start	end	text
48140	54160	Welcome to Space Security Challenge 2020, HackASAT, the final event.
54160	59320	As the democratization of space opens up a new frontier for exploration and innovation,
59320	63160	we see new cybersecurity vulnerabilities emerging.
64080	68920	The Space Security Challenge is designed to inspire the world's top cybersecurity talent
68920	74080	to develop the skills necessary to secure this last frontier of cybersecurity.
74080	78840	Space. And already we've made a ton of progress.
78840	80280	I'll catch you up.
80440	84360	This spring we hosted over 2,000 teams who worked their way through a set of
84360	89960	foundational space cybersecurity challenges in our HackASAT qualification round.
89960	94340	Now, eight finalist teams are stepping up to the ultimate challenge.
94660	97440	They are hacking a satellite.
104180	109820	Welcome to the Saturday daily recap of Space Security Challenge 2020, or HackASAT.
110420	113500	For the second to last time, I'm your host, Jordan Wines,
113500	116800	and it's time to fill you in on how our competitors did on day two
116800	119720	of this first-of-its-kind satellite hacking competition.
119840	123140	Okay, let's get right to the moment everyone's been waiting for.
123140	128040	Here is our video to show which team was selected for the on-orbit challenge.
129620	132040	Oh, I'm sorry.
132420	136360	Actually, it appears that we're experiencing some technical difficulties.
136800	139680	Yeah, I guess that means you're going to have to listen to the rest of this update,
139680	142160	and then we'll play the big reveal at the end instead.
142440	145140	So let's take a look back at today's action.
152100	156460	In fact, let's go ahead and take a look at the scoreboard now in our live octagon feed.
157260	159400	And they definitely haven't slowed down.
159400	163300	You'll notice that SolarWine actually scored first blood on Challenge 3.
163300	166100	Congratulations to them for the great work overnight.
166100	172840	You can also see FluxRepeatRocket scoring just before this broadcast with only a 5% reduction in total points.
172840	177380	That means SolarWine and FluxRepeatRocket are both moving on to Challenge 4.
177380	181720	While the score hasn't changed, we have had one important game milestone pass us by.
181720	184080	We timed out unavailable points for Challenge 3.
184080	187580	That means those two teams, SolarWine and FluxRepeatRocket,
187580	193660	they've obtained points for that challenge and all other teams were given a solution script so they can focus on the next challenge.
199020	203600	If you've been following along at home, you know that we sprung our on-orbit challenge on our teams yesterday.
203600	210120	We had four teams submit their solutions by 4 p.m. Pacific, our deadline for evaluation for on-orbit,
210120	214900	but only one was selected to have their code sent to the live satellite to capture a moonshot.
214900	218020	We will learn who that lucky team is later on in the broadcast.
219140	225820	While today's action started strong with several early scores, teams really struggled their way through Challenge 4 today.
225820	231100	While the organizers knew it would be the hardest challenge, the hope was that it would be solved before this point.
231100	235720	In fact, in the last hour of the competitions, some teams had run so low on power
235720	240600	that the organizers offered to take the flatsats offline so they could plug them into power.
240600	244840	This would mean teams would have challenges in solving Challenge 5,
244840	249820	but hopefully it would give them enough power and time to solve Challenge 4 in the last few minutes.
250000	255120	Given that, here is our explanation for the Challenge 4 solution.
256180	257760	Challenge 4.
258440	259900	Here's what we know.
259900	264160	We've restored communication with the payload module, but we still can't operate it.
264160	270100	The challenge? Now teams must restore normal operations of the payload module so we can access the imager.
270280	271880	Here's how they do it.
271880	278080	Teams discover that the payload module bootloader has been corrupted, which is why the payload module is not operating normally.
278080	283800	The teams discover a system console to the payload module and the ability to access the payload module system console
283800	289360	by controlling an undocumented GPIO and multiplexer on the CNDH board.
289360	296580	The teams must write a custom flight software application that can control the GPIO and enable access to the payload system console.
296580	301420	After writing the application, the teams must upload it to the CNDH and execute it.
301420	306360	Once the teams have access to the system console, they will identify that it has been corrupted.
306680	314620	The teams will need to research nominal Qubose bootloader configuration and repair the payload module's bootloader to resume proper operation of the payload module.
320140	325240	As I mentioned during a previous update, there was always a chance that the scoreboard was going to go dark.
325240	331120	And sure enough, with 30 minutes left in the competition, as teams were hopefully nearing in on a Challenge 4 solution,
331120	333920	the organizers decided to keep us all in suspense.
333920	338160	Here's a look at our final scoreboard that everyone saw before it went dark.
339680	345380	As we can tell, we had a couple of solves later on, but early was where most of the action happened.
345380	352560	However, with our accepted and rejected on-orbit status, we knew that there were two teams who would not be eligible for final prizes.
352680	357480	We will make the final actual scores available tomorrow during the closing ceremony.
357480	366620	Before you make your predictions on our podium winners, let's take a look at the final Challenge 5 to see what it was teams would have had to solve after they finished Challenge 4.
367920	368960	Challenge 5
370160	375540	Here's what we know. We've done our best work, and it seems that we've regained control of the satellite.
375720	377480	But how do we know for sure?
377860	384460	The challenge? Teams must prove that we are fully in control of the satellite system by successfully imaging the moon.
394230	398770	I thought I could have solved some of these challenges, and the answer was almost certainly not.
398770	402630	I've got a lot of respect for the teams out there who made progress at all through this event.
402630	409490	With a very difficult environment, very different to what many other CTFs have to do, there's a lot of extra constraints you have to worry about.
409570	416890	For more information on that, let's do one last Q&A session with Jason Latimer to talk about how teams were approaching Challenge 4.
416970	419770	Let's see if we can get him in here. Jason, do you hear me?
420430	421390	Yeah, I got you.
421390	427150	Excellent, and I hear you as well. Great. So, we're wrapped up. The game is over.
427150	435510	I hopped into a couple of your calls, and I was listening to you guys describe some of the approaches teams were taking on Challenge 4.
435670	439890	I thought there were some really, really interesting things that came out of that. I'd love to hear a little bit more from your perspective.
440470	448810	Yeah, so the background on Challenge 4 was that the teams had gotten past the implant that the adversary had put on the satellite,
448810	453870	and that they were trying to use the payload, and quickly found that the payload wasn't functional.
455050	462290	So, what the adversary had done was corrupted the bootloader, and so they had to uncorrupt the bootloader.
462530	468370	There were a number of approaches. Teams seemed to be struggling in the beginning, so at one point we gave a hint that said,
468370	476630	hey, you need to write an application that's capable of communicating with the system console and enabling that system console via GPIO.
476630	481830	Very quickly, teams started uploading their custom CFS applications.
481970	490270	Some teams were just trying to enable the GPIO to control the system console based on other GPIOs that were already on the system,
490270	492270	and they had done that successfully.
492270	500350	And then we had some unique approaches where teams were trying to upload applications that could do TFTP transfers to the device.
500350	504230	So, we had a number of different approaches to Challenge.
504230	509410	So, the application that they're compiling, was this just a standard compiler they could use,
509410	514930	or what sort of information about that environment did they have to have to build these custom applications?
515450	518190	Yeah, so it's actually a little bit more complicated than that.
518190	522610	We didn't want that to be the challenge behind the whole restoring the bootloader,
522610	529090	so we actually did provide to the teams ahead of time the RTEMs build environment they would need to build an application.
529090	537090	And then we provided also a set of example applications that they could use as a template for creating this application
537090	539790	that would restore the bootloader on the payload.
539970	544670	There were still quite a bit of challenges there because there were specific peripherals that they'd have to be able to control.
544670	553810	So, talking to specific UART and GPIO drivers to do that, so it was non-trivial.
553990	555710	Yeah, what did your solution look like?
555710	560090	Did it rebuild it or how did your intended solution work on that?
560190	568410	So, we had a custom application that ran in CFS that could talk to the Raspberry Pi system console over the UART.
568410	571750	So, it was literally like talking to this system console.
571750	576370	We would send a command and we could do an LS on the shell or whatever it was.
576370	582630	And through that, we could restore the bootloader via just typical system console commands.
582630	587690	But in order to actually enable that UART, we had a GPIO that was hidden.
587930	597190	So, one of the challenges for Challenge 4 was actually looking through the FPGA Verilog and VHDL code and finding that that actually existed.
597190	605150	So, we had gotten some feedback during quals that teams were really interested in doing that kind of documentation reverse engineering.
605150	608330	So, we went to a lot of effort to make sure that that existed.
608330	615210	So, to even identify that that was there, they were doing code inspections of the VHDL and the Verilog for the FPGA.
615270	621270	Now, I heard hints that at least one team was doing something creative with direct memory writes.
621270	623110	What do we know about that?
624310	630230	All we know about that, well, teams were doing uploads of applications,
630230	637610	but it looked like some teams were using the direct memory writes to actually interact with that shell, the Raspberry Pi shell.
637610	642010	So, a little different than our approach, but yeah, it was interesting.
642330	644610	If it gets your code running, it gets it working, right?
644610	649830	There's no points for the jankiness or the cleverness. It's just, does it solve the challenge, right?
649830	654110	So, one of the things that I just mentioned to people, of course, was the power constraints
654110	658090	and how many of the satellites were running low on power at the end from a lot of movement throughout the day
658090	663430	and a lot of usage and the sort of option they had to get connected to a ground power.
663730	665890	Tell me how that changed the sort of Challenge 5 requirements.
665890	670210	And if a team was able to solve a Challenge 4 after the SCOBR went dark,
670210	674710	would they have been able to do it from the ground or was that completely impossible or what happened there?
675550	679930	Yeah, so we talked with the organizers and based on the fact that we had these power constraints
680850	686170	and that the teams that had elected to be put on the ground wouldn't be able to get a picture of the moon,
686170	690130	we adjusted the criteria for Challenge 5 to just be get a picture.
690130	699290	It was interesting to see what the different teams were doing as far as power.
699630	703850	Some teams had conserved their power throughout the day and other teams had not.
703850	708670	So, we had some teams that were in the running to solve Challenge 4 that said,
708670	711330	hey, we don't want to be put on the ground. We'll just stay on the carousel.
711710	713610	We've been good with the batteries all day.
713710	717950	And we actually mentioned that in an earlier update here that power was potentially a concern.
717950	720410	And it was nice that teams weren't entirely out of the running.
720410	726270	There was sort of a backup mechanism, but it cost them time while their flat set was taken down, was rewired in.
726270	730810	And so, that was sort of a penalty for exercising that option, although they weren't kind of out of the running entirely.
730810	732470	That works out great.
732630	737810	All right, well, thank you very much for taking time to talk to us and we'll continue on with the rest of our update.
738350	739290	Thank you.
740510	744830	All right, now the moment that you hopefully have actually been waiting for.
744830	749650	We're going to answer the question as to which team had their code sent into space tonight.
750430	755130	So, the video that we're going to look at here is the same one that I previewed earlier.
755130	759430	So, we can see Poland Can is the very first team to get an acceptable payload.
759430	762830	We knew that from watching the scoreboard and got reasonably close.
762970	765010	Next coming in are going to be several other teams.
765010	768650	ADD Vulcan, number two, and then number three, Flux Repeat Rocket.
768650	773650	So, we've got the three quickest ones and then we're going to have right here a Samurai come in.
773650	775910	So, these were the four that came in before the timeline.
775910	778690	So, if we stop right now, this is our launch cutoff, right?
778690	780930	So, these were the teams that came in.
780930	790730	And if we look at closest to the bullseye, you can see that Poland Candidate Space just beat out Flux Repeat Rocket with the most accurate solution during our window.
790730	795030	And this is the payload that's being run on an actual satellite right now.
795030	800010	So, we're looking forward to getting the results back from that tonight as it runs.
800010	803690	And then tomorrow during the live event, we're going to show you, hopefully, the moonshot.
803690	805710	We'll find out how accurate it was.
805810	813030	And, of course, we're going to continue the run here because, as I mentioned earlier, we know there was that sort of like sudden death for the last two slots, right?
813030	816290	And we could see the teams that were two more slots that were available.
816450	820870	And so, after that 7 p.m. cutoff, we had a quick 1550 tree that was able to make it in.
820870	824010	But we also noticed that Poland Candidate really got in close.
824010	825970	And so, they got a really, really nice solution.
825970	827010	They kept iterating on it.
827010	827910	There was no points for it.
827910	831310	It was not considered for the on-orbit.
831570	838850	But it was so good that the individuals we had evaluating all of the solutions, they had a lot of automation.
838850	840790	But there was also, I guess, a little bit of an art to it.
840790	846490	They were explaining that they thought that final Poland Candidate was so beautiful that it was like a piece of art.
846490	848890	They loved that final solution.
849210	856710	And then, of course, we had our last solve here coming in that's going to be from PFS, which we've already revealed.
856710	869990	They were the last team to make it into the qualifying minimal acceptable range, which unfortunately left our two other teams, which were SolarWind and 1064 Seabred, not in the running for that.
870030	881790	So, first of all, congrats to Team Poland Candidate for submitting not only the best solution overall throughout the whole evaluation period, but the solution that is going to space.
881790	883930	Let's see their team bio again.
916190	922510	And into space, I can confirm that your commands were uplinked in our comms window earlier today.
922530	929490	We expect the moonshot to happen in a couple of hours at 630 Pacific, and that picture will be sent down to Earth at about 1 a.m. Pacific.
929490	933850	We will reveal what is hopefully a clear moonshot picture at tomorrow's closing ceremonies.
933850	936450	It all depends on how accurate your command really was.
936450	937490	Fingers crossed.
937790	942410	You'd think that just watching instead of playing would be less stressful, and I'm sure it was worse for our competitors.
942410	947850	But even in the production room, we were cheering and sweating along with our teams as they worked their way through these challenges.
948010	950550	Thanks very much for joining us throughout this event.
951390	953110	That's it for today's recap.
953110	962730	Make sure you tune in to Hackensack Closing Ceremonies tomorrow at 11 Pacific, where we will hopefully reveal the world's first CTF moonshot taken by Poland Candid to space.
962730	969550	We'll also show you the overall contest results and award the prizes to our teams and reveal what happened after the scoreboard went dark.
969550	974870	We'll also hear closing remarks by Dr. Will Roper from the U.S. Space Force and Air Force Acquisition Chief.
974990	979730	Be sure to also check out all the great happenings going on at DEFCON and in the Aerospace Village.
979790	982570	See you tomorrow at 11 Pacific for the closing ceremonies.