start	end	text
5160	11940	Welcome to Space Security Challenge 2020, HackASAT, the final event. As the democratization
11940	17400	of space opens up a new frontier for exploration and innovation, we see new cybersecurity
17400	24040	vulnerabilities emerging. The Space Security Challenge is designed to inspire the world's
24040	29740	top cybersecurity talent to develop the skills necessary to secure this last frontier of
29740	37280	cybersecurity, space. And already we've made a ton of progress. I'll catch you up. This
37280	42080	spring, we hosted over 2,000 teams who worked their way through a set of foundational space
42080	48000	cybersecurity challenges in our HackASAT qualification round. Now, eight finalist
48000	54080	teams are stepping up to the ultimate challenge. They are hacking a satellite.
60860	66420	Welcome to the Saturday daily recap of Space Security Challenge 2020, or HackASAT.
66960	72080	For the second to last time, I'm your host, Jordan Wines, and it's time to fill you in on how our
72080	77420	competitors did on day two of this first-of-its-kind satellite hacking competition. Okay, let's get
77420	82500	right to the moment everyone's been waiting for. Here is our video to show which team was selected
82500	91260	for the on-orbit challenge. Oh, I'm sorry. Actually, it appears that we're experiencing
91260	95600	some technical difficulties. Yeah, I guess that means you're going to have to listen to the rest
95600	100560	of this update, and then we'll play the big reveal at the end instead. So let's take a look back at
100560	112380	today's action. In fact, let's go ahead and take a look at the scoreboard now in our live Octagon
112380	118400	feed. And they definitely haven't slowed down. You'll notice that Solarwine actually scored first
118400	123900	blood on Challenge 3. Congratulations to them for the great work overnight. You can also see Flux
123900	129660	Repeat Rocket scoring just before this broadcast with only a 5% reduction in total points. That
129660	134760	means Solarwine and Flux Repeat Rocket are both moving on to Challenge 4. While the score hasn't
134760	139960	changed, we have had one important game milestone pass us by. We timed out unavailable points for
139960	144960	Challenge 3. That means those two teams, Solarwine and Flux Repeat Rocket, they've obtained points
144960	149420	for that challenge, and all other teams were given a solution script so they can focus on the next
149420	159180	challenge. If you've been following along at home, you know that we sprung our on-orbit challenge on
159180	164520	our teams yesterday. We had four teams submit their solutions by 4 p.m. Pacific, our deadline
164520	169740	for evaluation for on-orbit, but only one was selected to have their code sent to the live
169740	174800	satellite to capture a moonshot. We will learn who that lucky team is later on in the broadcast.
175840	180960	While today's action started strong with several early scores, teams really struggled their way
180960	185560	through Challenge 4 today. While the organizers knew it would be the hardest challenge, the hope
185560	190300	was that it would be solved before this point. In fact, in the last hour of the competitions, some
190300	195440	team had run so low on power that the organizers offered to take the flatsats offline so they
195440	201440	could plug them into power. This would mean teams would have challenges in solving Challenge 5,
201440	206440	but hopefully it would give them enough power and time to solve Challenge 4 in the last few minutes.
206640	211760	Given that, here is our explanation for the Challenge 4 solution.
212740	219240	Challenge 4. Here's what we know. We've restored communication with the payload module, but we
219240	224440	still can't operate it. The challenge? Now teams must restore normal operations of the payload
224440	229800	module so we can access the imager. Here's how they do it. Teams discover that the payload
229800	234720	module bootloader has been corrupted, which is why the payload module is not operating normally.
234720	239060	The teams discover a system console to the payload module and the ability to access the
239060	245160	payload module system console by controlling an undocumented GPIO and multiplexer on the CNDH
245160	250080	board. The teams must write a custom flight software application that can control the GPIO
250080	254820	and enable access to the payload system console. After writing the application,
254820	259820	the teams must upload it to the CNDH and execute it. Once the teams have access to the system
259820	264580	console, they will identify that it has been corrupted. The teams will need to research
264580	269360	nominal kubos bootloader configuration and repair the payload module's bootloader to resume proper
269360	279840	operation of the payload module. As I mentioned during a previous update, there was always a
279840	283880	chance that the scoreboard was going to go dark. And sure enough, with 30 minutes left in the
283880	288300	competition, as teams were hopefully nearing it on a challenge four solution, the organizers
288300	293060	decided to keep us all in suspense. Here's a look at our final scoreboard that everyone saw
293060	300600	before it went dark. As we can tell, we had a couple of solves later on, but early was where
300600	305220	most of the action happened. However, with our accepted and rejected on orbit status,
305220	309200	we knew that there was two teams who would not be eligible for final prizes.
309200	314700	We will make the final actual scores available tomorrow during the closing ceremony. Before you
314700	318840	make your predictions on our podium winners, let's take a look at the final challenge five
318840	323240	to see what it was teams would have had to solve after they finished challenge four.
324600	330780	Challenge five. Here's what we know. We've done our best work and it seems that we've regained
330780	336900	control of the satellite. But how do we know for sure? The challenge? Teams must prove that we are
336900	341000	fully in control of the satellite system by successfully imaging the moon.
351240	354700	Thought I could have solved some of these challenges and the answer was almost certainly
354700	359040	not. I've got a lot of respect for the teams out there who made progress at all through this event
359040	364160	with a very difficult environment, very different to what many other CTFs have to do. There's a lot
364160	368720	of extra constraints you have to worry about. For more information on that, let's do one last Q&A
368720	374140	session with Jason Latimer to talk about how teams were approaching challenge four. Let's see if we
374140	380120	can get him in here. Jason, do you hear me? Yeah, I got you. Excellent. I hear you as well. Great.
380120	387420	So, we're wrapped up. The game is over. I hopped into a couple of your calls and I was listening
387420	392580	to you guys describe some of the approaches teams were taking on challenge four. I thought
392580	394880	there's some really, really interesting things that came out of that. I'd love to hear a little
394880	400980	bit more from your perspective. Yeah, so the background on challenge four was that, you know,
400980	405760	teams had gotten past the implant that the adversary had put on the satellite and that
405760	410420	they were trying to use the payload and quickly found that the payload wasn't functional.
411720	417420	So, what the adversary had done was corrupted the bootloader. And so, they had to, you know,
417420	422560	uncorrupt the bootloader. There were a number of approaches. Teams seemed to be struggling in the
422560	427380	beginning. So, at one point, we gave a hint that said, hey, you need to write an application that's
427380	433400	capable of communicating with the system console and enabling that system console via GPIO.
433480	440360	Very quickly, teams started uploading their custom CFS applications. Some teams were just
440360	445860	trying to enable the GPIO to control the system console based on other GPIOs that were already
445860	451100	on the system. And they had done that successfully. And then we had some unique approaches where
451100	457120	teams were trying to upload applications that could do like TFTP transfers to the device. So,
457320	463800	a number of different approaches. I was going to say, so, the application that they're compiling,
463800	468580	was this like just a standard compiler they could use? Or what sort of information about
468580	473280	that environment did they have to have to build these custom applications? Yeah, so, it's actually
473460	477300	a little bit more complicated than that. And we didn't want that to be the challenge behind the
477300	481420	whole, you know, restoring the bootloader. So, we actually did provide to the teams ahead of time
481420	487000	the RTEMS build environment they would need to build an application. And then we provided also
488120	493680	a set of example applications that they could use as a template for creating this application
493680	498180	that would restore the bootloader on the payload. There was still quite a bit of challenges there
498180	501800	because there were specific peripherals that they'd have to be able to control. So,
501800	510520	talking to, you know, specific UART and GPIO drivers to do that. So, it was non-trivial.
510520	513100	Yeah, what did your solution look like? I mean, it just sort of like,
513100	516680	did it rebuild it? Or how did your intended solution work on that?
516880	524060	So, we had a custom application that ran in CFS that could talk to the Raspberry Pi system console
524060	528740	over the UART. So, it was literally like talking to this, you know, system console. We would send
528860	533700	a command and we could, you know, do an LS on the shell or whatever it was. And through that,
533700	540400	we could restore the bootloader via just typical system console commands. But in order to actually
540400	548280	enable that UART, we had a GPIO that was hidden. So, one of the challenges for Challenge 4 was
548280	554340	actually looking through the FPGA Verilog and VHDL code and finding that that actually existed. So,
554340	558640	we had gotten some feedback during quals that, you know, teams were really interested in doing
558640	564320	that kind of documentation reverse engineering. So, we went to a lot of effort to make sure that
564320	570160	that existed. So, to even identify that that was there, they were doing code inspections of the
570160	574960	Verilog for the FPGA. Now, I heard hints that, like, at least one team was doing something
574960	583740	creative with, like, direct memory writes. What do we know about that? All we know about that, well,
584720	589640	teams were doing uploads of applications, but it looked like some teams were using the direct
589640	595040	memory writes to actually interact with that shell, the Raspberry Pi shell. So, a little
595040	600380	different than our approach, but yeah, it was interesting. If it gets your code running,
600380	605120	it gets it working, right? There's no points for the jankiness or the cleverness. It's just,
605120	608680	does it solve the challenge, right? So, one of the things that I just mentioned to people,
608680	613360	of course, was the power constraints and how many of the satellites were running low on power at the
613360	618140	end from a lot of movement throughout the day and a lot of usage and the sort of option they had to
618140	622700	get connected to a ground power. Tell me how that changed the sort of Challenge 5 requirements. And
622700	627720	if a team was able to solve a Challenge 4 after the SCOBR went dark, would they have been able to
627720	632620	do it from the ground or was that completely impossible or what happened there? Yeah. So,
632620	636580	we talked with the organizers and based on the fact that we had these power constraints
637480	642020	and that the teams that had elected to be put on the ground wouldn't be able to get a picture of
642020	647580	the moon, we adjusted the criteria for Challenge 5 to just be get a picture. It was interesting to
648320	658220	the different teams were doing as far as power. Some teams had conserved their power throughout
658220	663080	the day and other teams had not. So, we had some teams that were in the running to solve Challenge
663080	668760	4 that said, hey, we don't want to be put on the ground. We'll just stay on the carousel. We've
668760	672180	been good with the batteries all day. And we actually mentioned that in an earlier update
672180	676100	here that power was potentially a concern. And it was nice that teams weren't entirely
676100	679980	out of the running, right? There was sort of a backup mechanism, but it cost them time while
680660	684920	their flat set was taken down, was rewired in. And so, that was sort of a penalty for exercising
684920	689100	that option, although they weren't kind of out of the running entirely. That works out great.
689280	693700	All right. Well, thank you very much for taking time to talk to us and we'll continue on with
693700	700340	the rest of our update. Thank you. All right. Now, the moment that you hopefully have actually
700340	705040	been waiting for. We're going to answer the question as to which team had their code sent
705040	710640	into space tonight. So, the video that we're going to look at here is the same one that I
710640	716040	previewed earlier. So, we can see Poland Can is the very first team to get an acceptable payload.
716040	720760	We knew that from watching the scoreboard and got reasonably close. Next coming in are going to be
720760	725640	several other teams. ADD Vulcan, number two, and then number three, Flux Repeat Rocket. So,
725640	730440	we've got the three quickest ones and then we're going to have right here a Samurai come in. So,
730440	734000	these were the four that came in before the timeline. So, if we stop right now,
734000	738700	this is our launch cutoff, right? So, these were the teams that came in. And if we look at closest
738700	744740	to the bullseye, you can see that Poland Candidate Space just beat out Flux Repeat Rocket with the
744740	750700	most accurate solution during our window. And this is the payload that's being run on an actual
750700	756340	satellite right now. So, we're looking forward to getting the results back from that tonight as it
756340	760300	runs. And then tomorrow during the live event, we're going to show you hopefully the moonshot.
760300	764340	Find out how accurate it was. And of course, we're going to continue the run here because
764340	769500	as I mentioned earlier, we know there was that sort of like sudden death for the last two slots,
769500	773480	right? And we could see the teams that were... two more slots that were available. And so,
773480	777980	after that 7 p.m. cutoff, we had a quick 1550 tree that was able to make it in. But we also
777980	782620	noticed that Poland Candidate really got in close. And so, they got a really, really nice solution.
782620	786920	They kept iterating on it. There was no points for it. There was no extra... it was not considered
786920	792540	for the on-orbit. But it was so good that the individuals we had evaluating all of the
792540	797460	solutions, they had a lot of automation. But there was also, I guess, a little bit of an art to it.
797460	802380	They were explaining that they thought that final Poland Candidate was so beautiful that it was like
802480	809120	a piece of art. They loved that final solution. And then of course, we had our last solve here
809120	814500	coming in that's going to be from PFS, which we've already revealed. They were the last team
814500	819700	to make it into the qualifying minimal acceptable range, which unfortunately left our two other
819700	828240	teams, which were Solarwine and 1064 Seabread, not in the running for that. So, first of all,
828240	833460	congrats to Team Poland Candidate into space for submitting not only the best solution overall
833460	839240	throughout the whole evaluation period, but the solution that is going to space. Let's see their
839240	877380	team bio again. And into space, I can confirm that your commands were uplinked to our comms
877380	881880	in our comms window earlier today. We expect the moonshot to happen in a couple of hours at 630
881880	887020	Pacific, and that picture will be sent down to earth at about 1am Pacific. We will review what
887020	891680	is hopefully a clear moonshot picture at tomorrow's closing ceremonies. It all depends on how accurate
891680	896360	your command really was. Fingers crossed. You'd think that just watching instead of playing would
896360	900300	be less stressful, and I'm sure it was worse for our competitors. But even in the production room,
900300	903640	we were cheering and sweating along with our teams as they worked their way through these
903640	909060	challenges. Thanks very much for joining us throughout this event. That's it for today's
909060	914460	recap. Make sure you tune in to HackASAC closing ceremonies tomorrow at 11 Pacific, where we will
914460	920060	hopefully reveal the world's first CTF moonshot taken by Poland Candid to space. We'll also show
920060	924660	you the overall contest results and award the prizes to our teams and reveal what happened
924660	929020	after the scoreboard went dark. We'll also hear closing remarks by Dr. Will Roper from the U.S.
929020	933660	Space Force and Air Force Acquisition Chief. Be sure to also check out all the great happenings
933660	938340	going on at DEFCON and in the Aerospace Village. See you tomorrow at 11 Pacific for the closing
938340	939220	ceremonies.