National leaders in the cybersecurity industry didn’t know who Andrew Langan, Beau Schwab and Sam Goodman were before the start of the 2023-24 school year.
They do now.
The juniors from DACC’s Cybersecurity lab teamed up this spring and placed sixth in the nation in MITRE's 2024 Embedded Capture the Flag™ competition. It marked the highest finish of any high school team in the country, with the DACC trio outperforming dozens of teams from some of the nation’s most prestigious colleges and universities.
“We were all amazed,” Schwab said. A total of 773 students from 95 academic institutions participated in this year’s competition.
“We were a group of high school juniors… going up against people with PhDs and masters degrees in cybersecurity – people who are really good at what they’re doing in college. For us to place sixth is amazing.”
Langan (Olentangy HS), Schwab (Delaware Hayes HS) and Goodman (Westerville South HS) were invited to speak at the awards ceremony for the competition, held at John F. Kennedy Presidential Library and Museum in Boston, in late April as a reward for their achievements.
They spent the weekend networking with industry leaders, sharing insights with competitors from other schools, training and competing with cutting-edge technology, and receiving well-earned recognition for their accomplishments.
“It's all about experience. This will be something I keep on my resume forever,” Goodman said. “This is the first big thing I’ve participated in that really threw me into the real world of cybersecurity and computer science. Some colleges had electrical engineering students helping them (during this competition), too. So this went even further than computer science.”
The competition
MITRE, a not-for-profit organization that manages federally funded research and development centers supporting various U.S. government agencies in the aviation, defense, healthcare, homeland security, and cybersecurity fields, launched this year’s eCTF competition in January.
Competing teams from across the country received the same set of instructions and guidelines. In this year’s competition, the client was a health care system, and teams were asked to write code that would protect one of its medical devices from attackers.
“They listed all the requirements: This is what this device needs to do, these are the basic security requirements this device should meet,” Langan said. “They gave us a baseline design with no security features built in, and we had three months to build a code that we believed would defend it.”
Langan, Schwab and Goodman all had different roles on the team.
Langan was the lead developer, tasked with writing the majority of the code for the design, then testing that code against potential attack methods. He worked with other students in his class to enhance the team’s code and prepare it for battle.
Schwab was the project manager, responsible for keeping the team on-track administratively. He made sure all paperwork was submitted, documents were finalized, and regulations were followed. He also made sure the team knew the rules heading into the attacking phase of the competition.
Goodman was the communications director, charged with handling all internal and external communications. He served as the communicative liaison between the team and event organizers, and he built and maintained the team’s internal and external communication tools, including channels on Trello and Slack. He also maintained the team’s engineering notebook.
The trio worked together from January to March to build the code they believed would compete nationally. Then, in March, all competing teams turned in their designs, and the attack phase began.
“We submitted our code to other teams, they shared their codes with us, and then we all just attacked each other,” Langan said.
Once the attack phase began, teams were not allowed to go back in and redesign their code. No additional protections could be added.
Attention to detail, strong design wins out
The attack phase lasted approximately one month, and Langan did the majority of the attacking for DACC’s trio. He spent long hours working to exploit his opponents’ weaknesses.
“I would have the boards all plugged into my laptop at home, and I would read through other teams’ code to find vulnerabilities,” he said. “Then I’d exploit them.”
Attention to detail, top-notch coding and savvy gamesmanship allowed DACC’s trio to compete with teams from some of the nation’s top colleges.
The trio earned points for never missing a deadline, Schwab said. They also earned points early on by finding a bug in the competition software and flagging it for event organizers. They were the only team to find such a bug, Schwab said, and it gave them an early lead heading into the attack phase.
Teams received points during the attack phase for the amount of time it took opponents to capture their flags. The longer it took, the more points they were awarded.
The DACC trio’s code proved nearly impenetrable. Four of the team’s seven flags were never captured over the course of the month-long competition.
“We had really good cryptography in our design,” Langan said.
The trio also used strategic gamesmanship to get ahead. Teams were awarded points for the number of flags they captured, and were required to submit their captured flags by the end of the competition. But instead of submitting all their captured flags right away, in real time, which would have tipped other teams off to their high place in the standings (and potentially drawn more attackers down the stretch), the trio from DACC chose to submit many of their flags (27 of the 71 they captured) with just five minutes remaining in the competition.
Their competitors had no idea how high they were in the standings until it was too late.
“It was more of a mental (game),” Schwab said.
This combination of sound coding and deliberate strategy led the trio from DACC to finish sixth in the nation, ahead of teams from schools such as MIT, Ohio State and UCLA (they trailed only Carnegie Mellon, Illinois, Purdue and Buffalo). The next-closest high school competitor finished 19th.
While some of the collegiate teams competing were well-funded, capable of spending thousands of dollars on extra boards and specialty hardware to enhance their designs, Goodman said his high school trio needed to work a little more frugally.
“We had an additional $4 board,” he said with a laugh. “They were on Spotify premium; we had to listen to ads and only had limited skips.”
But in the end, neither resources nor experience mattered much. How the students approached the competition – and performed in it – did.
“These big-name schools are in a big-name competition that means something, obviously they’re going to spend money to try to do the best they can,” Goodman said with a smile. “Sometimes it worked, sometimes it didn’t.”
A productive trip to Boston
The trio from DACC was invited to speak at the competition’s annual awards ceremony as a reward for their achievements.
Langan, Schwab and Goodman flew out to Boston together on April 25 and returned on April 27. They were busy during their stay, training and competing on MIT’s campus and networking with collegiate competitors and industry leaders. They spoke in front of a crowd of 200 people during the awards ceremony, describing how they earned a sixth-place finish in such a crowded field.
“We were definitely the faces of it all,” Goodman said of the weekend. “Naturally, the youngest guys in the room are going to turn some heads.”
Schwab said the trio fielded plenty of questions from their competitors (and made sure to ask plenty themselves).
“The Carnegie Mellon guys said, ‘You guys are the only team we’re really worried about (moving forward),” Schwab added with a laugh. “Guys were coming up to Andrew asking, ‘How did you write and see this? We haven’t even learned that in our college-degree classes yet.’”
The trio from DACC said they used the weekend to network and develop relationships with more experienced folks in the industry. The experience allowed them to get one step closer to their post-graduation goals.
“This was amazing for that,” Langan said. “I want to go to college, and I’m looking at Carnegie Mellon. Now, I know people personally from CMU.”
And in the meantime, Schwab believes competing this spring will help elevate their education back at DACC. This experience will only deepen their knowledge of the industry they are looking to enter.
“We learned a bunch from this competition,” Schwab said. “It’s helped us apply (perspective) to different things we can do in our lab.”
Langan, Schwab and Goodman said they didn’t know what to expect heading into this year’s competition. They went in merely looking to be competitive, to finish near the middle of the pack.
But after placing sixth this spring, the trio said expectations will be sky-high heading into their senior year.
“We plan on being in the top three,” Schwab said.