Rensselaer students took top prizes in the North American finals of the 14th annual New York University Cyber Security Awareness Week (CSAW) games—the world’s largest and most comprehensive set of student-led security challenges. From an initial pool of more than 12,000 competitors in 98 countries, more than 400 students participated in CSAW final rounds held in five regional hubs worldwide, including New York.
Students from the Rensselaer computer security club RPISEC took first place in the Capture the Flag event and the Red Balloon Hardware Hacking Contest, and second place in the Security Quiz Bowl. The win comes on the heels of a seventh-place showing in the qualifications for the HITCON (Hacks in Taiwan) cybersecurity conference finals, a result that will propel RPISEC to the final event in Taipei, Taiwan.
“RPISEC has evolved into a mature student-driven organization, and their recent success, including at CSAW, is a demonstration of their increasing skill spanning a diverse category of tasks,” said Chuck Stewart, head of the computer science department. “The team has developed several strategies for recruiting new members, training one another, and working with alumni to sharpen their skills. CSAW is the largest Capture the Flag event in the world, and their results speak to a growing culture of success.”
The North American finals included six competitions among 133 students and 46 teams, with competitors ranging from high school students to doctoral candidates. Prizes for first-place winners in the Capture the Flag, Embedded Security Challenge, and Applied Research Challenge at all five regional hubs included doctoral scholarships and fellowships to the NYU Tandon School of Engineering, which founded CSAW in 2003.
Capture the Flag (CTF) is the flagship event of CSAW and the 2017 event began with a preliminary round held during 48 hours of around-the-clock software hacking in September. A top-notch group of college students, including RPISEC, bested nearly 2,400 teams from 95 countries to become finalists at the five global CSAW hubs.
Ten North American teams competed in the CTF final competition. Rensselaer has been a regular winner of both the CTF and the Security Quiz Bowl throughout CSAW’s history, and in each of the last three years RPISEC finished in the second or third CTF spots. This year, with two returning competitors from last year’s team, RPISEC took first place in a nail-biting surge at the tail end of the 36-hour competition. Team RPISEC was comprised of Rensselaer students Jack Dates, Kareem El-Faramawi, Josh Ferrell, and Max Shavrick.
The final round of the CSAW Security Quiz Bowl, a test of security technology, history, and culture, followed on the heels of the 36-hour CTF. Undaunted by sleep deprivation, three of the four finalist teams, including RPISEC, were comprised of CTF participants. Second place went to Team RPISEC57, comprised of Rensselaer students Aidan Noll, Kevin Phoenix, Avi Weinstock, and Anthony DeLorenzo.
As a side hardware challenge, sponsor Red Balloon Security challenged students and professionals to hack the hardware of a Voice over Internet Protocol (VoIP) phone to win a literal sack of cash and a drone. Two teams tied and split the cash prize; a sudden-death challenge gave the drone to one of the RPISEC teams. First place in the Red Balloon Hardware Hacking Contest went to Team RPISEC, comprised of Rensselaer students Ethan Wright, Ethan Riley, Kibo Schaffer, Jacob Tinkhauser, and Avi Weinstock.