A team of students from the Texas A&M University College of Engineering recently placed second in the 2021 Embedded Capture the Flag competition (eCTF), which has held virtually by the MITRE Corporation.
The members of the Texas A&M team included Addison Crump (computer science), Cormac Cupples (computer engineering), Garrett Weston (computer science), Andrew Chai (computer science), Jonathan Labrum (computer science) and Jacob Morgan (electrical engineering). Dr. Martin Carlisle, professor of practice in the Department of Computer Science and Engineering, served as the team's faculty advisor.
Beginning in January, the eCTF is a semester-long, two-phase competition that takes students through the experience of creating a secure system and then learning from their mistakes. Because it is focused on securing special purpose computers like smartwatches and GPS systems, the eCTF brings forth an entirely different set of challenges and security issues that are not covered by traditional capture the flag competitions. It also includes a design and build phase, in addition to the attack and defend phase.
For this year's challenge, the participants were tasked with designing a secure communications system for an unmanned aerial vehicle (UAV) package delivery system. To be successful, the UAVs have to communicate with devices on the ground, so their design had to prevent attackers from accessing the network to spy on and disrupt the system.
In their overall design, the team distributed two secret keys to each UAV while registering them. One key was used to verify that the messages had not been tampered with, and the other was used to encrypt the contents of the messages. They also added a counter to the messages to fend off simple replay attacks, a form of network attack where a hacker fraudulently delays or repeats a valid data transmission. To make securing their design easier, they used Rust, a popular programming language designed for performance and safety.
During the design phase, the team became the first in the competition's history to get their design through testing on their first try. The students will receive a cash prize of $1,300 from MITRE.
"We found the competition challenging but fascinating at the same time," said Weston. "Our team was comprised of Aggies from many different backgrounds, some of which had little to no practical experience in cybersecurity or embedded systems. So this was a great opportunity to dive right in, learn a lot and have some fun.”
The competition ended in April with a virtual awards ceremony.