WEBVTT 00:05.160 --> 00:10.880 Welcome to Space Security Challenge 2020, HackASAT, the final event. 00:10.880 --> 00:19.800 As the democratization of space opens up a new frontier for exploration and innovation, we see new cybersecurity vulnerabilities emerging. 00:20.680 --> 00:32.460 The Space Security Challenge is designed to inspire the world's top cybersecurity talent to develop the skills necessary to secure this last frontier of cybersecurity, space. 00:32.680 --> 00:35.480 And already we've made a ton of progress. 00:35.480 --> 00:36.880 I'll catch you up. 00:36.880 --> 00:46.600 This spring, we hosted over 2,000 teams who worked their way through a set of foundational space cybersecurity challenges in our HackASAT qualification round. 00:46.600 --> 00:51.000 Now, eight finalist teams are stepping up to the ultimate challenge. 00:51.000 --> 00:54.080 They are hacking a satellite. 01:00.860 --> 01:06.420 Welcome to the Saturday daily recap of Space Security Challenge 2020, or HackASAT. 01:06.960 --> 01:16.340 For the second to last time, I'm your host, Jordan Wines, and it's time to fill you in on how our competitors did on day two of this first-of-its-kind satellite hacking competition. 01:16.460 --> 01:19.800 Okay, let's get right to the moment everyone's been waiting for. 01:19.800 --> 01:24.560 Here is our video to show which team was selected for the on-orbit challenge. 01:26.520 --> 01:28.640 Oh, I'm sorry. 01:29.020 --> 01:33.020 Actually, it appears that we're experiencing some technical difficulties. 01:33.460 --> 01:38.800 Yeah, I guess that means you're going to have to listen to the rest of this update, and then we'll play the big reveal at the end instead. 01:39.120 --> 01:41.740 So let's take a look back at today's action. 01:48.780 --> 01:53.260 In fact, let's go ahead and take a look at the scoreboard now in our live Octagon feed. 01:53.760 --> 01:56.140 And they definitely haven't slowed down. 01:56.140 --> 01:59.960 You'll notice that Solarwine actually scored first blood on Challenge 3. 01:59.960 --> 02:02.940 Congratulations to them for the great work overnight. 02:02.980 --> 02:09.420 You can also see Flux Repeat Rocket scoring just before this broadcast with only a 5% reduction in total points. 02:09.420 --> 02:13.980 That means Solarwine and Flux Repeat Rocket are both moving on to Challenge 4. 02:13.980 --> 02:18.320 While the score hasn't changed, we have had one important game milestone pass us by. 02:18.320 --> 02:20.720 We timed out unavailable points for Challenge 3. 02:20.720 --> 02:30.220 That means those two teams, Solarwine and Flux Repeat Rocket, they've obtained points for that challenge, and all other teams were given a solution script so they can focus on the next challenge. 02:35.640 --> 02:40.200 If you've been following along at home, you know that we sprung our on-orbit challenge on our teams yesterday. 02:40.200 --> 02:43.040 We had four teams submit their solutions by 4 p.m. 02:43.040 --> 02:51.540 Pacific, our deadline for evaluation for on-orbit, but only one was selected to have their code sent to the live satellite to capture a moonshot. 02:51.600 --> 02:54.800 We will learn who that lucky team is later on in the broadcast. 02:55.840 --> 03:02.400 While today's action started strong with several early scores, teams really struggled their way through Challenge 4 today. 03:02.400 --> 03:07.720 While the organizers knew it would be the hardest challenge, the hope was that it would be solved before this point. 03:07.720 --> 03:17.300 In fact, in the last hour of the competitions, some team had run so low on power that the organizers offered to take the flatsats offline so they could plug them into power. 03:17.300 --> 03:26.440 This would mean teams would have challenges in solving Challenge 5, but hopefully it would give them enough power and time to solve Challenge 4 in the last few minutes. 03:26.640 --> 03:31.760 Given that, here is our explanation for the Challenge 4 solution. 03:32.740 --> 03:34.400 Challenge 4. 03:35.020 --> 03:36.380 Here's what we know. 03:36.380 --> 03:40.760 We've restored communication with the payload module, but we still can't operate it. 03:40.760 --> 03:41.800 The challenge? 03:41.800 --> 03:46.760 Now teams must restore normal operations of the payload module so we can access the imager. 03:46.900 --> 03:48.580 Here's how they do it. 03:48.580 --> 03:54.720 Teams discover that the payload module bootloader has been corrupted, which is why the payload module is not operating normally. 03:54.720 --> 04:05.960 The teams discover a system console to the payload module and the ability to access the payload module system console by controlling an undocumented GPIO and multiplexer on the CNDH board. 04:05.960 --> 04:13.100 The teams must write a custom flight software application that can control the GPIO and enable access to the payload system console. 04:13.100 --> 04:18.120 After writing the application, the teams must upload it to the CNDH and execute it. 04:18.120 --> 04:22.980 Once the teams have access to the system console, they will identify that it has been corrupted. 04:23.300 --> 04:31.240 The teams will need to research nominal kubos bootloader configuration and repair the payload module's bootloader to resume proper operation of the payload module. 04:36.780 --> 04:41.880 As I mentioned during a previous update, there was always a chance that the scoreboard was going to go dark. 04:41.880 --> 04:50.380 And sure enough, with 30 minutes left in the competition, as teams were hopefully nearing it on a challenge four solution, the organizers decided to keep us all in suspense. 04:50.380 --> 04:54.800 Here's a look at our final scoreboard that everyone saw before it went dark. 04:56.320 --> 05:02.020 As we can tell, we had a couple of solves later on, but early was where most of the action happened. 05:02.020 --> 05:09.200 However, with our accepted and rejected on orbit status, we knew that there was two teams who would not be eligible for final prizes. 05:09.200 --> 05:14.140 We will make the final actual scores available tomorrow during the closing ceremony. 05:14.140 --> 05:23.240 Before you make your predictions on our podium winners, let's take a look at the final challenge five to see what it was teams would have had to solve after they finished challenge four. 05:24.600 --> 05:26.160 Challenge five. 05:26.800 --> 05:28.220 Here's what we know. 05:28.220 --> 05:32.200 We've done our best work and it seems that we've regained control of the satellite. 05:32.420 --> 05:34.120 But how do we know for sure? 05:34.420 --> 05:35.680 The challenge? 05:35.700 --> 05:41.000 Teams must prove that we are fully in control of the satellite system by successfully imaging the moon. 05:51.240 --> 05:55.280 Thought I could have solved some of these challenges and the answer was almost certainly not. 05:55.280 --> 06:03.840 I've got a lot of respect for the teams out there who made progress at all through this event with a very difficult environment, very different to what many other CTFs have to do. 06:03.840 --> 06:06.140 There's a lot of extra constraints you have to worry about. 06:06.280 --> 06:13.560 For more information on that, let's do one last Q&A session with Jason Latimer to talk about how teams were approaching challenge four. 06:13.640 --> 06:14.780 Let's see if we can get him in here. 06:14.780 --> 06:16.440 Jason, do you hear me? 06:17.100 --> 06:18.020 Yeah, I got you. 06:18.100 --> 06:18.420 Excellent. 06:18.420 --> 06:19.480 I hear you as well. 06:19.580 --> 06:20.120 Great. 06:20.120 --> 06:22.560 So, we're wrapped up. 06:22.560 --> 06:23.760 The game is over. 06:23.760 --> 06:32.140 I hopped into a couple of your calls and I was listening to you guys describe some of the approaches teams were taking on challenge four. 06:32.360 --> 06:34.300 I thought there's some really, really interesting things that came out of that. 06:34.300 --> 06:36.500 I'd love to hear a little bit more from your perspective. 06:37.120 --> 06:50.420 Yeah, so the background on challenge four was that, you know, teams had gotten past the implant that the adversary had put on the satellite and that they were trying to use the payload and quickly found that the payload wasn't functional. 06:51.720 --> 06:55.980 So, what the adversary had done was corrupted the bootloader. 06:55.980 --> 06:59.180 And so, they had to, you know, uncorrupt the bootloader. 06:59.180 --> 07:01.140 There were a number of approaches. 07:01.320 --> 07:03.040 Teams seemed to be struggling in the beginning. 07:03.040 --> 07:13.400 So, at one point, we gave a hint that said, hey, you need to write an application that's capable of communicating with the system console and enabling that system console via GPIO. 07:13.480 --> 07:18.500 Very quickly, teams started uploading their custom CFS applications. 07:18.600 --> 07:26.920 Some teams were just trying to enable the GPIO to control the system console based on other GPIOs that were already on the system. 07:26.920 --> 07:28.780 And they had done that successfully. 07:28.780 --> 07:37.020 And then we had some unique approaches where teams were trying to upload applications that could do like TFTP transfers to the device. 07:37.020 --> 07:39.580 So, a number of different approaches. 07:39.580 --> 07:46.020 I was going to say, so, the application that they're compiling, was this like just a standard compiler they could use? 07:46.020 --> 07:51.540 Or what sort of information about that environment did they have to have to build these custom applications? 07:52.100 --> 07:54.820 Yeah, so, it's actually a little bit more complicated than that. 07:54.820 --> 07:59.240 And we didn't want that to be the challenge behind the whole, you know, restoring the bootloader. 07:59.240 --> 08:05.820 So, we actually did provide to the teams ahead of time the RTEMS build environment they would need to build an application. 08:05.820 --> 08:16.460 And then we provided also a set of example applications that they could use as a template for creating this application that would restore the bootloader on the payload. 08:16.600 --> 08:21.300 There was still quite a bit of challenges there because there were specific peripherals that they'd have to be able to control. 08:21.300 --> 08:28.820 So, talking to, you know, specific UART and GPIO drivers to do that. 08:28.820 --> 08:30.520 So, it was non-trivial. 08:30.520 --> 08:32.300 Yeah, what did your solution look like? 08:32.300 --> 08:34.120 I mean, it just sort of like, did it rebuild it? 08:34.120 --> 08:36.680 Or how did your intended solution work on that? 08:36.880 --> 08:45.040 So, we had a custom application that ran in CFS that could talk to the Raspberry Pi system console over the UART. 08:45.040 --> 08:48.420 So, it was literally like talking to this, you know, system console. 08:48.420 --> 08:52.960 We would send a command and we could, you know, do an LS on the shell or whatever it was. 08:52.960 --> 08:59.000 And through that, we could restore the bootloader via just typical system console commands. 08:59.300 --> 09:04.280 But in order to actually enable that UART, we had a GPIO that was hidden. 09:04.580 --> 09:13.840 So, one of the challenges for Challenge 4 was actually looking through the FPGA Verilog and VHDL code and finding that that actually existed. 09:13.840 --> 09:21.680 So, we had gotten some feedback during quals that, you know, teams were really interested in doing that kind of documentation reverse engineering. 09:21.680 --> 09:24.960 So, we went to a lot of effort to make sure that that existed. 09:24.960 --> 09:31.860 So, to even identify that that was there, they were doing code inspections of the Verilog for the FPGA. 09:31.880 --> 09:37.940 Now, I heard hints that, like, at least one team was doing something creative with, like, direct memory writes. 09:37.940 --> 09:39.780 What do we know about that? 09:40.960 --> 09:54.240 All we know about that, well, teams were doing uploads of applications, but it looked like some teams were using the direct memory writes to actually interact with that shell, the Raspberry Pi shell. 09:54.240 --> 09:58.660 So, a little different than our approach, but yeah, it was interesting. 09:58.980 --> 10:01.240 If it gets your code running, it gets it working, right? 10:01.240 --> 10:04.720 There's no points for the jankiness or the cleverness. 10:04.720 --> 10:06.480 It's just, does it solve the challenge, right? 10:06.480 --> 10:20.060 So, one of the things that I just mentioned to people, of course, was the power constraints and how many of the satellites were running low on power at the end from a lot of movement throughout the day and a lot of usage and the sort of option they had to get connected to a ground power. 10:20.400 --> 10:22.520 Tell me how that changed the sort of Challenge 5 requirements. 10:22.520 --> 10:31.360 And if a team was able to solve a Challenge 4 after the SCOBR went dark, would they have been able to do it from the ground or was that completely impossible or what happened there? 10:32.160 --> 10:32.480 Yeah. 10:32.480 --> 10:46.780 So, we talked with the organizers and based on the fact that we had these power constraints and that the teams that had elected to be put on the ground wouldn't be able to get a picture of the moon, we adjusted the criteria for Challenge 5 to just be get a picture. 10:46.780 --> 10:55.920 It was interesting to the different teams were doing as far as power. 10:56.280 --> 11:00.500 Some teams had conserved their power throughout the day and other teams had not. 11:00.520 --> 11:06.880 So, we had some teams that were in the running to solve Challenge 4 that said, hey, we don't want to be put on the ground. 11:06.880 --> 11:08.000 We'll just stay on the carousel. 11:08.360 --> 11:10.240 We've been good with the batteries all day. 11:10.360 --> 11:14.580 And we actually mentioned that in an earlier update here that power was potentially a concern. 11:14.580 --> 11:17.160 And it was nice that teams weren't entirely out of the running, right? 11:17.160 --> 11:22.920 There was sort of a backup mechanism, but it cost them time while their flat set was taken down, was rewired in. 11:22.920 --> 11:27.420 And so, that was sort of a penalty for exercising that option, although they weren't kind of out of the running entirely. 11:27.420 --> 11:29.100 That works out great. 11:29.280 --> 11:29.440 All right. 11:29.440 --> 11:34.680 Well, thank you very much for taking time to talk to us and we'll continue on with the rest of our update. 11:35.200 --> 11:35.900 Thank you. 11:37.280 --> 11:37.760 All right. 11:37.820 --> 11:41.440 Now, the moment that you hopefully have actually been waiting for. 11:41.480 --> 11:46.200 We're going to answer the question as to which team had their code sent into space tonight. 11:47.160 --> 11:51.760 So, the video that we're going to look at here is the same one that I previewed earlier. 11:51.760 --> 11:56.040 So, we can see Poland Can is the very first team to get an acceptable payload. 11:56.040 --> 11:59.380 We knew that from watching the scoreboard and got reasonably close. 11:59.600 --> 12:01.660 Next coming in are going to be several other teams. 12:01.660 --> 12:05.220 ADD Vulcan, number two, and then number three, Flux Repeat Rocket. 12:05.340 --> 12:10.300 So, we've got the three quickest ones and then we're going to have right here a Samurai come in. 12:10.300 --> 12:12.540 So, these were the four that came in before the timeline. 12:12.540 --> 12:15.340 So, if we stop right now, this is our launch cutoff, right? 12:15.340 --> 12:17.580 So, these were the teams that came in. 12:17.580 --> 12:27.380 And if we look at closest to the bullseye, you can see that Poland Candidate Space just beat out Flux Repeat Rocket with the most accurate solution during our window. 12:27.380 --> 12:31.680 And this is the payload that's being run on an actual satellite right now. 12:31.680 --> 12:36.680 So, we're looking forward to getting the results back from that tonight as it runs. 12:36.680 --> 12:40.300 And then tomorrow during the live event, we're going to show you hopefully the moonshot. 12:40.300 --> 12:42.360 Find out how accurate it was. 12:42.420 --> 12:49.660 And of course, we're going to continue the run here because as I mentioned earlier, we know there was that sort of like sudden death for the last two slots, right? 12:49.660 --> 12:52.960 And we could see the teams that were... two more slots that were available. 12:53.080 --> 12:54.440 And so, after that 7 p.m. 12:54.480 --> 12:57.520 cutoff, we had a quick 1550 tree that was able to make it in. 12:57.520 --> 13:00.660 But we also noticed that Poland Candidate really got in close. 13:00.660 --> 13:02.620 And so, they got a really, really nice solution. 13:02.620 --> 13:03.660 They kept iterating on it. 13:03.660 --> 13:04.560 There was no points for it. 13:04.560 --> 13:07.980 There was no extra... it was not considered for the on-orbit. 13:08.200 --> 13:15.520 But it was so good that the individuals we had evaluating all of the solutions, they had a lot of automation. 13:15.520 --> 13:17.460 But there was also, I guess, a little bit of an art to it. 13:17.460 --> 13:23.140 They were explaining that they thought that final Poland Candidate was so beautiful that it was like a piece of art. 13:23.140 --> 13:25.540 They loved that final solution. 13:25.860 --> 13:33.320 And then of course, we had our last solve here coming in that's going to be from PFS, which we've already revealed. 13:33.320 --> 13:46.620 They were the last team to make it into the qualifying minimal acceptable range, which unfortunately left our two other teams, which were Solarwine and 1064 Seabread, not in the running for that. 13:46.620 --> 13:58.400 So, first of all, congrats to Team Poland Candidate into space for submitting not only the best solution overall throughout the whole evaluation period, but the solution that is going to space. 13:58.400 --> 14:00.320 Let's see their team bio again. 14:33.140 --> 14:39.140 And into space, I can confirm that your commands were uplinked to our comms in our comms window earlier today. 14:39.160 --> 14:46.060 We expect the moonshot to happen in a couple of hours at 630 Pacific, and that picture will be sent down to earth at about 1am Pacific. 14:46.060 --> 14:50.460 We will review what is hopefully a clear moonshot picture at tomorrow's closing ceremonies. 14:50.460 --> 14:53.080 It all depends on how accurate your command really was. 14:53.080 --> 14:54.100 Fingers crossed. 14:54.440 --> 14:59.040 You'd think that just watching instead of playing would be less stressful, and I'm sure it was worse for our competitors. 14:59.060 --> 15:04.480 But even in the production room, we were cheering and sweating along with our teams as they worked their way through these challenges. 15:04.600 --> 15:07.440 Thanks very much for joining us throughout this event. 15:08.000 --> 15:09.720 That's it for today's recap. 15:09.720 --> 15:19.360 Make sure you tune in to HackASAC closing ceremonies tomorrow at 11 Pacific, where we will hopefully reveal the world's first CTF moonshot taken by Poland Candid to space. 15:19.360 --> 15:26.200 We'll also show you the overall contest results and award the prizes to our teams and reveal what happened after the scoreboard went dark. 15:26.200 --> 15:28.040 We'll also hear closing remarks by Dr. 15:28.040 --> 15:29.020 Will Roper from the U.S. 15:29.020 --> 15:31.520 Space Force and Air Force Acquisition Chief. 15:31.640 --> 15:36.380 Be sure to also check out all the great happenings going on at DEFCON and in the Aerospace Village. 15:36.380 --> 15:39.220 See you tomorrow at 11 Pacific for the closing ceremonies.