During Cyberweek 2023, Digital Wallonia‘s « Agence du Numérique », in collaboration with the association BeHack, organized a Capture the Flag (CTF) competition for students with a passion for cybersecurity. The event lasted all night, from 7 pm on October 13 to midday on October 14. Punctuated by a variety of challenges, the aim of the event was to test students’ skills and highlight know-how and future talent in the field. Companies such as Wavestone and Thales were on hand to run workshops, spot this talent and fill the very real shortage of cybersecurity specialists.

Our partner BeHack, co-organizer of the competition, invited Epitech Brussels’ students to take part and the challenge was met with great success, as one of the two groups of our students who entered was the overall winner! The second group of Epitech students came in 7th place.

MyLittlePwnies

The winning group is called MyLittlePwnies. More than a group formed ad-hoc for this competition, MyLittlePwnies is a student association committed to raising awareness of computer security. Let’s get to know its members!

After spending the first three years of their studies at Epitech Nancy, Nathan Chiodin and Lucie Thomas are in their fourth year of computer science studies at Epitech Brussels, specializing in cybersecurity. Their fellow students from Epitech Nancy, Alexandre Romanowski and Mathieu Gillet, have joined them for the occasion to complete the team’s skills pool and capture together as many flags as possible. Alexandre is currently a third-year student and Mathieu has just finished his five years at Epitech, but still enjoys taking part in CTFs and hackathons in his spare time. Clearly, this field is more than a professional opportunity for them, it’s a passion.

The name of the team that meets regularly in more or less the same format to take part in cybersecurity competitions is a play on words stemming from Mathieu’s imagination. A hacker slang term, “to pwn” means “to compromise” or “to control”. As its pronunciation is close to the word “own”, “MyLittlePwnies” makes us think of ponies. We prefer to think of them as “unicorns”.

How to win a CTF competition

Faced with a series of challenges from the organizing companies – Cresco, RedSystem and Approach Cyber – MyLittlePwnies proved to be a solid team, thanks to the complementary skills of its members. They took the lead an hour after the start of the CTF, and it was then that they realized that it could go very well, despite the obstacles.

“It motivated us enormously that everyone could go into their own area of expertise and do as they pleased,” says Nathan.

OSINT is Lucie’s favorite theme, so she tackled the challenges associated with this field head-on. Using hidden yet open-source digital data, she was able to identify the location where an image was taken. In the second OSINT challenge, she also found a secret location using three words. Overpass Turbo, What3words, Google Images… the secret is to know which tools to use to get the job done. Lucie also had fun picking locks and solving steganography challenges. But not everything was rosy: “I practically spent from midnight to 9:30 and 16 seconds on the cryptography challenges and cried blood!”

Helped by Alexandre and Mathieu, Nathan was able to master the reverse engineering and password cracking challenges. Nevertheless, Forensics is Nathan’s favorite category. He had the pleasure of being the first to solve two of the four challenges in this discipline – quite a feat, given his condition:

“I had a headache, a sore throat, an earache and no voice. The good thing was that I was so sick that I didn’t feel tired anymore. So I was able to concentrate all night. I assumed that as long as I didn’t fall down, I’d be able to keep going. It was the first time in a long time that we’d managed to do a CTF together in person. That’s what motivated me the most. What’s more, I was the first to find a flag early in the evening, and that’s when I realized there might be a chance.”

Lessons to take away

MyLittlePwnies were marked by having come this far and won. They entered the competition to have fun and ended up surprising themselves.

As well as learning cryptographic skills, the experience helped Lucie gain even more self-confidence. Nathan improved his way of thinking and learned to see certain things from a different angle: “I came across a flag I didn’t recognize, for example. Next time, I’ll know better.”

As well as learning, MyLittlePwnies like to share their knowledge: “I’ve been out and about with all the teams, helping out with the OSINT challenges. In fact, we gave pointers to the other participants. That’s one of the things we really wanted to do: maintain the Epitech atmosphere at the CTF. We prefer to help people learn,” says Lucie.

As members of the MyLittlePwnies association, Lucie and Nathan have already organized their own CTF competition in Nancy and are currently preparing the second edition, perhaps on the Epitech Brussels campus. This CTF, hosted by Digital Wallonia’s Agence du Numérique, has surely inspired them to enrich their own event, which will take place in March 2024. Stay tuned!