pls carry :3 win LakeCTF at EPFL; first major open CTF to ban AI

pls carry :3 wins prestigious EPFL cybersecurity competition LakeCTF - EPFL

pls carry :3 wins prestigious EPFL cybersecurity competition LakeCTF

Import & publish the news

Are you sure you want to import this news into ?

This news will be sent to its subscribers.

The fourth edition of Lake CTF brought ten teams to EPFL to take part in a jeopardy-style security hacking contest – with no LLMs allowed.

CTFs, or Capture the Flags, are competitions where the goal is to reverse engineer, decrypt and hack into computer systems to capture flags and win points for your team.

Since launching four years ago,Lake CTF,organized by EPFL’s Capture the Flag team thepolygl0tsand theSchool of Computer and Communication Sciences (IC), has rapidly built a reputation as one of the top CTF competitions in the world with a challenging format, high-caliber participants and an in-person final, which is rare and highly prized.

The event brings 80 participants in 10 teams to EPFL find text strings, called ‘flags’, secretly hidden in purposefully vulnerable programs or websites. The more they find, the better their score, and at the end of an eight-hour nonstop day of roughly 20 challenges, one team is declared the winner. One aspect that differentiated this year’s LakeCTF from many of the similar events was a strict ban on the use of AI.

“Like many other CTF competitions, we faced the controversial choice of how much AI to allow players to use,” says Luca Di Bartolomeo, a final year PhD student in the HexHive lab of Prof. Mathias Payer and one of the original founders of LakeCTF. “Until now, most of the major CTFs have just partially banned AI, and only regional competitions experimented with full bans on generative AI. LakeCTF is now the first major open CTF to also adopt this policy. We were very surprised by how positive the players’ reaction to this full ban was. Everyone really enjoyed going ‘back to basics’ and the ability to really see the difference in skills and preparation between teams.”

This year’s edition included 10 teams: pls carry :3, .;,;., flagbot, FluxFingers, ARESx, SleepyHollow, Squid Proxy Lovers, r3kapig, NUS Greyhats, and CyKor.

“It was a beautiful experience! The challenges were amazing and the organization of the event was perfect,” says Alessandro Rizzo, a computer science student from the Università del Salento and member of the winning team pls carry :3. “It was really fun to get rid of AI and play like we did in the old days. We hope to be here next year too!”

This year, along with the more standard hacking challenges, teams also competed for flags with some less conventional challenges, such as arcade games like Mortal Kombat and using a piece of string to retrieve a plastic duck from a kiddie pool.

“Some of LakeCTF challenges are painful, but they are always fun, and we learn a lot,” says Leoandro Mazzorana, who studies at the University of Trento and is on the ARESx team. He started participating in CTF competitions at 16 years old. “Also the no AI policy makes it more enjoyable.”

Arnav Adepu, a student from the United States competing on the team Squid Lovers Proxy (SLP) agreed that the prohibition on AI was an asset to the competition. “It’s a really fun CTF, especially with the use of no AI. I’ve felt like over the last few months, CTF culture has become predominately about who has better AI, so without that, it is just genuinely an enjoyable experience. I found the on-site challenges to be really creative with interesting ideas. This is definitely one of the more advanced CTFs.”

“Being the first CTF to put a ban on AI is a precedent, and it will be interesting to see if others will follow suit given the positive feedback we’ve received from players” says Deirdre Rochat, LakeCTF founder and organizer, and Head of Communications for the EPFL IC School. “For the challenge authors who create problems with the solver in mind, it’s far more motivating to design for a human rather than a machine. Without that human element, much of the incentive disappears, and it’s important to give challenge authors a space where their work is still valued. The IC School is proud that LakeCTF continues to set the standard in terms of the levels of challenges and the quality of the competition. This event will continue to put EPFL on the global cybersecurity map, demonstrating the power of bringing young talent together from across the globe to shape a more secure and responsible digital future.”

The polygl0ts and the IC School would like to thank LakeCTF’s sponsors: Asymmetric Research, Zellic, OtterSec, Cyberdefense, and Infomaniak.

Companies interested in partnering with LakeCTF in 2027 can contact Deirdre Rochat:[email protected]

10 competing teams & their placements

pls carry :3, multiple institutions, international - Score 1843

.;,;., multiple universities, USA 1829

FluxFingers, Ruhr-Universität Bochum, Germany - Score 1295

flagbot,ETH Zürich, gibb Berufsfachschule Bern, - Score 1199

ARESx, multiple universities, Europe – Score 1138

SleepyHollow,multiple institutions, France - Score 1081

Squid Proxy Lovers, multiple institutions,USA - Score 1032

r3kapig, ETH Zurich, Switzerland; Universität Bonn, Germany; UC San Diego, USA, - Score 1015

NUS Greyhats, National University of Singapore, Singapore – Score 879

CyKor, Korea University, Korea - Score 657

Source:Computer and Communication Sciences | IC

This content is distributed under a Creative Commons CC BY-SA 4.0 license. You may freely reproduce the text, videos and images it contains, provided that you indicate the author’s name and place no restrictions on the subsequent use of the content. If you would like to reproduce an illustration that does not contain the CC BY-SA notice, you must obtain approval from the author.

All Computer and Communication Sciences | IC news

CTFs, or Capture the Flags, are competitions where the goal is to reverse engineer, decrypt and hack into computer systems to capture flags and win points for your team.Since launching four years ago,Lake CTF,organized by EPFL’s Capture the Flag team thepolygl0tsand theSchool of Computer and Communication Sciences (IC), has rapidly built a reputation as one of the top CTF competitions in the world with a challenging format, high-caliber participants and an in-person final, which is rare and highly prized.The event brings 80 participants in 10 teams to EPFL find text strings, called ‘flags’, secretly hidden in purposefully vulnerable programs or websites. The more they find, the better their score, and at the end of an eight-hour nonstop day of roughly 20 challenges, one team is declared the winner. One aspect that differentiated this year’s LakeCTF from many of the similar events was a strict ban on the use of AI.“Like many other CTF competitions, we faced the controversial choice of how much AI to allow players to use,” says Luca Di Bartolomeo, a final year PhD student in the HexHive lab of Prof. Mathias Payer and one of the original founders of LakeCTF. “Until now, most of the major CTFs have just partially banned AI, and only regional competitions experimented with full bans on generative AI. LakeCTF is now the first major open CTF to also adopt this policy. We were very surprised by how positive the players’ reaction to this full ban was. Everyone really enjoyed going ‘back to basics’ and the ability to really see the difference in skills and preparation between teams.”This year’s edition included 10 teams: pls carry :3, .;,;., flagbot, FluxFingers, ARESx, SleepyHollow, Squid Proxy Lovers, r3kapig, NUS Greyhats, and CyKor.“It was a beautiful experience! The challenges were amazing and the organization of the event was perfect,” says Alessandro Rizzo, a computer science student from the Università del Salento and member of the winning team pls carry :3. “It was really fun to get rid of AI and play like we did in the old days. We hope to be here next year too!”This year, along with the more standard hacking challenges, teams also competed for flags with some less conventional challenges, such as arcade games like Mortal Kombat and using a piece of string to retrieve a plastic duck from a kiddie pool.“Some of LakeCTF challenges are painful, but they are always fun, and we learn a lot,” says Leoandro Mazzorana, who studies at the University of Trento and is on the ARESx team. He started participating in CTF competitions at 16 years old. “Also the no AI policy makes it more enjoyable.”Arnav Adepu, a student from the United States competing on the team Squid Lovers Proxy (SLP) agreed that the prohibition on AI was an asset to the competition. “It’s a really fun CTF, especially with the use of no AI. I’ve felt like over the last few months, CTF culture has become predominately about who has better AI, so without that, it is just genuinely an enjoyable experience. I found the on-site challenges to be really creative with interesting ideas. This is definitely one of the more advanced CTFs.”“Being the first CTF to put a ban on AI is a precedent, and it will be interesting to see if others will follow suit given the positive feedback we’ve received from players” says Deirdre Rochat, LakeCTF founder and organizer, and Head of Communications for the EPFL IC School. “For the challenge authors who create problems with the solver in mind, it’s far more motivating to design for a human rather than a machine. Without that human element, much of the incentive disappears, and it’s important to give challenge authors a space where their work is still valued. The IC School is proud that LakeCTF continues to set the standard in terms of the levels of challenges and the quality of the competition. This event will continue to put EPFL on the global cybersecurity map, demonstrating the power of bringing young talent together from across the globe to shape a more secure and responsible digital future.”The polygl0ts and the IC School would like to thank LakeCTF’s sponsors: Asymmetric Research, Zellic, OtterSec, Cyberdefense, and Infomaniak.Companies interested in partnering with LakeCTF in 2027 can contact Deirdre Rochat:[email protected]10 competing teams & their placementspls carry :3, multiple institutions, international - Score 1843.;,;., multiple universities, USA 1829FluxFingers, Ruhr-Universität Bochum, Germany - Score 1295flagbot,ETH Zürich, gibb Berufsfachschule Bern, - Score 1199ARESx, multiple universities, Europe – Score 1138SleepyHollow,multiple institutions, France - Score 1081Squid Proxy Lovers, multiple institutions,USA - Score 1032r3kapig, ETH Zurich, Switzerland; Universität Bonn, Germany; UC San Diego, USA, - Score 1015NUS Greyhats, National University of Singapore, Singapore – Score 879CyKor, Korea University, Korea - Score 657