Computer engineering undergraduate Renaaron Ellis designs a security workforce development tool
Provided
Professor Micheal Zuzak, left, and Renaaron Ellis worked together to build a gamified hardware platform to help students learn about techniques to discover and prevent online exploits.
Renaaron Ellis is helping his red-team cybersecurity peers to learn how recognize and prevent black hat temptations. His RenCTF program is a gamified security workforce development program that uses team-based activities to help students to understand how hacks and other online exploits are conducted and how to prevent or mediate these exploits.
The computer engineering undergraduate has been focused on building workforce development security tools this academic year as part of a larger National Science Foundation research project with Michael Zuzak, assistant professor in the Kate Gleason College of Engineering, to develop workforce development security tools. Ellis has taken coursework and added web design and interactive hardware onto a platform that expands the traditional Capture the Flag and Hack the Box security exercises.
Ellis, a third-year student in the secure systems option of computer engineering from East Stroudsburg, Pa., talked about the project, how it came about, and why it is needed.
What is RenCTF and how does it work?
RenCTF stands for my name, Ren, and Capture the Flag. It is a gamified platform with interactive challenges—easy, intermediate, and difficult—that programmers and security officials in the world of offensive testing experience in terms of trying to get into a network system. We built the app ourselves; there’s no templates that we used. It was an original idea. There are some common challenges on the internet, but by gamifying them, turning them into to something that can be played throughout the department, Dr. Zuzak wanted to have something for the students in computer engineering.
What did it take to build this system? And what is the status of this project?
The site is live with multiple players, and there is a LED board located in the department that shows team status. Before I worked on this project, I had done a decent amount of hardware projects. But the web application side, that was something I had no idea how to do at all. Over the summer, it was – what is a website? How do I host one? How do I build one? What are the languages, the frameworks? I learned a bunch of applications. That process of stacking on what you know already and what you don’t know will become shorter and shorter as you build your repertoire.
What are red-team instructions and black-hat temptations?
“Red-team instructions” or red-teaming is specifically in a simulated environment where there is no actual risk of compromising real sensitive information. It is basically the process of breaking into something, or reverse engineering something to try to get past some barrier that another team puts up. “Black-hat temptations” or black-hat attackers refer to unethical hacking practices aimed at exploiting systems in a non-simulated real environment. They have the incentive of getting into a program or application toward something valuable that they want to get to or look at. And our product puts this in a facilitated space where we can test those challenges. We can see what it is like to be on the other side and help defend against it.
Why are systems such as this important?
We started working on this December 2023. Dr. Zuzak was showing me some of the hardware he had in his office and there is a little circuit board, an ESP32, and I thought, I can do something with this. I took it home that night and came up with a prototype and brought it back. He was like, ‘Wow this is pretty close to what I had envisioned.’ By November 2024 we had a formal project underway.
There’s a lot that, especially with developments of AI and everything increasingly online, when it comes to computer engineering, it is important to understand how to make it safe and to understand how an adversary would think about getting behind what you have made. It is important to see it from both ends, because if you don’t, then we have situations where people are just writing erroneous code that leads to security issues. This project is important to me, not only because I think the mission we have with it is one that I agree with and like.
What is next?
This was my first project that I did where I was able to apply everything that I’ve learned on smaller projects over the years—doing PCP design and 3D printing, learning web development, using Raspberry Pi and Arduinos. I took Dr. Z’s hardware security class last semester; it was the best class I’ve taken. It was fun. Everything that I learned in that class has fundamentally changed the way that I design things and how I would protect information. I want to work in the security area. I don’t know if that will come through industry or research. I’m glad that I was able to realize that this is definitely the field I want to be in.
