pico CTF Teaching 10 000 High School Students

pico. CTF: Teaching 10, 000 High School Students to Hack Peter Chapman peter@cmu. edu This material is based upon work supported by the National Science Foundation Graduate Research Fellowship under Grant No. 0946825. 1/15/2014 Carnegie Mellon University

Technology has the potential to truly revolutionize education by simultaneously reducing cost and increasing quality. Founded Fall 2011 2

Udacity Collegiate High Schools 2, 500 Students over 400 Teams 3

Carnegie Mellon University 2012 4

High School Computer Science Education There is a nationwide shortage of computer security and computer science experts. Roughly 30, 000 high students from 2, 000 schools took the AP CS exam in 2013. Eighty-two percent of surveyed U. S. millennials say no high school teacher or guidance counselor ever mentioned to them the idea of a career in cybersecurity. “It will take a national strategy, similar to the effort to upgrade science and mathematics education in the 1950’s, to meet this challenge. ” 5

pico. CTF A competition-based computer security educational experience targeting high school students. Introduce real-world offensive and defensive skills to all backgrounds. Build the event around an interactive game to motivate students and teachers. 7

Capture the Flag Competitions CTFs DIGITAL [1] Open-Ended and Difficult 8

Traditional CTF Competitions Cryptography Digital Forensics Reverse Engineering Binary Exploitation Web Security 9

pico. CTF Goals 1. An authentic, fun, and interactive hacking experience. 2. Encourage students to pursue degrees of computer science, regardless of incoming background. 3. Nationally recognize and inspire top competitors to become industry leaders. 10

What is a hacker? 11

HACKER: someone who seeks and exploits weaknesses in a computer system or computer network. 12

Provides a service! I made the We make vending case. machines! I designed the keypad. 13

Let’s meet Kelly. 14

Let’s meet Collin. ? 15

An Idea! ? 16

Expectation Reality Checks denomination of coin by size. Checks inserted object by size. 17

How to fix it? Let‘s check the weight too. 18

Another Idea! Computer security is a backand-forth between attackers and defenders. ? We refer to our assumptions about the attacker as our 'threat model’. 19

HACKER: Someone that exploits the gap between what is expected and what is possible. Why teach hacking? Understanding how to break systems is necessary in order to defend them well. 20

The Team 21

Entertainment Technology Center Experts in game development and design. 22

April 26 7: 00 AM EDT - May 6 11: 59 PM EDT A polished presentation to welcome students and add legitimacy. 23

24

25

Sponsors 26

Success! 1, 938 Participating Teams 955 Participating Schools 8 -10, 000 Students 57 Computer Security Challenges The largest computer security competition ever held. 27

955 different schools. 28

Unsolicited Message from Pennsylvania Teacher Wow! I haven't seen something like this light the fire of such a wide range of students in my 22 years of teaching computer science… Neither robotics, ACSL, face-face or online traditional programming contests, Logo, Alice, block based languages a la Scratch or App. Inventor, early HTML development, or any other single CS phenomenon has ever inspired so many students to fight to get access in the computer lab after school and ask me cerebral questions such as bit-wise arithmetic or syntax questions on languages they haven't learned in school! THERE IS NO DOUBT IN MY MIND THAT THIS CONTEST WILL SINGLE-HANDEDLY ATTRACT MANY STUDENTS TO CAREERS IN CYBERSECURITY AND COMPUTER SCIENCE IN GENERAL! 29

pico. CTF 2014 • Fall Competition Date • Focused Computer Security Curriculum and Educational Content • Emerging Partnerships to Expand Scope • Team and Instructor Management • Robust Communication System 30

pico. CTF Largest computer security competition ever held. • Polish and presentation matter at scale. • Leverage existing organizations for support and growth. 31

32