Capture the flag (cybersecurity)

From Wikipedia, the free encyclopedia
A team competing in the CTF competition at DEF CON 17

Capture the Flag (CTF) in computer security is an exercise in which participants attempt to find text strings, called "flags", which are secretly hidden in purposefully-vulnerable programs or websites. They can be for both competitive or educational purposes. In two main variations of CTFs, participants either steal flags either from other participants (attack/defense-style CTFs) or from organizers (jeopardy-style challenges). Competitions can include hiding flags in hardware devices, they can be both online or in-person, and can be advanced or entry-level. The game is based on the traditional outdoor sport of the same name.

Overview[edit]

Capture the Flag (CTF) is a cybersecurity competition that is used test and develop computer security skills. It was first developed in 1996 at DEF CON, the largest cybersecurity conference in the United States hosted annually in Las Vegas, Nevada.[1] The conference hosts a weekend of cybersecurity competitions, including their flagship CTF. Two popular CTF formats are jeopardy and attack-defense.[2] Both formats test participant’s knowledge in cybersecurity, but differ in objective. In the Jeopardy format, participating teams must complete as many challenges of varying point values from a various categories such as cryptography, web exploitation, and reverse engineering.[3] In the attack-defense format, competing teams must defend their vulnerable computer systems while attacking their opponent's systems.[2]

Educational applications[edit]

CTFs have been shown to be an effective way to improve cybersecurity education through gamification.[4] There are many examples of CTFs designed to teach cybersecurity skills to a wide variety of audiences, including PicoCTF, organized by the Carnegie Mellon CyLab, which is oriented towards high school students, and Arizona State University supported pwn.college.[5][6][7] Beyond educational CTF events and resources, CTFs has been shown to be a highly effective way to instill cybersecurity concepts in the classroom.[8][9] CTFs have been included in undergraduate computer science classes such as Introduction to Security at the University of Southern California.[10] CTFs are also popular in military academies. They are often included as part of the curriculum for cybersecurity courses, with the NSA organized Cyber Exercise culminating in a CTF competition between the US service academies and military colleges.[11]

Competitions[edit]

Community competitions[edit]

Every year there are dozens of CTF's organized in a variety of formats. Many CTFs are associated with cybersecurity conferences such as DEF CON, HITCON, and BSides. The DEF CON CTF, an attack-defence CTF, is notable for being one of the oldest CTF competitions to exist, and has been variously referred to as the "World Series",[12] "Superbowl",[7][13] and "Olympics",[14] of hacking by media outlets. The NYU Tandon hosted Cybersecurity Awareness Worldwide (CSAW) CTF is one of the largest open-entry competitions for students learning cybersecurity from around the world.[3] In 2021, it hosted over 1200 teams during the qualification round.[15]

In addition to conference organized CTFs, many CTF clubs and teams organize CTF competitions.[16] Many CTF clubs and teams are associated with universities, such as the CMU associated Plaid Parliament of Pwning, which hosts PlaidCTF.[3]

Government-supported competitions[edit]

Governmentally supported CTF competitions include the DARPA Cyber Grand Challenge and ENISA European Cybersecurity Challenge. In 2023, the US Space Force-sponsored Hack-a-Sat CTF competition included, for the first time, a live orbital satellite for participants to exploit.[17]

Corporate-supported competitions[edit]

Corporations and other organizations sometimes use CTFs as a training or evaluation exercise.[citation needed] The benefits of CTFs are similar to those of using CTFs in an educational environment.[citation needed] In addition to internal CTF exercises, some corporations such as Google and Tencent host publicly accessible CTF competitions.

In popular culture[edit]

See also[edit]

References[edit]

  1. ^ Cowan, C.; Arnold, S.; Beattie, S.; Wright, C.; Viega, J. (April 2003). "Defcon Capture the Flag: Defending vulnerable code from intense attack". Proceedings DARPA Information Survivability Conference and Exposition. Vol. 1. pp. 120–129 vol.1. doi:10.1109/DISCEX.2003.1194878. ISBN 0-7695-1897-4. S2CID 18161204.
  2. ^ a b Says, Etuuxzgknx (2020-06-10). "Introduction To 'Capture The Flags' in CyberSecurity - MeuSec". Retrieved 2022-11-02.
  3. ^ a b c Chung, Kevin; Cohen, Julian (2014). "Learning Obstacles in the Capture The Flag Model". {{cite journal}}: Cite journal requires |journal= (help)
  4. ^ Balon, Tyler; Baggili, Ibrahim (Abe) (2023-02-24). "Cybercompetitions: A survey of competitions, tools, and systems to support cybersecurity education". Education and Information Technologies: 1–33. doi:10.1007/s10639-022-11451-4. ISSN 1573-7608. PMC 9950699. PMID 36855694.
  5. ^ "ASU's cybersecurity dojo". ASU News. 2021-02-15. Retrieved 2023-07-18.
  6. ^ "picoCTF aims to close the cybersecurity talent gap". www.cylab.cmu.edu. Retrieved 2023-07-18.
  7. ^ a b "Wanted: hackers. Reward: the best may get a spot at CMU". Pittsburgh Post-Gazette. Retrieved 2023-07-18.
  8. ^ McDaniel, Lucas; Talvi, Erik; Hay, Brian (January 2016). "Capture the Flag as Cyber Security Introduction". 2016 49th Hawaii International Conference on System Sciences (HICSS). pp. 5479–5486. doi:10.1109/HICSS.2016.677. ISBN 978-0-7695-5670-3. S2CID 35062822.
  9. ^ Leune, Kees; Petrilli, Salvatore J. (2017-09-27). "Using Capture-the-Flag to Enhance the Effectiveness of Cybersecurity Education". Proceedings of the 18th Annual Conference on Information Technology Education. SIGITE '17. New York, NY, USA: Association for Computing Machinery. pp. 47–52. doi:10.1145/3125659.3125686. ISBN 978-1-4503-5100-3. S2CID 46465063.
  10. ^ Vykopal, Jan; Švábenský, Valdemar; Chang, Ee-Chien (2020-02-26). "Benefits and Pitfalls of Using Capture the Flag Games in University Courses". Proceedings of the 51st ACM Technical Symposium on Computer Science Education. pp. 752–758. arXiv:2004.11556. doi:10.1145/3328778.3366893. ISBN 9781450367936. S2CID 211519195.
  11. ^ "National Security Agency/Central Security Service > Cybersecurity > NSA Cyber Exercise". www.nsa.gov. Retrieved 2023-07-18.
  12. ^ Producer, Sabrina Korber, CNBC (2013-11-08). "Cyberteams duke it out in the World Series of hacking". CNBC. Retrieved 2023-07-18.{{cite web}}: CS1 maint: multiple names: authors list (link)
  13. ^ Email, Ryan Noone (2022-08-15). "CMU Hacking Team Wins Super Bowl of Hacking for 6th Time - News - Carnegie Mellon University". www.cmu.edu. Retrieved 2023-07-18.
  14. ^ Siddiqui, Zeba (2022-08-18). "Hacker tournament brings together world's best in Las Vegas". Reuters. Retrieved 2023-07-18.
  15. ^ "CSAW Capture the Flag". CSAW. Retrieved 2022-11-02.
  16. ^ Balon, Tyler; Baggili, Ibrahim (Abe) (2023-02-24). "Cybercompetitions: A survey of competitions, tools, and systems to support cybersecurity education". Education and Information Technologies: 1–33. doi:10.1007/s10639-022-11451-4. ISSN 1360-2357. PMC 9950699. PMID 36855694.
  17. ^ Hardcastle, Jessica Lyons. "Moonlighter space-hacking satellite is in orbit". www.theregister.com. Retrieved 2023-07-18.
  18. ^ Woodward, Alan (2022-07-07). "'Some staff work behind armoured glass': a cybersecurity expert on The Undeclared War". The Guardian. ISSN 0261-3077. Retrieved 2023-07-18.

External links[edit]

  • ctftime.org - an archive of historic, current, and future CTF competitions.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Capture_the_flag_(cybersecurity)&oldid=1169913575"