33 students, 6 hours, one goal: To capture the flag. On January 21, 2023, the Research Unit Security and Privacy held an Attack/Defense Capture the flag (CTF) competition as part of the “Attacks and Defenses in Computer Security, ADCS (192.111)” course at TU Wien Informatics. Marco Squarcina, Lorenzo Veronese, Georg Merzdovnik and Michael Pucher organized the event, which was joined by students within and beyond the ADCS course.

Attack/Defense CTFs simulate real-world IT security scenarios. Teams are trying to defend a virtual machine with ad-hoc applications – so-called “services”. They are also tasked with attacking the virtual machines of other teams to capture “flags”, which are essentially strings of text representing sensitive data.

As part of the course project, students of the ADCS course developed all 6 CTF services for the competition. To do so, they had to create a program with custom vulnerabilities, develop patches to secure it, understand how to attack it, and provide test scripts to check the correct functioning of the program. The platform to host the competition was based on the framework developed by our team for the ECSC 22 finals.