WEBVTT 00:05.460 --> 00:11.180 Welcome to Space Security Challenge 2020, HackASAT, the final event. 00:11.180 --> 00:20.100 As the democratization of space opens up a new frontier for exploration and innovation, we see new cybersecurity vulnerabilities emerging. 00:21.020 --> 00:32.740 The Space Security Challenge is designed to inspire the world's top cybersecurity talent to develop the skills necessary to secure this last frontier of cybersecurity, space. 00:32.940 --> 00:35.720 And already we've made a ton of progress. 00:35.720 --> 00:37.240 I'll catch you up. 00:37.280 --> 00:46.880 This spring we hosted over 2,000 teams who worked their way through a set of foundational space cybersecurity challenges in our HackASAT qualification round. 00:46.880 --> 00:51.300 Now, eight finalist teams are stepping up to the ultimate challenge. 00:51.300 --> 00:54.060 They are hacking a satellite. 01:00.640 --> 01:06.220 Welcome to the first of two daily recaps for the Space Security Challenge 2020 or HackASAT. 01:06.220 --> 01:08.660 I'm still your host, Jordan Wines. 01:09.320 --> 01:16.920 As our eight teams have been vying for a share of a $100,000 prize pool, we're going to check in and summarize the status of the day. 01:16.920 --> 01:21.860 Of course, they also received $15,000 just to get here as a finalist. 01:22.020 --> 01:24.200 The competition for that was fierce. 01:24.200 --> 01:29.840 Our finalists beat out over 2,000 other teams made up of over 6,000 other competitors. 01:30.100 --> 01:41.420 Of course, the biggest prize of all might not even be the money or even the friends we made along the way, but the bragging rights for your code to be selected to take an actual photograph of the moon from a satellite in space. 01:41.680 --> 01:50.300 While this event was originally planned to be in person during DEF CON in the aerospace village, the global pandemic has caused us to reimagine the event experience. 01:50.380 --> 01:57.600 The result is an immersive 3D environment where you can stay up to date with the competition while learning all about space security and the event itself. 01:57.600 --> 02:01.740 You can connect with other spectators and even play games and add to our graffiti wall. 02:01.840 --> 02:08.760 So if you aren't already watching this from our immersive 3D environment, check it out at virtual.hackasat.com. 02:09.080 --> 02:16.260 As prior DEF CON attendees, some of you are very familiar with the many flavors of contests that test your hacking skills. 02:16.260 --> 02:19.160 But for others, we realize this is a whole new world. 02:19.160 --> 02:25.800 There are many types of hacking contests and Hackasat falls into the category of Capture the Flag or CTF. 02:28.650 --> 02:33.010 Remember the game you played as a kid with flags hidden in opponent's terrain? 02:33.010 --> 02:37.090 Now imagine the field or code and the flags are secret data. 02:37.090 --> 02:43.470 Players exploit security flaws to capture the flags while at the same time defending their networks from opposing teams. 02:43.470 --> 02:48.670 These Capture the Flag CTF events are as diverse as the teams that play them. 02:48.770 --> 02:53.430 This is a global competitive community with thousands of players and global rankings. 02:53.430 --> 02:58.330 It's been a part of the origin story for a great many prominent security experts. 02:58.350 --> 03:00.790 So what do these hacking games look like? 03:00.790 --> 03:06.530 CTFs can be either in-person or online and usually take place over a weekend or other short period. 03:06.530 --> 03:11.230 They often have a qualification round that determines who gets to participate in the finals. 03:11.230 --> 03:21.650 CTFs are sometimes themed around a specific domain like space for Hackasat, but more commonly they are not specialized and include a wide variety of different types of challenges. 03:21.710 --> 03:31.050 The most common types of CTFs include Jeopardy CTFs, sometimes called Red Team CTFs, are named for their use of the classic game board as a scoreboard. 03:31.050 --> 03:32.690 These are more offensive focused. 03:32.690 --> 03:41.010 Each team is given infrastructure to attack and the number of successful attacks, the difficulty, or the speed at which they succeed is factored into their score. 03:41.010 --> 03:47.850 Attack Defense, A-D, or Full Spectrum CTFs, which are closer to the original game you might have played as a kid. 03:47.850 --> 03:54.510 Each team has a server or set of servers to defend and must attack other teams while also protecting their own infrastructure. 03:54.510 --> 04:02.650 Key of the Hill style CTFs are Full Spectrum CTFs in which teams score points by gaining and maintaining control of individual systems. 04:02.750 --> 04:07.850 And finally, the less common Blue Team Exercises, which are primarily defensive events. 04:07.850 --> 04:14.310 Game organizers host an environment and often a professional team of attackers to test the participants defensive skills. 04:14.310 --> 04:17.190 These are more common in the high school and collegiate level. 04:17.290 --> 04:18.430 How do you win? 04:18.550 --> 04:25.110 Even though the goal of the CTFs are to find and exploit vulnerabilities in computer systems, fair play is essential. 04:25.170 --> 04:30.670 There are lots of ways to win, but to get the respect of your peers, you need to have good technical solutions. 04:30.710 --> 04:37.650 Nobody is impressed if you use a network flood to knock the scoreboard offline, and those kinds of shenanigans will get you shunned quickly. 04:37.650 --> 04:45.280 The best CTF players have built specialized tools, practice within their domains, and include domain experts in many aspects of security. 04:46.290 --> 04:47.330 Why CTF? 04:47.330 --> 04:55.530 At their core, CTF challenges are a way for hackers to build community and demonstrate and hone their skills with other equally skilled people. 04:55.530 --> 05:03.250 Competitions are also a chance to experience the joy of learning about a new programming language or a new piece of technology hackers haven't used before. 05:03.250 --> 05:10.390 Capture the Flag challenges have also been used to help train cybersecurity teams and to get new hackers interested in security research. 05:10.390 --> 05:16.490 Some companies even use competitions similar to CTFs to recruit and vet potential candidates for employment. 05:16.490 --> 05:23.110 And CTFs have had real-world impact, with competitors finding actual security flaws in contest infrastructure. 05:23.110 --> 05:28.690 Their solutions, while not counting towards winning the game, are often implemented in a real-world context. 05:29.090 --> 05:40.450 With HackASAT, we have a CTF game designed to raise awareness about cybersecurity issues in space and help researchers develop specific skills and domain knowledge they'll need to help secure this new frontier. 05:40.770 --> 05:47.670 But as many of the players during our Qualls round found out, there are a lot of problems unique to the environments outside our atmosphere. 05:47.670 --> 05:54.870 To learn more about hacking in space, check out our Space Talk videos that explain some of the most interesting space-specific challenges. 05:56.010 --> 06:04.050 For more on CTFs and other hacking and space-related topics, go to the research room in the virtual environment or check out the related YouTube playlist. 06:04.190 --> 06:07.830 Okay, let's go ahead and recap the whole day so far. 06:13.880 --> 06:24.000 The game has actually been underway for one hour now, and our team's first challenge has been to regain control of the ground station that they'll be using to communicate with their Flatsats. 06:24.000 --> 06:31.720 In fact, just before this broadcast went live, we received word that this challenge was actually solved by Team Samurai. 06:31.960 --> 06:33.400 Congratulations to them! 06:33.400 --> 06:39.880 Right after our last update ended with only a Samurai solve, several other teams came in with solutions for Challenge Zero. 06:40.060 --> 06:44.640 PFS and Solarwine were solvers 2 and 3 on that challenge. 06:44.980 --> 06:51.340 After those two teams scored on Challenge Zero , every other team was eventually able to solve Challenge Zero over the next several hours. 06:51.340 --> 06:55.740 Taking a look at the scoreboard so far, we've had an eventful last hour. 06:55.740 --> 07:00.120 Our teams continue to make progress, with four teams now having solved Challenge One. 07:00.200 --> 07:07.180 Unfortunately, the window of time after first solve has expired, and the remaining four teams were given a solution with no points. 07:07.240 --> 07:15.340 PFS and Colon Can Into Space were joined by 1553 and 1064 Seabred with solutions for Challenge One. 07:15.480 --> 07:25.080 Now, this was going to be where I signed off with this update, but as we were live, PFS actually jumped up on the scoreboard yet again, solving Challenge Two. 07:30.870 --> 07:34.790 You may have noticed that first blood overlay and sound effect in that summary. 07:34.790 --> 07:45.350 While it was originally used in Unreal Tournament to indicate a kill, the phrase and even sometimes the sound effects are often used in CTF competitions to indicate the first team to solve a particular challenge. 07:46.330 --> 08:04.110 The challenges that teams have solved so far include a which required exploiting an insecure web application to steal credentials for the ground station controller, and then using that Cosmos ground station, the teams had to restore communication with their flatsets as they were tumbling and not communicating well. 08:04.270 --> 08:15.070 The Challenge One involved connecting to the ground station, turning up the power, turning down the bandwidth, which is very much a real-world troubleshooting step. 08:15.190 --> 08:23.310 Next, the teams have to restore proper orientation control over their flatset, but only one team so far has managed to accomplish this feat. 08:23.330 --> 08:27.110 That brings us to what's happened in the last two hours of the competition. 08:27.270 --> 08:30.050 Most teams are now working on two or three challenges. 08:30.250 --> 08:33.770 The on-orbit challenge, Challenge Two, and Challenge Three. 08:36.030 --> 08:41.030 PFS has been pulling away to a healthy lead that is going to be hard to catch up to tomorrow. 08:41.050 --> 08:43.470 Hard, but definitely not impossible. 08:43.750 --> 08:50.250 All it takes is for them to get stuck in a problem and be passed in turn, much like they did to Samurai at the start of the game. 08:51.190 --> 09:02.610 It's also interesting to note that PFS, which is actually short for Pwn First Search, and Pulling Can Into Space, are number one and number two on the leaderboard, are two of the smallest teams in the competition. 09:02.970 --> 09:11.770 Having a large team is sometimes an advantage, but it definitely comes with logistical issues, and in this case, where the challenges are serial in nature, it isn't always helpful. 09:12.090 --> 09:15.970 Let's take a look again at the PFS team bio. 09:44.920 --> 09:50.960 If you were here with us live, you might remember that right in the middle of teams working on their challenges at around 12 p.m. 09:50.960 --> 09:56.440 Pacific, all teams had to stop what they were doing and shift focus to the on-orbit challenge. 09:57.400 --> 10:00.620 Stop everything and look up. 10:00.920 --> 10:04.440 Starting now, teams shift to the on-orbit challenge. 10:04.520 --> 10:08.820 Their primary goal is to capture a picture of the moon using this satellite. 10:09.460 --> 10:15.240 Competitors will have access to the two-line element of the vehicle and the camera's foresight vector. 10:15.640 --> 10:22.900 Each team is tasked with creating a mission plan that transitions a satellite from a tumbling state to one where it points the camera at the moon. 10:23.500 --> 10:28.960 The team will reach a successful status once their resulting mission plan meets key criteria. 10:29.340 --> 10:34.580 One , the commands are generated in the correct order and are within the specified period. 10:34.580 --> 10:39.280 Two, the image capture angle of the moon is within specifications. 10:40.080 --> 10:48.420 Three, the team's negative z-axis is pointed as close to the earth's center as possible without affecting the camera to moon pointing error. 10:48.760 --> 10:54.060 The teams are given a command dictionary with the format for submitting the commands and parameters. 10:54.080 --> 10:56.380 The rest is up to them. 10:59.260 --> 11:04.820 Of course, while PFS is currently in the lead, they still have a critical problem to solve. 11:04.900 --> 11:07.300 Specifically, the on-orbit challenge. 11:07.300 --> 11:18.580 While Pullin' Cannon to Space is only nipping at their heels at number two on the scoreboard, they are critically not only the first team with an attempted solution to their on-orbit challenge, but the first with an accepted solution. 11:18.920 --> 11:32.480 That would mean that they would be able to pass PFS if PFS is not able to actually solve because, again, that is a pass-fail challenge and it will be critical to see what happens in the last few minutes of gameplay today as well as tomorrow in the on-orbit challenge. 11:32.760 --> 11:48.360 Now that the day is wrapping up, hopefully some of the organizers have a little bit more time, so we're going to see if we can bring into video chat Vito Genovese, who many of you may recognize from his time as a member of LegitBS, the team that organized the DEF CON CTF for five years prior to the current organizers, 11:48.360 --> 11:49.640 The Order of the Overflow. 11:49.760 --> 11:55.080 Vito is also currently with Chromulence, the creators of the flatsats and many of the challenges in HackASAP. 11:55.140 --> 11:56.420 Vito, can you hear me? 11:56.420 --> 11:57.040 Are you there? 11:57.700 --> 11:58.700 Yes, loud and clear. 11:58.700 --> 11:59.460 Good evening. 11:59.580 --> 12:00.140 Excellent. 12:00.140 --> 12:01.060 Glad we got you. 12:01.060 --> 12:01.820 Thanks for stopping by. 12:01.820 --> 12:06.420 I know you guys have been very, very busy kind of manning the systems and talking to the teams. 12:06.420 --> 12:08.300 How's the game going so far? 12:09.000 --> 12:10.120 It's been going. 12:10.240 --> 12:12.640 We've kind of had some, you know, rough times today. 12:12.640 --> 12:23.900 The flatsats are, you know, small run hardware, which always has issues, but we're super, super thankful the teams are being patient with us and they're putting up a good fight and making really, really good progress in the game. 12:24.100 --> 12:25.980 Is this pacing what you expected? 12:26.000 --> 12:29.720 Sorry, is this pacing what you expected speaking of like how they're kind of doing? 12:29.720 --> 12:33.960 Is this about where you thought they would be or you wanted them to be or how does this fit with your expectations? 12:34.740 --> 12:37.700 It's really hard to set expectations for these games. 12:37.700 --> 12:40.260 A lot of it is, you know, throwing stuff around. 12:40.260 --> 12:43.520 We can't even be in the same room doodling on a whiteboard while we do it. 12:43.700 --> 12:50.180 So, you know, the expectations are not necessarily what's been happening, but we'll survive. 12:50.180 --> 12:54.800 It's a difficult game and, you know, we'll see what happens tomorrow. 12:55.120 --> 13:00.400 And I mean, it does seem like that if they're made good progress up to here, they could have been a lot further behind. 13:00.400 --> 13:04.300 It would be nice to see them maybe a challenge ahead, but this is certainly within reach, right? 13:04.300 --> 13:07.240 Like there's nothing kind of too crazy about what they have remaining. 13:07.380 --> 13:11.260 This could be doable and we know these are good teams that are capable of more, it seems like, right? 13:12.120 --> 13:13.440 Right, yeah, absolutely. 13:13.760 --> 13:20.640 The, you know, challenges zero, challenges one, they're hard challenges and the teams that took time on them, they still took time on them. 13:20.640 --> 13:22.980 They did make progress and they did get through eventually. 13:23.340 --> 13:28.220 It's, you know, admirable work and it's, you know, it's a difficult time for everybody involved. 13:28.580 --> 13:33.440 Now, do you miss actually being in Vegas and going to DEF CON or you actually kind of prefer being remote? 13:33.440 --> 13:34.800 What's your take on that? 13:34.800 --> 13:36.920 Oh, I absolutely miss it. 13:37.180 --> 13:42.580 You know, my favorite restaurant in Vegas, I miss, or my favorite restaurants, plural in Vegas, I miss that. 13:42.580 --> 13:43.960 I miss seeing my friends. 13:43.960 --> 13:54.660 I miss wearing my, you know, special DEF CON shoes, which are behind me on the shelf there, not in frame yet, but, you know, it's better than getting really, really sick, I guess. 13:55.320 --> 13:59.680 Given the alternative, yeah, we're all kind of doing what we can and should there. 13:59.680 --> 14:07.700 In fact, even you were originally supposed to be on stream with me and we just thought for safety reasons that we would do this via Zoom and we'd be able to work it out that way. 14:07.700 --> 14:10.180 So thanks for doing that. 14:10.180 --> 14:17.100 Tell me a little bit more about the rationale behind the scoring algorithm and the game design, this decay and the kind of the grace window. 14:17.100 --> 14:20.740 What design constraints went into that decision? 14:21.500 --> 14:25.840 Okay, so the main design constraint with this is it's a very linear catch-the-flag game. 14:26.800 --> 14:34.840 So what has to happen is we're trying to get teams to take over this or regain control of this, you know, tumbling satellite lost in space. 14:34.940 --> 14:37.300 And that is a complicated operation. 14:37.620 --> 14:45.860 And instead of just having, you know, one single, you know, you get this chunk of points if you win the game, we split it up into different little gates that teams have to pass through. 14:46.060 --> 14:51.520 So, you know, challenge zero or the first gate is getting control of a machine in the ground station. 14:51.680 --> 14:56.060 Challenge one after that is being able to actually talk and receive messages with the satellite. 14:56.200 --> 15:02.120 So we had to split this up in order to keep, you know, make the game actually have points before you get to the end. 15:02.460 --> 15:11.520 And at the same time, in order to make the points actually meaningful, we wanted to make sure there was some time pressure for teams to go quickly and make progress throughout the whole weekend. 15:11.720 --> 15:14.440 So we have this kind of decay system implemented. 15:14.640 --> 15:17.740 So each challenge is worth a fixed number of points at the beginning. 15:17.780 --> 15:22.580 And as soon as the team solves it the first time, the clock starts ticking. 15:22.580 --> 15:28.000 So within that first 30 minutes, anybody else who solves that challenge is also going to get the full points. 15:28.000 --> 15:29.760 For challenge zero, that would be 50 points. 15:29.760 --> 15:33.540 For challenge two or for challenge one, that was 200 points. 15:33.620 --> 15:42.220 Beyond that, after that first 30 minutes, we have another two-hour interval where that point amount starts gradually ticking down towards zero. 15:42.660 --> 15:45.100 Once it's hit zero, we don't award points for it. 15:45.100 --> 15:50.440 And at that point, it also means that we share hints to, you know, nudge teams along to get them to the next phase of the competition. 15:51.060 --> 16:05.720 And that's one of the advantages, I think, is that, you know, a team, if they happen to get stuck on one particular problem in a serial event in particular, there's just not much you can do in fairness to the other teams in terms of, you know, kind of you don't want to give a team a hint just because they're behind because that actually hurts them. 16:05.720 --> 16:11.640 But by having the score drop off at a point which they have to be done or else they're just given a hint, well, then they've lost all the points for it. 16:11.640 --> 16:15.420 And so, it keeps them up with the game while not punishing the teams that do well. 16:15.420 --> 16:17.120 So, that makes a lot of sense. 16:17.120 --> 16:19.940 If you had a favorite challenge, what's the number? 16:19.940 --> 16:24.100 And if it's one we haven't seen yet, like, no spoilers, of course, but what do you like best? 16:24.800 --> 16:31.980 So, it's honestly, for me, it's probably challenge one, which is kind of where the game starts to diverge from a normal Capture the Flag contest. 16:31.980 --> 16:36.940 With Challenge Zero, we had a web app that teams had to, I think, determine a cookie secret in. 16:37.180 --> 16:37.760 And that's very... 16:41.060 --> 16:43.440 Challenge one is where we start to diverge. 16:43.720 --> 16:59.820 That's where we have to, once we've gotten into the ground station and are able to talk to the, you know, satellite control system, Cosmos, that's where teams have to figure out how to turn telemetry on on the satellite because it's not, you know, just another machine on the network with an IP address. 16:59.820 --> 17:09.560 And where teams have to figure out how to tell the satellite's radio to configure itself in a way that it's actually functional for the rest of the game, for sending messages back and forth. 17:09.560 --> 17:18.420 I saw a great quote go over the team communication channel from the organizers that said, these are not like traditional network devices. 17:18.420 --> 17:31.680 And if you think sending, you know, two requests a second, you know, will get you more reliability the way you would in a normal network, that may be counterproductive here, which I thought was a great kind of nod towards the, yeah, there's some different constraints and different concerns that maybe, 17:31.680 --> 17:36.440 you know, are not the folks first instincts are accurate on, given the environment. 17:36.440 --> 17:37.840 So that makes a lot of sense. 17:38.400 --> 17:39.400 Yeah, absolutely. 17:39.400 --> 17:43.300 It's a satellite is in some senses, it is, you know, still a computer. 17:43.520 --> 17:48.680 But the problem is, is it's a computer that costs millions and millions of dollars to, you know, install. 17:48.680 --> 17:50.380 And it costs, you know, billions of... 17:52.220 --> 17:55.260 No, I think we might have lost you a little bit there for some network. 17:56.420 --> 18:01.160 Oh, it costs, you know, millions to, you know, put it in place in the first place. 18:01.160 --> 18:04.680 And it costs billions to send somebody up there to push a button to restart it. 18:05.180 --> 18:08.820 Beyond that, it's, you know, a computer that you only talk to an RF. 18:08.940 --> 18:13.400 And it's moving in a way that whenever you can see it, you can probably talk to it. 18:13.400 --> 18:17.200 But there's a lot of time from any given ground station where you can't see it at all. 18:17.360 --> 18:19.860 And that's a very unique challenge. 18:21.060 --> 18:25.620 Vito, thank you very much for both your work on the game and for taking some time to talk to us tonight. 18:25.620 --> 18:31.880 Look forward to seeing how teams do tomorrow and look forward to talking to some more as we see their progress. 18:32.520 --> 18:33.160 Excellent. 18:33.160 --> 18:33.500 Thanks. 18:33.500 --> 18:34.380 Take care. 18:34.480 --> 18:35.460 Take care. 18:36.180 --> 18:41.620 That's it for this first day of the Space Security Challenge 2020 or HackASet final event. 18:41.620 --> 18:52.220 Overnight, we'll be taking our FlatSats offline so they can get a good rest, aka have their batteries charged, and so the competition organizers can recharge their batteries , aka have a good night's rest. 18:52.220 --> 19:00.060 Of course, in addition to sleep, the teams will need to continue working on some of the components in between game shutdown and game start tomorrow morning at 7 a.m. 19:00.060 --> 19:01.120 Pacific and 10 a.m. 19:01.120 --> 19:01.680 Eastern. 19:01.740 --> 19:06.520 They've actually been given a firmware image that will help them for the upcoming Challenge 3. 19:07.180 --> 19:08.960 Thanks for spending your day with us. 19:08.960 --> 19:14.800 Make sure to check out the rest of what's happening at DEF CON, the Aerospace Village, and our Aerospace Workshops. 19:14.800 --> 19:17.720 And I look forward to seeing you all tomorrow morning at 9 a.m. 19:17.720 --> 19:18.700 Pacific, 12 p.m. 19:18.700 --> 19:20.460 Eastern for our next game update.