C4RD5 T4K3 N1NTH 4T 5P0K4N3 C7B3R CUP

This past weekend, NIC’s Computer Science Club took ninth place in the Spokane Cyber Cup, a cybersecurity competition (or hackathon) hosted by Eastern Washington University’s Computer Science program in Spokane, WA.

“Students are competing basically to show their proficiency in different cybersecurity concepts,” said Ethan Rabe, an EWU Computer Science Alum. Now working in the field professionally, he was among many other EWU alums volunteering as coaches for the 7-hour-hackathon. 

“Whether that be breaking password hashes or using open-source intelligence on the internet to solve problems, it basically demonstrates problem-solving proficiency.”

The club’s team was comprised of students Aaron Jarnes, the club president, Michael Habermann, Lance Vasquez, and Walter Neils.

The competition was divided into two brackets, “Swallow” and “Canary.” NIC Comp Sci competed in the Canary bracket, which was meant for smaller schools like NIC. Larger teams from schools such as WSU, Gonzaga, UW, and U of I competed in the Swallow bracket.

To quote Morpheus in “The Matrix” (1999), it is all around us. Even now, in this very room. The challenges given to competitors of the Spokane Cyber Cup mimicked numerous real-life cybersecurity scenarios, including Phone Phreaking, a relatively archaic predecessor of hacking wherein users mimic dial tones to make phone calls for free or access restricted information.

Rabe described a more up-to-date challenge named ‘Amazon.’

“The idea is that we have Jeff Bezos’ login,” Rabe said.

“But his account is protected by two-factor authentication; so he has a one-time password, and that token resets every few seconds.”

“The idea is that you break into that one-time password [OTP] by generating a whole bunch of OTP tokens, essentially generating that [OTP] over and over again to brute force it.”

In the opening hours of the hackathon, NIC Comp Sci led the Canary bracket. The team attributed this largely to Walter Neils, who, despite being a first timer, found his stride and scored a remarkable number of points, walking through a slew of challenges to build a lead for the team early on.

“It was honestly a lot easier than I was expecting,” Neils said. “I didn’t really expect to get as much done as I did.”

Neils explained a challenge he completed, “One was basically overfilling a region of memory to get a program to behave incorrectly and expose data,” he said, calling it a ‘capture the flag’ exercise. “The entire point of the exercise was to build a very specific series of input bytes to force the program to erroneously jump to a function it wasn’t supposed to. And when it executes that function, it dumps the flag back to the console.”

Lance Vasquez noted that despite spending the majority of the roughly eight-hour competition seated, he was exhausted.

“It was surprisingly draining considering it was mostly just sitting down the whole time,” Vasquez said. “I really didn’t know that much about cybersecurity, and this helped inform me about what it involves.”

“I do feel like I have more knowledge than I when I entered the competition.”

Vasquez also pointed out the importance of teamwork. “I feel like it was more of a team effort, I’m not sure if I completed a challenge by myself, but I did work for most of the challenges,” Vasquez said. “Mostly by translating things between different data formats like hash to text.”

Aaron Jarnes was competing in his first cybersecurity competition, and said it was a good experience that he hopes to repeat.

“I think it was really hard for beginners, but I learned a lot,” Jarnes said. “I want to do it again next year; it was a lot of fun.”