eCTF
Embedded Capture the Flag Competition
The Competition
The Embedded Capture the Flag (eCTF) Competition is an attack-and-defend exercise for designing secure embedded systems
The Embedded Capture the Flag (eCTF) is an embedded security competition run by MITRE that puts participants through the experience of trying to create a secure system and then learning from their mistakes. The main target is a real physical embedded device, which opens the scope of the challenge to include physical/proximal access attacks. The eCTF is a two-phase competition with attack and defense components. In the first phase, competitors design and implement a secure system based on a set of challenge requirements. The second phase involves analyzing and attacking the other teams’ designs.
New Look
Same Competition
2024 eCTF
The 2024 eCTF is underway! Teams will design and implement a supply chain security solution for microcontrollers on a medical device. The system must securely verify the device integrity while keeping sensitive data confidential.
The 2024 competition will run from January 17th through April 17th with an award ceremony on April 26th.
For more information or to join the email list, reach us at ectf@mitre.org.
Countdown to the Award Ceremony
Day(s)
:
Hour(s)
:
Minute(s)
:
Second(s)
See our NICE K-12 Conference Talk
We presented at the 2022 NICE K-12 Conference about the eCTF and how the first and most successful high school team Delaware Area Career Center used the eCTF in their program.
How is the eCTF different from other competitions?
The eCTF is unique in three major ways. First, the focus is on securing embedded systems, which presents a new set of challenges and security issues that are not currently covered by traditional “online” CTFs. Second, unlike the standard attack-only CTF, the eCTF balances offense and defense by including design, build, and attack components. Finally, the eCTF runs over the majority of the spring semester through three phases, allowing time for development and for advanced attacks during the Attack Phase.
01
Focus on Embedded
02
Attack / Defend
03
Extended Time
Past eCTF Competitions
2023 - Car Key Fob
Teams designed and implemented a secure key fob system for a car door lock. The system had to protect the car from unauthorized entry and prevent attacks like replays and key fob cloning.
2022 - Avionics Bootloader
2021 - UAV Communications
Teams designed a secure communications system for an unmanned aerial vehicle (UAV) package delivery system. The system had to be secure to prevent attackers from gaining access to the network to spy on and disrupt the UAV system.
2020 - Audio DRM
Teams designed a secure audio digital rights management (DRM) module for a next-generation multimedia player on the Digilent Cora Z7. The system had to be secure to prevent users from playing pirated music, support region locking, and prevent the creation of cloned bootleg players.
2019 - Video Game Console
Teams designed a secure video game console on the Digilent Arty Z7. The system had to attempt to protect the intellectual property of game designers, prevent users from loading their own software, and allow verified users to install and play games that they have purchased.
2018 - ATM System
Teams were tasked with designing a modern chip-and-PIN ATM system. Teams had to design and implement the firmware, software, and protocols for the ATM card, the ATM, and the Bank Server to support secure cash withdrawals.
2017 - Car Bootloader
Teams were challenged to design and implement a system to support secure firmware distribution for automotive control.
2016 - IoT Door Lock
In the inaugural eCTF, teams designed a secure pin door lock system.
Past Competitors
Amrita Vishwa Vidyapeetham University • Baldwin Wallace University • Boston University • Carnegie Mellon University • Cornell University • Dakota State University • Delaware Area Career Center • Florida International University • Florida State University • George Mason University • Indiana Institute of Technology • Massachusetts Institute of Technology • Michigan State University • Morgan State University • Norfolk State University • Northeastern University • Nova Southeastern University • Purdue University • Rensselaer Polytechnic Institute • Rochester Institute of Technology • Singapore Management University • Syracuse University • Texas A&M University • The Ohio State University • Tufts University • University at Buffalo • University of Alabama in Huntsville • University of California Irvine • University of Cincinnati • University of Colorado Boulder • University of Connecticut • University of Dayton • University of Florida • University of Illinois at Urbana-Champaign • University of Maryland College Park • University of Massachusetts Amherst • University of Massachusetts Lowell • University of Nebraska Omaha • University of New Hampshire • University of Pennsylvania • University of Texas at Dallas • University of Wyoming • Virginia State University • Virginia Tech • Worcester Polytechnic Institute
Interested in getting involved as a sponsor?
For the first time, the eCTF is accepting commercial sponsorships through MITRE Engenuity. See the MITRE Engenuity site below or email us at ectf@mitre.org for more information.
Competitor Testimonials
Frequently Asked Questions
Who can participate?
Anyone! The eCTF is open to all US citizens 13 or older and most non-US citizens 18 or older (see the participant agreement for all eligiblilty information and exceptions). Students at all academic levels are welcome to participate. Team sizes are unlimited (although a minimum of 3 students is recommended). Sponsorship of a teacher or faculty member to act as a team advisor is required.
However, to be eligible for prizes, students must be US Citizens as of the start of the competition.
Please see the 2024 eCTF Participant Agreement for full terms and conditions.
What does MITRE provide to help?
MITRE provides teams with a reference implementation, embedded hardware (and/or hardware emulator), and technical guidance.
Does the eCTF cost anything?
Participation in the eCTF is entirely free. MITRE will provide the resources to complete the competition including one set of development boards per team, however teams may choose to purchase additional resources to aid with development or attacking.
Are there awards?
Winning teams receive a cash prize, publicity from MITRE, and typically earn accolades from their university as well. The prize amount for 2023 will be announced at the kickoff, though the 2022 eCTF awarded $5,000 in prizes. Students have used their participation in eCTF to build resumes, present at conferences, and open the door to valuable internship and career opportunities, including engineering positions at MITRE and Riverside Research.
Can I earn college credits?
Most students can earn college credit. Work with your professor(s) / faculty advisor to determine how to earn credit at your institution. Remember that this is a significant time commitment, typically commensurate with the credit hours you may receive. An example syllabus is available from the eCTF organizers upon request.
What level of experience is required to compete?
We encourage teams of all levels of experience to compete in the eCTF and aim to make the eCTF accessible to students new to security and embedded systems. We do recommend an understanding of development in C and Python, as the reference design will be implmented in those languages.
However, while the competition may be approachable, the depth of embedded systems enables teams with more experience to attempt more advanced countermeasures and attacks, providing an engaging experience for students of all levels of experience.
How do I sign up?
When team registration opens in September, work with your faculty advisor to fill out this form.
Individual competitor regitration will open in December.
Do I need to travel for the competition?
The competition can be done 100% remotely. MITRE will provide teams with hardware and/or servers to develop and compete on. Once teams have a completed design, they submit the code to MITRE for testing and MITRE will ensure that all challenge requirements are met. Once this verification process is completed, your implementation (source code and protected binaries) will be provided to all of the attacking teams.
After the competition concludes, MITRE hosts an award ceremony in April where teams are invited to share in their accomplishments, meet participants from other schools, interact with MITRE staff, and see the final standings revealed! Prior to COVID, this award ceremony was in-person at MITRE in Bedford, MA, but has been a virtual event for the past 3 years. Plans for the 2023 award ceremony will be announced at kick-off in January 2023.
Can students who are MITRE employees compete?
Yes! Current and former MITRE employees frequently compete in the eCTF. To ensure fairness, competitors who are MITRE employees will have no additional access to the organizers or any internal eCTF resources and will be treated the same as any other competitor.
Can international students or teams compete?
We welcome international students and teams to compete except for students under 18 and students and institutions from Quebec, Russia, Crimea, Cuba, Iran, Syria, North Korea, and Sudan. However, prize money can only be distributed to US citizens atending US-based institutions.
Can high school teams compete?
Yes! We have had high school teams compete and succeed in the eCTF. See our talk at the 2022 NICE K12 Conference for more information (slides) (DACC Video).
However, the competition is only open to US citizens 13 or older and non-US citizens 18 or older.
Other questions?
Please contact the eCTF team at ectf@mitre.org
QUESTIONS? EMAIL US AT ECTF@MITRE.ORG
MITRE is a not-for-profit organization that operates research and development centers sponsored by the federal government. MITRE works with industry and academia to apply science, technology, and systems engineering that enables the government and the private sector to make better decisions. Learn more at www.mitre.org