Elite high school hackers convene at CMU to claim their well-earned picoCTF prizes

Last September, five high school students from across the US met online and formed a competitive hacking team. After nearly 36 straight hours of banging away at their keyboards, the quintet out-smarted tens of thousands of other middle and high school-aged hackers to achieve their ultimate goal: winning the largest online hacking competition, picoCTF.

Four months later, members of team “redpwn” met face-to-face for the first time at Carnegie Mellon University in Pittsburgh, PA to claim their $6,000 prize.

We’d been preparing for months.

Aaron Esau, a senior at Tigard High School in Tigard, Oregon and a member of the winning team of picoCTF 2019

“We were all highly motivated,” said Aaron Esau, one member of “redpwn” and a senior at Tigard High School in Tigard, Oregon. “We’d been preparing for months.”

Esau noted that Carnegie Mellon was every team member’s top school choice for college, and they believed that winning picoCTF would significantly help their chances of getting in.

“We knew that if we had on our resumes that we won picoCTF, that’d be strong,” Esau said.

Team “Flannel Forum of Forensics” finished second in picoCTF’s 2019 competition, with team “GS Goofballs” finishing in third. All three top teams visited CMU to receive cash prizes last week.

Every year, participants of the two-week online computer security competition hosted by Carnegie Mellon work through a series of challenges to find virtual “flags” that earn them points. Many players learn to hack on-the-go with challenges starting off relatively easy, offering hints along the way.

The challenges in the competition mimic real-world cybersecurity problems and are written by Carnegie Mellon’s internationally-acclaimed student hacking team, the Plaid Parliament of Pwning (PPP).

Our main goal with picoCTF is to take these complex ideas and present them to students in a way that they will understand.

Zach Wade, a problem developer for picoCTF 2019 and a member of the Plaid Parliament of Pwning competitive hacking team

“There are a lot of great resources for hackers who know what they’re looking for, but to someone just starting out—like a high school student—these resources might not be as useful,” says Zach Wade, a member of PPP. “Our main goal with picoCTF is to take these complex ideas and present them to students in a way that they will understand.”

Related to the topic of useful resources, picoCTF software engineer Dustin Martin announced during the ceremony some changes to the picoCTF platform that will give users access to more educational resources. One new part of the platform will include something that the picoCTF developers are currently referring to as the “Gym.”

“There will be a new area in the platform where we’ll make challenges from previous years available in a non-competitive, non-timed environment,” said Martin. “This relieves the problem of challenges going away when competitions are taken offline. We’ll be able to move those challenges into the Gym where they’ll always be accessible, and you can use them to practice for other CTFs or future years’ competitions.”

For now, Martin and the developers behind picoCTF are focused on getting the new platform ready to be rolled out by this fall, pushing the next official picoCTF competition to Spring 2021.