MITRE eCTF 2025
🏴 The embedded cybersecurity competition is an annual semester-long CTF run by MITRE Corporation. It is an attack-defense CTF which makes participants dive into cryptography and embedded firmware, and design a secure system that holds up to attack against other universities. MSU students have been taking part in the eCTF since 2022!
The 2025 competition ran from January 15th through April 16th with an Award Ceremony on April 25th. MSU's team finished 21st out 116 international teams, with 4 out of 5 defense flags intact throughout the whole competition!
In the 2025 eCTF, teams designed and implemented a Satellite TV system. The system had to securely encode and decode satellite TV data streams while protecting against unauthorized access to protected channels.
The main challenge for this year's competition was broadcast encryption, where the same data stream is shared from the satellite with every client (decoder), and has to be decoded by only authorized clients without the use of bi-directional communication.
This ruled out simpler schemes like challenge-response and required us to come up with a key distribution and encryption mechanism that uniquely applied to the situation at hand - effectively sharing a unique password per frame for channels with up to 2^64 frames, and a subscription to an arbitrary start and end timestamp.
We did this by using a downwards hash tree, which was a binary tree where the root node was successively hashed with unique "left" and "right" values to derive children nodes. The height of the tree was 64, which meant there were 2^64 leaves - each representing a frame in our scenario. This way, having access to a parent node let you decrypt every frame under its descendants, while going the other way around was infeasible by needing to compute a hash pre-image. This meant we could grant decoders fine-grained access to a range of frames from 0 to 2^64, each with a unique decryption password, by sharing on average only ~70 unique values!
Our design was also coded in Rust to avoid common memory safety pitfalls, and as an experience for getting more familiar with the language in an embedded context 🦀
Our design
Team Members
Udbhav Saxena (Lead), Adrian Self, Maksim Savich, Charles Selipsky, Samuel Lain Hedden, Doruk Alp Mutlu, Fatima Saad, Mariana Vangelov, Matteo Krivitzky, Jonathan Bolton, Felipe Marques Allevato, Shamar Dotson, Raj Dhullipalla, Aditya Chaudhari, Aashish Harishchandre, Lucas Bosca, Caroline Huang, Conner O'Sullivan
Advisor: Dr. Qiben (Ben) Yan