Cyber Security

Cyber savant hacks his way onto international team

Nathan Kahl — Tue, 03 Dec 2024 16:48:51 +0000

Cyber savant hacks his way onto international team Nathan Kahl Tue, 12/03/2024 - 11:48

Dylan Victor Knoff is president of the Mason Competitive Cyber (MCC) club, a computer science major, and the kind of self-motivated hacker you might see rummaging through Goodwill bins, in his free time looking for a $4 router that he can use to bolster his resume.

“I’ll pull it apart and take the firmware off the chip. It's good fun, responsibly and ethically doing stuff to it, of course, and then reporting vulnerabilities,” he said.

The ��AV junior likes to examine routers because they are more likely than other devices to have detectable problems. Once he finds a vulnerability, per industry practice, he reports it to the vendor and then MITRE, the nonprofit that that catalogs firmware and software problems. Getting a mention on their common vulnerabilities and exposures listing looks good professionally for young cyber sleuths.

This ambition to make the cyber world a better, safer place is a theme in Knoff’s life. First, he started a Capture the Flag (CTF) team during high school, and then he attended a university cyber club while still a teen. When the Orlando native and first-gen college student could have chosen the local University of Central Florida, instead he left home for George Mason, recognizing the university’s prowess in the field and the benefit of being close to potential employers in the Washington, D.C., metropolitan region. Knowing that breaking into cybersecurity is no Mickey Mouse endeavor, shortly after arriving in Fairfax he networked with the Battelle intern coordinator and subsequently landed a paid, full-time co-op with the STEM giant.

When he's not hacking routers, Knoff enjoys Shenandoah National Park

Knoff is on the U.S. Cyber Team and in October competed at the International Cybersecurity Challenge in Santiago, Chile. He said, “We competed against other countries’ teams in a two-day CTF, where one day was attack-and-defend, and the second day was on vulnerability assessment and exploit development.”

Knoff’s research focus is reverse engineering and vulnerability research. “I'll find something wrong with a specific device or framework and I'll find a ‘zero day,’ which is a vulnerability that is unknown to the vendor, and then I'll disclose it to them,” he said, indicating the standard industry practice.

For next year’s DistrictCon, a hacker conference in Washington, D.C., in February, Knoff and two members of MCC participated in the Junkyard Contest, where participants find vulnerabilities in devices; they discovered a stunning eight zero days on one router.

Knoff is giving a separate talk at the conference, on return-oriented programming, a way that hackers can get into a system by reusing code that already exists in a program. “I made this tool that utilizes computer emulation to analyze and visualize the memory side effects of elements that make up a return-oriented attack. Using data aggregation, these elements are then sorted based on their exploitation effects and made easily searchable to an operator.” He made the tool open source, available to anyone on GitHub, and is releasing an updated version the day of the talk.

On rare days when he’s not at a keyboard, Knoff enjoys getting outside, especially for a hike. “I love going to Shenandoah with my friends, doing Old Rag and White Oak,” he said, referencing two of the more popular—and challenging—Shenandoah National Park trails.

Currently he’s entertaining offers for two new co-ops, with the hopes of potentially spinning one of those into full-time employment. And whether scaling digital peaks or the rugged trails of Shenandoah, Knoff will find himself climbing…toward discovery and solutions in a safer cyber world.

Topics

Cyber Security

Mason Competitive Cyber

computer science

Tech Talent Investment Program (TTIP)

Students

Information technology students stepped up to secure Virginia’s elections

Teresa Donnellan — Wed, 28 Aug 2024 14:19:47 +0000

Information technology students stepped up to secure Virginia’s elections Teresa Donnellan Wed, 08/28/2024 - 10:19

Secure elections are the cornerstone of democracy, and the Virginia Cyber Navigator Internship Program (VA-CNIP) has equipped students with the skills to strengthen the cybersecurity posture of election infrastructures. As an intern last summer, information technology (IT) major Duong Thuy Nguyen helped secure a rural county's technology for the upcoming presidential election alongside two other George Mason students, Maha Khan and Sophie Bates.

Sponsored by the National Security Agency (NSA) and run by the University of Virginia (UVA) and five other Virginia universities including George Mason, VA-CNIP was developed to address the need for improved election security in localities that may not have the resources to implement necessary cybersecurity measures.

Nguyen, who is pursuing a dual concentration in database technology and programming and cyber security, traveled to Campbell County for a few days each week over the summer to support the county’s dedicated and hard-working IT staff in complying with the Locality Election Security Standards (LESS) required by the Commonwealth of Virginia. The LESS requirements are designed to ensure that all localities, regardless of size, have baseline cybersecurity measures in place, with further goals to achieve "preferred" or "premium" levels of security. The program thus not only prepared students for future careers but also left a lasting impact on the local governments they serve.

From left to right, Albanese, Hicks, and Nguyen with two other VA-CNIP interns. Photo provided.

George Mason Associate Professor Max Albanese helped lead VA-CNIP, designing a course in election security that was a prerequisite for all interns. In addition to the course, a two-day boot camp at UVA provided interns with training, including hands-on activities and talks from high profile industry experts and election officials. This year United States Election Assistance Commissioner Thomas Hicks spoke at the boot camp.

“Especially this year, the focus was on trying to send interns to localities that were in most need of upgrading their security posture,” said Albanese, “and that means the more rural or less technologically advanced counties.”

Each week, students worked remotely for part of their assignments but also traveled to their assigned localities for on-site work. Due to the often-rural nature of the counties involved, VA-CNIP provided a $3,000 travel allowance to each intern in addition to their $9,000 stipend. This allowed students to travel long distances and, when necessary, stay overnight in nearby towns to avoid lengthy commutes. The George Mason interns this year traveled about four hours one way to reach Campbell County.

Nguyen in Campbell County. Photo provided.

Nguyen noted how rewarding it was to work in-person with the local IT department. Her tasks included developing security policies, conducting research on cybersecurity tools, and even designing tabletop exercises to prepare local officials for possible cyber incidents on election day. Nguyen raved about her internship, which was her first. Even though she had to travel a lot, she said, she would not change her experience.

“They were all very welcoming, and they gave us all the support that we needed,” she said.

VA-CNIP exemplifies the power of academia, government, and students working together to tackle one of the most pressing challenges of our time—ensuring the security and integrity of democratic processes. While funding for VA-CNIP ends this year, there are ongoing discussions about sustaining the program going forward.

In This Story

Massimiliano Albanese

Explore career options at University Career Services

Topics

information technology

Information Sciences and Technology Department

information sciences and technology

CEC high impact stories

CEC internships

Cybersecurity Honors College student ready to hit the ground running

Nathan Kahl — Mon, 12 Aug 2024 17:59:19 +0000

Cybersecurity Honors College student ready to hit the ground running Nathan Kahl Mon, 08/12/2024 - 13:59

Jose Perez starts at ��AV this fall, majoring in Cyber Security Engineering and participating in the Honors College. But the Falls Church, Virginia native feels like he’s already a student, in a way.

“I’m familiar with so many of the faculty at this point because I participated in the Early Identification Program—I’ve been coming here for summer events since as early as 8th grade,” he said. “I’ve already formed a sense of community here. And as an International Baccalaureate student, I had college-level work for two years and so have decent academic preparation.”

He describes himself as a “STEM kid from the get-go,” and participated in cybersecurity-related extracurriculars in high school. “For me, it’s the best cross between raw engineering and computer science.” Being part of Meridian High School’s Cyber Patriots team exposed him to the challenges and opportunities in computer science.

Perez took part in the First Robotics Competition in high school. Photo provided

He burnished his high school resume with a lot of extracurriculars: He was the lead engineer on a Science Olympiad team, participated in George Mason’s Youth Research Council, volunteered for Habitat for Humanity, and was a four-year participant in the urban farm project at his school.

Perez is the child of immigrants from the Philippines—both his parents are nurses—and he recognizes that opportunities presented here at George Mason will allow him a great path toward upward mobility that he might not have at other institutions, especially being able to save money while living at home. “I knew I would be happy here and get what I need, especially because I feel like I've already formed a sense of community here.”

He’s ready and excited for what new changes are in place. “I’m aware of the new amount of freedom and responsibility I’ll have as a college student. I’ll just be prepared to take that on. I’m trying to push myself to do a lot this first semester and I’m part of the Global Gateway and will be going to Korea in my second semester. It will be a great way to throw myself in there.”

Topics

Cyber Security

Honors College

Early Identification Program (EIP)

Students

��AV redesignated as a National Center of Academic Excellence

Nathan Kahl — Tue, 05 Dec 2023 15:42:36 +0000

��AV redesignated as a National Center of Academic Excellence Nathan Kahl Tue, 12/05/2023 - 10:42

��AV was recently redesignated by the National Security Agency (NSA) as a National Center of Academic Excellence (NCAE) in Cybersecurity. This recognition continues a designation that has been in place since 1999 and makes Mason’s College of Engineering and Computing eligible for special funding opportunities.

Mason was redesignated in two categories: Cyber Defense (CAE-CD), valid through 2027, and Research (CAE-R), valid through 2028. Mason is one of only seven schools that received a designation with the original cohort in 1999. The CAE in Cyber Defense is the longest-running designation of any program in the country.

NSA has curriculum requirements that a program must meet, involving a rigorous, peer-reviewed, multi-step application. Massimiliano (Max) Albanese, an associate professor and associate chair for research in the Department of Information Sciences and Technology and the associate director of the Center for Secure Information Systems, helps lead Mason’s efforts in securing the designation.

According to the CAE Community website, “The CAE in Cyber Research designation indicates that (an) institution increases the understanding of robust cyber defense technology, policy, and practices that will enable our Nation to prevent and respond to a catastrophic event. The CAE in Cyber Defense designation indicates that (an) institution is helping reduce threats to our national infrastructure by promoting higher education and research in cyber defense as well as provide the nation with a pipeline of qualified cybersecurity professionals.”

Max Albanese (with plaque) with representatives from the FBI, NSA, and CISA

Albanese said, “To become eligible for the Cyber Defense designation, which is the education component of the NCAE program, a school has to have a validated program of study meeting NSA curriculum requirements; the one that allowed us to be eligible for the designation is our bachelor’s in information technology, with a concentration in cybersecurity.” To be eligible for the Research designation, a school must have a PhD program preparing students for research in cybersecurity, which at Mason is the PhD in information technology. Albanese added that the university is currently preparing an application to also validate the college’s master’s in applied information technology.

“In addition to the prestige,” Albanese said, “an advantage of the designation is that we have access to exclusive funding opportunities. We’ve been receiving funds for the Cyber Security Scholarship Program (CySP) for many years, for example, which covers tuition, health insurance for doctoral students, laptops, a stipend, and more.” The program brings roughly $150-$200k annually for Mason students. NSA funding that Mason receives for other cyber-based projects is also contingent on the school having the CAE designation.

Albanese said, “Mason’s NCAE designation isn’t just a badge of honor, it’s a testament to our commitment to excellence in cybersecurity education and research. Beyond the obvious financial benefits, being part of the CAE community is a catalyst for innovation and collaboration. The innovative Virginia Cyber Navigator Internship Program (VA-CNIP), managed by a coalition of NCAE-designated Virginia universities, is a prime example of how being part of this community translates into impactful initiatives and real-world experiences for our students.”

In This Story

Massimiliano Albanese

Learn About IST Research

Topics

Cyber Security

cyber defense

National Security

National Center of Academic Excellence

Campus News

CSIRTs protect cybersecurity; expand job opportunities

Rena Malai — Fri, 11 Mar 2022 20:05:11 +0000

CSIRTs protect cybersecurity; expand job opportunities Rena Malai Fri, 03/11/2022 - 15:05

In This Story

Sherif Hashem

Cybersecurity is a growing concern for anyone using technology—which is pretty much everyone. It’s an area that has seen tremendous research since the first global attacks surfaced in the late 1980s and early 1990s.

Low-income countries can have challenges with getting appropriate cybersecurity protective measures in place and developing much-needed cybersecurity talents. To address this concern, George Mason Information Sciences and Technology professor Sherif Hashem was part of a team that produced a report ‘Cyber Incident Management in Low-Income Countries.’ The report was funded by Global Affairs Canada, and presented last month in an international webinar by the Global Forum on Cyber Expertise.

According to Hashem, having Computer Security Incidence Response Teams (CSIRTs) in place can greatly help in handling and preventing cyber attacks. He says Computer Incidence Response is a term that popped up globally about 30 years ago, and it is associated with professionals who respond to the threats made over computer systems and networks.

“Established CSIRTs can help detect a cyber attack when it happens, and greatly minimize its impact,” Hashem says. “Cyber attacks against critical national infrastructure can be some of the most impactful as they can potentially affect everyone in society.”

One recent example is the Colonial Pipeline ransomware attack in 2021, the largest cyber attack on an oil infrastructure target in U.S. history, says Hashem.

“CSIRTs across the globe work together to mitigate such cyber attacks and help bring the criminals to justice,” he says. “Without CSIRTs in situations like this, the aftermath of a cyber attack can be devastating. It’s better to be prepared and minimize any losses; recover quickly.”

The ‘Cyber Incident Management in Low-Income Countries’ report showcases CSIRT models and structures that are workable within limited budgets. The report also provides guidance on developing technical skills within CSIRTs and highlights a wide range of training programs and tools.

“Our research findings can be used holistically by any entity looking to establish CSIRTs, whether there is a limited budget or not,” says Hashem.

The first CSIRT was created by Carnegie Mellon University over thirty years ago, says Hashem. Since then, the cybersecurity space has become an area rich with job opportunities. An estimated 400,000 open cybersecurity jobs are available today in the United States alone.

“I hope this motivates students to consider information security as a part of their education and career plan,” says Hashem. “The opportunities are endless.”

The full webinar is available to view on You Tube. Part 1 and part 2 of the report are also available to view.

Topics

Cyber Security

College of Engineering and Computing

information sciences and technology

Information Sciences and Technology Department

Mason wins VMI Cyber Fusion event

Rena Malai — Wed, 02 Mar 2022 15:23:45 +0000

Mason wins VMI Cyber Fusion event Rena Malai Wed, 03/02/2022 - 10:23

In This Story

Jim Jones

The Mason team poses with the first place trophy after winning VMI's Cyber Fusion event.

Mason Patriots won Commonwealth Cyber Fusion, an event that combines a collegiate cyber competition with learning and career opportunities.

��AV students competed in the event last weekend and again claimed first place, a position Mason has maintained from the previous Cyber Fusion. Mason representatives at Cyber Fusion included Henry Coffman, member of the Virginia Cyber Range Executive Committee, and Jim Jones, Mason faculty advisor.

The students who competed in the event are a part of Mason’s Competitive Cyber club, sponsored by the Cybersecurity Engineering (CYSE) department and coached by Jones. A number of members in the club are also students in the CYSE program.

Peggy Brouse, CYSE professor, says she is very proud of the winners’ continuing efforts and their achievements as representatives of Mason.  

“Once again, our CEC students from both the Cyber Security Engineering and the Computer Science departments brought home the first place trophy from the Cyber Fusion conference,” says Brouse. “The students they competed against are from top-ranked cyber schools which makes the accomplishment even more noteworthy.”

The students self-formed the Mason Competitive Cyber club which plays a large part in their successes, she says.  

“Especially impressive is that the club welcomes all students to learn about and practice for competitions regardless of experience or academic year,” Brouse says. “I look forward to future competitions.”

Cyber Fusion is co-hosted by the Virginia Military Institute (VMI), Sen. Mark R. Warner, the Commonwealth Cyber Initiative, and the Virginia Cyber Range. According to VMI, Cybersecurity is one of the nation’s and Commonwealth’s top priorities. Cyber Fusion is the organized integration of data and tools from disparate sources of support for secure and resilient system lifecycles.

Topics

Events

Department of Cyber Security Engineering

Cyber Security

College of Engineering and Computing

Mason welcomes new Eminent Scholar in Cybersecurity

Martha Bushong — Wed, 22 Sep 2021 22:14:51 +0000

Mason welcomes new Eminent Scholar in Cybersecurity Martha Bushong Wed, 09/22/2021 - 18:14

Giuseppe Ateniese is the Eminent Scholar for Cybersecurity. Courtesy photo

It’s not surprising that ��AV’s prominence in the field of cybersecurity attracted Giuseppe Ateniese to the College of Engineering and Computing. Mason has a long history of active teaching and research in cybersecurity. In the 2022 U.S. News and World Report Best Colleges List Mason ranked #28 nationally and #15 for public universities. Ateniese, who was recently hired as an Eminent Scholar in Cybersecurity, wants to take Mason to the next level.

“Mason was always on my radar,” says Ateniese. “So once this opportunity as an eminent scholar popped up, I was very interested. Mason is providing me with strong support to build a top-notch research group.”

Ateniese comes to Mason from Stevens Institute of Technology, where he was chair of the computer science department. He taught at Sapienza-University of Rome, served as assistant and associate professor at Johns Hopkins University, and was one of the JHU Information Security Institute founders. His experience in the corporate sector included a stint as a researcher at IBM’s Zurich research lab and as a scientist at the Information Sciences Institute of the University of Southern California. He also briefly worked as a visiting professor at Microsoft in Redmond, Washington.

In addition to teaching cybersecurity classes, Ateniese expects to lead transformative growth in Mason’s cybersecurity research portfolio and encourage and foster new and existing collaborations with the Commonwealth Cyber Initiative and its partners as well as other academic, industrial, and governmental institutions in the greater Washington, D.C. area.

Ateniese says he would like to serve as a bridge between different units. “This is something I actually learned as department chair,” he says. “When I was able to connect faculty within my department to different units, sometimes I was able to make things happen.” He sees a large part of his role as finding collaborators. “I really want to go after bringing cybersecurity to the next level and figure out what is needed at Mason to move in that direction,” he says.

Ateniese’s research focuses on cloud security and machine learning applied to security and intelligence issues. He is also investigating new security applications for decentralized computing based on blockchain/bitcoin technology.

“Society is embracing artificial intelligence, and I’m concerned that we are doing this in a way that is probably too fast,” he says. “We have to consider also security and privacy implications of this technology. My goal is to build a safe and private artificial intelligence framework so that we can ensure that machine learning models are doing what they’re supposed to do.”

He is also investigating new security applications for decentralized computing based on blockchain/bitcoin technology. “Everyone is talking about bitcoin and other cryptocurrencies,” he says. “But that’s probably nothing compared to what is possible with blockchains and smart contracts.”

Though his appointment is with the computer science and cybersecurity engineering departments, he sees amazing potential collaborations between different groups because cybersecurity spans many units. As time goes on, he aims to understand what’s available and coordinate significant cybersecurity initiatives.

Department of Computer Science chair David Rosenblum says, “Giuseppe is an internationally leading scholar who brings to Mason an outstanding record of research achievement in computer security, as well as extensive leadership experience in academic administration and entrepreneurship. We look forward to supporting him as he leads strategic research efforts in critically important areas such as blockchain technology and trustworthy AI.”

Topics

Cyber Security

computer science

The Cybersecurity Manufacturing Innovation Institute receives national recognition by the White House

Martha Bushong — Fri, 27 Aug 2021 18:03:16 +0000

The Cybersecurity Manufacturing Innovation Institute receives national recognition by the White House Martha Bushong Fri, 08/27/2021 - 14:03

In This Story

Paulo Costa

The Cybersecurity Manufacturing Innovation Institute (CyManII) was recognized by President Joe Biden and the White House Administration during his address given to the Cybersecurity Summit on August 25, 2021. U.S. public and private sector entities have been attacked in various high-profile cybersecurity incidents by increasingly sophisticated and malicious cyber attackers. President Biden addressed the cybersecurity threats and incidents that are currently affecting the nation and discussed how the government, education, and private sectors can work together to improve the nation’s cybersecurity.

Researchers from Mason’s College of Engineering and Computing are deeply involved with CyManII, and dedicated space at ��AV’s Arlington Campus serves as the institute's east coast headquarters. The headquarters will house offices, meeting space, and training facilities for the National Capital Region.

“The Arlington facility will include lab space and equipment to demonstrate, test, and validate CyManII’s emerging cybersecurity and advanced manufacturing technologies and products,” says Associate Professor and Vice President for Securing Automation and Supply Chain Paulo Costa. “Our proximity to the Department of Energy and Washington, D.C. will be useful to visitors when we return to in-person meetings and events.”

The 13,000-square-foot facility supports robotic platforms that evaluate security vulnerabilities, the impact of 5G on autonomous vehicles, the power grid, smart buildings and cities, and smart manufacturing. The space will also host a robotic smart manufacturing testbed and provide meeting and temporary office space for visiting researchers and staff.

Mason is participating in road mapping efforts and strategic decisions about investments, technical focus, and projects. Mason faculty will also gain complimentary access to CyManII events, tech showcases and meetings, and participate in the annual RFP (Request for Proposals) competition. Researchers from the College of Engineering and Computing, who are setting up the lab, are playing key roles in CyManII’s first-year projects, finding ways to protect manufacturing automation and supply chains from cyber threats, and designing better security for advanced manufacturing plants.

Funded by the Department of Energy, CyManII addresses the fundamental, hard challenges of cybersecurity within the manufacturing and cybersecurity sectors of our nation’s infrastructure. As mentioned by the White House, the U.S. manufacturing and energy critical infrastructure ecosystems are at high risk to cyber-attacks and thus, makes the U.S. manufacturing sector the number one target for nation-state cyber-attacks.

“CyManII recognizes that to transform the manufacturing industry, we must provide workforce development at scale to reach manufacturers where they exist today to upskill and reskill their workforce,” said CyManII Chief Executive Officer Howard Grimes. “To protect U.S. companies from cyber-attacks, a massive workforce development effort must be launched.”

Investing its technical expertise and efforts into developing a state-of-the-art secure manufacturing architecture called Energy Efficient (ε) Pervasive, Unobtrusive, Resilient, and Economical (ε-PURE), CyManII has begun the work necessary to research, implement and educate manufactures on the evolving threat vectors. This work aims to protect U.S companies from current and future cyber-attacks as well as increase overall equipment energy efficiency to provide manufacturers more productivity and more profit.

“CyManII will introduce new cyber-informed, secure-by-design architectures and we will align the implementation of these architectures, on both legacy and new systems, with a highly trained workforce capable of defending U.S. companies and manufacturers over the next decades,” says Grimes.

Topics

Cyber Security

College of Engineering and Computing

Arlington campus

Mason Engineering BS in cyber security engineering earns ABET accreditation

Anonymous — Tue, 19 Jan 2021 14:45:18 +0000

Mason Engineering BS in cyber security engineering earns ABET accreditation Anonymous (not verified) Tue, 01/19/2021 - 09:45

Mason Engineering’s bachelor’s degree program in cyber security engineering has been accredited by the Engineering Accreditation Commission of ABET, the global accreditor of college and university programs in applied and natural science, computing, engineering, and engineering technology.  

ABET accreditation assures that programs meet standards to produce graduates ready to enter critical technical fields that are leading the way in innovation and emerging technologies and anticipating the welfare and safety needs of the public.

“ABET accreditation is important to all engineering programs. The BS in cyber security engineering being the first ABET-accredited cyber security engineering program, and the first accredited with the new cyber security program criteria, is an important achievement for the new Volgenau Department of Cyber Security Engineering, but it is only the beginning,” says Peggy Brouse, professor and associate chair for the department. “The department is launching the new MS CYSE degree this spring semester. In addition, we are in a great position to extend research that we already have with the National Security Agency and the Department of Homeland Security. We are excited for the future.”

Students pursuing a BS in cybersecurity engineering learn from distinguished faculty in the classroom and gain hands-on experience through projects and a year-long senior design capstone where faculty, students, and even alumni come together to tackle real-world problems.

Alumnus turned senior design capstone advisor Matthew Wilkes, BS cyber security engineering ’18, says of the students he has mentored, “I want to ensure they’re encouraged to be successful in both their project and beyond. I won’t make it easy for them because if it was easy every student could do it.” Wilkes was among the first students to graduate from the program.

“Any student who graduates from Mason with a degree in cyber security engineering has very high expectations,” says Wilkes.

Students praise the program and the opportunities that Mason offers. “Mason’s cybersecurity program has helped me build a solid base of practice and theory to fuel extracurricular study,” says cyber security engineering student Zaine Wilson. “Professors Tom Winston, Jim Jones, Mohamed Gebril, and all the other professors in the department, you won't find a group of more caring, inspiring, and wise mentors anywhere else.”

ABET’s voluntary peer-review process is highly respected because it adds critical value to academic programs in the technical disciplines, where quality, precision, and safety are of the utmost importance.

Topics

Cyber Security

Cybersecurity

Accreditation

Department of Cyber Security Engineering

Mason Competitive Cyber Club cracks the code, hacks a building

Anonymous — Mon, 04 Jan 2021 14:11:34 +0000

Mason Competitive Cyber Club cracks the code, hacks a building Anonymous (not verified) Mon, 01/04/2021 - 09:11

This past November, Mason Competitive Cyber (MCC) put their hacking skills to the test and participated in Hack the Building, a cybersecurity competition hosted by the U.S. Cyber Command, a division of the U.S. Department of Defense, Dreamport, and the Maryland Innovation and Security Institute.

Eight of MCC’s top members teamed up with fellow cyber competition enthusiasts at the University of Virginia to literally hack a building, but not just any building. This was a 150,000 square feet, two-story office building filled with smart devices, diesel generators, and business systems.

“This was unlike any competition we had participated in before,” says Caleb Yu, MCC’s vice president. “We encountered both traditional information technology networks and industrial control networks and hacked through both cyber and physical means.”

While most of MCC’s team hacked the building remotely from the safety of their homes, two members from each team were invited to also infiltrate the building on-site in Annapolis, Maryland. “Uniquely, this competition featured physical access control systems to attack and exploit, including badge readers, security cameras, and physical doors,” says MCC president Zaine Wilson. “This was the first time I'd ever been to a competition that has these challenges.”

Over the four-day competition, MCC’s team was given numerous scenarios in which they had to hack various components of the smart building. “Hack the Building had several challenges that required Red Team skills like lateral movement, privilege escalation, and password attacks,” says MCC competitions officer Andrew Oliveau. “We began in an IT network and hacked our way into a non-internet connected OT [industrial hardware] network.”

From there, the team reverse-engineered elevator controls, disabled heat exhaust fans, and manipulated electric power distribution units.

In one challenge the team disabled the building’s security cameras. “Some of the challenges seemed straight out of spy films,” says Yu. “It is exhilarating when we’re able to pull off a successful cyber-attack, but, at the same time, it is also frightening. Scenarios like these show how our network-connected world can be brought down by hackers.”

Facing stiff competition from security industry professionals around the country, ��AV’s student team not only held its own but also found surprising success in many of the event’s challenges and exceeded expectations throughout the four days.

They even received a shoutout from competition officials in front of former Cybersecurity and Infrastructure Security Agency Director Chris Krebs on the Hack the Building livestream. Krebs oversaw much of the national strategy for defending critical infrastructure in cyberspace. It was a wonderful surprise to the team to be lauded in front of him.

Although Hack the Building does not formally declare a winner, team bragging rights come from getting “first blood” on various challenges, which means they were able to hack their way through the challenge before any of the other teams. Impressively, a moderator informed Mason Competitive Cyber’s team that they had the most first blood solves in the competition of any team, including the professional ones.

At the end of the four days, MCC members spoke highly of the competition and expressed eagerness to compete again in the following years. “This competition gave me experience in what it's actually like to run a full-scope penetration test, and I'm absolutely hooked,” says Wilson.

Hack the Building created the most realistic environment that the MCC team has encountered, says the team. Rather than solving isolated cybersecurity challenges, the competition’s style of scenario-based cyber-attack campaigns brought a sense of realism to the competition.

And as the U.S. Department of Defense works to raise the next generation of cyber warriors through competitions such as Hack the Building, MCC proved they are up for the challenge.

This story was written by members of the Mason Competitive Cyber club.

Topics

Cybersecurity

Cyber Security

student organizations

Cyber Security

Cyber savant hacks his way onto international team

Topics

Information technology students stepped up to secure Virginia’s elections

In This Story

Explore career options at University Career Services

Related Stories

Topics

Cybersecurity Honors College student ready to hit the ground running

Topics

����AV redesignated as a National Center of Academic Excellence

In This Story

Learn About IST Research

Topics

CSIRTs protect cybersecurity; expand job opportunities

In This Story

Topics

Mason wins VMI Cyber Fusion event

In This Story

Topics

Mason welcomes new Eminent Scholar in Cybersecurity

Topics

The Cybersecurity Manufacturing Innovation Institute receives national recognition by the White House

In This Story

Topics

Mason Engineering BS in cyber security engineering earns ABET accreditation

Topics

Mason Competitive Cyber Club cracks the code, hacks a building

Topics

��AV redesignated as a National Center of Academic Excellence