Pitch Link: https://vimeo.com/1244817217 Demo Link: https://vimeo.com/1244907739?share=copy&fl=sv&fe=ci

Inspiration

When a company gets hacked, it floods: systems go down, data pours out, and money goes with it. Most companies don't sink from the first hit. They sink because the team can't coordinate, since the attacker is sitting in the same email, chat and files the team would use.

So we built the boat. ARK is where the response team climbs in when everything else is under water: off the company network, trusting nothing, keeping everyone together until the flood goes down.

What it does

ARK is an off-network incident command system, software plus hardware.

  • Red kill switch: declares the incident and cuts the compromised network
  • Green switch: resolves the incident and brings operations back online
  • Encrypted relay: carries messages it can't read or forge
  • Face-to-face join: responders are added with a matching 6-digit code
  • Live incident timeline: organized by NIST phases
  • Scope tracking: what's encrypted, stolen, suspected or clean
  • Real-time chat: plus one-click alerts that buzz the manager's panel
  • Legal deadline clocks: start when personal data is stolen
  • Tamper-evident record: every entry signed, encrypted and hash-chained
  • Offline report: for stakeholders and outside counsel

Demo: a fictional company, Meridian, is hit by a simulated ransomware attack. The analyst spots it in ARK, the manager hits red, and the data theft stops mid-transfer. The team contains it in ARK, hits green, and the attacker is locked out.

Why HolyC

  • No packages: nothing to poison
  • No framework: no hidden code
  • No browser or web server: fewer layers to attack
  • Under 6,000 lines: one person can audit it all
  • Native and fast: starts instantly when every minute counts

How we built it

  • ARK station: HolyC compiled with hcc, SDL2 interface
  • Crypto: libsodium, Ed25519 signatures
  • Relay: Arduino UNO Q on Debian; USB (adb + socat) and Wi-Fi
  • Kill-switch panel: Arduino Uno with buttons, LEDs and a buzzer
  • Network control: NetworkManager, logged to journald
  • Offline report: local Gemma model via Ollama
  • Attack simulation: Python demo prop, not part of ARK; attacks nothing
  • AI assistance: Claude, for planning, code help, intro video and logo

Challenges we ran into

  • Running HolyC natively with real hardware
  • Assuming even our own relay could be compromised
  • Designing for people under stress
  • Syncing three laptops, two boards and a live attack

Accomplishments that we're proud of

  • A full incident command center in HolyC powered with hardware & software
  • A real kill switch that changes network state and logs it
  • One click from "that looks wrong" to the manager's panel buzzing
  • An offline report built from ARK's own signed record for the stakeholders

What we learned

  • How ransomware attacks unfold, step by step
  • Why responders need a channel the attacker can't see
  • How much legal deadlines shape incident response

What's next for ARK

  • Kill switch on a real network switch
  • Key rotation for lost devices

Built With

  • adb
  • arduino
  • arduino-uno
  • arduino-uno-q
  • debian
  • ed25519
  • gemma
  • hcc
  • holyc
  • journald
  • libsodium
  • linux
  • llm
  • networkmanager
  • ollama
  • python
  • sdl2
  • sdl2-ttf
  • socat
Share this project:

Updates

Submission history