We built hardware challenges for Serbian national CTF... twice. Building a good hardware challenge is a balancing act between security, education, creativity, and logistics. The talk follows the entire process, from the initial idea and vulnerability selection to hardware and challenge design, storytelling, participant experience, manufacturing, and deployment at the competition.
Technical level: Beginner/Intermediate. No prior hardware security experience or preparation is required. The talk is intended for anyone interested in hardware, embedded systems, cybersecurity, or CTF challenge design.
Our talk presents the process of creating the hardware challenges used in the Serbian National CTF in 2025 and 2026. In both editions, we designed custom embedded devices with intentionally introduced vulnerabilities, built specifically to be exploited during the competition. From selecting realistic attack vectors and hardware components, designing PCBs and firmware, manufacturing the boards, and preparing the competition environment, to watching students solve them during the event, we were involved in every stage of the process.
This talk explores how the challenges are conceived, designed, built, and deployed. Along the way, we will discuss the technical and practical trade-offs, the lessons we learned, and the challenges of creating educational, engaging, and reliable hardware CTF tasks.
The talk is suitable for attendees with a beginner/intermediate level of technical knowledge. Whether one is interested in hardware security, embedded systems, or CTF competitions, they will gain a behind-the-scenes understanding of how hardware challenges are designed, built, and deployed. No prior experience with hardware hacking or specialized tools is required.
The talk will follow the outline below:
Motivation
- Why we decided to introduce hardware challenges to the Serbian national CTF.
- Inspiration from ECSC, where hardware challenges have been a regular competition category.
- Our backgrounds and how the project came together.
Hardware CTF Design Principles
- What makes a good hardware CTF challenge.
- Constraints and trade-offs: budget, accessibility, educational value, realism, and fun.
- Examples of hardware challenges from ECSC and the ideas that inspired our designs.
2025 Challenge
- Initial concept and design goals.
- Hardware architecture, component selection, and PCB design.
- Manufacturing.
- Challenge narrative and participant experience.
- Vulnerabilities and intended attack paths:
- UART
- eFuse
- USB HID
- Vulnerable OTA updates
- Unsafe cryptographic secret storage
- Reverse engineering
2026 Challenge
- Design goals and concept of a fictional game console.
- Hardware architecture, component selection, and PCB design.
- Manufacturing.
- Challenge narrative and gameplay.
- Vulnerabilities and attack techniques:
- Introductory side-channel analysis
- SPI bus sniffing and display reconstruction
- Logic analyzer usage
- Timing attacks using PIO
Lessons Learned
- Challenge balancing and playtesting.
- Designing intentional vulnerabilities.
- Manufacturing, logistics, and deployment during the competition.
- What worked well and what we would do differently.
Future Directions
Ideas for future competition challenges:
- Glitching and fault injection.
- Power analysis.
- NFC/RFID.
- Radio protocols.
- CAN bus.