By Bethaney Lee
City College’s ethical hacking team placed second after mashing the keys of their provided laptops during a two-day cyber security competition located at Uber’s headquarters in San Francisco.
The Collegiate Penetration Testing Championship (CPTC) has held national competitions for the last three years in New York. Beginning with regional competitions hosted by colleges around the country, top teams from each region are selected to further compete in nationals during the fall.
City College’s six team members competed in the Western Regionals, which consists of 13 other states, on Oct. 7-8, 2017 and was invited to compete in nationals in Rochester, NY this November, the only community college in the competition. Their names are Tomas Horvath, Elizabeth Biddlecome, Joseph Nguyen, Andrew Mei, Tim Ip and Stuart Morris.
Morris, a computer networking and information technology major, is the leader of the team and said most of the other schools in the competition have teams which practice year round for cybersecurity competitions. He included that most teams live in close proximity, and in some cases the same dorms, but City College has team members in San Francisco, East Bay, South Bay and as far as Sonoma.
“The fact is, infosec (information security) is not just what we are studying; it’s our hobby. So we made the most of the little time we had to prepare relative to the other teams,” Morris said.
Because of the team’s distance, they focused their practice on how they could communicate information, document their processes as to not duplicate work and strategize on sharing information throughout the competition.
Sequestered to a hot conference room lacking an air conditioning unit and armed with nothing but a white board and six Macbook Pro’s, the team started hacking into a fictitious Gotham Election Network on Oct. 7, 2016.
Morris said, “The network we were attacking was set up like an internal corporate network would have been, and we compromised machines, identified vulnerabilities and basically got as much access as we could to their internal services over the next hours.”
CPTC’s website claims the competition “is unique in offering a simulated environment that mimics real world networks,” and students report on computer related security risks in the same way they would in a professional working environment. Part of the integrity of the competition relies on “injects” who are members of CPTC who carry out the role of the mock company by asking the teams a series of technical questions.
The team was given ten minutes to verbally respond. “Our team was very strong here and came up with excellent solutions for these challenges. Different team members were
required to answer each one, which played to our team’s strengths,” Morris said.
At 6 p.m. a gong rang to symbolize the end of the first part of the competition, but the team’s night was far from over.
Morris said the group was unhappy as they left, feeling they had not compromised enough servers. The team debriefed and drove home in heavy traffic before beginning work on their report. Once the team made it back to their individual homes, they worked through shared Google Docs until 50 pages of findings were reported.
“We did not get much sleep that night, and despite a mini-crisis that we worked through at the deadline, got our report in on time,” Morris said.
The team never discussed what prospects they might have in the competition but Morris said, “I knew that everyone privately wanted to compete at nationals, because what we had done the previous day was so fun and challenging, but we weren’t about to talk about that.”
The award presentation took the group by surprise. “As Berkeley straightened their hair, we waited, holding our breath as they announced the second place winner,” Morris said. In disbelief, the team heard City College announced and went up to accept their award which secured their seats at nationals.
“I kinda like that they called us City College,” Morris said. “It separates us from the rest of the teams who are four-year universities. It was satisfying knowing our hard work had paid off and that we had put CCSF on the map.”
City College Professor Sam Bowne, who the team attributes a large part of their success to, put the team’s plane tickets on his credit card the moment he heard they were headed to nationals. The college did not offer to pay for the trip. The team hopes to pay back Bowne not just in money, but a national win.