Invisible Truck, GPS Hacking, & Mad Racing: First-Person View of World’s First-Ever Autonomous Driving CTF Contest
By: Asguard Uci
Tags: Self Driving Cars, Ctf, AI, Machine Learning, Hacking

By ASGuard Research Group @ UC Irvine

CTF (Capture The Flag) is perhaps the most famous hacking contest in the computer security world. In DEF CON, one of the world’s largest and most notable hacker conventions, CTF contests have been organized since 1996 and always been the focal point of computer security professionals and practitioners. As the organizer for DEFCON China, Baidu Security has been organizing the CTF contests, called BCTF, in the past few years. This year, with the booming of the autonomous driving industry, Baidu organized the world’s first-ever Autonomous Driving CTF, AutoDriving CTF, on September 26th, 2020. Since it is part of BCTF, AutoDriving CTF attracted many notable Chinese CTF teams such as the well-known ChaMd5 team, the WatchAndLearn team from the industry security enthusiasts, as well as teams from the Academia such as Tsinghua University.

Our team, named ASGuard (Autonomous Systems Guard), registered early for this contest. After 24 hours of intense competition, we eventually won the Champion, defeating 23 other teams. This article is a brief summary of our first-person experience of this first-of-its-kind CTF event.

AutoDriving CTF: World’s first CTF focused on Autonomous Driving

Autonomous Driving (AD) is a multidisciplinary subject integrating AI, robotics, control, vehicle engineering, sensors, networks, and a lot others. For such a complex system, its security is an important challenge that cannot be ignored. The AutoDriving CTF adheres to the theme of AD security throughout the competition. The provided problems range from traditional CTF problems such as Binary and Reversing to brand new problem types such as Adversarial Machine Learning (AML) and AD planning and control algorithms (Mad Race). Such problems are closely related to the AD security issues exhibited in real life. For example, GPS spoofing is a practical attack method against the AD localization module; adversarial patches that can make trucks disappear is also a big challenge for obstacle detection in AD systems, which is inspired by the recent Tesla crash on the highway. Such type of CTF provides a great opportunity for AD developers and security researchers to practice the offensive and defense technologies under the AD context.

Intensive 24 hours

Timeline of our progress in the AutoDriving CTF

Since there are over 20 teams competing, including well-known ones from industry and academia, our team has almost kept full spinning for the entire competition to catch up with others. In the first few hours of the CTF, we had almost no clue of how to solve the problems, and by this time other teams had already begun to score. It was not until 3 hours later that we solved the first problem. Since then, our team has entered an explosive period — team members have successively solved problems they are responsible for, and our ranking has quickly climbed to the 1st place.

The AutoDriving CTF started at 7 pm PDT, and most of our team members were in California during that time. At 4–5 am, everyone was too sleepy after working on the problems for 9–10 hours straight, and could only start to taking naps. Fortunately, one of our team members is still in China, who is able to make continuous progress in scoring. Despite that, we still couldn’t beat the momentum of other teams — by the time we returned at 9 am, we already dropped to the 3rd place. There are only three problems left at this moment, but those are the most difficult ones in the entire CTF. After that, it follows by a 6-hour tough period when we were struggling to solve those problems. Only until the last 2 hours were we able to consecutively solve 2 of the 3 tough questions, which brought us back to the 1st place and kept us there to the end of the CTF.

The most interesting problems in AutoDriving CTF

Championship point: Mad Race racing game. This brand new problem has never appeared in the other CTFs before. It requires the teams to implement AD planning and control algorithms, and compete with each other on the same track. The first to finish the route gets the highest score. A total of four matches were held during the CTF.

These matches are very critical to the final results of the CTF. In the last Mad Race match, the 1st place can get 80 points, the 2nd place 40 points, the 3rd place 20 points, and so on. At that time, the score difference between the top 3 teams was exactly 80 points, so the result of this match will almost directly determine the title of the championship and the rankings of the top 3. Although our team has the highest overall score at the time, we had never won the 1st place in the previous Mad Race matches — we would miss the championship if we failed to win the 1st place in that match. Therefore, in the last few hours, the team members in charge of the problem spent considerable time adjusting the control algorithm. Dramatically, our racing car led all the way in the match — which never happened to our team in previous matches — and rushed out of the finish line as the first one. This secured our championship!

Our racing car in the last Mad Race match

Interestingly, we later heard that there was a hidden vulnerability in this racing game that the teams could leverage to attack other cars. We suspect that some other team already added attacking code to attack the other teams. But it could be possible that since our control algorithm was well optimized, our car ran too fast such that their attack code could not respond in time. This means that focusing on improving the Autonomous Driving algorithm instead of offensive and defensive tactics in this match can also be a winning strategy, which may also be the interesting part of this new type of CTF problem.

Key problem: The lost truck. In this question, the teams need to submit an adversarial patch that can make the truck undetectable from the widely used DNN (Deep Neural Network) based object detector. The evaluation system places the patch on the truck while let the Autonomous Vehicle gradually approaching the truck. During this period, the truck cannot be detected in any single frame. Different from traditional AI attack and defense, the challenging part in this problem is that the adversarial patch needs to deceive continuous frames, which requires the patch generation method to consider the perspective and distance changes along the vehicle trajectory, as well as practical considerations such as camera blurring, image preprocessing, etc. These are very close to the technical challenges for attacking the autonomous vehicle perception systems in real life. As a result, only 2 teams were able to solve this problem likely due to these difficulties. On our side, this is exactly the research topic of some of our team members, so we leverage our experience to make the patch as robust as possible. Solving this problem helped us return to the 1st place when it was 2 hours before the end of the CTF.