Limit one laptop per contestant.
You can't use the same vulnerability to claim more than one box, if it is a cross-platform issue.
Thirty minute attack slots given to contestants at each box.
Attack slots will be scheduled at the contest start by the methods selected by the judges.
Attacks are done via crossover cable. (attacker controls default route)
RF attacks are done offsite by special arrangement...
No physical access to the machines.
Major web browsers (IE, Safari, Konqueror, Firefox), widely used and deployed plugin frameworks (AIR, Silverlight), IM clients (MSN, Adium, Skype, Pigdin, AOL, Yahoo), Mail readers (Outlook, Mail.app, Thunderbird, kmail) are all in scope.