Meridian Freight Logistics · Security Review

Hide & Seek

Twenty-six things are hidden in a live network security console — in how it is configured, and in what its traffic history recorded. Your team has one window to find them.

What you are doing

Meridian Freight Logistics is a haulage company with a real, working network security tenant — sites, firewall rules, VPN users, administrators, and an AI security service that has been inspecting employee traffic for a full day.

You have been handed a read-only auditor's account. Nothing in that tenant is labelled as part of a game. The answers are ordinary-looking configuration and ordinary-looking traffic; finding them means reading the console the way an auditor would, not hunting for anything that looks out of place.

Before you begin

• A browser. Nothing to install.
• An authenticator app on your phone — Google Authenticator, Authy, 1Password, any TOTP app.
• Your team's entry code, which looks like MERIDIAN-4KX9-P2WD.
• Teammates, up to six per team.

Getting in

1. Create your account

   Go to the scoreboard address above and register. One account per person — your teammates each make their own.

2. Create or join a team

   Scoring is per team, not per person. Whoever registers first creates the team and shares its password with the others. Maximum six people.

3. Redeem your entry code

   Go to /hs on the scoreboard — cato-hs-dev-f9a9b3.eastus2.cloudapp.azure.com/hs, also linked as Hide & Seek in the top navigation — and enter your code. This is reversible and costs you no time: if the code is wrong or mistyped, fix it and redeem again. Your clock has not started yet.

4. Press Start

   This begins your window and reveals both the challenge list and your console credentials. Read the warning below before you press it.

5. Sign in to the console

   After Start, the Hide & Seek page shows your sign-in address, username, password, and an authenticator key. Add that key to your authenticator app, then enter the six-digit code it generates when the console asks for it.

   Everyone on the team uses the same account, and it is strictly read-only.

6. Find things, submit flags

   Every answer is a flag in the form CATO{…}. Submit it on the challenge page. Challenge titles are hints about where something hides — that is why they stay hidden until you start.

The clock, and how you rank

Teams start whenever they choose, so the leaderboard cannot rank on wall clock. You are ranked on flags found first, then on elapsed time from your own start. A team that starts on Friday night competes on equal terms with one that started on Monday morning.

Your window closes at the timestamp shown on the page. Submissions are checked against it on every attempt, so a late submission simply will not score. All times shown are UTC.

What you are hunting

Twenty-six challenges, 6,400 points in total, across six categories. The category and the title are all you get.

Challenges are worth 100, 200, or 300 points. Each carries up to two hints: the first is free, the second costs 50 points. Take the free one early if you are stuck — it costs you nothing but the time you already spent.

Worth knowing

• Your account cannot change anything in the tenant, and no challenge requires it.
• Nothing is hidden behind a password, a file, or an exploit. Everything is visible to a read-only auditor who looks in the right place.
• One window per team. Pressing Start twice does nothing — it will not restart your clock.
• You can change your entry code before Start, never after.
• Answers are stable. A flag that scored for another team will score for you.

Meridian Freight Logistics is fictional. Its network, its staff, and its traffic were built for this event, and every account you are given is read-only.