1
00:00:05,160 --> 00:00:10,880
Welcome to Space Security Challenge 2020, HackASAT, the final event.

2
00:00:10,880 --> 00:00:19,800
As the democratization of space opens up a new frontier for exploration and innovation, we see new cybersecurity vulnerabilities emerging.

3
00:00:20,680 --> 00:00:32,460
The Space Security Challenge is designed to inspire the world's top cybersecurity talent to develop the skills necessary to secure this last frontier of cybersecurity, space.

4
00:00:32,680 --> 00:00:35,480
And already we've made a ton of progress.

5
00:00:35,480 --> 00:00:36,880
I'll catch you up.

6
00:00:36,880 --> 00:00:46,600
This spring, we hosted over 2,000 teams who worked their way through a set of foundational space cybersecurity challenges in our HackASAT qualification round.

7
00:00:46,600 --> 00:00:51,000
Now, eight finalist teams are stepping up to the ultimate challenge.

8
00:00:51,000 --> 00:00:54,080
They are hacking a satellite.

9
00:01:00,860 --> 00:01:06,420
Welcome to the Saturday daily recap of Space Security Challenge 2020, or HackASAT.

10
00:01:06,960 --> 00:01:16,340
For the second to last time, I'm your host, Jordan Wines, and it's time to fill you in on how our competitors did on day two of this first-of-its-kind satellite hacking competition.

11
00:01:16,460 --> 00:01:19,800
Okay, let's get right to the moment everyone's been waiting for.

12
00:01:19,800 --> 00:01:24,560
Here is our video to show which team was selected for the on-orbit challenge.

13
00:01:26,520 --> 00:01:28,640
Oh, I'm sorry.

14
00:01:29,020 --> 00:01:33,020
Actually, it appears that we're experiencing some technical difficulties.

15
00:01:33,460 --> 00:01:38,800
Yeah, I guess that means you're going to have to listen to the rest of this update, and then we'll play the big reveal at the end instead.

16
00:01:39,120 --> 00:01:41,740
So let's take a look back at today's action.

17
00:01:48,780 --> 00:01:53,260
In fact, let's go ahead and take a look at the scoreboard now in our live Octagon feed.

18
00:01:53,760 --> 00:01:56,140
And they definitely haven't slowed down.

19
00:01:56,140 --> 00:01:59,960
You'll notice that Solarwine actually scored first blood on Challenge 3.

20
00:01:59,960 --> 00:02:02,940
Congratulations to them for the great work overnight.

21
00:02:02,980 --> 00:02:09,420
You can also see Flux Repeat Rocket scoring just before this broadcast with only a 5% reduction in total points.

22
00:02:09,420 --> 00:02:13,980
That means Solarwine and Flux Repeat Rocket are both moving on to Challenge 4.

23
00:02:13,980 --> 00:02:18,320
While the score hasn't changed, we have had one important game milestone pass us by.

24
00:02:18,320 --> 00:02:20,720
We timed out unavailable points for Challenge 3.

25
00:02:20,720 --> 00:02:30,220
That means those two teams, Solarwine and Flux Repeat Rocket, they've obtained points for that challenge, and all other teams were given a solution script so they can focus on the next challenge.

26
00:02:35,640 --> 00:02:40,200
If you've been following along at home, you know that we sprung our on-orbit challenge on our teams yesterday.

27
00:02:40,200 --> 00:02:43,040
We had four teams submit their solutions by 4 p.m.

28
00:02:43,040 --> 00:02:51,540
Pacific, our deadline for evaluation for on-orbit, but only one was selected to have their code sent to the live satellite to capture a moonshot.

29
00:02:51,600 --> 00:02:54,800
We will learn who that lucky team is later on in the broadcast.

30
00:02:55,840 --> 00:03:02,400
While today's action started strong with several early scores, teams really struggled their way through Challenge 4 today.

31
00:03:02,400 --> 00:03:07,720
While the organizers knew it would be the hardest challenge, the hope was that it would be solved before this point.

32
00:03:07,720 --> 00:03:17,300
In fact, in the last hour of the competitions, some team had run so low on power that the organizers offered to take the flatsats offline so they could plug them into power.

33
00:03:17,300 --> 00:03:26,440
This would mean teams would have challenges in solving Challenge 5, but hopefully it would give them enough power and time to solve Challenge 4 in the last few minutes.

34
00:03:26,640 --> 00:03:31,760
Given that, here is our explanation for the Challenge 4 solution.

35
00:03:32,740 --> 00:03:34,400
Challenge 4.

36
00:03:35,020 --> 00:03:36,380
Here's what we know.

37
00:03:36,380 --> 00:03:40,760
We've restored communication with the payload module, but we still can't operate it.

38
00:03:40,760 --> 00:03:41,800
The challenge?

39
00:03:41,800 --> 00:03:46,760
Now teams must restore normal operations of the payload module so we can access the imager.

40
00:03:46,900 --> 00:03:48,580
Here's how they do it.

41
00:03:48,580 --> 00:03:54,720
Teams discover that the payload module bootloader has been corrupted, which is why the payload module is not operating normally.

42
00:03:54,720 --> 00:04:05,960
The teams discover a system console to the payload module and the ability to access the payload module system console by controlling an undocumented GPIO and multiplexer on the CNDH board.

43
00:04:05,960 --> 00:04:13,100
The teams must write a custom flight software application that can control the GPIO and enable access to the payload system console.

44
00:04:13,100 --> 00:04:18,120
After writing the application, the teams must upload it to the CNDH and execute it.

45
00:04:18,120 --> 00:04:22,980
Once the teams have access to the system console, they will identify that it has been corrupted.

46
00:04:23,300 --> 00:04:31,240
The teams will need to research nominal kubos bootloader configuration and repair the payload module's bootloader to resume proper operation of the payload module.

47
00:04:36,780 --> 00:04:41,880
As I mentioned during a previous update, there was always a chance that the scoreboard was going to go dark.

48
00:04:41,880 --> 00:04:50,380
And sure enough, with 30 minutes left in the competition, as teams were hopefully nearing it on a challenge four solution, the organizers decided to keep us all in suspense.

49
00:04:50,380 --> 00:04:54,800
Here's a look at our final scoreboard that everyone saw before it went dark.

50
00:04:56,320 --> 00:05:02,020
As we can tell, we had a couple of solves later on, but early was where most of the action happened.

51
00:05:02,020 --> 00:05:09,200
However, with our accepted and rejected on orbit status, we knew that there was two teams who would not be eligible for final prizes.

52
00:05:09,200 --> 00:05:14,140
We will make the final actual scores available tomorrow during the closing ceremony.

53
00:05:14,140 --> 00:05:23,240
Before you make your predictions on our podium winners, let's take a look at the final challenge five to see what it was teams would have had to solve after they finished challenge four.

54
00:05:24,600 --> 00:05:26,160
Challenge five.

55
00:05:26,800 --> 00:05:28,220
Here's what we know.

56
00:05:28,220 --> 00:05:32,200
We've done our best work and it seems that we've regained control of the satellite.

57
00:05:32,420 --> 00:05:34,120
But how do we know for sure?

58
00:05:34,420 --> 00:05:35,680
The challenge?

59
00:05:35,700 --> 00:05:41,000
Teams must prove that we are fully in control of the satellite system by successfully imaging the moon.

60
00:05:51,240 --> 00:05:55,280
Thought I could have solved some of these challenges and the answer was almost certainly not.

61
00:05:55,280 --> 00:06:03,840
I've got a lot of respect for the teams out there who made progress at all through this event with a very difficult environment, very different to what many other CTFs have to do.

62
00:06:03,840 --> 00:06:06,140
There's a lot of extra constraints you have to worry about.

63
00:06:06,280 --> 00:06:13,560
For more information on that, let's do one last Q&A session with Jason Latimer to talk about how teams were approaching challenge four.

64
00:06:13,640 --> 00:06:14,780
Let's see if we can get him in here.

65
00:06:14,780 --> 00:06:16,440
Jason, do you hear me?

66
00:06:17,100 --> 00:06:18,020
Yeah, I got you.

67
00:06:18,100 --> 00:06:18,420
Excellent.

68
00:06:18,420 --> 00:06:19,480
I hear you as well.

69
00:06:19,580 --> 00:06:20,120
Great.

70
00:06:20,120 --> 00:06:22,560
So, we're wrapped up.

71
00:06:22,560 --> 00:06:23,760
The game is over.

72
00:06:23,760 --> 00:06:32,140
I hopped into a couple of your calls and I was listening to you guys describe some of the approaches teams were taking on challenge four.

73
00:06:32,360 --> 00:06:34,300
I thought there's some really, really interesting things that came out of that.

74
00:06:34,300 --> 00:06:36,500
I'd love to hear a little bit more from your perspective.

75
00:06:37,120 --> 00:06:50,420
Yeah, so the background on challenge four was that, you know, teams had gotten past the implant that the adversary had put on the satellite and that they were trying to use the payload and quickly found that the payload wasn't functional.

76
00:06:51,720 --> 00:06:55,980
So, what the adversary had done was corrupted the bootloader.

77
00:06:55,980 --> 00:06:59,180
And so, they had to, you know, uncorrupt the bootloader.

78
00:06:59,180 --> 00:07:01,140
There were a number of approaches.

79
00:07:01,320 --> 00:07:03,040
Teams seemed to be struggling in the beginning.

80
00:07:03,040 --> 00:07:13,400
So, at one point, we gave a hint that said, hey, you need to write an application that's capable of communicating with the system console and enabling that system console via GPIO.

81
00:07:13,480 --> 00:07:18,500
Very quickly, teams started uploading their custom CFS applications.

82
00:07:18,600 --> 00:07:26,920
Some teams were just trying to enable the GPIO to control the system console based on other GPIOs that were already on the system.

83
00:07:26,920 --> 00:07:28,780
And they had done that successfully.

84
00:07:28,780 --> 00:07:37,020
And then we had some unique approaches where teams were trying to upload applications that could do like TFTP transfers to the device.

85
00:07:37,020 --> 00:07:39,580
So, a number of different approaches.

86
00:07:39,580 --> 00:07:46,020
I was going to say, so, the application that they're compiling, was this like just a standard compiler they could use?

87
00:07:46,020 --> 00:07:51,540
Or what sort of information about that environment did they have to have to build these custom applications?

88
00:07:52,100 --> 00:07:54,820
Yeah, so, it's actually a little bit more complicated than that.

89
00:07:54,820 --> 00:07:59,240
And we didn't want that to be the challenge behind the whole, you know, restoring the bootloader.

90
00:07:59,240 --> 00:08:05,820
So, we actually did provide to the teams ahead of time the RTEMS build environment they would need to build an application.

91
00:08:05,820 --> 00:08:16,460
And then we provided also a set of example applications that they could use as a template for creating this application that would restore the bootloader on the payload.

92
00:08:16,600 --> 00:08:21,300
There was still quite a bit of challenges there because there were specific peripherals that they'd have to be able to control.

93
00:08:21,300 --> 00:08:28,820
So, talking to, you know, specific UART and GPIO drivers to do that.

94
00:08:28,820 --> 00:08:30,520
So, it was non-trivial.

95
00:08:30,520 --> 00:08:32,300
Yeah, what did your solution look like?

96
00:08:32,300 --> 00:08:34,120
I mean, it just sort of like, did it rebuild it?

97
00:08:34,120 --> 00:08:36,680
Or how did your intended solution work on that?

98
00:08:36,880 --> 00:08:45,040
So, we had a custom application that ran in CFS that could talk to the Raspberry Pi system console over the UART.

99
00:08:45,040 --> 00:08:48,420
So, it was literally like talking to this, you know, system console.

100
00:08:48,420 --> 00:08:52,960
We would send a command and we could, you know, do an LS on the shell or whatever it was.

101
00:08:52,960 --> 00:08:59,000
And through that, we could restore the bootloader via just typical system console commands.

102
00:08:59,300 --> 00:09:04,280
But in order to actually enable that UART, we had a GPIO that was hidden.

103
00:09:04,580 --> 00:09:13,840
So, one of the challenges for Challenge 4 was actually looking through the FPGA Verilog and VHDL code and finding that that actually existed.

104
00:09:13,840 --> 00:09:21,680
So, we had gotten some feedback during quals that, you know, teams were really interested in doing that kind of documentation reverse engineering.

105
00:09:21,680 --> 00:09:24,960
So, we went to a lot of effort to make sure that that existed.

106
00:09:24,960 --> 00:09:31,860
So, to even identify that that was there, they were doing code inspections of the Verilog for the FPGA.

107
00:09:31,880 --> 00:09:37,940
Now, I heard hints that, like, at least one team was doing something creative with, like, direct memory writes.

108
00:09:37,940 --> 00:09:39,780
What do we know about that?

109
00:09:40,960 --> 00:09:54,240
All we know about that, well, teams were doing uploads of applications, but it looked like some teams were using the direct memory writes to actually interact with that shell, the Raspberry Pi shell.

110
00:09:54,240 --> 00:09:58,660
So, a little different than our approach, but yeah, it was interesting.

111
00:09:58,980 --> 00:10:01,240
If it gets your code running, it gets it working, right?

112
00:10:01,240 --> 00:10:04,720
There's no points for the jankiness or the cleverness.

113
00:10:04,720 --> 00:10:06,480
It's just, does it solve the challenge, right?

114
00:10:06,480 --> 00:10:20,060
So, one of the things that I just mentioned to people, of course, was the power constraints and how many of the satellites were running low on power at the end from a lot of movement throughout the day and a lot of usage and the sort of option they had to get connected to a ground power.

115
00:10:20,400 --> 00:10:22,520
Tell me how that changed the sort of Challenge 5 requirements.

116
00:10:22,520 --> 00:10:31,360
And if a team was able to solve a Challenge 4 after the SCOBR went dark, would they have been able to do it from the ground or was that completely impossible or what happened there?

117
00:10:32,160 --> 00:10:32,480
Yeah.

118
00:10:32,480 --> 00:10:46,780
So, we talked with the organizers and based on the fact that we had these power constraints and that the teams that had elected to be put on the ground wouldn't be able to get a picture of the moon, we adjusted the criteria for Challenge 5 to just be get a picture.

119
00:10:46,780 --> 00:10:55,920
It was interesting to the different teams were doing as far as power.

120
00:10:56,280 --> 00:11:00,500
Some teams had conserved their power throughout the day and other teams had not.

121
00:11:00,520 --> 00:11:06,880
So, we had some teams that were in the running to solve Challenge 4 that said, hey, we don't want to be put on the ground.

122
00:11:06,880 --> 00:11:08,000
We'll just stay on the carousel.

123
00:11:08,360 --> 00:11:10,240
We've been good with the batteries all day.

124
00:11:10,360 --> 00:11:14,580
And we actually mentioned that in an earlier update here that power was potentially a concern.

125
00:11:14,580 --> 00:11:17,160
And it was nice that teams weren't entirely out of the running, right?

126
00:11:17,160 --> 00:11:22,920
There was sort of a backup mechanism, but it cost them time while their flat set was taken down, was rewired in.

127
00:11:22,920 --> 00:11:27,420
And so, that was sort of a penalty for exercising that option, although they weren't kind of out of the running entirely.

128
00:11:27,420 --> 00:11:29,100
That works out great.

129
00:11:29,280 --> 00:11:29,440
All right.

130
00:11:29,440 --> 00:11:34,680
Well, thank you very much for taking time to talk to us and we'll continue on with the rest of our update.

131
00:11:35,200 --> 00:11:35,900
Thank you.

132
00:11:37,280 --> 00:11:37,760
All right.

133
00:11:37,820 --> 00:11:41,440
Now, the moment that you hopefully have actually been waiting for.

134
00:11:41,480 --> 00:11:46,200
We're going to answer the question as to which team had their code sent into space tonight.

135
00:11:47,160 --> 00:11:51,760
So, the video that we're going to look at here is the same one that I previewed earlier.

136
00:11:51,760 --> 00:11:56,040
So, we can see Poland Can is the very first team to get an acceptable payload.

137
00:11:56,040 --> 00:11:59,380
We knew that from watching the scoreboard and got reasonably close.

138
00:11:59,600 --> 00:12:01,660
Next coming in are going to be several other teams.

139
00:12:01,660 --> 00:12:05,220
ADD Vulcan, number two, and then number three, Flux Repeat Rocket.

140
00:12:05,340 --> 00:12:10,300
So, we've got the three quickest ones and then we're going to have right here a Samurai come in.

141
00:12:10,300 --> 00:12:12,540
So, these were the four that came in before the timeline.

142
00:12:12,540 --> 00:12:15,340
So, if we stop right now, this is our launch cutoff, right?

143
00:12:15,340 --> 00:12:17,580
So, these were the teams that came in.

144
00:12:17,580 --> 00:12:27,380
And if we look at closest to the bullseye, you can see that Poland Candidate Space just beat out Flux Repeat Rocket with the most accurate solution during our window.

145
00:12:27,380 --> 00:12:31,680
And this is the payload that's being run on an actual satellite right now.

146
00:12:31,680 --> 00:12:36,680
So, we're looking forward to getting the results back from that tonight as it runs.

147
00:12:36,680 --> 00:12:40,300
And then tomorrow during the live event, we're going to show you hopefully the moonshot.

148
00:12:40,300 --> 00:12:42,360
Find out how accurate it was.

149
00:12:42,420 --> 00:12:49,660
And of course, we're going to continue the run here because as I mentioned earlier, we know there was that sort of like sudden death for the last two slots, right?

150
00:12:49,660 --> 00:12:52,960
And we could see the teams that were... two more slots that were available.

151
00:12:53,080 --> 00:12:54,440
And so, after that 7 p.m.

152
00:12:54,480 --> 00:12:57,520
cutoff, we had a quick 1550 tree that was able to make it in.

153
00:12:57,520 --> 00:13:00,660
But we also noticed that Poland Candidate really got in close.

154
00:13:00,660 --> 00:13:02,620
And so, they got a really, really nice solution.

155
00:13:02,620 --> 00:13:03,660
They kept iterating on it.

156
00:13:03,660 --> 00:13:04,560
There was no points for it.

157
00:13:04,560 --> 00:13:07,980
There was no extra... it was not considered for the on-orbit.

158
00:13:08,200 --> 00:13:15,520
But it was so good that the individuals we had evaluating all of the solutions, they had a lot of automation.

159
00:13:15,520 --> 00:13:17,460
But there was also, I guess, a little bit of an art to it.

160
00:13:17,460 --> 00:13:23,140
They were explaining that they thought that final Poland Candidate was so beautiful that it was like a piece of art.

161
00:13:23,140 --> 00:13:25,540
They loved that final solution.

162
00:13:25,860 --> 00:13:33,320
And then of course, we had our last solve here coming in that's going to be from PFS, which we've already revealed.

163
00:13:33,320 --> 00:13:46,620
They were the last team to make it into the qualifying minimal acceptable range, which unfortunately left our two other teams, which were Solarwine and 1064 Seabread, not in the running for that.

164
00:13:46,620 --> 00:13:58,400
So, first of all, congrats to Team Poland Candidate into space for submitting not only the best solution overall throughout the whole evaluation period, but the solution that is going to space.

165
00:13:58,400 --> 00:14:00,320
Let's see their team bio again.

166
00:14:33,140 --> 00:14:39,140
And into space, I can confirm that your commands were uplinked to our comms in our comms window earlier today.

167
00:14:39,160 --> 00:14:46,060
We expect the moonshot to happen in a couple of hours at 630 Pacific, and that picture will be sent down to earth at about 1am Pacific.

168
00:14:46,060 --> 00:14:50,460
We will review what is hopefully a clear moonshot picture at tomorrow's closing ceremonies.

169
00:14:50,460 --> 00:14:53,080
It all depends on how accurate your command really was.

170
00:14:53,080 --> 00:14:54,100
Fingers crossed.

171
00:14:54,440 --> 00:14:59,040
You'd think that just watching instead of playing would be less stressful, and I'm sure it was worse for our competitors.

172
00:14:59,060 --> 00:15:04,480
But even in the production room, we were cheering and sweating along with our teams as they worked their way through these challenges.

173
00:15:04,600 --> 00:15:07,440
Thanks very much for joining us throughout this event.

174
00:15:08,000 --> 00:15:09,720
That's it for today's recap.

175
00:15:09,720 --> 00:15:19,360
Make sure you tune in to HackASAC closing ceremonies tomorrow at 11 Pacific, where we will hopefully reveal the world's first CTF moonshot taken by Poland Candid to space.

176
00:15:19,360 --> 00:15:26,200
We'll also show you the overall contest results and award the prizes to our teams and reveal what happened after the scoreboard went dark.

177
00:15:26,200 --> 00:15:28,040
We'll also hear closing remarks by Dr.

178
00:15:28,040 --> 00:15:29,020
Will Roper from the U.S.

179
00:15:29,020 --> 00:15:31,520
Space Force and Air Force Acquisition Chief.

180
00:15:31,640 --> 00:15:36,380
Be sure to also check out all the great happenings going on at DEFCON and in the Aerospace Village.

181
00:15:36,380 --> 00:15:39,220
See you tomorrow at 11 Pacific for the closing ceremonies.