Welcome to Space Security Challenge 2020, HackASAT, the final event.
As the democratization of space opens up a new frontier for exploration and innovation,
we see new cybersecurity vulnerabilities emerging.
The Space Security Challenge is designed to inspire the world's top cybersecurity talent
to develop the skills necessary to secure this last frontier of cybersecurity.
Space. And already we've made a ton of progress.
I'll catch you up.
This spring we hosted over 2,000 teams who worked their way through a set of
foundational space cybersecurity challenges in our HackASAT qualification round.
Now, eight finalist teams are stepping up to the ultimate challenge.
They are hacking a satellite.
Welcome to the Saturday daily recap of Space Security Challenge 2020, or HackASAT.
For the second to last time, I'm your host, Jordan Wines,
and it's time to fill you in on how our competitors did on day two
of this first-of-its-kind satellite hacking competition.
Okay, let's get right to the moment everyone's been waiting for.
Here is our video to show which team was selected for the on-orbit challenge.
Oh, I'm sorry.
Actually, it appears that we're experiencing some technical difficulties.
Yeah, I guess that means you're going to have to listen to the rest of this update,
and then we'll play the big reveal at the end instead.
So let's take a look back at today's action.
In fact, let's go ahead and take a look at the scoreboard now in our live octagon feed.
And they definitely haven't slowed down.
You'll notice that SolarWine actually scored first blood on Challenge 3.
Congratulations to them for the great work overnight.
You can also see FluxRepeatRocket scoring just before this broadcast with only a 5% reduction in total points.
That means SolarWine and FluxRepeatRocket are both moving on to Challenge 4.
While the score hasn't changed, we have had one important game milestone pass us by.
We timed out unavailable points for Challenge 3.
That means those two teams, SolarWine and FluxRepeatRocket,
they've obtained points for that challenge and all other teams were given a solution script so they can focus on the next challenge.
If you've been following along at home, you know that we sprung our on-orbit challenge on our teams yesterday.
We had four teams submit their solutions by 4 p.m. Pacific, our deadline for evaluation for on-orbit,
but only one was selected to have their code sent to the live satellite to capture a moonshot.
We will learn who that lucky team is later on in the broadcast.
While today's action started strong with several early scores, teams really struggled their way through Challenge 4 today.
While the organizers knew it would be the hardest challenge, the hope was that it would be solved before this point.
In fact, in the last hour of the competitions, some teams had run so low on power
that the organizers offered to take the flatsats offline so they could plug them into power.
This would mean teams would have challenges in solving Challenge 5,
but hopefully it would give them enough power and time to solve Challenge 4 in the last few minutes.
Given that, here is our explanation for the Challenge 4 solution.
Challenge 4.
Here's what we know.
We've restored communication with the payload module, but we still can't operate it.
The challenge? Now teams must restore normal operations of the payload module so we can access the imager.
Here's how they do it.
Teams discover that the payload module bootloader has been corrupted, which is why the payload module is not operating normally.
The teams discover a system console to the payload module and the ability to access the payload module system console
by controlling an undocumented GPIO and multiplexer on the CNDH board.
The teams must write a custom flight software application that can control the GPIO and enable access to the payload system console.
After writing the application, the teams must upload it to the CNDH and execute it.
Once the teams have access to the system console, they will identify that it has been corrupted.
The teams will need to research nominal Qubose bootloader configuration and repair the payload module's bootloader to resume proper operation of the payload module.
As I mentioned during a previous update, there was always a chance that the scoreboard was going to go dark.
And sure enough, with 30 minutes left in the competition, as teams were hopefully nearing in on a Challenge 4 solution,
the organizers decided to keep us all in suspense.
Here's a look at our final scoreboard that everyone saw before it went dark.
As we can tell, we had a couple of solves later on, but early was where most of the action happened.
However, with our accepted and rejected on-orbit status, we knew that there were two teams who would not be eligible for final prizes.
We will make the final actual scores available tomorrow during the closing ceremony.
Before you make your predictions on our podium winners, let's take a look at the final Challenge 5 to see what it was teams would have had to solve after they finished Challenge 4.
Challenge 5
Here's what we know. We've done our best work, and it seems that we've regained control of the satellite.
But how do we know for sure?
The challenge? Teams must prove that we are fully in control of the satellite system by successfully imaging the moon.
I thought I could have solved some of these challenges, and the answer was almost certainly not.
I've got a lot of respect for the teams out there who made progress at all through this event.
With a very difficult environment, very different to what many other CTFs have to do, there's a lot of extra constraints you have to worry about.
For more information on that, let's do one last Q&A session with Jason Latimer to talk about how teams were approaching Challenge 4.
Let's see if we can get him in here. Jason, do you hear me?
Yeah, I got you.
Excellent, and I hear you as well. Great. So, we're wrapped up. The game is over.
I hopped into a couple of your calls, and I was listening to you guys describe some of the approaches teams were taking on Challenge 4.
I thought there were some really, really interesting things that came out of that. I'd love to hear a little bit more from your perspective.
Yeah, so the background on Challenge 4 was that the teams had gotten past the implant that the adversary had put on the satellite,
and that they were trying to use the payload, and quickly found that the payload wasn't functional.
So, what the adversary had done was corrupted the bootloader, and so they had to uncorrupt the bootloader.
There were a number of approaches. Teams seemed to be struggling in the beginning, so at one point we gave a hint that said,
hey, you need to write an application that's capable of communicating with the system console and enabling that system console via GPIO.
Very quickly, teams started uploading their custom CFS applications.
Some teams were just trying to enable the GPIO to control the system console based on other GPIOs that were already on the system,
and they had done that successfully.
And then we had some unique approaches where teams were trying to upload applications that could do TFTP transfers to the device.
So, we had a number of different approaches to Challenge.
So, the application that they're compiling, was this just a standard compiler they could use,
or what sort of information about that environment did they have to have to build these custom applications?
Yeah, so it's actually a little bit more complicated than that.
We didn't want that to be the challenge behind the whole restoring the bootloader,
so we actually did provide to the teams ahead of time the RTEMs build environment they would need to build an application.
And then we provided also a set of example applications that they could use as a template for creating this application
that would restore the bootloader on the payload.
There were still quite a bit of challenges there because there were specific peripherals that they'd have to be able to control.
So, talking to specific UART and GPIO drivers to do that, so it was non-trivial.
Yeah, what did your solution look like?
Did it rebuild it or how did your intended solution work on that?
So, we had a custom application that ran in CFS that could talk to the Raspberry Pi system console over the UART.
So, it was literally like talking to this system console.
We would send a command and we could do an LS on the shell or whatever it was.
And through that, we could restore the bootloader via just typical system console commands.
But in order to actually enable that UART, we had a GPIO that was hidden.
So, one of the challenges for Challenge 4 was actually looking through the FPGA Verilog and VHDL code and finding that that actually existed.
So, we had gotten some feedback during quals that teams were really interested in doing that kind of documentation reverse engineering.
So, we went to a lot of effort to make sure that that existed.
So, to even identify that that was there, they were doing code inspections of the VHDL and the Verilog for the FPGA.
Now, I heard hints that at least one team was doing something creative with direct memory writes.
What do we know about that?
All we know about that, well, teams were doing uploads of applications,
but it looked like some teams were using the direct memory writes to actually interact with that shell, the Raspberry Pi shell.
So, a little different than our approach, but yeah, it was interesting.
If it gets your code running, it gets it working, right?
There's no points for the jankiness or the cleverness. It's just, does it solve the challenge, right?
So, one of the things that I just mentioned to people, of course, was the power constraints
and how many of the satellites were running low on power at the end from a lot of movement throughout the day
and a lot of usage and the sort of option they had to get connected to a ground power.
Tell me how that changed the sort of Challenge 5 requirements.
And if a team was able to solve a Challenge 4 after the SCOBR went dark,
would they have been able to do it from the ground or was that completely impossible or what happened there?
Yeah, so we talked with the organizers and based on the fact that we had these power constraints
and that the teams that had elected to be put on the ground wouldn't be able to get a picture of the moon,
we adjusted the criteria for Challenge 5 to just be get a picture.
It was interesting to see what the different teams were doing as far as power.
Some teams had conserved their power throughout the day and other teams had not.
So, we had some teams that were in the running to solve Challenge 4 that said,
hey, we don't want to be put on the ground. We'll just stay on the carousel.
We've been good with the batteries all day.
And we actually mentioned that in an earlier update here that power was potentially a concern.
And it was nice that teams weren't entirely out of the running.
There was sort of a backup mechanism, but it cost them time while their flat set was taken down, was rewired in.
And so, that was sort of a penalty for exercising that option, although they weren't kind of out of the running entirely.
That works out great.
All right, well, thank you very much for taking time to talk to us and we'll continue on with the rest of our update.
Thank you.
All right, now the moment that you hopefully have actually been waiting for.
We're going to answer the question as to which team had their code sent into space tonight.
So, the video that we're going to look at here is the same one that I previewed earlier.
So, we can see Poland Can is the very first team to get an acceptable payload.
We knew that from watching the scoreboard and got reasonably close.
Next coming in are going to be several other teams.
ADD Vulcan, number two, and then number three, Flux Repeat Rocket.
So, we've got the three quickest ones and then we're going to have right here a Samurai come in.
So, these were the four that came in before the timeline.
So, if we stop right now, this is our launch cutoff, right?
So, these were the teams that came in.
And if we look at closest to the bullseye, you can see that Poland Candidate Space just beat out Flux Repeat Rocket with the most accurate solution during our window.
And this is the payload that's being run on an actual satellite right now.
So, we're looking forward to getting the results back from that tonight as it runs.
And then tomorrow during the live event, we're going to show you, hopefully, the moonshot.
We'll find out how accurate it was.
And, of course, we're going to continue the run here because, as I mentioned earlier, we know there was that sort of like sudden death for the last two slots, right?
And we could see the teams that were two more slots that were available.
And so, after that 7 p.m. cutoff, we had a quick 1550 tree that was able to make it in.
But we also noticed that Poland Candidate really got in close.
And so, they got a really, really nice solution.
They kept iterating on it.
There was no points for it.
It was not considered for the on-orbit.
But it was so good that the individuals we had evaluating all of the solutions, they had a lot of automation.
But there was also, I guess, a little bit of an art to it.
They were explaining that they thought that final Poland Candidate was so beautiful that it was like a piece of art.
They loved that final solution.
And then, of course, we had our last solve here coming in that's going to be from PFS, which we've already revealed.
They were the last team to make it into the qualifying minimal acceptable range, which unfortunately left our two other teams, which were SolarWind and 1064 Seabred, not in the running for that.
So, first of all, congrats to Team Poland Candidate for submitting not only the best solution overall throughout the whole evaluation period, but the solution that is going to space.
Let's see their team bio again.
And into space, I can confirm that your commands were uplinked in our comms window earlier today.
We expect the moonshot to happen in a couple of hours at 630 Pacific, and that picture will be sent down to Earth at about 1 a.m. Pacific.
We will reveal what is hopefully a clear moonshot picture at tomorrow's closing ceremonies.
It all depends on how accurate your command really was.
Fingers crossed.
You'd think that just watching instead of playing would be less stressful, and I'm sure it was worse for our competitors.
But even in the production room, we were cheering and sweating along with our teams as they worked their way through these challenges.
Thanks very much for joining us throughout this event.
That's it for today's recap.
Make sure you tune in to Hackensack Closing Ceremonies tomorrow at 11 Pacific, where we will hopefully reveal the world's first CTF moonshot taken by Poland Candid to space.
We'll also show you the overall contest results and award the prizes to our teams and reveal what happened after the scoreboard went dark.
We'll also hear closing remarks by Dr. Will Roper from the U.S. Space Force and Air Force Acquisition Chief.
Be sure to also check out all the great happenings going on at DEFCON and in the Aerospace Village.
See you tomorrow at 11 Pacific for the closing ceremonies.