MITRE Engenuity The Embedded Capture the Flag™ (eCTF™)

January 17, 2024 - April 17, 2024

 MITRE Engenuity’s eCTF is an embedded security competition that puts student teams through the experience of creating a secure system and learning from their mistakes. This competition helps develop practical skills that can be applied to securing critical embedded systems, such as UAVs, smart grids, and IoT devices.

eCTF Competition Format

Over each Spring semester, hundreds of students compete in MITRE Engenuity’s Collegiate Embedded Capture-the-Flag (eCTF). The MITRE Engenuity eCTF is unique from other CTF competitions. First, the focus of the eCTF is on embedded systems, which present a new set of challenges and security implications. Second, the eCTF balances offense and defense by testing and awarding both sets of skills. Split into two six-week phases: “Design” and “Attack;” the design phase asks students to develop a secure embedded system that meets a provided set of requirements. While attacking, they compete to break the security of other teams’ designs.

What Students Get Out of the eCTF

Throughout the competition, students have the opportunity to learn hard and soft skills not often taught in the classroom.

During the design phase, students design and build a realistic system and meeting complex security requirements without sacrificing functionality. This open-ended task promotes problem-solving and offers what are many students’ first experiences in project management, cybersecurity, and embedded systems. Students also gain an in-depth understanding of cryptography through the design and implementation of their secure protocols.

During the attack phase, students learn hands-on, real-world attacks in an unparalleled experience. Since the designs being attacked are created by other teams, students search for and encounter real, unintended vulnerabilities, rather than pre-canned challenges that are often used in other CTFs.

The eCTF as a Course 

Many schools offer the eCTF as a for-credit course, often as a special topics course or an independent study. We strongly recommend this route as it helps students to commit time for the competition and recognizes and awards students for their efforts.

An example syllabus is available upon request.

The eCTF challenge defines several artifacts and deliverables that universities can use as course assignments. These include design documents, offensive and defensive writeups, and the system implementation/code itself.

Of course, faculty may also choose to augment the competition with additional lectures or readings.

 Next Steps

If you are interested in the eCTF, please reach out to ectf@mitre-engenuity.org to join our email list for updates about the competition. You may also want to begin the process of creating a for-credit course for your team next semester.

During the fall semester, you should begin reaching out to potential student competitors. Good avenues for finding interested students include reaching out to relevant student clubs or groups, announcing the competition in related classes, and posting flyers in public areas (an example flyer is available upon request).

When team registration opens in September, you will be able to register your intent to form a team, even if you don’t yet know the exact students that will participate.

Beginning in December, individual competitor registration will open, which each student on your team will need to complete before the competition begins

Frequently Asked Questions

Who can participate?

Anyone! Students at all academic levels are welcome to participate. Team sizes are unlimited (although a minimum of 4 students is recommended to avoid burnout). Basic programming experience is required and any experience with C and Python will greatly help teams. Sponsorship of a faculty member, teacher, or adult mentor to act as a team advisor is required. What is provided by MITRE to help? MITRE provides teams with a reference implementation, embedded hardware, and technical guidance throughout the competition.

Are there awards?

 Winning teams receive a cash prize, publicity from MITRE and MITRE Engenuity, and typically earn accolades from their university as well. Students have used their participation in eCTF to build resumes, present at conferences, and open the door to valuable internship and career opportunities, including engineering positions at MITRE and the eCTF sponsors. 

What is this year’s challenge?

Teams will design and implement a supply chain security solution for microcontrollers on a medical device. The system must securely verify the device integrity while keeping sensitive data confidential. 

For more information about MITRE Engenuity's ECTF, contact ectf@mitre-engenuity.org