Welcome to Space Security Challenge 2020, HackASAT, the final event. As the democratization
of space opens up a new frontier for exploration and innovation, we see new cybersecurity
vulnerabilities emerging. The Space Security Challenge is designed to inspire the world's
top cybersecurity talent to develop the skills necessary to secure this last frontier of
cybersecurity, space. And already we've made a ton of progress. I'll catch you up. This
spring, we hosted over 2,000 teams who worked their way through a set of foundational space
cybersecurity challenges in our HackASAT qualification round. Now, eight finalist
teams are stepping up to the ultimate challenge. They are hacking a satellite.
Welcome to the Saturday daily recap of Space Security Challenge 2020, or HackASAT.
For the second to last time, I'm your host, Jordan Wines, and it's time to fill you in on how our
competitors did on day two of this first-of-its-kind satellite hacking competition. Okay, let's get
right to the moment everyone's been waiting for. Here is our video to show which team was selected
for the on-orbit challenge. Oh, I'm sorry. Actually, it appears that we're experiencing
some technical difficulties. Yeah, I guess that means you're going to have to listen to the rest
of this update, and then we'll play the big reveal at the end instead. So let's take a look back at
today's action. In fact, let's go ahead and take a look at the scoreboard now in our live Octagon
feed. And they definitely haven't slowed down. You'll notice that Solarwine actually scored first
blood on Challenge 3. Congratulations to them for the great work overnight. You can also see Flux
Repeat Rocket scoring just before this broadcast with only a 5% reduction in total points. That
means Solarwine and Flux Repeat Rocket are both moving on to Challenge 4. While the score hasn't
changed, we have had one important game milestone pass us by. We timed out unavailable points for
Challenge 3. That means those two teams, Solarwine and Flux Repeat Rocket, they've obtained points
for that challenge, and all other teams were given a solution script so they can focus on the next
challenge. If you've been following along at home, you know that we sprung our on-orbit challenge on
our teams yesterday. We had four teams submit their solutions by 4 p.m. Pacific, our deadline
for evaluation for on-orbit, but only one was selected to have their code sent to the live
satellite to capture a moonshot. We will learn who that lucky team is later on in the broadcast.
While today's action started strong with several early scores, teams really struggled their way
through Challenge 4 today. While the organizers knew it would be the hardest challenge, the hope
was that it would be solved before this point. In fact, in the last hour of the competitions, some
team had run so low on power that the organizers offered to take the flatsats offline so they
could plug them into power. This would mean teams would have challenges in solving Challenge 5,
but hopefully it would give them enough power and time to solve Challenge 4 in the last few minutes.
Given that, here is our explanation for the Challenge 4 solution.
Challenge 4. Here's what we know. We've restored communication with the payload module, but we
still can't operate it. The challenge? Now teams must restore normal operations of the payload
module so we can access the imager. Here's how they do it. Teams discover that the payload
module bootloader has been corrupted, which is why the payload module is not operating normally.
The teams discover a system console to the payload module and the ability to access the
payload module system console by controlling an undocumented GPIO and multiplexer on the CNDH
board. The teams must write a custom flight software application that can control the GPIO
and enable access to the payload system console. After writing the application,
the teams must upload it to the CNDH and execute it. Once the teams have access to the system
console, they will identify that it has been corrupted. The teams will need to research
nominal kubos bootloader configuration and repair the payload module's bootloader to resume proper
operation of the payload module. As I mentioned during a previous update, there was always a
chance that the scoreboard was going to go dark. And sure enough, with 30 minutes left in the
competition, as teams were hopefully nearing it on a challenge four solution, the organizers
decided to keep us all in suspense. Here's a look at our final scoreboard that everyone saw
before it went dark. As we can tell, we had a couple of solves later on, but early was where
most of the action happened. However, with our accepted and rejected on orbit status,
we knew that there was two teams who would not be eligible for final prizes.
We will make the final actual scores available tomorrow during the closing ceremony. Before you
make your predictions on our podium winners, let's take a look at the final challenge five
to see what it was teams would have had to solve after they finished challenge four.
Challenge five. Here's what we know. We've done our best work and it seems that we've regained
control of the satellite. But how do we know for sure? The challenge? Teams must prove that we are
fully in control of the satellite system by successfully imaging the moon.
Thought I could have solved some of these challenges and the answer was almost certainly
not. I've got a lot of respect for the teams out there who made progress at all through this event
with a very difficult environment, very different to what many other CTFs have to do. There's a lot
of extra constraints you have to worry about. For more information on that, let's do one last Q&A
session with Jason Latimer to talk about how teams were approaching challenge four. Let's see if we
can get him in here. Jason, do you hear me? Yeah, I got you. Excellent. I hear you as well. Great.
So, we're wrapped up. The game is over. I hopped into a couple of your calls and I was listening
to you guys describe some of the approaches teams were taking on challenge four. I thought
there's some really, really interesting things that came out of that. I'd love to hear a little
bit more from your perspective. Yeah, so the background on challenge four was that, you know,
teams had gotten past the implant that the adversary had put on the satellite and that
they were trying to use the payload and quickly found that the payload wasn't functional.
So, what the adversary had done was corrupted the bootloader. And so, they had to, you know,
uncorrupt the bootloader. There were a number of approaches. Teams seemed to be struggling in the
beginning. So, at one point, we gave a hint that said, hey, you need to write an application that's
capable of communicating with the system console and enabling that system console via GPIO.
Very quickly, teams started uploading their custom CFS applications. Some teams were just
trying to enable the GPIO to control the system console based on other GPIOs that were already
on the system. And they had done that successfully. And then we had some unique approaches where
teams were trying to upload applications that could do like TFTP transfers to the device. So,
a number of different approaches. I was going to say, so, the application that they're compiling,
was this like just a standard compiler they could use? Or what sort of information about
that environment did they have to have to build these custom applications? Yeah, so, it's actually
a little bit more complicated than that. And we didn't want that to be the challenge behind the
whole, you know, restoring the bootloader. So, we actually did provide to the teams ahead of time
the RTEMS build environment they would need to build an application. And then we provided also
a set of example applications that they could use as a template for creating this application
that would restore the bootloader on the payload. There was still quite a bit of challenges there
because there were specific peripherals that they'd have to be able to control. So,
talking to, you know, specific UART and GPIO drivers to do that. So, it was non-trivial.
Yeah, what did your solution look like? I mean, it just sort of like,
did it rebuild it? Or how did your intended solution work on that?
So, we had a custom application that ran in CFS that could talk to the Raspberry Pi system console
over the UART. So, it was literally like talking to this, you know, system console. We would send
a command and we could, you know, do an LS on the shell or whatever it was. And through that,
we could restore the bootloader via just typical system console commands. But in order to actually
enable that UART, we had a GPIO that was hidden. So, one of the challenges for Challenge 4 was
actually looking through the FPGA Verilog and VHDL code and finding that that actually existed. So,
we had gotten some feedback during quals that, you know, teams were really interested in doing
that kind of documentation reverse engineering. So, we went to a lot of effort to make sure that
that existed. So, to even identify that that was there, they were doing code inspections of the
Verilog for the FPGA. Now, I heard hints that, like, at least one team was doing something
creative with, like, direct memory writes. What do we know about that? All we know about that, well,
teams were doing uploads of applications, but it looked like some teams were using the direct
memory writes to actually interact with that shell, the Raspberry Pi shell. So, a little
different than our approach, but yeah, it was interesting. If it gets your code running,
it gets it working, right? There's no points for the jankiness or the cleverness. It's just,
does it solve the challenge, right? So, one of the things that I just mentioned to people,
of course, was the power constraints and how many of the satellites were running low on power at the
end from a lot of movement throughout the day and a lot of usage and the sort of option they had to
get connected to a ground power. Tell me how that changed the sort of Challenge 5 requirements. And
if a team was able to solve a Challenge 4 after the SCOBR went dark, would they have been able to
do it from the ground or was that completely impossible or what happened there? Yeah. So,
we talked with the organizers and based on the fact that we had these power constraints
and that the teams that had elected to be put on the ground wouldn't be able to get a picture of
the moon, we adjusted the criteria for Challenge 5 to just be get a picture. It was interesting to
the different teams were doing as far as power. Some teams had conserved their power throughout
the day and other teams had not. So, we had some teams that were in the running to solve Challenge
4 that said, hey, we don't want to be put on the ground. We'll just stay on the carousel. We've
been good with the batteries all day. And we actually mentioned that in an earlier update
here that power was potentially a concern. And it was nice that teams weren't entirely
out of the running, right? There was sort of a backup mechanism, but it cost them time while
their flat set was taken down, was rewired in. And so, that was sort of a penalty for exercising
that option, although they weren't kind of out of the running entirely. That works out great.
All right. Well, thank you very much for taking time to talk to us and we'll continue on with
the rest of our update. Thank you. All right. Now, the moment that you hopefully have actually
been waiting for. We're going to answer the question as to which team had their code sent
into space tonight. So, the video that we're going to look at here is the same one that I
previewed earlier. So, we can see Poland Can is the very first team to get an acceptable payload.
We knew that from watching the scoreboard and got reasonably close. Next coming in are going to be
several other teams. ADD Vulcan, number two, and then number three, Flux Repeat Rocket. So,
we've got the three quickest ones and then we're going to have right here a Samurai come in. So,
these were the four that came in before the timeline. So, if we stop right now,
this is our launch cutoff, right? So, these were the teams that came in. And if we look at closest
to the bullseye, you can see that Poland Candidate Space just beat out Flux Repeat Rocket with the
most accurate solution during our window. And this is the payload that's being run on an actual
satellite right now. So, we're looking forward to getting the results back from that tonight as it
runs. And then tomorrow during the live event, we're going to show you hopefully the moonshot.
Find out how accurate it was. And of course, we're going to continue the run here because
as I mentioned earlier, we know there was that sort of like sudden death for the last two slots,
right? And we could see the teams that were... two more slots that were available. And so,
after that 7 p.m. cutoff, we had a quick 1550 tree that was able to make it in. But we also
noticed that Poland Candidate really got in close. And so, they got a really, really nice solution.
They kept iterating on it. There was no points for it. There was no extra... it was not considered
for the on-orbit. But it was so good that the individuals we had evaluating all of the
solutions, they had a lot of automation. But there was also, I guess, a little bit of an art to it.
They were explaining that they thought that final Poland Candidate was so beautiful that it was like
a piece of art. They loved that final solution. And then of course, we had our last solve here
coming in that's going to be from PFS, which we've already revealed. They were the last team
to make it into the qualifying minimal acceptable range, which unfortunately left our two other
teams, which were Solarwine and 1064 Seabread, not in the running for that. So, first of all,
congrats to Team Poland Candidate into space for submitting not only the best solution overall
throughout the whole evaluation period, but the solution that is going to space. Let's see their
team bio again. And into space, I can confirm that your commands were uplinked to our comms
in our comms window earlier today. We expect the moonshot to happen in a couple of hours at 630
Pacific, and that picture will be sent down to earth at about 1am Pacific. We will review what
is hopefully a clear moonshot picture at tomorrow's closing ceremonies. It all depends on how accurate
your command really was. Fingers crossed. You'd think that just watching instead of playing would
be less stressful, and I'm sure it was worse for our competitors. But even in the production room,
we were cheering and sweating along with our teams as they worked their way through these
challenges. Thanks very much for joining us throughout this event. That's it for today's
recap. Make sure you tune in to HackASAC closing ceremonies tomorrow at 11 Pacific, where we will
hopefully reveal the world's first CTF moonshot taken by Poland Candid to space. We'll also show
you the overall contest results and award the prizes to our teams and reveal what happened
after the scoreboard went dark. We'll also hear closing remarks by Dr. Will Roper from the U.S.
Space Force and Air Force Acquisition Chief. Be sure to also check out all the great happenings
going on at DEFCON and in the Aerospace Village. See you tomorrow at 11 Pacific for the closing
ceremonies.