Plaid Parliament of Pwning

Plaid Parliament of Pwning is a collegiate computer security team known for competitive capture the flag performance, research contributions, and tooling in the information security community. Founded at an academic institution, the group has fielded teams at international competitions and contributed to vulnerability research, exploit development, and defensive techniques. Members have interacted with conferences, vendors, and standards bodies across the technology industry and open source ecosystems.

History

The group originated at an academic setting tied to University of Cambridge student communities and rose during the proliferation of DEF CON competitions, contemporaneous with teams active at Carnegie Mellon University, Massachusetts Institute of Technology, and Stanford University. Early participation overlapped with events such as DEF CON Capture the Flag, European Cyber Security Challenge, and regional contests like RuCTF and ZHCon. Over time the team engaged with institutions including SANS Institute, Usenix, Black Hat USA, RSA Conference, and CanSecWest. Members contributed to discourse alongside figures from Google Project Zero, Microsoft Security Response Center, Red Team Village, and OWASP. Collaborations and rivalries involved teams from Tokyo Westerns, PPP (team name conflicts), Team GhostShell, and Plaid Parliament of Pwning contemporaries at California Institute of Technology. Historical touchpoints include interactions with NIST, ENISA, European Union Agency for Cybersecurity, and academic bodies like MITRE and IEEE.

Organization and Membership

Membership has typically been student-based with alumni moving into roles at organizations such as Google, Microsoft, Amazon, Facebook, Apple Inc., Intel Corporation, Cisco Systems, IBM, CrowdStrike, Palo Alto Networks, FireEye, Qualcomm, Red Hat, and Canonical. Leadership structures mirrored collegiate club models seen at University of Oxford and Harvard University, with training programs influenced by materials from Coursera, edX, and workshops run at DEF CON, BSides, and Hack in the Box. Members have held positions in research at MIT, ETH Zurich, UC Berkeley, University of Toronto, University of Cambridge, Imperial College London, University of Washington, and Princeton University. The team’s networking involved participation in conferences like Black Hat Europe, Chaos Communication Congress, ShmooCon, BlueHat, Vault, and Nullcon.

Notable Competitions and Achievements

The team achieved recognition through placements at major events including DEF CON CTF Finals, CTFtime ranked contests, and national qualifiers analogous to US Cyber Challenge and regional tournaments like ASEAN Cybersecurity Challenge and National Cyber League. They competed against prominent teams such as PPP (CTF team), Dragon Sector, Plaid Parliament of Pwning contemporaries at 0days contests, Order of the Overflow, Shellphish, TUCTF, More Smoked Leet Chicken, and 0ops. Achievements were noted in categories including binary exploitation at events modeled after DARPA Cyber Grand Challenge, reverse engineering contests linked to Google CTF, and web security puzzles similar to those presented at Pwn2Own. Successes led to invitations to speak at CanSecWest Pwn2Own, REcon, OffensiveCon, and to participate in community initiatives like Hack The Box and CTFtime panels. Alumni successes include employment and recognition at NCC Group, Kaspersky Lab, Bitdefender, Trend Micro, Sophos, and ESET.

Research and Publications

Members authored whitepapers and blog posts addressing vulnerabilities comparable to disclosures by Project Zero, CERT Coordination Center, and researchers at NCC Group and Kaspersky Lab. Topics covered included heap exploitation techniques, format string vulnerabilities, Return-oriented programming, side-channel analysis, cryptographic protocol weaknesses, and IoT security flaws. The group’s outputs paralleled publications appearing in proceedings of Usenix Security Symposium, ACM Conference on Computer and Communications Security, IEEE Symposium on Security and Privacy, NDSS Symposium, and presentations at Black Hat USA and BSides. Collaborations and citations connected work from Mudge, Tavis Ormandy, Chris Evans (security researcher), Aleph One, and teams at Google, Microsoft, Apple Inc..

Tools and Contributions to Security Community

Contributions included tooling and challenge frameworks in the style of Metasploit Framework, Pwntools, Radare2, Ghidra, and Binwalk, along with challenge distribution methods echoing CTFd and Docker-based deployment. Tools and write-ups influenced practice at SANS Institute courses, Offensive Security training, and community resources like Exploit Database, VulnHub, GitHub, and Stack Exchange. The team engaged with disclosure practices akin to Coordinated Vulnerability Disclosure, working with vendors such as Intel Corporation, AMD, NVIDIA, Broadcom, and Qualcomm for patching. Contributions touched on protocol analysis for TLS, SSH, HTTP/2, and Bluetooth stacks, and on container security related to Docker, Kubernetes, and OpenStack. Outreach and education took place through workshops at DEF CON, Black Hat, BSides, ShmooCon, and university lecture series at MIT, Stanford University, and University of Cambridge.

Category:Capture the Flag teams