A team of 15 students from Carnegie Mellon University have won the 2025 Embedded Capture the Flag (eCTF) security competition, securing CMU’s fourth straight win. The eCTF is a two-phase competition run by MITRE that challenges teams to design and submit a secure system and then analyze and attack other teams’ designs with the goal of having the most impenetrable system.
The Plaid Parliament of Pwning (PPP) team is made up of students from the CMU Robotics Institute (RI), Information Networking Institute (INI), Electrical and Computer Engineering department (ECE) and Computer Science department (CSD). Leonardo Mouta, Master of Robotics in Systems Development (MRSD) student and software engineering intern at the National Robotics Engineering Center (NREC), is the first RI student to join a CMU eCTF team and contribute to their success at the competition.
This year’s theme was centered around designing and implementing a Satellite TV System Solution. Each system focused on securing video frame transmission to ensure that only users with the proper subscriptions can see them. The teams aimed to encode and decode satellite TV data streams while protecting against unauthorized access to protected channels.
Back row, left to right: Peiyu Lin, Matin Sadeghian, Taha Biyikli, Om Arora, Surya Togaru, Akhil Harikumar, Daniel Ha, Rohil Chaudhry
Front row, left to right: Haonan Yan, Janice He, Harrison Lo, Sky Bailey, Carson Swoveland, Samuel Dinesh, Leonardo Mouta
“While the overall problem scope is somewhat smaller compared to previous years, this is still a realistic scenario that is significantly harder to implement correctly than it might seem at first glance,” said Mouta. “The security of our design hinged on how well we could model an attacker and how they might compromise our assets, which is difficult to emulate.”
The students had three advisors overseeing their work: Anthony Rowe, Siewiorek and Walker Family Professor in Electrical and Computer Engineering; Patrick Tague, Associate Teaching Professor at the Information Networking Institute; and Maverick Woo, Systems Scientist at the CyLab Security and Privacy Institute. This year’s team received funding from AT&T, Amazon Web Services, Cisco, Infineon, Nokia Bell Labs, Rolls-Royce, and Siemens through the Cylab Partnership Program.
The eCTF competition takes an entire semester and fulfills a class requirement for each of the students who participate. Each team member must take a qualifying set of questions, developed by Maverick Woo, that measures their experiences and pinpoints what expertise they may bring to the project. The qualifying members join the team and begin work in January for the competition towards the end of the Spring semester.
“In phase one of the competition, each team designs a system during the first half of the semester, and that system has to meet security and functional requirements. We then ship it off to other competing schools who try to hack your system while you try to hack theirs,” said Mouta, “If your system is not breached, you gain points. If you breach a different schools’ system, you ‘captured their flag’ and also gain points.”
Mouta explained the many difficulties that the PPP team had to handle, including tight deadlines, fierce competition, busy schedules, and other schools releasing their code at all hours of the day, meaning the team had to be ready to attack at any time. However, the CMU team pushed through the obstacles and emerged victorious.
“This was one of the hardest things I have done in my career at CMU,” said Mouta. “ It was such a multidisciplinary effort, and I am pleased we were able to add a roboticist perspective to the team. Even though we are not experts in every subject, our background in systems engineering and range of knowledge helps foster dialogue across disciplines.”
Haonan Yan, Master in Information Security (MSIS) student and fellow PPP teammate weighed in on the competition structure and how the team worked together to accomplish their goals.
“The eCTF competition had a structure similar to that of a real company. We had roles such as a tech lead and a product manager, and a shared goal: to deliver a secure product within a limited timeframe. This environment taught me how to effectively report my progress and collaborate with team members to complete the project.”
The eCTF awards ceremony was held in Boston, Massachusetts on April 25. The CMU team was awarded $10,000 in prize money, which will directly support the next eCTF team’s efforts in the 2025-2026 competition.
“I certainly hope this inspires more RI students to join next year,” said Mouta. “I love seeing collaboration between departments. It only makes the eCTF teams stronger.”
The members of the 2025 PPP team are listed below:
- Om Arora, CSD First-year
- Sky Bailey, ECE Senior
- Taha Biyikli, CSD First-year
- Rohil Chaudhry, INI Master’s Student
- Samuel Dinesh, INI Master’s Student
- Daniel Ha, ECE First-year
- Akhil Harikumar, INI Master’s Student
- Janice He, INI Master’s Student
- Peiyu Lin, ECE Master’s Student
- Harrison Lo, ECE Master’s Student
- Leonardo Mouta, RI Master’s Student
- Matin Sadeghian, CSD First-year
- Carson Swoveland, ECE Senior
- Surya Togaru, INI Master’s Student
- Haonan Yan, INI Master’s Student
For More Information: Aaron Aupperlee | 412-268-9068 | aaupperlee@cmu.edu