CMU Scores Fourth Straight Victory At MITRE eCTF Cybersecurity Competition

A team of 15 students from Carnegie Mellon University have won the 2025 Embedded Capture the Flag(opens in new window) (eCTF) security competition, securing CMU’s fourth straight win. The eCTF is a two-phase competition run by MITRE(opens in new window) that challenges teams to design and submit a secure system and then analyze and attack other teams’ designs with the goal of having the most impenetrable system. 

The Plaid Parliament of Pwning(opens in new window) (PPP) team is made up of students from the CMU Robotics Institute(opens in new window) (RI), Information Networking Institute(opens in new window) (INI), Electrical and Computer Engineering department(opens in new window) (ECE) and Computer Science department(opens in new window) (CSD). Leonardo Mouta(opens in new window), Master of Robotics in Systems Development (MRSD) student and software engineering intern at the National Robotics Engineering Center(opens in new window) (NREC), is the first RI student to join a CMU eCTF team and contribute to their success at the competition.

The team of 15 students were coached by a team of advisers that included INI Associate Teaching Professor Patrick Tague(opens in new window). 

“The greatest values I see in the eCTF are the ways that the competition incorporates multiple aspects of real-world design — including systems, networking, software and security — and the way this naturally attracts, includes and values students with diverse academic backgrounds and perspectives,” said Tague. “Students on the team are able to learn from and support each other through the challenges in the competition, and every student provides unique value to the success of the team.” 

The MITRE eCTF challenges competitors to design security solutions for the embedded systems found inside objects. These are systems found in devices like GPS and fitness trackers or the automotive industry. For this year’s competition, teams were tasked with designing and implementing a system that could securely encode and decode satellite TV data streams.  

This year’s theme(opens in new window) was centered around designing and implementing a satellite TV system solution. Each system focused on securing video frame transmission to ensure that only users with the proper subscriptions can see them. The teams aimed to encode and decode satellite TV data streams while protecting against unauthorized access to protected channels.

“While the overall problem scope is somewhat smaller compared to previous years, this is still a realistic scenario that is significantly harder to implement correctly than it might seem at first glance,” said Mouta. “The security of our design hinged on how well we could model an attacker and how they might compromise our assets, which is difficult to emulate.” 

The students had three advisers overseeing their work: Tague; Anthony Rowe(opens in new window), Siewiorek and Walker Family Professor in Electrical and Computer Engineering; and Maverick Woo(opens in new window), systems scientist at the CyLab Security and Privacy Institute. This year’s team received funding from AT&T, Amazon Web Services, Cisco, Infineon, Nokia Bell Labs, Rolls-Royce, and Siemens through the Cylab Partnership Program(opens in new window). 

The eCTF competition takes an entire semester and fulfills a class requirement for each of the students who participate. Each team member answered a qualifying set of questions, developed by Woo, that measured their experiences and pinpointed what expertise they could bring to the project. The qualifying members joined the team and began work in January for the competition toward the end of the Spring semester. 

“In phase one of the competition, each team designs a system during the first half of the semester, and that system has to meet security and functional requirements. We then ship it off to other competing schools who try to hack your system while you try to hack theirs,” said Mouta, “If your system is not breached, you gain points. If you breach a different schools’ system, you ‘captured their flag’ and also gain points.”

Mouta explained the many difficulties that the PPP team had to handle, including tight deadlines, fierce competition, busy schedules, and other schools releasing their code at all hours of the day, meaning the team had to be ready to attack at any time. However, the CMU team pushed through the obstacles and emerged victorious.

“This was one of the hardest things I have done in my career at CMU,” said Mouta. “ It was such a multidisciplinary effort, and I am pleased we were able to add a roboticist perspective to the team. Even though we are not experts in every subject, our background in systems engineering and range of knowledge helps foster dialogue across disciplines.” 

Haonan Yan, Master in Information Security (MSIS) student and fellow PPP teammate, weighed in on the competition structure and how the team worked together to accomplish their goals.

“The eCTF competition had a structure similar to that of a real company. We had roles such as a tech lead and a product manager, and a shared goal: to deliver a secure product within a limited timeframe. This environment taught me how to effectively report my progress and collaborate with team members to complete the project.”

The eCTF awards ceremony was held in Boston, Massachusetts on April 25. The CMU team was awarded $10,000 in prize money, which will directly support the next eCTF team’s efforts in the 2025-26 competition. 

“I certainly hope this inspires more RI students to join next year,” said Mouta. “I love seeing collaboration between departments. It only makes the eCTF teams stronger.”