Mercer University’s cybersecurity team, known as the CyBears, recently progressed to the regional round of the Collegiate Penetration Testing Competition, which takes place across the world with over 100 teams competing.
The team is captained by Leonidas McClurkin, a senior majoring in cybersecurity, and coached by Dr. Johnathan Yerby, associate professor of computer science. Other students on the team are Co-Captain Patrick Burnette, Taka Nakamura, Andrew Triplett and Jay Sanchez.
“Traveling and competing in this event for the CyBears has been one of the most memorable experiences and showed us that we knew even more than we realized,” McClurkin said.
The competition required that students hack and defeat security systems as if they were conducting a penetration test for a company. Working under the theme of a hotel, the CyBears worked for nine hours to see what systems they could access, what information was vulnerable, and how they would be able to exploit those vulnerabilities.
The CyBears were able to get into some of the systems to view reservations, take user information, and change reservations and prices. They had some success getting into the point-of-sale system as well. They also were able to conduct phishing attacks where they sent an email to a targeted user with the intent of capturing login information. The targeted user received the message but did not turn over the login credentials.
The CyBears had to complete a bid to be invited to the competition. In it, the students detailed why they should be selected, their skills, method and team roster. After the bidding period, the competition organizers selected the top 10 proposals for the Southeastern region.
The team prepared some of its attack plan prior to competition day, which was Nov. 19. On the day of the competition, the students left Mercer’s Macon campus in a van to travel to the Georgia Cyber Innovation and Training Center in Augusta. Once on site, they received instructions and a room to work from for the next nine hours. After working to penetrate the defenses, they were let out at 8 p.m. For the following seven hours they documented their findings in a professional penetration test report to be submitted by 3 a.m. the next morning.
That morning, the top three teams were announced, and there was a short debriefing. While the CyBears did not make the top three, they were told they did a great job and the judging was close between several teams.
This was the CyBears first time participating in an offensive security competition. They competed in the National Cyber League defensive competition two weeks before the onsite Collegiate Penetration Testing Competition.
This competition and others align with the defensive, offensive and administrative nature of the Bachelor of Science and Bachelor of Arts degrees in cybersecurity. Interested Mercer students are welcome to join the CyBears by contacting Dr. Yerby at yerby_jm@mercer.edu.
