Over 18,000 people hacked their way through picoCTF 2022

Companies everywhere are struggling to fill cybersecurity jobs as the industry faces a severe talent shortage. The good news is, more than 18,000 people participated in Carnegie Mellon University’s annual cybersecurity competition last month—including more than 6,000 middle and high school students.

“Our goal has always been to attract more young people to cybersecurity,” says CyLab’s Hanan Hibshi, an assistant teaching professor in the Information Networking Institute and a faculty advisor for picoCTF, the annual cybersecurity competition and year-round education platform. “The countless headlines we’re seeing about the latest data breach or cyberattack stem from an inadequate pipeline of talent into the field. Our hope is that many of these students will go on to pursue a career in cybersecurity.”

Our goal has always been to attract more young people to cybersecurity.

Hanan Hibshi, Assistant teaching professor, Information Networking Institute

Over a two-week period starting March 15, participants of picoCTF worked through 68 challenges that started out relatively easy, and gradually increased in difficulty. If participants found themselves stumped, they could access hints that nudged them towards the solution.

Many of the challenges were written by members of Carnegie Mellon’s internationally acclaimed competitive hacking team, the Plaid Parliament of Pwning. The team has won the so-called “Olympics of Hacking”—DefCon’s Capture the Flag competition five times in the past nine years.

While many participants were from the United States, this year more than 11,000 participants were international, indicative of picoCTF’s efforts toward a more global reach. Several countries have leveraged CyLab’s competition for their own residents by sponsoring picoCTF and hosting their own country-specific leaderboards during the competition, including Canada, Japan, and for the first time ever, Africa.

Team “redpwn” took the top spot in this year’s US middle/high school competition, with its five members located all over the US, and team Thinker28 took the top prize in the middle school competition.

Teams “redpwn” and “b1c_waves” both finished with the maximum number of points, but “redpwn” was named the official 1^st place winner because they reached that maximum number of points roughly three days faster than “b1c_waves.”

The top US middle and high school teams were awarded cash prizes and are invited to attend a picoCTF 2022 awards ceremony to be held later this year.