To a middle-school kid, Capture the Flag means lots of sprinting, feinting and tagging people out.
To a team of computer hackers at Carnegie Mellon, "Capture the Flag" was a computer-programming competition that meant free trips to Korea, some nice cash prizes and a chance at some incredibly high-profile security jobs.
CMU's team of hackers, known as the Plaid Parliament of Pwning (PPP), competes in events known as "computer wars" that take place all over the world. University teams recruit engineering and computer-science students -- in this case, the PPP includes grads, undergrads and even doctoral candidates. Since its founding in September 2009, the team has competed in eight international championships.
On April 7 and 8, the team competed against the top eight teams in the world at CodeGate Capture the Flag 2010 in Seoul, South Korea. The PPP was the only U.S. team to make the journey, facing off against teams from Sweden, Russia, Spain, Italy, Korea and Japan. The PPP performed admirably, maintaining the lead until the competition's last half-hour, when Sweden nosed ahead. Sweden won first place, with the PPP placing second and Spain third.
"It was a real nail-biter finish," says professor David Brumley, the 34-year-old adviser for Carnegie Mellon's hacker team. For its efforts, the team returned last week with a prize of $9,000. To get to the Seoul event, the PPP team bested more than 100 teams in an online qualifying event on March 13 and 14. Because they won the qualifier, all expenses for the Korea trip were paid by contest organizers.
"I personally think we've done a really great job," says team captain Brian Pak, an undergraduate computer-science major. "This couldn't be done, however, without having awesome teammates who are really skilled and brilliant."
There are 15 programmers on the PPP roster, but once the team qualified, only four of them could compete in CodeGate.
"These competitions are actually pretty intense," says Brumley. The competitions, he says, can go on for 36 to 48 hours straight. "There's an endurance factor. They work in shifts so someone can steal a couple hours of sleep at a time."
So how does a "computer war" work?
"It's like an electronic war-game," Brumley explains. Teams are given complex puzzles and decoding tasks. The first to solve all the puzzles wins the competition. In some cases, teams are required to build their own databases and protect them from digital invasion, while simultaneously trying to hack into their opponents' systems. In Seoul, the competition went on for nearly two days. As Brumley describes it, the "tasks" are listed on a grid, much like the screens on Jeopardy. Teams work their way through each puzzle, until the board is cleared.
"You're cracking a code," he says. "They give you an encrypted message, and you have to find out what it says."
"Each member has a specialty/field," explained Pak by e-mail. "We work really well as a team."
These competitions are more than just a fun pastime for ultra-skilled computer nerds: They are also closely watched by security companies and even government agencies. Victory in a computer war can make contestants attractive to large corporations like Lockheed Martin, as well as smaller security companies.
"Information security is actually one of the most highly sought-out skills these days," Brumley says. "[The students] are demonstrating that they're good. These people are going to be defending the country against cyber-attacks. It's really common for [employers] to say, 'Who are the students in the competition? We want to hire them.' A lot of these students are so gifted, they're doing their own original research as well."
Having seen so much success in the past eight months, the PPP teammates are eager for new competitions. The next stop is DEF CON 18, a Las Vegas-based "hacker convention" where the PPP can expect hearty Capture the Flag competition. Unlike CodeGate, DEF CON is not a subsidized trip, and the PPP is scrambling to make hotel and flight arrangements for the end of July.
"We're always looking for sponsors," Brumley says.