On the weekend VolgaCTF.org team launched an annual competition series by holding a VolgaCTF 2018 Quals event. The contest started on March 23rd at 15:00 UTC and lasted 48 hours. It went quite smoothly and we would like to share some key metrics that were collected during the event.
Wherever possible, the data will be compared against Volga CTF 2017 Quals, which was held almost a year ago, so as to give a reader a perception of a growing interest in information security as a whole, and in particular in CTF competitions amongst people all over the world.
Sign up
Sign up was made available almost a month before the competition start. Some participants decided to register in advance, while the all-time record was established on the first day of the competition, March 23rd.
Number of teams
Beyond our wildest dreams, more than 1000 teams signed up for the competition for the second year in a row. Not only they registered, but the majority also logged in during the competition and tried to submit answers to one or more tasks.
| Number of teams | VolgaCTF 2017 Quals | VolgaCTF 2018 Quals | Change |
|---|---|---|---|
| Total | 1115 | 1243 | +128 |
| Qualified | 1024 | 1097 | +73 |
| Disqualified | 0 | 0 | – |
| Signed in during the competition | 961 | 1045 | +84 |
| Submitted at least one flag | 708 | 602 | -106 |
| Solved at least one task | 677 | 411 | -266 |
| Reviewed at least one task | 363 | 207 | -156 |
Fortunately, no team was disqualified. Although, we have spotted a hilarious moment in our logs:
One might notice that the number of teams who managed to solve at least one task has decreased. Well, due to the absence of “Quiz” task this year (whether you liked the competition or not, any sort of answer will do), this hardly comes as a surprise.
Team sign in activity
The competition lasted 48 hours and participants seemed to be fairly active. The chart below shows how many different teams logged in during the contest.
Task submit attempts distribution
602 teams tried to submit flags. 203 tried their luck submitting flags to a single task, and only 3 tried to submit flags to 18 tasks. Look at the chart below.
Task hit distribution
411 teams succeeded in solving tasks. 171 solved only one task, and 2 performed exceptionally well with 16 and 17 solved tasks accordingly.
Task review distribution
Reviews provide task authors with valuable feedback. Teams were able to submit reviews to the tasks they solved. 121 teams wrote only one review, and 1 team made as many as 13 reviews. Well done!
Team/country distribution
Needless to say that VolgaCTF is truly international. Teams from all continents take part in the competition! The most represented countries are shown in the chart below:
And here is a comparison table:
| # | Country | Number of teams (2017) | Number of teams (2018) | Change |
|---|---|---|---|---|
| 1 | Russia | 195 | 197 | +2 |
| 2 | United States | 81 | 121 | +40 |
| 3 | India | 44 | 88 | +44 |
| 4 | Republic of Korea | 48 | 68 | +20 |
| 5 | France | 29 | 44 | +15 |
| 6 | Japan | 51 | 39 | -12 |
| 7 | Vietnam | 39 | 36 | -3 |
| 8 | Indonesia | 21 | 36 | +15 |
| 9 | China | 23 | 32 | +9 |
| 10 | Germany | 22 | 29 | +7 |
| 11 | Australia | 12 | 25 | +13 |
| 12 | Taiwan | 11 | 22 | +11 |
| 13 | Canada | 6 | 22 | +16 |
| 14 | United Kingdom | 10 | 21 | +11 |
| 15 | Poland | 13 | 18 | +5 |
| 16 | International | 195 | 18 | -177 |
| 17 | Israel | 6 | 17 | +11 |
| 18 | Brazil | 17 | 15 | -2 |
| 19 | Turkey | 6 | 14 | +8 |
| 20 | Spain | 14 | 14 | – |
| 21 | Italy | 12 | 13 | +1 |
| 22 | Algeria | 5 | 13 | +8 |
| 23 | Belgium | 4 | 11 | +7 |
| 24 | Singapore | 3 | 9 | +6 |
| 25 | Netherlands | 7 | 8 | +1 |
| 26 | Egypt | 4 | 8 | +4 |
| 27 | Austria | 5 | 8 | +3 |
| 28 | Morocco | 3 | 7 | +4 |
| 29 | Hong Kong | 0 | 7 | +7 |
| 30 | Denmark | 3 | 7 | +4 |
| 31 | Czechia | 0 | 7 | +7 |
| 32 | Ukraine | 12 | 6 | -6 |
| 33 | Saudi Arabia | 0 | 6 | +6 |
| 34 | Iran | 7 | 6 | -1 |
| 35 | Tunisia | 3 | 5 | +2 |
| 36 | Switzerland | 2 | 5 | +3 |
| 37 | Portugal | 2 | 5 | +3 |
| 38 | Mongolia | 25 | 5 | -20 |
| 39 | Argentina | 4 | 5 | +1 |
| 40 | Romania | 3 | 4 | +1 |
| 41 | Mexico | 0 | 4 | +4 |
| 42 | Kazakhstan | 2 | 4 | +2 |
| 43 | Colombia | 1 | 4 | +3 |
| 44 | Belarus | 4 | 4 | – |
| 45 | Greece | 3 | 3 | – |
| 46 | Finland | 2 | 3 | +1 |
| 47 | Åland | 0 | 2 | +2 |
| 48 | Uzbekistan | 0 | 2 | +2 |
| 49 | United Arab Emirates | 1 | 2 | +1 |
| 50 | Togo | 0 | 2 | +2 |
| 51 | Sweden | 7 | 2 | -5 |
| 52 | South Africa | 0 | 2 | +2 |
| 53 | Malaysia | 1 | 2 | +1 |
| 54 | Fiji | 0 | 2 | +2 |
| 55 | Ecuador | 0 | 2 | +2 |
| 56 | Cambodia | 0 | 2 | +2 |
| 57 | Bulgaria | 2 | 2 | – |
| 58 | Antarctica | 0 | 2 | +2 |
| 59 | Vatican City | 0 | 1 | +1 |
| 60 | U.S. Virgin Islands | 0 | 1 | +1 |
| 61 | Turks and Caicos Islands | 0 | 1 | +1 |
| 62 | Thailand | 4 | 1 | -3 |
| 63 | Sudan | 0 | 1 | +1 |
| 64 | Slovakia | 0 | 1 | +1 |
| 65 | Republic of Moldova | 1 | 1 | – |
| 66 | Republic of Lithuania | 0 | 1 | +1 |
| 67 | Philippines | 4 | 1 | -3 |
| 68 | Peru | 0 | 1 | +1 |
| 69 | Palestine | 2 | 1 | -1 |
| 70 | Norway | 5 | 1 | -4 |
| 71 | North Korea | 4 | 1 | -3 |
| 72 | Monaco | 0 | 1 | +1 |
| 73 | Martinique | 0 | 1 | +1 |
| 74 | Kenya | 0 | 1 | +1 |
| 75 | Ivory Coast | 0 | 1 | +1 |
| 76 | Iraq | 0 | 1 | +1 |
| 77 | Iceland | 0 | 1 | +1 |
| 78 | Hungary | 0 | 1 | +1 |
| 79 | Hashemite Kingdom of Jordan | 0 | 1 | +1 |
| 80 | Gibraltar | 0 | 1 | +1 |
| 81 | Georgia | 0 | 1 | +1 |
| 82 | Estonia | 1 | 1 | – |
| 83 | Equatorial Guinea | 0 | 1 | +1 |
| 84 | Cyprus | 0 | 1 | +1 |
| 85 | Croatia | 0 | 1 | +1 |
| 86 | Bangladesh | 1 | 1 | – |
| 87 | Azerbaijan | 2 | 1 | -1 |
| 88 | Antigua and Barbuda | 0 | 1 | +1 |
The country data above was collected from teams’ profiles. During the sign up, a country field was automatically filled in according to GeoIP data provided by MaxMind, yet a team was still able to change it.
Note that the country data might not be pretty accurate - for instance, it is really hard to believe that there is a team from Antarctica. However, who knows…
P.S. Further posts will focus on task metrics. Stay tuned!