Justas Kaminskas on what CTF is and how to win it

My favorite was the 2024 Hack the Box challenge, Operation Tinsel Trace II: Join the Resistance Against Krampus!, where we had to answer questions about the artifacts provided, which were “released” every few days, and the first person to solve that day’s challenge won. The very last, 6th challenge was the most difficult; it took me 5 hours to solve, and I was definitely feeling exhausted by then. Somehow I pulled myself together and won. Try hack me was also memorable because of the prize we won—together with the NRD Cyber Security team, we received twelve PlayStation 5 consoles.

The NKSC, which is a partner of the SANS CTF EU, shared information about the event. I saw it and decided to participate. The irony is that I might not have even been able to enter this competition at all. I kept putting off registration, and by the time I was ready… I couldn’t register anymore. I didn’t give up, and my third attempt to contact the organisers was successful – they let me participate.

I got very little sleep during the competition itself. I knew that it wasn’t just speed that mattered, but also the number of incorrect answers. I wasn’t among the leaders at any point during the competition, but I armed myself with patience and tried to make as few mistakes as possible and use as few attempts as possible. In the end, I made only one mistake, jumped up 30 spots, and became the winner. There were 300 participants left in the final; about 1,000 people participated in total.

It certainly presents many challenges, especially since AI is used to solve problems. Easy problems become even easier to solve, while harder ones become harder – but that’s just the way it is. And if AI can’t solve them, then no one can. So a dilemma naturally arises: is this a competition of cybersecurity knowledge and skills, or a contest to see who can make better and more effective use of AI’s capabilities? Organisers of in-person CTFs try to limit the use of AI, but doing so online is very difficult. That’s why, for example, reflecting on the BSides Vilnius conference, the organising team and I discussed holding next year’s CTF (which took place online this time) in person.

Undoubtedly, AI is becoming a part of our daily lives, both at work and everywhere else, so CTFs shouldn’t be an exception either, and we need to look for ways in which these competitions should and could evolve. When AI is used properly, it makes it easier to track information, follow sequences, and stay on track. This becomes especially valuable during sleepless nights, as it allows you to organise and process information more quickly. Also, AI plays an important supporting role – when you’re stuck, the right query can put you on the path to solving the problem.

Well, first of all, you need to take a broad interest in the field of cybersecurity, the incidents occurring around the world, and try to understand how they happened, how they are investigated, and how they are resolved. You’ll also definitely need technical skills and knowledge. You can use various online platforms for this, such as pwncollege, where you can learn how to “hack” programs.

Second, you need to give it a try. It’s worth starting with simpler competitions; for example, picoCTF would be a good choice. If you’re still in school, the NKSC organizes the Cyber Marathon (with monthly challenges), where you can test your skills. Also, for young people (up to age 25), the NKSC organizes an annual selection process for the national CTF team called Cyber Sprint, followed by training camps and other events.

There are certainly plenty of opportunities and ways to get involved, so I encourage you to give it a try and join these competitions. I hope the national team will thrive and grow stronger, and that we’ll make a name for ourselves on the international stage!