Many of us remember playing capture the flag (CTF) back when we were kids. The idea was to divide into teams, try to sneak to the other teams side and capture their flag. Years later, this idea was expanded on when Playstation and XBox started putting together multiplayer games that had the same general idea. More recently, the idea has morphed once again with hacking and computer security related CTF competitions. Perhaps the most famous CTF is the annual Defcon CTF where participants from around the world work to qualify to take part in the event at the conference itself, but this is just one of countless CTF competitions that take place on nearly a daily basis.
Very recently, I have had the pleasure of in participating in two CTFs for work. The first one was the Army Cyber Stakes Challenge hosted by the computer science department at West Point. The competition lasts for about a week and has challenges in forensics, reverse engineering, cryptography, and others. For someone who is relatively new to cyber and not a computer science major, I think I had a very respectable finish in 147/493 participants (13 out of Army warrant officers).
Yesterday, I finished up the what had been several months of being the OIC for the 780th MI Brigade’s Cyber Skills Challenge. This was the 5th year of the competition which is put on annually by the brigade’s warrant officers. What makes this competition a little bit different is the fact that it includes both physical and technical challenges. Participants started the morning doing an APFT, 5 mile ruck march and then a modified Army Combat Readiness Test. Then after that, we locked them in a room for 14 hours and tossed a number of technical challenges at them. This year for the first time, the entire thing was hosted virtually allowing us to have participants in HI, MD, and GA.
Why?
So the obvious question is why do these things? Because I personally think they are fun. Warrants (and anyone doing cyber work in general) need to be curious and constantly learning. CTFs are great way to do that. During a CTF event I am faced with a number of challenges that I often only have a slight idea of how to tackle. That forces me to spend some quality time with my favorite website….Google trying to figure out what I don’t know and how the hell to tackle a problem. As a network defender it also helps to open my eyes to just what is possible which helps me think of what the bad guy could really be doing on my networks to hide themselves.
I plan on taking some time here and there in the future to do write-ups for some of the challenges I have completed so that they can hopefully help other competitors figure out the problem they are working on, and maybe grab the interest of someone new.