The Security Engineering teams at Google love 3 things:

• Playing Capture the Flag (CTF) competitions
• Sharing knowledge they've acquired through decades of working on hard security problems
• Ensuring Google and the industry can rely on brilliant talent for the decades to come

Once a year, these interests culminate at our ESCAL8 conference. Originally started as a small CTF in a meeting room in Zurich, these days this conference regularly brings together 100+ invited attendees at the hosting venue (we rotate locations).

Fig. 1. Hacking action at the first edition of ESCAL8 in Zurich

In this post, we’ll take a look at last year’s ESCAL8 conference, and also shed some light on what attendees can expect from ESCAL8 2024, including how Google CTF players can qualify for the finals which will be a part of ESCAL8!

ESCAL8 2023

At the beginning of October last year, we were in Tokyo to run the 2023 edition of ESCAL8. As a full-fledged security conference, ESCAL8 targets a wide range of participants, ranging from students through CTF players to experienced bug hunters. Imagine an esports-style hacking event, combined with the goal of inspiring students to become tomorrow's cyber security experts, and engaging our top Bug Hunters in focused hacking sessions.

More concretely, over the six days we spent at our Tokyo office, we focused on three distinct activities:

• bugSWAT

  Is there a better way to spend time than hacking Google products with our top bug hunters? This was not only fun, but resulted in 54 new bug reports, with total rewards exceeding 100’000 USD. Targets included Vertex AI, Cloud Workstations, Google One VPN, Android Auto and Wear OS.

• Google CTF Finals

  Google CTF is an annual hacking competition, with the goal of determining who actually is the best CTF team out there. After successfully qualifying at an online event in June, eight teams came together in Tokyo to compete in a gamified esport-style competition, solving visually designed, security-based tasks as quickly as possible. Congrats to the winners of the grand final, “C4T BuT S4D”.

• init.g workshop

  During this workshop, we trained students from 17 universities across Japan on the essentials of cybersecurity. In various sessions and talks, we covered a wide span of topics such as Offensive Security, Web Security, Hardening, Hardware hacking, and career pathway options.

  In the words of one of the workshop participants:

  It was a super super exciting event. It's not flattery. I think this is the most well-structured and well organized security event among the events I have experienced so far in Japan. We got a lot of knowledge from the talks, understood what the security engineer's career looks like, and made a lot of friends that are interested in security things.

To get a first-hand impression of 2023’s ESCAL8 conference, scroll to the end of this post where you can find a short summary video.

Fig. 2. & 3. Workshops at init.g (in Tokyo)

What’s Next? A Convergence of Cyber Expertise in Malaga

In October 2024, we'll be coming together for another edition of ESCAL8, this time in Malaga, Spain, where the University of Malaga is partnering with Google to create an unforgettable ESCAL8 experience.

What can you expect? Get ready for this year’s pinnacle cybersecurity showdown at the Google CTF Finals, where the most talented CTF teams will again compete in a thrilling new episode of Hackceler8, our well-established CTF grand finale. Witness the clash of brains as they unravel complex challenges in an esports-style competition (you can watch the finals via live stream). If you are interested in joining as a participant, you can qualify through our online CTF qualification round running June 21 - 23: feel free to register a team at goo.gle/ctf now. The top 8 teams will be invited to Hackceler8!

But that's not all that ESCAL8 has to offer! We're inviting top Google Bug Hunters for bugSWAT, an exciting event focused on intense bug-hunting sessions, allowing them to contribute to the security of Google products while simultaneously earning rewards. And for aspiring security professionals, ESCAL8 2024 will again host the init.g() workshop, focused on cybersecurity. Students will learn from industry experts, participate in hands-on activities, and kickstart their journey towards a successful career in cybersecurity. A number of sessions will be supported by members of Google's VirusTotal team which is based at our recently established Google Safety Engineering Center (GSEC) in Malaga, where the sessions will also take place.

Hack on! And be sure to follow us on x.com/googleVRP for updates.