awesome. Thank you. Um Hey, a
yay. Awesome. Um uh Jeff did not like my
class. Um he left my class soon after
this exam. Um but he's a nice person so
he got a shout out. Anyway,
um so I mentioned before that I had to
break the exam into uh four components
and the first component was part A which
was when we mapped the network. The
purpose of this was to orient the
students to the network that we were
using. Um now the networking course goes
through how a router works and I
basically reuse the same course on my
micro:bit. So the students were familiar
with the experience. Um I gave them this
question complete the following table.
They basically had to build a router
table. Um this serve two purposes. One
force them to actually go through the
network and two force them to write down
the information they got from the
network because writing down things is
hard. Um
uh they need to write code that's going
to let them navigate through the
channels, check for communication on
those channels and record the
information they find. So students took
a lot of different approaches to this.
Um, this was a pretty basic one. Uh,
this is what everyone sort of starts
with and the idea is you just hardcode
in the channel number into the microbit
and then if you find a message in that
channel, you print it out. Um, if you
don't get a message, you go back into
the code, you change, you edit it, you
reflash it, you run it again. Um,
there are 82 channels available on the
microbit radio. If you do this for every
time and your chat flash takes 10 to 15
seconds, um, you're looking at 25
minutes of an exam sitting there just
re-uploading code. Now, that's a
wonderful brute force method and it
might eventually work, but boredom is
also a problem and you might just get
tired and skip channels. Um, so this was
not ideal. Um, this is pretty good. Um,
I had a student who just slapped onto
the buttons, hey, we can rotate through
the channels on our buttons. um when we
get to a channel, print the message out,
print any messages out. Um this method
was what most students made use of. Um
this method was really fun. Um I had a
student who very correctly assumed that
if a bot is going to be sitting on that
channel, they will probably have an act
of some kind. And so if they push a
message out, they don't need to wait for
a response. They can just get the
response immediately. Um and so he wrote
a for loop, looped through every
channel, pushed a message out, scared
some of the other students in the class
at the time. Um,
but he managed to map the network in
less than a minute, which was terrifying
and cool. Um, so
they know the channels, they map the
network. Uh, it's time to actually read
what is being said. Um, so that we can
learn things. The idea here is to get
them comfortable with the idea of
reading messages from the bots and then
sending messages to the bots and and
doing the communication part. Um, so I
give them this question. What happens
when you send a message in the wrong
format to those agents? what happens
when you send a message in the right
format to those agents.
Um, I wanted there to be traffic of some
kind. Um, I didn't want to have to fake
a bunch of conversations or fill it with
junk data. Uh, so I did this. Um, I was
like, "Hey, chat GPT, it's 2023. This is
a cool new thing. Um, I need a series of
measures that are less than 20
characters in length that use terms and
phrases that will confuse and annoy
15-year-olds. Uh, but it must sound like
a real conversation." Um, and then, uh,
Chacht gave me a thumbs up and I was
like, "Sweet. Okay. And I get this. I
get message banks. Um I I take all the
messages, I organize them into different
lists, and then I pass those to the
bots. Um and I get conversations to
start looking like this. Alice says,
"Sup, hang." And Dan goes, "Oh my god,
no way." And Alice says, "Got to go
later." And then Alice says, "Sup hang
again." Because there aren't that many
messages and it randomizes and say
message twice.
But it's close enough. So now I want
them to record. I want the students to
record a conversation um and then try to
actually interact with the student uh
with the with the bots. Um so we have
some pretty simple methods of trying to
of trying to interact with the bots um
go to the channel and then on a button
press hit radio. And then you have your
source destination um payload.
Uh we had some other iterations on this.
Um, I had one student that did a pretty
cool thing um that realized that you can
just shove input into your code and that
way if you pre-program your source and
destination, you can just put an S
string through and then have uh whenever
you press the button to send a message,
you can type in the message instead of
having to hardcode the message. Um, this
sped up his process through it. It was
pretty cool to see. Um, the bot code for
response, pretty straightforward. Um, if
they get a message, check it in the
right format, send an act. Um, randomly
send a message every 3 to 5 seconds. um
so that it looks like we're having a
conversation.
Uh it looked like this. Um if the
message is in the correct format, i.e.
there's two colons, um break it up into
source destination payload. Um if it's
an approved user, send an act. If it's
not an approved user, send a message.
And then if they don't use right format,
send a different message. So each bot
then has their own unique response for
if the user isn't in the writing table
and if the message is not in the correct
format. Um I believe this was Alice and
then Bob had these messages and then uh
yes um I was questioned on um why I had
the bot say these words and I ignored
those questions. Um and then we had the
router and I during the exam would have
the router plugged into my computer so I
could observe it directly and I had some
error messages on there to just be like
something has happened that I probably
need to investigate um just to warn me
um really quickly. So
this is cool. The students have mapped
the network. The students have talked to
the bots. Um
when they go through that network, one
of the bots will be a little bit weird.
They will say this DLJ SPIZ also go to
your channel. Um
I discovered that there's going to be a
problem when communicating on open
channels with some cross communication
happening during my first run. uh if the
students need to talk to the bots and do
cool things like find a passphrase and
use it or send them a specific message
um or just normally chat that
information is visible to everyone else
who's also trying to talk to the bot at
the same time. Um this means students
can cheat super easy. I had to address
this. Um if I have 25 students in a
room, it gets confusing really really
quickly. So I decided that what I needed
was a student router. I grabbed their ID
numbers to use as a sender. I randomly
assigned them a channel number. Um I
distribute that channel number to the
students ahead of time. So the students
all know what channel they're supposed
to go to. Um it looked like this. We
have a nested dictionary. The ID is the
key. The subdictionary is any data they
wanted to have. And this is when I
realized something cool. Um obviously I
have to have the channel number in
there. But I could also put some other
interesting personal information in
there like their middle name or their
address or their parents' names. Um and
then I realized something else really
cool. I have these bots that are now
speaking only to them and I could
personalize this and have them talk to
them directly. And while that would be
weird to have happen in exam, it is way
weirder if you only do it with about 10%
of the students
[Music]
and you randomize what details you give
each of those students and then when
they talk after the exam, they get
really scared.
I have poor impulse control.
Um, so,
uh, we have this cipher. We have DLJ
squiz. Um, that is a pretty basic
rotation cipher. Um, I wanted them to
start with something super easy that
they could crack. Um, GJ Squizz
translates to say hello. Um, this is
what, uh, Dan's code basically said. We
start with some basic rotation ciphers.
We then shift into a different rotation
cipher just to get them experience with
it. Um, and then we move into um,
frequency analysis, which we have this
wonderful sentence that I came up with
because I wanted them to be able to do
the frequency analysis on a small amount
of text and still be able to solve the
substitution cipher quickly. So, we have
the wordthe is common as is the word
and, but the is the most common word in
English, which if you're trying to solve
for frequency analysis is great. If
you're trying to read it, it's awful.
Um, I confuse a lot of students with
this and my final version was much
better. Um, speaking of which, the
subcipher is the last stage of the
practice exam. Uh, the actual exam is
not really that different from the
practice exam. I added more bots, added
more conversations. The subcipher is now
an actual conversation instead of a
clunky sentence. Um, and the biggest
difference is I added the third bot that
communicates only using visionaires.
The two communicating bots will give
instructions on how to talk to the third
bot and where to find the key. Uh,
visionaires stops being interesting once
you have a key. Um, so I thought to make
it more interesting, the students would
then have to communicate using the
visionaires. So they would have to
encrypt as well as decrypt. Um the final
line of the instructions is the pass key
is on a post-it note under the teacher's
desk.
Making students get up during the exam
to look under the desk was super fun. Um
one of the students mentioned that this
was the coolest part of the exam. Having
them look under my desk while I was
sitting at it was really weird.
I very rapidly realized that I will sit
at a different desk during this exam.
Um, but it also gave me a quick visual
on how the exam was actually going for a
bunch of the students. If I'm seeing
students start to get up and move
around, I know they're up to the final
stage of the exam. Now, uh, I mentioned
I was had a steography thing in there
and I did. Um, if the students did
everything right, at the very end, the
bot wouldn't say anything at all. It
would play Morse code. In my head, this
was awesome. For that first student who
figured this out, it was incredible. Um,
they have written code. They have
cracked a cipher. And in the complete
dead silence of the exam room, they just
start hearing the beep beep beep of
Morse code. Um, they realized they
caused that. An action they did
triggered that response. They got up,
they ran to my desk and they, um,
grabbed the microbit and they started
listening to Morse code and started
translating it. This experience was
magic. It was absolutely incredible.
For literally everyone else in the room,
um, who was now dealing with Morse code
beeping out during their exam, uh, to
students who were up to the Morse code
and now had to wait for the entire Morse
code to recycle. for students who were
doing the MOS code but then had a bit
miss and then they had to start again.
Um it was less magic and more an
exercise in stressing out because there
was a big clock on the wall that's
ticking down time and they're standing
there going I actually can't do anything
right now. This might be a problem. Um
if students made it to this point I was
pretty much satisfied they met the
achievement standards. They had done
everything I needed to do to be like
you've done you have learned have have
the mark. Um so to translate the MOS
code I actually shifted and had them
just work in teams. Um, it was a bit
weird to work in teams on an exam, but
what I had happen was groups who would
then start getting super competitive
with the other groups. Um, and they got
super excited and super invested and I
had to remind them that we're in an exam
and you need to be quieter. Um, also
maybe don't shout the answer when you
get it. That's a bit problematic for an
exam. Um, my favorite solution was a
student who recorded the entire MOS code
segment on her phone and then um had the
phone play it back and the phone had
that upy downy sound wavy thing um and
she could just read um where were the
long bits and the short bits and could
just read the MOS code off. That was an
awesome solution I'd never considered.
Um and my final takeaways from this
whole thing was it was enormously fun.
Um I had significantly more fun doing
this than I ever thought I would. Um,
these students loved during the exam.
Sorry, the students loved doing the
exam, which I thought was weird. Um, but
turns out it went really well. Um, and
including a physical component in the
exam had significantly greater benefits
than I thought. It made the entire thing
feel a lot more dynamic and just a lot
more enjoyable, I think. Um, and that's
it. If you would like to look at this
exam or would like some form of
explanation of the code or how any of it
works, um, please find me, please talk
to me, please email me. I love sharing
all my stuff. Um, thank you for coming
to my talk.
[Applause]