Remember the game you played as a kid, with flags hidden in opponents' terrain?
Now, imagine the field or code, and the flags are secret data.
Players exploit security flaws to capture the flags while at the same time defending their networks from opposing teams.
These capture-the-flag, CTF events, are as diverse as the teams that play them.
This is a global competitive community with thousands of players and global rankings.
It's been a part of the origin story for a great many prominent security experts.
So what do these hacking games look like?
CTFs can be either in-person or online, and usually take place over a weekend or other short period.
They often have a qualification round that determines who gets to participate in the finals.
CTFs are sometimes themed around a specific domain, like space for HackASAT.
But more commonly, they are not specialized and include a wide variety of different types of challenges.
The most common types of CTFs include...
Jeopardy CTFs, sometimes called Red Team CTFs, are named for their use of the classic game board as a scoreboard.
These are more offensive-focused. Each team is given infrastructure to attack,
and the number of successful attacks, the difficulty, or the speed at which they succeed, is factored into their score.
Attack Defense, A-D, or Full Spectrum CTFs, which are closer to the original game you might have played as a kid.
Each team has a server or set of servers to defend, and must attack other teams while also protecting their own infrastructure.
King of the Hill-style CTFs are Full Spectrum CTFs, in which teams score points by gaining and maintaining control of individual systems.
And finally, the less common Blue Team Exercises, which are primarily defensive events.
Game organizers host an environment and often a professional team of attackers to test the participants' defensive skills.
These are more common in the high school and collegiate level.
Even though the goal of the CTFs are to find and exploit vulnerabilities in computer systems, fair play is essential.
There are lots of ways to win, but to get the respect of your peers, you need to have good technical solutions.
Nobody is impressed if you use a network flood to knock the scoreboard offline, and those kinds of shenanigans will get you shunned quickly.
The best CTF players have built specialized tools, practiced within their domains, and include domain experts in many aspects of security.
Why CTF?
At their core, CTF challenges are a way for hackers to build community and demonstrate and hone their skills with other equally skilled people.
Competitions are also a chance to experience the joy of learning about a new programming language or a new piece of technology hackers haven't used before.
Capture the Flag challenges have also been used to help train cybersecurity teams and to get new hackers interested in security research.
Some companies even use competitions similar to CTFs to recruit and vet potential candidates for employment.
And CTFs have had real-world impact, with competitors finding actual security flaws in contest infrastructure.
Their solutions, while not counting towards winning the game, are often implemented in a real-world context.
With HackASAT, we have a CTF game designed to raise awareness about cybersecurity issues in space
and help researchers develop specific skills and domain knowledge they'll need to help secure this new frontier.
But as many of the players during our Quaz round found out, there are a lot of problems unique to the environments outside our atmosphere.
To learn more about hacking in space, check out our Space Talk videos that explain some of the most interesting space-specific challenges.