Hack like you meme it

ASU and fellow Arizona universities unite to create new statewide cybersecurity competition

What do pepperoni pizza, cat memes and an online dojo have in common?

It turns out, these are all essential elements of a great cybersecurity hacking competition. And experts at Arizona State University, the University of Arizona, Northern Arizona University and Grand Canyon University all agree — such events are some of the best ways to prepare students to assume challenging jobs in the computer security sector.

Cybersecurity researchers from all four universities united to cohost the Capture the Flag Hacking Competition held on Saturday, April 5. Undergraduates enrolled in Arizona universities and community colleges convened on all four campuses and online, with nearly 400 students from across the state registered to participate and compete to win prizes, including an Amazon gift card valued at $1337.

Jackie LeFevers serves as associate director of research operations for the Center for Cybersecurity and Trusted Foundations, or CTF, a cybersecurity research and education group that is part of the ASU Global Security Initiative. With approximately 70 student researchers who are part of the center, CTF is located in the School of Computing and Augmented Intelligence, part of the Ira A. Fulton Schools of Engineering at ASU.

She explains that the hacking competition is part of a cooperative, statewide strategy to both fill the jobs pipeline with well-qualified graduates and to continue to grow Arizona’s profile as a global hub for computer security.

“Capture the flag hacking competitions are a great way to gamify the process of increasing cybersecurity skills,” she says. “Forming a statewide competition puts a spotlight on Arizona as the place to be for cybersecurity education and careers.”

Even as threats to critical technical infrastructure continue to rise, the cybersecurity field has a well-documented shortage of workers, with an estimated 4.8 million unfilled jobs globally. About 500,000 of those vacancies are in the U.S.

Gus Hintermeister, an undergraduate computer science student in the School of Computing and Augmented Intelligence, part of the Ira A. Fulton Schools of Engineering at ASU, attends the Capture the Flag hacking competition in the Brickyard Engineering building on the ASU Tempe campus. He accesses the pwn.college platform to work on a series of competitive cybersecurity exercises. Photographer: Kelly deVos/ASU

Game on

Jobs in cybersecurity are among the toughest in computer science, says Yan Shoshitaishvili.

“To protect a computer system from hacking, you often need to understand it better than the people who actually created it,” he says. “You’ve got to find and fix vulnerabilities in code you didn’t write.”

Shoshitaishvili is a Fulton Schools associate professor of computer science and engineering and is an innovator of a global cybersecurity learning platform known as pwn.college. The site offers a distinct combination of an educational curriculum, a competitive practice environment and a set of communication tools to help students learn collaboratively about cybersecurity.

On pwn.college, students from 145 countries complete learning modules and then engage in online capture the flag exercises. Capture the flag began as an outdoor game where two teams race to retrieve a flag from the opposing team’s base. In a computing environment, a similar activity involves hiding a cryptographic token — usually a short line of code — within a secure system.

The goal is for hackers to exploit vulnerabilities, bypass security and uncover the hidden code. The pwn.college platform mimics a dojo, even awarding real belts to students who complete challenges.

For April’s Capture the Flag hacking competition, the university researchers created 23 new challenges that addressed issues in web technology, the blockchain, the Linux operating system and more.

Paul E. Wagner, an associate professor of practice at the University of Arizona, led the competition at U of A. As the director of the Arizona Cybersecurity Clinic and the Arizona Cybersecurity Academy his work focuses on focuses on cybersecurity education and workforce development. He says experiential learning opportunities are important.

“CTF competitions are an excellent complement to formal education programs,” Wagner says. “These competitions allow students to apply their technical skills, think critically under pressure, and develop real world problem-solving abilities.”

On the competition Discord server, organizers kept students updated on the status of challenges and maintained a contest leaderboard. The students could ask questions … and even share a few cat memes. Image courtesy of the Center for Cybersecurity and Trusted Foundations

Real sense of security

At the event, organizers awarded nearly $2,000 in Amazon gift cards. For student participants, the event seemed to accomplish its bigger goal of galvanizing enthusiasm for cybersecurity.

Gus Hintermeister, a junior studying computer science in the Fulton Schools, says he’s considering a cybersecurity career and appreciated the opportunity to learn new things.

“To me, cybersecurity seems more enjoyable and fulfilling than other specialties of computer science,” he says.

Dagny Howard, a Fulton Schools mechanical engineering student, already has a position at Kudelski Security and came to the hacking competition to improve her skills in securing web browsers. She said she would encourage fellow students to give the event a try.

“Just show up and throw yourself at it,” she says.

Shoshitaishvili says that CTF hopes to make the hacking competition an annual event that continues to foster interest in computer security for Arizona students.

“To really hone their skills, students need opportunities to practice,” he says. “Capture the flag competitions provide those kinds of chances.”

Congratulations, winners!

First place: Ishaan Kurmi, ASU
Second place: Atul Raman, ASU
Third place: Dvir Hamu, ASU