Winning Teams Announced in Build It, Break It, Fix It Contest

cybersecurity competition

Published October 15, 2014

After three intense rounds of competition, two teams were chosen as winners in the inaugural Build It, Break It, Fix It cybersecurity competition.

The online contest—conceived by faculty and graduate students in the Maryland Cybersecurity Center (MC2)—drew the interest of students from 61 universities from across the U.S., including 39 students from the University of Maryland.
Cybersecurity experts judging the competition gave participating teams two independent ratings: one for building a secure system (Build It), and one for finding flaws in an opponents’ system (Break It).

Twenty-eight teams competed in the Build It round, while nine teams took part in the Break It round. Contestants could choose to enter either category, or could compete in both.

“Team meh” from the University of California, Berkley, was awarded first place in the Build It category, with Harvard University’s “Team Error309” coming in second.

For the Break It category, “Team SSRG_VT” from Virginia Polytechnic Institute took first place with “Team woopwoop” from University of Cincinnati placing second.

In addition to bragging rights, the first-place teams each received a cash prize of $4,000. Second-place finishers received $2,500.

The overall goal of the contest, says Michael Hicks, a UMD professor of computer science who conceived the competition, was to give students hands-on experience in writing more secure software programs.
During the Build It round, contestants wrote software for a system specified by contest organizers. In the Break It round, the students looked to exploit flaws in the software programs submitted by other teams. During the Fix It round, teams had to patch vulnerabilities in their software that was exposed by their competitors.
“The Build It teams took a very different approach to solving the problem presented to them, using an interesting variety of programming languages and working styles,” says Hicks, who is a member of MC2 and also holds an appointment in the University of Maryland Institute for Advanced Computer Studies.

Kevin Casey, a member of Team meh and a junior computer science major at Berkeley, says the competition put his coding skills to the test.

“I learned a lot about actually implementing security, applying the theory we learned in school, and weighing the cost of various optimizations versus security,” Casey says.

Alex Turcu, the sole member of Virginia Tech’s Team SSRG_VT and a final-year computer engineering doctoral student, says he was surprised to be named the top breaker.

“I spent significantly more time and effort as a builder, yet I won first place as a breaker,” Turcu says. “The most important lesson for me was that building software to a specification is difficult, and requires paying the utmost attention to every detail.”

Contest sponsors included AT&T, Cyberpoint, Trail of Bits, Cigital, Patriot, the National Science Foundation, SuprTEK, AsTech Consulting, Galois, and iSEC Partners, part of the NCC Group.

Go here for an in-depth look at the contest. See the final scoreboard and photos of the winning teams here.

- Story by Melissa Brachfeld