Carnegie Mellon cyber hacking team wins record 7th title in annual competition

LAS VEGAS — Carnegie Mellon University’s cyber hacking team, the Plaid Parliament of Pwning (PPP), defended its title in DEF CON’s Capture-the-Flag competition — its seventh victory in the past 11 years.

The team joined forces with the University of British Columbia’s Maple Bacon team and hackers from CMU Alum startup Theori.io (The Duck), playing under the name Maple Mallard Magistrates (MMM).

“It feels great to win once again, and the team is incredibly pleased that we built and maintained a lead throughout the entire contest,” said Jay Bosamiya, PPP’s team captain and a Ph.D. student in CMU’s Computer Science department, and member of CMU’s CyLab Security and Privacy Institute. “Our victory as MMM shows how well our three teams work together.”

Set in Las Vegas, DEF CON’s three-day flagship competition, widely considered the Olympics of hacking, brought together some of the world’s most talented cybersecurity professionals, researchers, and students, as 12 of the world’s top teams (who qualified from a field of 1,828 teams) attempted to break each other’s systems, stealing virtual flags and accumulating points while simultaneously protecting their own.

Carnegie Mellon University’s hacking team, the Plaid Parliament of Pwning, defended its title at the 2023 @DEFCON Capture-the-Flag competition, earning its seventh victory in eleven years.#DEFCON2023 #DEFCON31

— CyLab (@CyLab) August 14, 2023

As the number of cybersecurity attacks continues to increase worldwide, competitions like DEF CON’s Capture-the-Flag provide the opportunity for leading cybersecurity engineers to measure up against one another, learning and developing new techniques as they work through various challenges.

CMU students, faculty, and alumni ended atop the leaderboard at the end of days one and two, and held on in the competition’s final 24 hours to secure the victory. For the win, the team earned eight black badges, the most elite recognition in hacking.

“It’s hard to understate the impact our students have in cybersecurity,” said David Brumley, a professor in the school’s Electrical and Computer Engineering department. “Aside from DEF CON, CMU students were the first to hack a Tesla and the iPhone, have founded multiple successful companies like Theori, ForAllSecure, and Comma, and have become professors at top universities. Graduates of CMU’s cybersecurity programs are simply among the best in the field, and DEF CON is just one very specific way that proves it.”

The CMU team was formed in 2009 and began competing at DEF CON in 2010. Previous wins for the school came in 2013, 2014, 2016, 2017, 2019, and 2022, with second-place finishes in 2015, 2018, 2020, and 2021. The team runs and competes in several cybersecurity competitions each year and recently defended its title at the MITRE embedded Capture-the-Flag event (eCTF).