Year after year, some of the world’s best hackers gather at DEF CON in Las Vegas to put their skills to the test. None is more prominent than the annual Capture the Flag (CTF) competition, where elite cybersecurity teams compete to find vulnerabilities, exploit systems, and defend their own infrastructure.
This year, Team Blue Water – which features nine Georgia Tech participants –came out on top after three days of intense competition.
“I've competed in DEF CON CTFs for four years now,” said Ph.D. student Kevin Stevens. “After winning second place three years in a row, it's so rewarding to finally achieve first place with such a great team.”
Blue Water finished with 578,103 points, well ahead of second-place team 0x4b52, which scored 454,797 points. SuperDiceCodeLovers took third place with 425,686 points.
The results highlighted Georgia Tech’s strength in the competition. The first-, second-, and third-place teams all included Georgia Tech students or alumni.
Georgia Tech participants on Blue Water included:
- Jalen Chuang, Ph.D. student
- Jiho Kim, Ph.D. student
- Andrew Chin, Ph.D. student
- Youngjoon Kim, postdoctoral researcher
- Kevin Stevens, Ph.D. student
- Yong Hwi Jin, Ph.D. student
- Sunghyeon Jo, Ph.D. student
- Yu-Fu Fu, Ph.D. student
- Gye Jin Lee, Ph.D. student
Blue Water consisted of members from Perfect Blue, Water Paddler, r00timentary, RedBud, BunkyoWesterns, and undef1ned. Combining multiple teams into a single roster is common at DEF CON CTF.
The competition unfolded over three days, with teams competing for about seven hours on each of the first two days and an additional two and a half hours on the final day. However, the work continued beyond the competition's official hours. The teams were allowed to continue working through the evenings and nights to find vulnerabilities, protect their systems, and gain points.
The challenges were designed by the Benevolent Bureau of Birds, the group that had won the competition for the past four years under the team name Maple Mallard Magistrates. The group is a collaboration between Plaid Parliament of Pwning from Carnegie Mellon University, The Duck from Theori Inc., and Maple Bacon from the University of British Columbia.
This year’s bird-themed competition featured a wide range of technical challenges, including escaping game softlocks, programming in a custom bird emoji language, working with a custom computer architecture and using Game of Life patterns for data exfiltration. Other challenges included a bot battleground, protecting the 1994 Netscape Navigator browser, and exploring a reimagined version of the internet built around “bird HTTP” and “bird CSS.”
For Stevens, one of his contributions to the winning effort focused on a new competition mechanic introduced this year, the “rebate mechanic.”
Teams could earn partial points back for flags stolen from them if they recovered those flags from recorded network traffic. Stevens created and maintained a service to manage the new mechanic, adding another layer of strategy to an already complex competition.
The victory adds another accomplishment to Georgia Tech’s growing record in elite cybersecurity competitions, where students regularly apply classroom knowledge and research skills into practice against some of the strongest teams in the field.
“SCP students and their collaborators continue to excel, winning elite cybersecurity competitions, including this year’s CTF at DEF CON,” said Mustaque Ahamad, interim chair of Georgia Tech’s School of Cybersecurity and Privacy (SCP).
“This is because of the excellence of our students and the SCP research projects and courses that prepare them with the advanced knowledge and skills needed to discover and mitigate the most challenging security vulnerabilities in systems on which we all rely.”
