1 00:00:11,930 --> 00:00:18,690 Welcome back to Space Security Challenge 2020, or Mathesat, as one of our competitors fondly called it. 2 00:00:18,690 --> 00:00:20,750 At least, we hope it was fondly. 3 00:00:20,750 --> 00:00:23,230 Anyway, I'm your host, Jordan Wines. 4 00:00:23,490 --> 00:00:28,490 It's been a quiet few hours since our last update, with, I think, no changes on the scoreboard. 5 00:00:28,490 --> 00:00:33,190 However, the teams have surprised us in the past, scoring in the middle of updates. 6 00:00:33,190 --> 00:00:36,530 So let's actually take a quick look at the scoreboard now to confirm that. 7 00:00:37,030 --> 00:00:41,950 If we look at the octagon, it does indeed look like our teams are scoring the same. 8 00:00:41,950 --> 00:00:46,850 Our last two solves with SolarWine and FluxRepeatRocket in Challenge 3. 9 00:00:46,850 --> 00:00:50,790 So we're still looking at Challenge 4 and 5 for the rest of the day. 10 00:00:51,150 --> 00:00:55,710 While the score hasn't changed, we have had one important game milestone pass us by. 11 00:00:55,710 --> 00:00:58,110 We timed out unavailable points for Challenge 3. 12 00:00:58,110 --> 00:01:07,690 That means those two teams, SolarWine and FluxRepeatRocket, they've obtained points for that challenge, and all other teams were given a solution script so they can focus on the next challenge. 13 00:01:07,690 --> 00:01:16,150 But before we move on to our explainer video for Challenge 3, we actually missed getting you the full explanation for Challenge 2 during our last update, so let's start with that. 14 00:01:17,350 --> 00:01:18,910 Challenge 2. 15 00:01:20,850 --> 00:01:27,690 The satellite is spinning out of control because the Attitude Determination and Control System, ADCS, has been manipulated. 16 00:01:27,790 --> 00:01:29,970 We suspect sabotage. 17 00:01:29,970 --> 00:01:31,110 The challenge? 18 00:01:31,110 --> 00:01:36,330 Teams must repair the ADCS system as quickly as possible to stop the dangerous spinning. 19 00:01:36,410 --> 00:01:37,750 Here's how they do it. 20 00:01:37,750 --> 00:01:43,010 Teams may first search the provided documentation for the appropriate command to reset the ADCS. 21 00:01:43,010 --> 00:01:45,030 They find it and execute it. 22 00:01:45,030 --> 00:01:46,930 But the reset does not work. 23 00:01:46,930 --> 00:01:51,850 The ADCS system begins communicating again, but it is not functioning properly. 24 00:01:51,950 --> 00:01:57,270 Teams discover that the ADCS configuration tables have been altered and must be restored. 25 00:01:57,270 --> 00:02:02,650 They have to the nominal parameters for the configuration tables from the provided user documentation. 26 00:02:02,730 --> 00:02:07,730 The teams then have to upload a new table to the vehicle and command the ADCS to load the table. 27 00:02:07,830 --> 00:02:11,450 This is how they will restore nominal operation of the ADCS. 28 00:02:11,570 --> 00:02:12,770 Good news! 29 00:02:12,770 --> 00:02:21,670 With the ADCS configuration table updated, they receive nominal status from the ADCS, but the majority of the ADCS commands still don't work. 30 00:02:21,730 --> 00:02:33,310 Teams realize that they can point the satellite by uploading various ADCS configuration tables, each with different pointing modes and configuration parameters, and loading them at different points in the orbit of the satellite. 31 00:02:33,650 --> 00:02:40,070 This allows the teams to stop the spin of the vehicle and point the solar arrays at the sun to charge the batteries. 32 00:02:44,350 --> 00:02:49,270 All right, now that we're caught up, here's a little bit more about the intended solution to Challenge 3. 33 00:02:50,510 --> 00:02:51,930 Challenge 3. 34 00:02:53,270 --> 00:02:54,450 Here's what we know. 35 00:02:54,450 --> 00:03:02,750 With the update to the ADCS, the teams have regained control of the satellite, but we still can't communicate with the payload module or operate the imager. 36 00:03:02,810 --> 00:03:07,370 In addition, the majority of useful commands are not being accepted by the flight software. 37 00:03:07,370 --> 00:03:10,910 We have to ask ourselves, what else did they damage on this satellite? 38 00:03:11,090 --> 00:03:12,050 The challenge? 39 00:03:12,050 --> 00:03:16,670 Teams must restore communication with the payload module so we can get it working again. 40 00:03:17,010 --> 00:03:18,450 Here's how they do it. 41 00:03:18,450 --> 00:03:24,210 The teams find that their initial commands to communicate with the payload module are not being accepted by the flight software. 42 00:03:24,330 --> 00:03:29,710 It's clear that the command and data handling C and DH system is not working appropriately. 43 00:03:29,710 --> 00:03:36,230 In fact, payload commands and the majority of the other commands have been disabled in the C and DH system. 44 00:03:36,330 --> 00:03:43,870 It turns out the attacker has modified the C and DH flight software and are now running their own code on board the space vehicle. 45 00:03:44,230 --> 00:03:52,210 The attacker code is rejecting the majority of commands to the satellite, including firmware updates, firmware restore, and ADCS commands. 46 00:03:52,210 --> 00:03:58,090 As a result, it is not possible to restore the failsafe image as the restore command has been disabled. 47 00:03:58,530 --> 00:04:05,070 Lucky for the teams, the attacker was sloppy and inadvertently introduced a vulnerability in the new firmware image. 48 00:04:05,170 --> 00:04:12,710 Teams exploit this vulnerability and use it to repair the system and restore the C and DH software back to normal operation. 49 00:04:12,870 --> 00:04:17,450 Once that is complete, they are able to communicate with the payload module once again. 50 00:04:21,620 --> 00:04:28,380 Challenge 3 happens to be my personal favorite as it, along with challenge 0, are probably the most similar to regular CTF challenges. 51 00:04:28,380 --> 00:04:29,800 I always love a good pwnable. 52 00:04:30,160 --> 00:04:36,080 Since we have some time in this update, I want to introduce a new graphic to you that we call the Race to Space. 53 00:04:36,400 --> 00:04:41,820 This will be a visualization we'll be using later on today to measure the team's on-orbit submissions. 54 00:04:41,920 --> 00:04:45,620 The closer to the center of the bullseye, the more accurate the solution. 55 00:04:45,640 --> 00:04:51,000 And of course, the minimum acceptance bar will let us see the solutions that were not accurate enough to be accepted. 56 00:04:51,100 --> 00:04:59,840 Each team gets their own little slice of the pie, and we'll be able to see how many tries it took to become accepted and or how accurate teams got. 57 00:05:00,400 --> 00:05:07,880 You may remember that we have four teams that all submitted accepted solutions before the 4 p.m pacific cutoff yesterday. 58 00:05:07,880 --> 00:05:15,200 They were Poland Cannon to Space ahead of the pack, and then ADD Vulcan, Flux Repeat Rocket, and finally Samurai. 59 00:05:15,300 --> 00:05:26,360 Speaking of ADD Vulcan, we haven't yet had a chance to show off their biography, so let's let's check them out now in recognition of them being the second accepted solution to the on-orbit challenge. 60 00:05:54,360 --> 00:06:01,220 Apparently, the real reason ADD Vulcan is participating in HackASAT was just as an excuse to make pink Starfleet uniforms. 61 00:06:01,380 --> 00:06:04,600 Go check out their Twitter Team Twitter account for more info on that. 62 00:06:04,720 --> 00:06:11,880 Also, one of the main team members, AmyDD, was on the recent TV show Lego Masters and also hosts an awesome STEM for Girls scholarship. 63 00:06:12,380 --> 00:06:14,180 That's it for this competition update. 64 00:06:14,180 --> 00:06:18,800 I'll see you back here in one hour at 11 50 a.m pacific, 2 50 p.m eastern.