HSE Students Win IX CTF Russian Cup

© HSE University

The CTF Russian Cup is one of the country’s key cybersecurity competitions and is held in the CTF (capture the flag) format. The semi-finals and the final took place in December at the Smart City Pavilion at VDNH. The winners were the HSE student team VDNKh, whose members are students of the HSE Tikhonov Moscow Institute of Electronics and Mathematics (MIEM) and the HSE Faculty of Computer Science.

The strongest teams in the semi-finals and final competed for sets of awards in three main categories: School, Academic, and Mixed.

The winners of the Academic category were the VDNKh team, made up of students from MIEM HSE and the Faculty of Computer Science. The team included Arseniy Porkhunov (captain) and Anton Egorov (both from the Faculty of Computer Science), as well as Aleksandr Vasilega, Nikolay Kusmaul, Yaroslav Kikel, Georgiy Balashov, and Alexey Novikov (all from MIEM).

CTF (capture the flag) competitions are events in the field of information security in which tasks are related to cryptography, steganography, hacking, and other key components of data protection. Taking part in CTF competitions helps participants develop a practical understanding of cybersecurity, learn to work in a team, and prepare for a career in InfoSec. Many CTF participants later become bug bounty researchers, SOC analysts, penetration testers, security engineers, or founders of their own companies.

Qualifying Round and Semi-Finals

For the qualifying round, the organisers chose the classic task-based format, in which teams receive a set of tasks of varying levels of difficulty and decide themselves in what order to solve them.

Nikolay Kusmaul

The semi-finals were held in an attack–defence format: teams were given servers with an identical set of vulnerabilities, and each team’s goal was to attack their opponents’ services in real time while defending their own. A successful attack meant capturing the ‘enemy flag.’ ‘In the semi-finals, both the Mixed and Academic categories competed, but the top two teams from each advanced to the final,’ said team member Nikolay Kusmaul. ‘As expected, the semi-final took place in the attack–defence format, but with one update: this time each service was running in a Kubernetes cluster, which added extra administrative complexity. However, thanks to our SRE Alexey, we were able to get the Kubernetes under control and successfully defend ourselves against attacks. For almost the entire game, we stayed in the top two of the overall rankings, which included both Mixed and student (Academic) teams. We qualified for the final as one of the top two teams overall and as the top student team, and our opponents in the final were the dtl team from MEPhI.’

Final

For the final, a penetration testing (pentest) format was chosen, in which teams had not only to break into their opponent’s machine but also to locate the ‘enemy flag’ within the infrastructure. ‘Three virtual machines were provided to solve, and once all the tasks on them were completed, a fourth one was unlocked,’ said Nikolay Kusmaul. ‘Each machine contained two flags—one at user level and one at root level. We were the first to successfully complete the entire first machine, obtained the first flag on the second one, and were also the first and only team to fully complete the third machine, where access had to be gained by sending a payload via a phone call. One amusing moment was that halfway through the game our teammate Valeriy Popov arrived, even though he was not playing in the Cup with us. He brought us Twisters from KFC and then immediately left. As a result, over the six hours of play we completed the largest number of tasks, outperforming both the mixed teams and our rivals in the student category.’

As a result, the HSE team confidently took first place. Along with the Cup, the participants were also presented with the travelling winner’s flag, which will remain at the university until the next competition. 

Arseniy Porkhunov

‘We are the first HSE team in the past three years to have won the main sporting event of the year in the CTF format,’ noted Arseniy Porkhunov. ‘Some of our team members have been working towards this for two years, others for three, and some have been taking part in the CTF Cup and dreaming of victory for as long as five years. This was the team’s biggest win in its year of existence.’

Recent Victories

Before the CTF Cup, the VDNKh team achieved a number of victories in major CTF competitions. Most recently, the team took second place at the M*CTF tournament organised by the Moscow Technical University of Communications and Informatics (with Valeriy Popov joining the team for that event). Around 100 teams took part in the qualifying tournament. Another victory is described here: on that occasion, the VDNKh team won the UralCUP CTF.

At the beginning of the current academic year, the CTF Academy student community was established at MIEM HSE. Open to students interested in cybersecurity competitions, the academy’s sessions combine traditional academic formats with hands-on practice of the competitive modes used in CTF. The coaches and instructors are students with extensive experience of participating in such competitions.