[INTERVIEW] CyKor wins the grand prize at SECCON: Japan’s largest hacker championship
CyKor has truly become the best student hacker club in the world.

CyKor, Korea University’s student hacker club, won an overwhelming victory at the Security Contest (SECCON), Japan’s largest hacker championship. The members of CyKor are all majoring in Cyber Defense.

This is not the first award for CyKor; they won a grand prize at the 13th Hacking and Defense Contest (HDCON) hosted by the Korea Internet & Security Agency (KISA) in November 2016, and the group has received awards in many national and international hacking competitions.

We conducted an interview with the members of CyKor after they returned from Japan. Due to the Department of Cyber Defense’s anonymity policy, we replaced the four members’ real names with the alphabet letters A, B, C, and D.

- Please give us a brief introduction of yourselves and CyKor.
- A: I’m a senior. B is a junior. C and D are sophomores. CyKor is a student club in the Department of Cyber Defense. Those who are interested in hacking or information security join our club. The members have seminars on these topics and participate in hacking competitions like SECCON as a team.
- B: CyKor has around forty members. Our department accepts applicants who’ve been studying hacking or cyber security and have experience in hacking competitions, through rolling admission. They play an important role whenever CyKor participates in hacking contests.

- A: It was originally organized by students of the Graduate School of Information Security in 2011. At the time, the members were all grad students. It was not until 2014 when undergraduates began leading the club.

- CyKor won first place by a wide margin at the SECCON. Please give us a brief explanation of CTF (Capture the Flag) competitions like SECCON for readers who may not be familiar with this term.
- B: There are many kinds of CTF competitions, but they are basically problem-solving competitions. The host of a competition sets up a certain hacking environment, and the competitors break into the target server and accomplish missions like logging in as admin. Those who succeed on a mission can get a certain symbol called an authentication key or a flag. This is why these competitions are called “Capture the Flag.” Once you obtain a flag and upload it on the website of the competition, your scores go up. The higher the score you get, the higher your rank is in the competition. This is how CTF competitions work, although the details may vary from competition to competition. 
- D: SECCON follows a specific kind of CTF rules called “King of the Hill.” Once you authenticate a flag you have won, you get scores. And if you keep occupying the server, you get additional scores for every five minutes of occupation.
- B: There are two types of scores for “King of the Hill”—attack points and defense points. When you break into a target server, you get attack points. And when you protect that server from other competitors’ attacks, you get defense points. Defense points are given every five minutes to the team with the shortest attack codes.

- Did you have any interesting episodes during the competition?
- A: Not really. The competition was so short and time flew by.
- C: We had one after the competition.
- A: Oh, right. We were supposed to return to Korea the day after the competition. In the evening of the last day of competition, we reserved a limousine bus to Narita. However, there was some misunderstanding with the bus staff, and we got on a bus to Haneda Airport. We missed our flight and had to stay in Japan one more day.

- You got one more day to enjoy Japan! By the way, I heard that CyKor has also won many national and international hacking competitions, like HDCON. How do you practice for these competitions?
- C: We try to create as many competitive experiences as possible and solve hacking practice problems posted on hacking websites. That’s pretty much all we do. I think these are the two most important ways to practice our skills. 

- Because of the distinct characteristics of your department, many Korea University students don’t know much about your daily routines on campus. Can you tell us about that?
- A: Our daily routines are not as secretive as you might think. One of my friends joined a drama club. Some people like interacting with many people and some people don’t. The activities we do as part of the department are not much different from those of other departments. We even throw parties and go to workshops with other departments.
- B: When I talk with friends from different departments, I also feel no differences. Of course, there are some differences in terms of curriculum and department policies. Students of other majors are not allowed to take our major courses, and when we register for classes and in public settings, we are not allowed to disclose our real names and other personal information. 
- D: Since only Cyber Defense students take the major courses, we don’t have to go through all the hassles of winning a seat in classes that fill quickly. But when we register for liberal arts classes, you have to move fast.  
- B: When I was a freshman, I couldn’t understand why my other friends wake up so early in order to turn on their computer on the registration day. Haha!

- A little while ago, you told us that some of the Cyber Defense students studied in this field and participated in hacking competitions before entering Korea University. What about students with no such experiences? How do they catch up with these early starters?
- A: I was one of those with no experience in this field. In my freshman year, it was hard to adjust to new surroundings. When I joined a team to enter a competition as part of CyKor, my scores were not so good. At the time, CyKor was in its early stages, and members usually solved practice problems together and had seminars rather than participating in competitions. Then, new junior members joined CyKor. They were so talented. I learned a lot from them. As I said before, there’s nothing special about how we practice. We just solve as many practice problems as we can.

- Thanks for your tips. These days, more and more people are getting interested in CTF competitions, hacking, and cyber security, thanks to CyKor and famous white hackers. Is there any way people with zero education or experience in cyber security can enter this field?
- A: Of course. I know a student of the Graduate School of Information Security who majored in Korea Language and Literature in college.

- Then what advice would you like to give them?
- C: When I was in high school, I joined a student hacker club. I learned a lot from the senior members there. But there are not many high schools with student hacker clubs. For example, D went to a high school with no such clubs.
- D: In the first two years since I started studying cyber security, I have not had to buy a single book because I could find a plethora of information online. I still get most of my information from the Internet. Actually, I bought some books for in-depth study, but there is nothing new in the books. I can find the information on the Internet. People upload all kinds of information, such as practice problems, basic principles of hacking, and what not. Just make sure to practice your Googling skills.
- C: Ah, one more thing! If you have a very challenging problem, don’t just give up or ask others for help before doing your best to solve it. When you go to online forums for hackers, you can find many questions posted. Some are good questions and they get many replies. But other questions are just pointless. If you want to ask good questions and get valuable help from others, you first need to take some time to study by yourself. It’s like studying math. Think for yourself.
- D: Yeah, that’s so true.
- B: Thinking for yourself is so important in college. When you are in middle school and high school, you can get good grades by doing what you are told to do. But once you get out of high school, you need to find your own way. There is no predetermined way to learn something. Sometimes, you may meet obstacles along the way. It’s okay to ask others for help. But before that, ask yourself if you took enough time to think for yourself.    

- Thank you for your advice. And here’s the last question: What is your next goal?
- A: I will be graduating from college this year. After graduation, I’d like to do research on some topics I’m interested in. CyKor has won so many awards and titles, and winning competitions is great, but I hope CyKor members don’t neglect research and study so that CyKor can create an active research environment.
- B: I’ll be a senior this year. I’ll focus on studying and keeping good grades.
- C: Yeah, me too. And I’d like to win more competitions with my CyKor buddies.
- D: I also want to study hard while in college. My ultimate dream is to become the world’s top specialist in cyber security.