Binghamton University team faces students from around the world in hacker competition

Imagine standing on a battlefield where more than 100 opponents attack at once, trying to find the weak spots so they can capture each other’s flags and achieve victory.

It’s sounds like a blockbuster Hollywood film, but Binghamton University students took part in a cybersecurity competition this spring with this exact setup — except the battles were virtual ones fought in front of computer screens.

For the first time, students from the Thomas J. Watson College of Engineering and Applied Science’s School of Computing matched wits with teams from around the world in the MITRE Embedded Capture the Flag Competition. They finished at #26 overall and #2 in New York — respectable rankings for an inaugural outing.

“Everything from A to Z is done by the students,” said Associate Professor Aravind Prakash, who serves as the Binghamton team’s advisor. “The structure of the competition focuses on software development for the first phase, and then in the attack phase they focus on reverse engineering. They work on learning new attack vectors and how to attack cryptography.”

MITRE is a not-for-profit organization that operates federally funded research and development centers to provide technical expertise, stability and continuity to government agencies. Among its work are advances in national defense, aviation safety, GPS, financial systems, healthcare and cybersecurity.

The eCTF competition includes not just software but also hardware, which can offer different ways to break into a system and get the valuable information inside.

“You are provided with every other teams’ source code and the documentation explaining how it works,” said David Demicco ’18, MS ’21, PhD ’25, one of the Binghamton team’s leaders. “From there, you need to look for vulnerabilities, and sometimes they’re very difficult to find. Sometimes you make mistakes.”

Hitting the physical systems that each team relies on for security led to some innovative solutions.

“Carnegie Mellon won the competition, and they used an attack that could skip an instruction,” said Liam Murphy ’25. “Normally when you look at code, you assume it’ll behave exactly as it shows, but the Carnegie Mellon team made it do something that it wasn’t supposed to. When they did that, they could read out all of our memory and get our flag.”

Vivek Raj ’23, MS ’25, has focused his time at Binghamton on artificial intelligence and machine learning, so cybersecurity proved to be a different challenge. He particularly enjoyed getting an extra point for “first blood” — being the first one to crack another team’s system.

“It was good for me because I got something new to learn, which I use as a project to highlight during my interviews,” said Raj, who led the team with Demicco. “Employers were impressed that I worked on this totally new thing out of my usual work area.”

Prakash is already looking ahead to next year’s eCTF competition, and he hopes to recruit a more interdisciplinary team to offer the necessary skills. For instance, he believes adding electrical engineers would help improve Binghamton’s chances of making successful hardware attacks. He also hopes to attract outside sponsorship to purchase equipment.

He said he will miss the students who graduated this spring: “Even without having to register for a course, students put an outrageous number of hours into the project but also had fun doing it. There is something about this whole competition-based approach to teaching where there is a reward of some sort — whether it’s a flag or a ranking for the school on a global list — that really entices students.”

Looking back on the experience, Demicco is “quite proud” of how his team did.

“It’s not top 10, but for first time just trying to figure out how it goes, I’m pretty happy with how our final position — but 25th would have been real nice!” he said with a laugh.