Cybersecurity team including students, faculty from ASU wins $2 million in international contest

PHOENIX — A team of cybersecurity experts from three colleges, including Arizona State University, won a multimillion dollar jackpot at a hacking competition last month.

The 25-person team called Shellphish won a $2 million prize after making the cut as finalists in a competition at DEF CON. The world’s largest hacker convention is held in Las Vegas each year.

Shellphish is made up of cybersecurity experts at ASU, Purdue University and the University of California, Santa Barbara.

The challenge the team took part in is called the AI Cyber Challenge Semifinal Competition (AIxCC).

Forty teams in total submitted working cybersecurity systems, according to Adam Doupé, an associate professor at ASU. He’s one of Shellphish’s leaders.

“This was just the first step of the process,” Doupé told KTAR News 92.3 FM’s Arizona’s Morning News on Monday. “So this was the qualification round where it was open to any team to compete.”

Shellphish is one of the top seven teams that will compete in the finals next year at DEF CON, he added.

WE QUALIFIED FOR AIxCC FINALS!!!! pic.twitter.com/QrA4hbliax

— Shellphish (@shellphish) August 11, 2024

Why is this important?

Cybersecurity is one of the top safety concerns in today’s digitized world. Many hospitals have equipment that relies on computer systems connected to the internet. Additionally, many modern cars are essentially computers on wheels due to their complex inner machinery.

Even something as simple as a bug in a software update can throw a wrench in entire industries. A global tech outage in July 2024 grounded flights, knocked banks offline and jerked media outlets off air in mid-July.

That’s why the Defense Advanced Research Projects Agency (DARPA) supports the yearly hacker convention. It wants to bolster cybersecurity professionals to ensure there’s a new crop of tech experts who can combat cyber criminals.

“They basically helped fund and research the internet,” Doupé said of DARPA. “One of the things they wanted to do is say ‘Hey, we have all these cool AI tools that people are creating, but can they be used to help people in a cybersecurity context?'”

That’s where the idea for AIxCC came from.

“I think competitions like this AI cyber challenge are ways to push the industry forward,” Doupé said.

What did the Shellphish team do to become finalists?

The team created a tool called ARTIPHISHELL for the competition. Shellphish’s automated tool checks computer programs for vulnerabilities.

“One of the things that is a little bit scary to think about is that so much of the software that we rely on day-to-day is essentially maintained by one person that they do in their free time,” Doupé said. “All it takes is one vulnerability in one of those libraries or those software that everyone uses, and this can have a massive impact, including in hospitals.”

ARTIPHISHELL is designed to help small teams of developers find issues in software they create and use.

“They can use our system and our AI tools in order to help them find vulnerabilities before the bad guys do,” Doupé said.

The prize money will help Shellphish continue working on ARTIPHISHELL. The group won $1 million in March in the first round of the contest. That money funded the early work behind their tool, as well as travel costs and practice in cybersecurity competitions.

During next year’s competition, Shellphish will compete for a $4 million prize.