Cryptax
Cryptax published the technical CTF write-up used for observed RP2040, MicroPython, Wi-Fi, web-CTF, filesystem, and flag-database behavior.
SourceBSides Kristiansand 2025 · Norway · 2025
Norwegian Security BSides SolaSec duck-shaped CTF badge
A source-backed Norwegian Security BSides electronic badge record: Noroff's post-event report documents a custom SolaSec electronic duck badge with seven LED challenge indicators, the official recordings page preserves Caleb Davis's Sykt Badge talk, and Cryptax's CTF write-up documents RP2040/MicroPython behavior, USB serial access, Wi-Fi AP setup, and on-badge web challenges.
People
Cryptax published the technical CTF write-up used for observed RP2040, MicroPython, Wi-Fi, web-CTF, filesystem, and flag-database behavior.
SourceNoroff identifies Kyle Shockley from SolaSec as one of the developers of the custom electronic badge.
SourceNoroff identifies Caleb Davis from SolaSec as one of the badge developers, and the official recordings page lists Caleb Davis's The making of a Sykt Badge talk.
SourceNoroff names SolaSec as the Texas-based cybersecurity company whose Kyle Shockley and Caleb Davis developed the custom electronic badge.
SourceIt adds Norway to the worldwide compendium with a modern regional BSides hardware badge, while keeping the technical description tied to the post-event report and attendee reverse-engineering write-up instead of inventing unrecovered schematics, firmware releases, production files, or image rights.
Noroff describes the badge as a custom-designed electronic badge shaped like a duck, made by Kyle Shockley and Caleb Davis from SolaSec, with seven LEDs representing unique challenges. Cryptax's write-up adds observed front LEDs, a USB connector, exposed pins, battery holder, underside button, Morse-code markings, and USB enumeration as a MicroPython board on a Raspberry Pi Pico W / RP2040 platform.
Cryptax documents MicroPython firmware, USB ACM serial access, a DUCK-prefixed Wi-Fi access point, a web server at 192.168.4.1, on-badge CTF pages, flag submission flow, a MicroPython REPL, filesystem files such as main.py and flagManager.py, and an encrypted JSON flag database. The public trail does not expose an official firmware repository or badge-team challenge archive.
The first BSides Kristiansand took place on June 6, 2025 at Noroff's Kristiansand campus. Noroff frames the badge as one of the conference's unique elements and quotes SolaSec as saying there were seven different ways to hack it; the official recordings page later published Caleb Davis's talk, The making of a Sykt Badge.
Lifecycle
Noroff reports that the duck-shaped electronic badge used seven LED lights, each representing a unique challenge, and quotes SolaSec saying there were seven different ways to hack it.
SourceCryptax's write-up records USB enumeration as a MicroPython board, a Raspberry Pi Pico W / RP2040 MicroPython banner, and a MicroPython REPL used to inspect files.
SourceThe badge created a DUCK-prefixed Wi-Fi access point, exposed an embedded web server at 192.168.4.1, and hosted CTF pages for flag capture.
SourceThe official recordings page preserves Caleb Davis's BSides Kristiansand 2025 talk about making the Sykt Badge.
SourceOperational history
The record keeps this as a CTF-solving and archive detail rather than treating it as a badge defect or official intended workflow.
The catalogue records observed hardware and software behavior while avoiding unrecovered component, board-source, and manufacturing claims.
The Norway record remains source-backed and image-free rather than copying event-site media, school-news photos, attendee screenshots, or generated badge art.