WEBVTT 00:02.930 --> 00:07.330 Remember the game you played as a kid, with flags hidden in opponents' terrain? 00:07.330 --> 00:11.370 Now, imagine the field or code, and the flags are secret data. 00:11.370 --> 00:17.770 Players exploit security flaws to capture the flags while at the same time defending their networks from opposing teams. 00:17.770 --> 00:22.970 These capture-the-flag, CTF events, are as diverse as the teams that play them. 00:23.070 --> 00:27.690 This is a global competitive community with thousands of players and global rankings. 00:27.690 --> 00:32.650 It's been a part of the origin story for a great many prominent security experts. 00:32.730 --> 00:35.090 So what do these hacking games look like? 00:35.090 --> 00:40.890 CTFs can be either in-person or online, and usually take place over a weekend or other short period. 00:40.890 --> 00:45.490 They often have a qualification round that determines who gets to participate in the finals. 00:45.530 --> 00:50.410 CTFs are sometimes themed around a specific domain, like space for HackASAT. 00:50.410 --> 00:55.910 But more commonly, they are not specialized and include a wide variety of different types of challenges. 00:55.910 --> 00:58.010 The most common types of CTFs include... 00:58.970 --> 01:05.370 Jeopardy CTFs, sometimes called Red Team CTFs, are named for their use of the classic game board as a scoreboard. 01:05.370 --> 01:06.990 These are more offensive-focused. 01:06.990 --> 01:15.270 Each team is given infrastructure to attack, and the number of successful attacks, the difficulty, or the speed at which they succeed, is factored into their score. 01:15.270 --> 01:22.130 Attack Defense, A-D, or Full Spectrum CTFs, which are closer to the original game you might have played as a kid. 01:22.130 --> 01:28.790 Each team has a server or set of servers to defend, and must attack other teams while also protecting their own infrastructure. 01:28.790 --> 01:36.970 King of the Hill-style CTFs are Full Spectrum CTFs, in which teams score points by gaining and maintaining control of individual systems. 01:37.030 --> 01:42.150 And finally, the less common Blue Team Exercises, which are primarily defensive events. 01:42.150 --> 01:48.610 Game organizers host an environment and often a professional team of attackers to test the participants' defensive skills. 01:48.610 --> 01:51.550 These are more common in the high school and collegiate level. 01:52.230 --> 01:59.410 Even though the goal of the CTFs are to find and exploit vulnerabilities in computer systems, fair play is essential. 01:59.410 --> 02:05.010 There are lots of ways to win, but to get the respect of your peers, you need to have good technical solutions. 02:05.030 --> 02:11.930 Nobody is impressed if you use a network flood to knock the scoreboard offline, and those kinds of shenanigans will get you shunned quickly. 02:11.950 --> 02:19.550 The best CTF players have built specialized tools, practiced within their domains, and include domain experts in many aspects of security. 02:20.310 --> 02:21.630 Why CTF? 02:21.630 --> 02:29.810 At their core, CTF challenges are a way for hackers to build community and demonstrate and hone their skills with other equally skilled people. 02:29.810 --> 02:37.470 Competitions are also a chance to experience the joy of learning about a new programming language or a new piece of technology hackers haven't used before. 02:37.470 --> 02:44.710 Capture the Flag challenges have also been used to help train cybersecurity teams and to get new hackers interested in security research. 02:44.710 --> 02:50.790 Some companies even use competitions similar to CTFs to recruit and vet potential candidates for employment. 02:50.790 --> 02:57.410 And CTFs have had real-world impact, with competitors finding actual security flaws in contest infrastructure. 02:57.450 --> 03:03.050 Their solutions, while not counting towards winning the game, are often implemented in a real-world context. 03:03.370 --> 03:14.770 With HackASAT, we have a CTF game designed to raise awareness about cybersecurity issues in space and help researchers develop specific skills and domain knowledge they'll need to help secure this new frontier. 03:15.090 --> 03:22.010 But as many of the players during our Quaz round found out, there are a lot of problems unique to the environments outside our atmosphere. 03:22.010 --> 03:28.910 To learn more about hacking in space, check out our Space Talk videos that explain some of the most interesting space-specific challenges.