1 00:00:48,140 --> 00:00:54,160 Welcome to Space Security Challenge 2020, HackASAT, the final event. 2 00:00:54,160 --> 00:01:03,160 As the democratization of space opens up a new frontier for exploration and innovation, we see new cybersecurity vulnerabilities emerging. 3 00:01:04,080 --> 00:01:14,080 The Space Security Challenge is designed to inspire the world's top cybersecurity talent to develop the skills necessary to secure this last frontier of cybersecurity. 4 00:01:14,080 --> 00:01:15,460 Space. 5 00:01:15,560 --> 00:01:18,840 And already we've made a ton of progress. 6 00:01:18,840 --> 00:01:20,280 I'll catch you up. 7 00:01:20,440 --> 00:01:29,960 This spring we hosted over 2,000 teams who worked their way through a set of foundational space cybersecurity challenges in our HackASAT qualification round. 8 00:01:29,960 --> 00:01:34,340 Now, eight finalist teams are stepping up to the ultimate challenge. 9 00:01:34,660 --> 00:01:37,440 They are hacking a satellite. 10 00:01:44,180 --> 00:01:49,820 Welcome to the Saturday daily recap of Space Security Challenge 2020, or HackASAT. 11 00:01:50,420 --> 00:01:59,720 For the second to last time, I'm your host, Jordan Wines, and it's time to fill you in on how our competitors did on day two of this first-of-its-kind satellite hacking competition. 12 00:01:59,840 --> 00:02:03,140 Okay, let's get right to the moment everyone's been waiting for. 13 00:02:03,140 --> 00:02:08,040 Here is our video to show which team was selected for the on-orbit challenge. 14 00:02:09,620 --> 00:02:12,040 Oh, I'm sorry. 15 00:02:12,420 --> 00:02:16,360 Actually, it appears that we're experiencing some technical difficulties. 16 00:02:16,800 --> 00:02:22,160 Yeah, I guess that means you're going to have to listen to the rest of this update, and then we'll play the big reveal at the end instead. 17 00:02:22,440 --> 00:02:25,140 So let's take a look back at today's action. 18 00:02:32,100 --> 00:02:36,460 In fact, let's go ahead and take a look at the scoreboard now in our live octagon feed. 19 00:02:37,260 --> 00:02:39,400 And they definitely haven't slowed down. 20 00:02:39,400 --> 00:02:43,300 You'll notice that SolarWine actually scored first blood on Challenge 3. 21 00:02:43,300 --> 00:02:46,100 Congratulations to them for the great work overnight. 22 00:02:46,100 --> 00:02:52,840 You can also see FluxRepeatRocket scoring just before this broadcast with only a 5% reduction in total points. 23 00:02:52,840 --> 00:02:57,380 That means SolarWine and FluxRepeatRocket are both moving on to Challenge 4. 24 00:02:57,380 --> 00:03:01,720 While the score hasn't changed, we have had one important game milestone pass us by. 25 00:03:01,720 --> 00:03:04,080 We timed out unavailable points for Challenge 3. 26 00:03:04,080 --> 00:03:13,660 That means those two teams, SolarWine and FluxRepeatRocket, they've obtained points for that challenge and all other teams were given a solution script so they can focus on the next challenge. 27 00:03:19,020 --> 00:03:23,600 If you've been following along at home, you know that we sprung our on-orbit challenge on our teams yesterday. 28 00:03:23,600 --> 00:03:26,380 We had four teams submit their solutions by 4 p.m. 29 00:03:26,380 --> 00:03:34,900 Pacific, our deadline for evaluation for on-orbit, but only one was selected to have their code sent to the live satellite to capture a moonshot. 30 00:03:34,900 --> 00:03:38,020 We will learn who that lucky team is later on in the broadcast. 31 00:03:39,140 --> 00:03:45,820 While today's action started strong with several early scores, teams really struggled their way through Challenge 4 today. 32 00:03:45,820 --> 00:03:51,100 While the organizers knew it would be the hardest challenge, the hope was that it would be solved before this point. 33 00:03:51,100 --> 00:04:00,600 In fact, in the last hour of the competitions, some teams had run so low on power that the organizers offered to take the flatsats offline so they could plug them into power. 34 00:04:00,600 --> 00:04:09,820 This would mean teams would have challenges in solving Challenge 5, but hopefully it would give them enough power and time to solve Challenge 4 in the last few minutes. 35 00:04:10,000 --> 00:04:15,120 Given that, here is our explanation for the Challenge 4 solution. 36 00:04:16,180 --> 00:04:17,760 Challenge 4. 37 00:04:18,440 --> 00:04:19,900 Here's what we know. 38 00:04:19,900 --> 00:04:24,160 We've restored communication with the payload module, but we still can't operate it. 39 00:04:24,160 --> 00:04:25,260 The challenge? 40 00:04:25,260 --> 00:04:30,100 Now teams must restore normal operations of the payload module so we can access the imager. 41 00:04:30,280 --> 00:04:31,880 Here's how they do it. 42 00:04:31,880 --> 00:04:38,080 Teams discover that the payload module bootloader has been corrupted, which is why the payload module is not operating normally. 43 00:04:38,080 --> 00:04:49,360 The teams discover a system console to the payload module and the ability to access the payload module system console by controlling an undocumented GPIO and multiplexer on the CNDH board. 44 00:04:49,360 --> 00:04:56,580 The teams must write a custom flight software application that can control the GPIO and enable access to the payload system console. 45 00:04:56,580 --> 00:05:01,420 After writing the application, the teams must upload it to the CNDH and execute it. 46 00:05:01,420 --> 00:05:06,360 Once the teams have access to the system console, they will identify that it has been corrupted. 47 00:05:06,680 --> 00:05:14,620 The teams will need to research nominal Qubose bootloader configuration and repair the payload module's bootloader to resume proper operation of the payload module. 48 00:05:20,140 --> 00:05:25,240 As I mentioned during a previous update, there was always a chance that the scoreboard was going to go dark. 49 00:05:25,240 --> 00:05:33,920 And sure enough, with 30 minutes left in the competition, as teams were hopefully nearing in on a Challenge 4 solution, the organizers decided to keep us all in suspense. 50 00:05:33,920 --> 00:05:38,160 Here's a look at our final scoreboard that everyone saw before it went dark. 51 00:05:39,680 --> 00:05:45,380 As we can tell, we had a couple of solves later on, but early was where most of the action happened. 52 00:05:45,380 --> 00:05:52,560 However, with our accepted and rejected on-orbit status, we knew that there were two teams who would not be eligible for final prizes. 53 00:05:52,680 --> 00:05:57,480 We will make the final actual scores available tomorrow during the closing ceremony. 54 00:05:57,480 --> 00:06:06,620 Before you make your predictions on our podium winners, let's take a look at the final Challenge 5 to see what it was teams would have had to solve after they finished Challenge 4. 55 00:06:07,920 --> 00:06:11,540 Challenge 5 Here's what we know. 56 00:06:11,540 --> 00:06:15,540 We've done our best work, and it seems that we've regained control of the satellite. 57 00:06:15,720 --> 00:06:17,480 But how do we know for sure? 58 00:06:17,860 --> 00:06:19,040 The challenge? 59 00:06:19,040 --> 00:06:24,460 Teams must prove that we are fully in control of the satellite system by successfully imaging the moon. 60 00:06:34,230 --> 00:06:38,770 I thought I could have solved some of these challenges, and the answer was almost certainly not. 61 00:06:38,770 --> 00:06:42,630 I've got a lot of respect for the teams out there who made progress at all through this event. 62 00:06:42,630 --> 00:06:49,490 With a very difficult environment, very different to what many other CTFs have to do, there's a lot of extra constraints you have to worry about. 63 00:06:49,570 --> 00:06:56,890 For more information on that, let's do one last Q&A session with Jason Latimer to talk about how teams were approaching Challenge 4. 64 00:06:56,970 --> 00:06:58,110 Let's see if we can get him in here. 65 00:06:58,110 --> 00:06:59,770 Jason, do you hear me? 66 00:07:00,430 --> 00:07:01,390 Yeah, I got you. 67 00:07:01,390 --> 00:07:02,770 Excellent, and I hear you as well. 68 00:07:02,890 --> 00:07:03,530 Great. 69 00:07:03,530 --> 00:07:05,910 So, we're wrapped up. 70 00:07:05,910 --> 00:07:07,150 The game is over. 71 00:07:07,150 --> 00:07:15,510 I hopped into a couple of your calls, and I was listening to you guys describe some of the approaches teams were taking on Challenge 4. 72 00:07:15,670 --> 00:07:17,610 I thought there were some really, really interesting things that came out of that. 73 00:07:17,610 --> 00:07:19,890 I'd love to hear a little bit more from your perspective. 74 00:07:20,470 --> 00:07:33,870 Yeah, so the background on Challenge 4 was that the teams had gotten past the implant that the adversary had put on the satellite, and that they were trying to use the payload, and quickly found that the payload wasn't functional. 75 00:07:35,050 --> 00:07:42,290 So, what the adversary had done was corrupted the bootloader, and so they had to uncorrupt the bootloader. 76 00:07:42,530 --> 00:07:44,470 There were a number of approaches. 77 00:07:44,670 --> 00:07:56,630 Teams seemed to be struggling in the beginning, so at one point we gave a hint that said, hey, you need to write an application that's capable of communicating with the system console and enabling that system console via GPIO. 78 00:07:56,630 --> 00:08:01,830 Very quickly, teams started uploading their custom CFS applications. 79 00:08:01,970 --> 00:08:12,270 Some teams were just trying to enable the GPIO to control the system console based on other GPIOs that were already on the system, and they had done that successfully. 80 00:08:12,270 --> 00:08:20,350 And then we had some unique approaches where teams were trying to upload applications that could do TFTP transfers to the device. 81 00:08:20,350 --> 00:08:24,230 So, we had a number of different approaches to Challenge. 82 00:08:24,230 --> 00:08:34,930 So, the application that they're compiling, was this just a standard compiler they could use, or what sort of information about that environment did they have to have to build these custom applications? 83 00:08:35,450 --> 00:08:38,190 Yeah, so it's actually a little bit more complicated than that. 84 00:08:38,190 --> 00:08:49,090 We didn't want that to be the challenge behind the whole restoring the bootloader, so we actually did provide to the teams ahead of time the RTEMs build environment they would need to build an application. 85 00:08:49,090 --> 00:08:59,790 And then we provided also a set of example applications that they could use as a template for creating this application that would restore the bootloader on the payload. 86 00:08:59,970 --> 00:09:04,670 There were still quite a bit of challenges there because there were specific peripherals that they'd have to be able to control. 87 00:09:04,670 --> 00:09:13,810 So, talking to specific UART and GPIO drivers to do that, so it was non-trivial. 88 00:09:13,990 --> 00:09:15,710 Yeah, what did your solution look like? 89 00:09:15,710 --> 00:09:20,090 Did it rebuild it or how did your intended solution work on that? 90 00:09:20,190 --> 00:09:28,410 So, we had a custom application that ran in CFS that could talk to the Raspberry Pi system console over the UART. 91 00:09:28,410 --> 00:09:31,750 So, it was literally like talking to this system console. 92 00:09:31,750 --> 00:09:36,370 We would send a command and we could do an LS on the shell or whatever it was. 93 00:09:36,370 --> 00:09:42,630 And through that, we could restore the bootloader via just typical system console commands. 94 00:09:42,630 --> 00:09:47,690 But in order to actually enable that UART, we had a GPIO that was hidden. 95 00:09:47,930 --> 00:09:57,190 So, one of the challenges for Challenge 4 was actually looking through the FPGA Verilog and VHDL code and finding that that actually existed. 96 00:09:57,190 --> 00:10:05,150 So, we had gotten some feedback during quals that teams were really interested in doing that kind of documentation reverse engineering. 97 00:10:05,150 --> 00:10:08,330 So, we went to a lot of effort to make sure that that existed. 98 00:10:08,330 --> 00:10:15,210 So, to even identify that that was there, they were doing code inspections of the VHDL and the Verilog for the FPGA. 99 00:10:15,270 --> 00:10:21,270 Now, I heard hints that at least one team was doing something creative with direct memory writes. 100 00:10:21,270 --> 00:10:23,110 What do we know about that? 101 00:10:24,310 --> 00:10:37,610 All we know about that, well, teams were doing uploads of applications, but it looked like some teams were using the direct memory writes to actually interact with that shell, the Raspberry Pi shell. 102 00:10:37,610 --> 00:10:42,010 So, a little different than our approach, but yeah, it was interesting. 103 00:10:42,330 --> 00:10:44,610 If it gets your code running, it gets it working, right? 104 00:10:44,610 --> 00:10:48,070 There's no points for the jankiness or the cleverness. 105 00:10:48,070 --> 00:10:49,830 It's just, does it solve the challenge, right? 106 00:10:49,830 --> 00:11:03,430 So, one of the things that I just mentioned to people, of course, was the power constraints and how many of the satellites were running low on power at the end from a lot of movement throughout the day and a lot of usage and the sort of option they had to get connected to a ground power. 107 00:11:03,730 --> 00:11:05,890 Tell me how that changed the sort of Challenge 5 requirements. 108 00:11:05,890 --> 00:11:14,710 And if a team was able to solve a Challenge 4 after the SCOBR went dark, would they have been able to do it from the ground or was that completely impossible or what happened there? 109 00:11:15,550 --> 00:11:30,130 Yeah, so we talked with the organizers and based on the fact that we had these power constraints and that the teams that had elected to be put on the ground wouldn't be able to get a picture of the moon, we adjusted the criteria for Challenge 5 to just be get a picture. 110 00:11:30,130 --> 00:11:39,290 It was interesting to see what the different teams were doing as far as power. 111 00:11:39,630 --> 00:11:43,850 Some teams had conserved their power throughout the day and other teams had not. 112 00:11:43,850 --> 00:11:50,270 So, we had some teams that were in the running to solve Challenge 4 that said, hey, we don't want to be put on the ground. 113 00:11:50,270 --> 00:11:51,330 We'll just stay on the carousel. 114 00:11:51,710 --> 00:11:53,610 We've been good with the batteries all day. 115 00:11:53,710 --> 00:11:57,950 And we actually mentioned that in an earlier update here that power was potentially a concern. 116 00:11:57,950 --> 00:12:00,410 And it was nice that teams weren't entirely out of the running. 117 00:12:00,410 --> 00:12:06,270 There was sort of a backup mechanism, but it cost them time while their flat set was taken down, was rewired in. 118 00:12:06,270 --> 00:12:10,810 And so, that was sort of a penalty for exercising that option, although they weren't kind of out of the running entirely. 119 00:12:10,810 --> 00:12:12,470 That works out great. 120 00:12:12,630 --> 00:12:17,810 All right, well, thank you very much for taking time to talk to us and we'll continue on with the rest of our update. 121 00:12:18,350 --> 00:12:19,290 Thank you. 122 00:12:20,510 --> 00:12:24,830 All right, now the moment that you hopefully have actually been waiting for. 123 00:12:24,830 --> 00:12:29,650 We're going to answer the question as to which team had their code sent into space tonight. 124 00:12:30,430 --> 00:12:35,130 So, the video that we're going to look at here is the same one that I previewed earlier. 125 00:12:35,130 --> 00:12:39,430 So, we can see Poland Can is the very first team to get an acceptable payload. 126 00:12:39,430 --> 00:12:42,830 We knew that from watching the scoreboard and got reasonably close. 127 00:12:42,970 --> 00:12:45,010 Next coming in are going to be several other teams. 128 00:12:45,010 --> 00:12:48,650 ADD Vulcan, number two, and then number three, Flux Repeat Rocket. 129 00:12:48,650 --> 00:12:53,650 So, we've got the three quickest ones and then we're going to have right here a Samurai come in. 130 00:12:53,650 --> 00:12:55,910 So, these were the four that came in before the timeline. 131 00:12:55,910 --> 00:12:58,690 So, if we stop right now, this is our launch cutoff, right? 132 00:12:58,690 --> 00:13:00,930 So, these were the teams that came in. 133 00:13:00,930 --> 00:13:10,730 And if we look at closest to the bullseye, you can see that Poland Candidate Space just beat out Flux Repeat Rocket with the most accurate solution during our window. 134 00:13:10,730 --> 00:13:15,030 And this is the payload that's being run on an actual satellite right now. 135 00:13:15,030 --> 00:13:20,010 So, we're looking forward to getting the results back from that tonight as it runs. 136 00:13:20,010 --> 00:13:23,690 And then tomorrow during the live event, we're going to show you, hopefully, the moonshot. 137 00:13:23,690 --> 00:13:25,710 We'll find out how accurate it was. 138 00:13:25,810 --> 00:13:33,030 And, of course, we're going to continue the run here because, as I mentioned earlier, we know there was that sort of like sudden death for the last two slots, right? 139 00:13:33,030 --> 00:13:36,290 And we could see the teams that were two more slots that were available. 140 00:13:36,450 --> 00:13:37,790 And so, after that 7 p.m. 141 00:13:37,830 --> 00:13:40,870 cutoff, we had a quick 1550 tree that was able to make it in. 142 00:13:40,870 --> 00:13:44,010 But we also noticed that Poland Candidate really got in close. 143 00:13:44,010 --> 00:13:45,970 And so, they got a really, really nice solution. 144 00:13:45,970 --> 00:13:47,010 They kept iterating on it. 145 00:13:47,010 --> 00:13:47,910 There was no points for it. 146 00:13:47,910 --> 00:13:51,310 It was not considered for the on-orbit. 147 00:13:51,570 --> 00:13:58,850 But it was so good that the individuals we had evaluating all of the solutions, they had a lot of automation. 148 00:13:58,850 --> 00:14:00,790 But there was also, I guess, a little bit of an art to it. 149 00:14:00,790 --> 00:14:06,490 They were explaining that they thought that final Poland Candidate was so beautiful that it was like a piece of art. 150 00:14:06,490 --> 00:14:08,890 They loved that final solution. 151 00:14:09,210 --> 00:14:16,710 And then, of course, we had our last solve here coming in that's going to be from PFS, which we've already revealed. 152 00:14:16,710 --> 00:14:29,990 They were the last team to make it into the qualifying minimal acceptable range, which unfortunately left our two other teams, which were SolarWind and 1064 Seabred, not in the running for that. 153 00:14:30,030 --> 00:14:41,790 So, first of all, congrats to Team Poland Candidate for submitting not only the best solution overall throughout the whole evaluation period, but the solution that is going to space. 154 00:14:41,790 --> 00:14:43,930 Let's see their team bio again. 155 00:15:16,190 --> 00:15:22,510 And into space, I can confirm that your commands were uplinked in our comms window earlier today. 156 00:15:22,530 --> 00:15:28,810 We expect the moonshot to happen in a couple of hours at 630 Pacific, and that picture will be sent down to Earth at about 1 a.m. 157 00:15:28,810 --> 00:15:29,490 Pacific. 158 00:15:29,490 --> 00:15:33,850 We will reveal what is hopefully a clear moonshot picture at tomorrow's closing ceremonies. 159 00:15:33,850 --> 00:15:36,450 It all depends on how accurate your command really was. 160 00:15:36,450 --> 00:15:37,490 Fingers crossed. 161 00:15:37,790 --> 00:15:42,410 You'd think that just watching instead of playing would be less stressful, and I'm sure it was worse for our competitors. 162 00:15:42,410 --> 00:15:47,850 But even in the production room, we were cheering and sweating along with our teams as they worked their way through these challenges. 163 00:15:48,010 --> 00:15:50,550 Thanks very much for joining us throughout this event. 164 00:15:51,390 --> 00:15:53,110 That's it for today's recap. 165 00:15:53,110 --> 00:16:02,730 Make sure you tune in to Hackensack Closing Ceremonies tomorrow at 11 Pacific, where we will hopefully reveal the world's first CTF moonshot taken by Poland Candid to space. 166 00:16:02,730 --> 00:16:09,550 We'll also show you the overall contest results and award the prizes to our teams and reveal what happened after the scoreboard went dark. 167 00:16:09,550 --> 00:16:11,430 We'll also hear closing remarks by Dr. 168 00:16:11,430 --> 00:16:12,430 Will Roper from the U.S. 169 00:16:12,430 --> 00:16:14,870 Space Force and Air Force Acquisition Chief. 170 00:16:14,990 --> 00:16:19,730 Be sure to also check out all the great happenings going on at DEFCON and in the Aerospace Village. 171 00:16:19,790 --> 00:16:22,570 See you tomorrow at 11 Pacific for the closing ceremonies.