The European Cyber Security Challenge (ECSC) is a yearly competition organized by the European Union Agency for Cybersecurity (ENISA), where national teams of young talents compete in a cybersecurity capture the flag (CTF) event. Since its conception in 2014, the ECSC has attracted the interest of a growing number of European countries and international stakeholders – so much so that it has been termed ‘the Eurovision‘ of Cyber Security. The 2022 edition took place in Vienna on 13–16 September, with 28 European countries participating and an additional five guest teams from the US, Canada, the UAE, Israel, and Serbia. Over 330 participants and more than 700 people engaged in the ethical hacking battle at Messe Wien for two days.

Attack/Defense Capture the Flag

TU Wien Informatics played a central role in this year’s competition. Marco Squarcina, PostDoc Researcher at the Research Unit for Security and Privacy at TU Wien Informatics, led the team of 16 national and international experts that designed and implemented the second day’s competition, structured as an attack/defense CTF. These competitions test teams under pressure during a simulated real-time cyber-attack. Each team controls a virtual server with various custom programs developed by the event organizers. These programs are called “services” and contain realistic vulnerabilities of different difficulty levels. The team’s goal is to identify vulnerabilities in their server, fix them, and simultaneously attack all other teams to capture flags routinely inserted in the services. This competition requires participants to master a diverse range of technical and soft skills – including network analysis, patch management, fast decision-making, and team coordination.

4TB of Traffic, 9.5 Hours of Competition, and One Lucky Winner

The attack/defense CTF of ECSC 2022 was one of the largest of its kind ever organized, with hundreds of participants in the same room constantly attacking each other for nine and a half hours. The organizers developed a novel infrastructure to host the competition and orchestrated a cluster of 120 nodes to cope with the extreme load of the event – participants generated nearly 4TB of network traffic during the CTF. Seven services were developed for the competition, each containing five to ten custom vulnerabilities. These services included innovative approaches to the attack/defense CTF format, including the execution of full-fledged web browsers and a CAN bus connecting vulnerable microservices.

The winner of the overall competition was Denmark, with Germany taking silver and France the bronze medal. The other top 10 countries are Italy, Poland, Sweden, Czechia, Romania, Switzerland, and Austria.