WEBVTT 00:05.910 --> 00:11.610 Welcome to Space Security Challenge 2020, HackASAT, the final event. 00:11.610 --> 00:20.550 As the democratization of space opens up a new frontier for exploration and innovation, we see new cybersecurity vulnerabilities emerging. 00:21.470 --> 00:33.230 The Space Security Challenge is designed to inspire the world's top cybersecurity talent to develop the skills necessary to secure this last frontier of cybersecurity, space. 00:33.390 --> 00:36.190 And already we've made a ton of progress. 00:36.190 --> 00:37.650 I'll catch you up. 00:37.650 --> 00:47.350 This spring, we hosted over 2,000 teams who worked their way through a set of foundational space cybersecurity challenges in our HackASAT qualification round. 00:47.350 --> 00:51.770 Now, eight finalist teams are stepping up to the ultimate challenge. 00:51.790 --> 00:54.500 They are hacking a satellite. 01:01.120 --> 01:06.660 Welcome to the first of two daily recaps for the Space Security Challenge 2020, or HackASAT. 01:06.660 --> 01:09.100 I'm still your host, Jordan Wines. 01:09.800 --> 01:17.380 As our eight teams have been vying for a share of a $100,000 prize pool, we're going to check in and summarize the status of the day. 01:17.380 --> 01:22.280 Of course, they also received $15,000 just to get here as a finalist. 01:22.480 --> 01:24.640 The competition for that was fierce. 01:24.640 --> 01:30.300 Our finalists beat out over 2,000 other teams made up of over 6,000 other competitors. 01:30.560 --> 01:41.880 Of course, the biggest prize of all might not even be the money or even the friends we made along the way, but the bragging rights for your code to be selected to take an actual photograph of the moon from a satellite in space. 01:42.260 --> 01:50.760 While this event was originally planned to be in person during DEF CON in the aerospace village, the global pandemic has caused us to reimagine the event experience. 01:50.800 --> 01:58.080 The result is an immersive 3D environment where you can stay up to date with the competition while learning all about space security and the event itself. 01:58.080 --> 02:02.200 You can connect with other spectators and even play games and add to our graffiti wall. 02:02.300 --> 02:09.200 So if you aren't already watching this from our immersive 3D environment, check it out at virtual.hackasat.com. 02:09.560 --> 02:16.720 As prior DEF CON attendees, some of you are very familiar with the many flavors of contests that test your hacking skills. 02:16.720 --> 02:19.600 But for others, we realize this is a whole new world. 02:19.600 --> 02:26.260 There are many types of hacking contests and Hackasat falls into the category of capture the flag or CTF. 02:29.140 --> 02:33.540 Remember the game you played as a kid with flags hidden in opponent's terrain? 02:33.540 --> 02:37.540 Now imagine the field or code and the flags are secret data. 02:37.540 --> 02:43.960 Players exploit security flaws to capture the flags while at the same time defending their networks from opposing teams. 02:43.960 --> 02:49.180 These capture the flag CTF events are as diverse as the teams that play them. 02:49.220 --> 02:53.900 This is a global competitive community with thousands of players and global rankings. 02:53.900 --> 02:58.840 It's been a part of the origin story for a great many prominent security experts. 02:58.840 --> 03:01.260 So what do these hacking games look like? 03:01.260 --> 03:06.940 CTFs can be either in person or online and usually take place over a weekend or other short period. 03:06.940 --> 03:11.660 They often have a qualification round that determines who gets to participate in the finals. 03:11.660 --> 03:22.100 CTFs are sometimes themed around a specific domain like space for but more commonly they are not specialized and include a wide variety of different types of challenges. 03:22.180 --> 03:31.520 The most common types of CTFs include Jeopardy CTFs, sometimes called red team CTFs, are named for their use of the classic game board as a scoreboard. 03:31.520 --> 03:33.140 These are more offensive focused. 03:33.140 --> 03:41.340 Each team is given infrastructure to attack and the number of successful attacks, the difficulty, or the speed at which they succeed is factored into their score. 03:41.340 --> 03:48.340 Attack defense, A slash D, full spectrum CTFs, which are closer to the original game you might have played as a kid. 03:48.340 --> 03:54.940 Each team has a server or set of servers to defend and must attack other teams while also protecting their own infrastructure. 03:54.940 --> 04:03.100 Key of the Hill style CTFs are full spectrum CTFs in which teams score points by gaining and maintaining control of individual systems. 04:03.140 --> 04:08.340 And finally, the less common blue team exercises, which are primarily defensive events. 04:08.340 --> 04:14.800 Game organizers host an environment and often a professional team of attackers to test the participants defensive skills. 04:14.800 --> 04:17.640 These are more common in the high school and collegiate level. 04:17.760 --> 04:18.880 How do you win? 04:18.940 --> 04:25.580 Even though the goal of the CTFs are to find and exploit vulnerabilities in computer systems, fair play is essential. 04:25.620 --> 04:31.120 There are lots of ways to win, but to get the respect of your peers, you need to have good technical solutions. 04:31.160 --> 04:38.020 Nobody is impressed if you use a network flood to knock the scoreboard offline and those kinds of shenanigans will get you shunned quickly. 04:38.020 --> 04:46.060 The best CTF players have built specialized tools, practice within their domains and include domain experts in many aspects of security. 04:46.760 --> 04:47.800 Why CTF? 04:47.800 --> 04:55.980 At their core, CTF challenges are a way for hackers to build community and demonstrate and hone their skills with other equally skilled people. 04:55.980 --> 05:03.640 Competitions are also a chance to experience the joy of learning about a new programming language or a new piece of technology hackers haven't used before. 05:03.640 --> 05:10.940 Capture the Flag challenges have also been used to help train cybersecurity teams and to get new hackers interested in security research. 05:10.940 --> 05:16.960 Some companies even use competitions similar to CTFs to recruit and vet potential candidates for employment. 05:16.960 --> 05:23.580 And CTFs have had real-world impact with competitors finding actual security flaws in contest infrastructure. 05:23.580 --> 05:29.100 Their solutions, while not counting towards winning the game, are often implemented in a real-world context. 05:29.120 --> 05:40.940 With HackASAT, we have a CTF game designed to raise awareness about cybersecurity issues in space and help researchers develop specific skills and domain knowledge they'll need to help secure this new frontier. 05:41.220 --> 05:48.160 But as many of the players during our quals round found out, there are a lot of problems unique to the environments outside our atmosphere. 05:48.160 --> 05:55.260 To learn more about hacking in space, check out our Space Talk videos that explain some of the most interesting space-specific challenges. 05:56.460 --> 06:04.480 For more on CTFs and other hacking and space-related topics, go to the research room in the virtual environment or check out the related YouTube playlist. 06:04.780 --> 06:08.500 Okay, let's go ahead and recap the whole day so far. 06:14.330 --> 06:24.490 The game has actually been underway for one hour now, and our team's first challenge has been to regain control of the ground station that they'll be using to communicate with their Flatsats. 06:24.490 --> 06:32.150 In fact, just before this broadcast went live, we received word that this challenge was actually solved by Team Samurai. 06:32.510 --> 06:33.830 Congratulations to them! 06:33.830 --> 06:40.310 Right after our last update ended with only a Samurai solve, several other teams came in with solutions for Challenge Zero. 06:40.510 --> 06:45.050 PFS and Solarwine were solvers 2 and 3 on that challenge. 06:45.310 --> 06:51.790 After those two teams scored on Challenge Zero, every other team was eventually able to solve Challenge Zero over the next several hours. 06:51.790 --> 06:56.150 Taking a look at the scoreboard so far, we've had an eventful last hour. 06:56.150 --> 07:00.550 Our teams continue to make progress, with four teams now having solved Challenge One. 07:00.610 --> 07:07.690 Unfortunately, the window of time after first solve has expired, and the remaining four teams were given a solution with no points. 07:07.710 --> 07:15.810 PFS and Colon Can Into Space were joined by 1553 and 1064 Seabred with solutions for Challenge One. 07:15.810 --> 07:25.470 Now, this was going to be where I signed off with this update, but as we were live, PFS actually jumped up on the scoreboard yet again, solving Challenge Two. 07:31.310 --> 07:35.410 You may have noticed that first blood overlay and sound effect in that summary. 07:35.410 --> 07:45.870 While it was originally used in Unreal Tournament to indicate a kill, the phrase and even sometimes the sound effects are often used in CTF competitions to indicate the first team to solve a particular challenge. 07:46.790 --> 08:04.530 The challenges that teams have solved so far include a Challenge Zero, which required exploiting an insecure web application to steal credentials for the ground station controller, and then using that Cosmos ground station, the teams had to restore communication with their flatsats as they were tumbling and not communicating well. 08:04.830 --> 08:15.490 The Challenge One involved connecting to the ground station, turning up the power, turning down the bandwidth, which is very much a real-world troubleshooting step. 08:15.630 --> 08:23.730 Next, the teams have to restore proper orientation control over their flatsat, but only one team so far has managed to accomplish this feat. 08:23.730 --> 08:27.530 That brings us to what's happened in the last two hours of the competition. 08:27.710 --> 08:34.210 Most teams are now working on two or three challenges, the On-Orbit Challenge, Challenge Two, and Challenge Three. 08:36.590 --> 08:41.450 PFS has been pulling away to a healthy lead that is going to be hard to catch up to tomorrow. 08:41.510 --> 08:43.890 Hard, but definitely not impossible. 08:44.270 --> 08:50.650 All it takes is for them to get stuck in a problem and be passed in turn, much like they did to Samurai at the start of the game. 08:51.590 --> 09:03.030 It's also interesting to note that PFS, which is actually short for Pwn First Search and Pull in Can Into Space, are number one and number two on the leaderboard, are two of the smallest teams in the competition. 09:03.370 --> 09:12.190 Having a large team is sometimes an advantage, but it definitely comes with logistical issues, and in this case, where the challenges are serial in nature, it isn't always helpful. 09:12.470 --> 09:16.710 Let's take a look again at the PFS team bio. 09:45.490 --> 09:56.870 If you were here with us live, you might remember that right in the middle of teams working on their challenges at around 12 p.m pacific, all teams had to stop what they were doing and shift focus to the on-orbit challenge. 09:57.870 --> 10:01.090 Stop everything and look up. 10:01.330 --> 10:04.890 Starting now, teams shift to the on-orbit challenge. 10:04.970 --> 10:09.250 Their primary goal is to capture a picture of the moon using the satellite. 10:09.990 --> 10:15.670 Competitors will have access to the two-line element of the vehicle and the camera's foresight vector. 10:16.010 --> 10:23.370 Each team is tasked with creating a mission plan that transitions a satellite from a tumbling state to one where it points the camera at the moon. 10:24.170 --> 10:29.430 The team will reach a successful status once their resulting mission plan meets key criteria. 10:29.870 --> 10:30.290 1. 10:30.290 --> 10:35.050 The commands are generated in the correct order and are within the specified period. 10:35.350 --> 10:36.210 2. 10:36.210 --> 10:39.870 The image capture angle of the moon is within specifications. 10:40.310 --> 10:41.130 3. 10:41.130 --> 10:48.810 The team's negative z-axis is pointed as close to the earth's center as possible without affecting the camera-to-moon pointing error. 10:49.210 --> 10:49.670 4. 10:49.670 --> 10:54.470 The teams are given a command dictionary with the format for submitting the commands and parameters. 10:54.490 --> 10:56.770 The rest is up to them. 10:59.810 --> 11:07.770 Of course, while PFS is currently in the lead, they still have a critical problem to solve, specifically the on-orbit challenge. 11:07.770 --> 11:19.010 While Poland Cannon to Space is only nipping at their heels at number two on the scoreboard, they are critically not only the first team with an attempted solution to their on-orbit challenge, but the first with an accepted solution. 11:19.510 --> 11:32.930 That would mean that they would be able to pass PFS if PFS is not able to actually solve, because again, that is a pass-fail challenge, and it will be critical to see what happens in the last few minutes of gameplay today, as well as tomorrow in the on-orbit challenge. 11:33.170 --> 11:48.830 Now that the day is wrapping up, hopefully some of the organizers have a little bit more time, so we're going to see if we can bring into video chat Vito Genovese, who many of you may recognize from his time as a member of LegitBS, the team that organized the DEFCON CTF for five years prior to the current organizers, 11:48.830 --> 11:50.110 The Order of the Overflow. 11:50.390 --> 11:55.510 Vito is also currently with Chromulence, the creators of the flatsats and many of the challenges in Hackasat. 11:55.630 --> 11:56.870 Vito, can you hear me? 11:56.870 --> 11:57.490 Are you there? 11:58.170 --> 11:59.170 Yes, loud and clear. 11:59.170 --> 11:59.910 Good evening. 12:00.070 --> 12:00.610 Excellent. 12:00.610 --> 12:01.510 Glad we got you. 12:01.510 --> 12:02.270 Thanks for stopping by. 12:02.270 --> 12:06.870 I know you guys have been very, very busy kind of manning the systems and talking to the teams. 12:06.890 --> 12:08.770 How's the game going so far? 12:09.330 --> 12:10.610 It's been going. 12:10.710 --> 12:24.650 We've kind of had some, the flatsats are small run hardware, which always has issues, but we're super, super thankful the teams are being patient with us and they're putting up a good fight and making really, really good progress in the game. 12:24.650 --> 12:26.370 Is this pacing what you expected? 12:28.610 --> 12:34.390 Speaking of how they're kind of doing, is this about where you thought they would be or you wanted them to be or how does this fit with your expectations? 12:35.490 --> 12:38.150 It's really hard to set expectations for these games. 12:38.150 --> 12:40.770 A lot of it is, you know, throwing stuff around. 12:40.770 --> 12:43.750 We can't even be in the same room doodling on a whiteboard while we do it. 12:44.130 --> 12:50.630 So, you know, the expectations are not necessarily what's been happening, but we'll survive. 12:50.630 --> 12:55.270 It's a difficult game and, you know, we'll see what happens tomorrow. 12:55.610 --> 13:00.850 And it, I mean, it does seem like that if they're made good progress up to here, they could have been a lot further behind. 13:00.850 --> 13:04.730 It would be nice to see them maybe a challenge ahead, but this is certainly within reach, right? 13:04.730 --> 13:07.710 Like there's nothing kind of too crazy about what they have remaining. 13:07.870 --> 13:08.670 This could be doable. 13:08.670 --> 13:11.710 And these, we know these are good teams that are capable of more, it seems like, right? 13:12.430 --> 13:13.910 Right, yeah, absolutely. 13:14.070 --> 13:21.110 The, you know, challenges zero, challenges one, they're hard challenges and the teams that took time on them, they still took time on them. 13:21.110 --> 13:23.410 They did make progress and they did get through eventually. 13:23.790 --> 13:28.890 It's, you know, admirable work and it's, you know, it's a difficult time for everybody involved. 13:29.330 --> 13:33.890 Now, do you miss actually being in Vegas and going to DEF CON or you actually kind of prefer being remote? 13:33.890 --> 13:35.470 What's your take on that? 13:35.890 --> 13:37.170 Absolutely miss it. 13:37.610 --> 13:42.490 You know, my, my favorite restaurant in Vegas, I miss, or my favorite restaurants plural in Vegas. 13:42.490 --> 13:43.050 I miss that. 13:43.050 --> 13:44.210 I miss seeing my friends. 13:44.210 --> 13:48.570 I miss wearing my, you know, special DEF CON shoes, which are behind me on the shelf. 13:48.570 --> 13:55.170 They're not in frame yet, but you know, it's, it's better than getting really, really sick, I guess. 13:55.770 --> 13:56.710 Given the alternative. 13:56.730 --> 13:57.250 Yeah. 13:57.250 --> 14:00.030 We're all kind of doing what, doing what we can and should there. 14:00.030 --> 14:08.190 In fact, even you were originally supposed to be on stream with me and we just thought for, that we would, we would do this via zoom and we'd be able to work it out that way. 14:08.190 --> 14:10.610 So thanks for, for doing that. 14:10.610 --> 14:21.190 Tell me a little bit more about the rationale behind the scoring algorithm and the game design, this, this decay and the kind of the grace window, what, what design constraints went into that, that decision? 14:22.010 --> 14:22.190 Okay. 14:22.190 --> 14:26.250 So the main design constraint with this is it's a very linear catch the flag game. 14:27.290 --> 14:35.350 So what's, what has to happen is we're trying to get teams to take over this, regain control of this, you know, tumbling satellite lost in space. 14:35.370 --> 14:37.810 And that is a complicated operation. 14:37.910 --> 14:46.330 And instead of just having, you know, one single, you know, you get this chunk of points, if you win the game, we split it up into different little gates that teams have to pass through. 14:46.510 --> 14:52.010 So, you know, challenge zero or the first gate is getting control of the, of a machine in the ground station. 14:52.290 --> 14:56.530 Challenge one after that is being able to actually talk and receive messages with the satellite. 14:56.630 --> 15:02.570 So we had to split this up in order to keep, you know, make the game actually have points before you get to the end. 15:03.090 --> 15:11.870 And at the same time, in order to make the points actually meaningful, we wanted to make sure there was some time pressure for teams to go quickly and make progress throughout the whole weekend. 15:12.210 --> 15:14.810 So we have this kind of decay system implemented. 15:15.070 --> 15:18.450 So each challenge is worth a fixed number of points at the beginning. 15:18.530 --> 15:22.990 And as soon as the team solves it the first time, the clock starts ticking. 15:23.070 --> 15:28.470 So within that first 30 minutes, anybody else who solves that challenge is also going to get the full points. 15:28.470 --> 15:30.270 For challenge zero, that would be 50 points. 15:30.270 --> 15:33.910 For challenge two, or for challenge one, that was 200 points. 15:34.090 --> 15:42.750 Beyond that, after that first 30 minutes, we have another two-hour interval where that point amount starts gradually ticking down towards zero. 15:42.970 --> 15:45.510 Once it's hit zero, we don't award points for it. 15:45.510 --> 15:50.990 And at that point, it also means that we share hints to, you know, nudge teams along to get them to the next phase of the competition. 15:51.670 --> 16:02.510 And that's one of the advantages, I think, is that, you know, a team, if they happen to get stuck on one particular problem, in a serial event in particular, there's just not much you can do, in fairness to the other teams, in terms of, you know, kind of, 16:02.510 --> 16:06.150 you don't want to give a team a hint just because they're behind, because that actually hurts them. 16:06.150 --> 16:12.090 But by having the score drop off in a point at which they have to be done or else they're just given a hint, well, then they've lost all the points for it. 16:12.090 --> 16:15.890 And so it keeps them up with the game while not punishing the teams that do well. 16:15.890 --> 16:17.410 So that makes a lot of sense. 16:17.410 --> 16:20.370 If you had a favorite challenge, what's the number? 16:20.370 --> 16:24.550 And if it's one we haven't seen yet, like, no spoilers, of course, but what do you like best? 16:25.150 --> 16:32.530 So it's honestly, for me, it's probably challenge one, which is kind of where the game starts to diverge from a normal capture the flag contest. 16:32.550 --> 16:37.450 With challenge zero, we had a web app that teams had to, I think, determine a cookie secret in. 16:37.630 --> 16:38.210 And that's very... 16:41.810 --> 16:43.830 Challenge one is where we start to diverge. 16:43.910 --> 17:00.570 That's where we have to, once we've gotten into the ground station and are able to talk to the, you know, satellite control system Cosmos, that's where teams have to figure out how to turn telemetry on on the satellite, because it's not, you know, just another machine on the network with an IP address, 17:00.570 --> 17:10.030 and where teams have to figure out how to tell the satellite's radio to configure itself in a way that it's actually functional for the rest of the game, for sending messages back and forth. 17:10.030 --> 17:18.850 I saw a great quote go over the team communication channel from the organizers that said, these are not like traditional network devices. 17:18.850 --> 17:32.030 And if you think sending, you know, two requests a second, you know, will get you more reliability the way you would in a normal network, that may be counterproductive here, which I thought was a great kind of nod towards the, yeah, there's some different constraints and different concerns that maybe, 17:32.030 --> 17:36.890 you know, are not the folks first instincts are accurate on, given the environment. 17:36.890 --> 17:38.350 So that makes a lot of sense. 17:38.890 --> 17:39.850 Yeah, absolutely. 17:39.850 --> 17:43.750 It's a satellite is, in some senses, it is, you know, still a computer. 17:43.930 --> 17:50.790 But the problem is, is it's a computer that costs millions and millions of dollars to, you know, install and it costs, you know, billions of... 17:52.570 --> 17:55.430 No, I think we might've lost you a little bit there for some network. 17:55.430 --> 17:56.090 Oh, you're back now. 17:56.090 --> 17:56.610 Go ahead. 17:56.850 --> 17:57.050 Yeah. 17:57.050 --> 17:57.590 Okay. 17:57.710 --> 17:58.030 Yeah. 17:58.030 --> 18:01.610 It costs, you know, millions to, you know, put it in place in the first place. 18:01.610 --> 18:05.190 And it costs billions to send somebody up there to push a button to restart it. 18:05.790 --> 18:17.710 Beyond that, it's, you know, a computer that you only talk to an RF and it's moving in a way that whatever you can see it, you can probably talk to it, but there's a lot of time from any given ground station where you can't see it at all. 18:17.850 --> 18:20.350 And that's a very unique challenge. 18:21.350 --> 18:26.090 Vito, thank you very much for both your work on the game and for taking some time to talk to us tonight. 18:26.090 --> 18:32.210 Look forward to seeing how the teams do tomorrow and look forward to talking to some more as we see their progress. 18:33.090 --> 18:33.610 Excellent. 18:33.610 --> 18:33.970 Thanks. 18:33.970 --> 18:34.710 Take care. 18:35.010 --> 18:35.790 Take care. 18:36.770 --> 18:42.050 That's it for this first day of the Space Security Challenge 2020 or HackASET final event. 18:42.190 --> 18:52.830 Overnight, we'll be taking our FlatSats offline so they can get a good rest, aka, have their batteries charged, and so the competition organizers can recharge their batteries, aka, have a good night's rest. 18:52.870 --> 19:00.470 Of course, in addition to sleep, the teams will need to continue working on some of the components in between game shutdown and game start tomorrow morning at 7 a.m. 19:00.470 --> 19:01.570 Pacific and 10 a.m. 19:01.570 --> 19:02.250 Eastern. 19:02.250 --> 19:06.970 They've actually been given a firmware image that will help them for the upcoming Challenge 3. 19:07.630 --> 19:09.390 Thanks for spending your day with us. 19:09.390 --> 19:15.370 Make sure to check out the rest of what's happening at DEFCON, the Aerospace Village, and our Aerospace Workshops. 19:15.370 --> 19:18.230 And I look forward to seeing you all tomorrow morning at 9 a.m. 19:18.230 --> 19:19.170 Pacific, 12 p.m. 19:19.170 --> 19:20.850 Eastern for our next game update.