1 00:01:15,780 --> 00:01:21,480 Welcome to Space Security Challenge 2020, HackASAT, the final event. 2 00:01:21,480 --> 00:01:30,440 As the democratization of space opens up a new frontier for exploration and innovation, we see new cybersecurity vulnerabilities emerging. 3 00:01:31,100 --> 00:01:43,100 The Space Security Challenge is designed to inspire the world's top cybersecurity talent to develop the skills necessary to secure this last frontier of cybersecurity, space. 4 00:01:43,260 --> 00:01:46,100 And already we've made a ton of progress. 5 00:01:46,100 --> 00:01:47,520 I'll catch you up. 6 00:01:47,520 --> 00:01:57,220 This spring, we hosted over 2,000 teams who worked their way through a set of foundational space cybersecurity challenges in our HackASAT qualification round. 7 00:01:57,220 --> 00:02:01,620 Now, eight finalist teams are stepping up to the ultimate challenge. 8 00:02:01,660 --> 00:02:04,700 They are hacking a satellite. 9 00:02:12,080 --> 00:02:17,000 Welcome back to the second and final day of the competition portion of HackASAT. 10 00:02:17,000 --> 00:02:17,960 Are you excited? 11 00:02:17,960 --> 00:02:20,620 As always, I'm your host, Jordan Wines. 12 00:02:20,840 --> 00:02:24,400 First, a quick recap of the game to this point. 13 00:02:30,140 --> 00:02:40,260 The game has actually been underway for one hour now, and our team's first challenge has been to regain control of the ground station that they'll be using to communicate with their Flatsats. 14 00:02:40,260 --> 00:02:47,980 In fact, just before this broadcast went live, we received word that this challenge was actually solved by Team Samurai. 15 00:02:48,040 --> 00:02:49,640 Congratulations to them. 16 00:02:49,640 --> 00:02:56,140 Right after our last update ended with only a Samurai solve, several other teams came in with solutions for Challenge Zero. 17 00:02:56,320 --> 00:03:00,900 PFS and Solarwine were solvers two and three on that challenge. 18 00:03:01,240 --> 00:03:07,640 After those two teams scored on Challenge Zero, every other team was eventually able to solve Challenge Zero over the next several hours. 19 00:03:07,640 --> 00:03:12,000 Taking a look at the scoreboard so far, we've had an eventful last hour. 20 00:03:12,000 --> 00:03:16,380 Our teams continue to make progress, with four teams now having solved Challenge One. 21 00:03:16,440 --> 00:03:23,440 Unfortunately, the window of time after first solve has expired, and the remaining four teams were given a solution with no points. 22 00:03:23,520 --> 00:03:31,580 PFS and Colon Can Into Space were joined by 1553 and 1064 Seabred with solutions for Challenge One. 23 00:03:31,740 --> 00:03:41,500 Now, this was going to be where I signed off for this update, but as we were live, PFS actually jumped up on the scoreboard, yet again, solving Challenge Two. 24 00:03:41,500 --> 00:03:44,560 Most teams are now working on two or three challenges. 25 00:03:44,700 --> 00:03:48,280 The On-Orbit Challenge, Challenge Two, and Challenge Three. 26 00:03:48,280 --> 00:03:51,100 PFS has been pulling away to a healthy lead. 27 00:03:51,100 --> 00:03:53,120 They still have a critical problem to solve. 28 00:03:53,120 --> 00:03:55,520 Specifically, the On-Orbit Challenge. 29 00:03:55,600 --> 00:04:06,480 While Colon Can Into Space is only nipping at their heels at number two on the scoreboard, they are critically not only the first team with an attempted solution to their On-Orbit Challenge, but the first with an accepted solution. 30 00:04:06,480 --> 00:04:14,040 That would mean that they would be able to pass PFS if PFS is not able to actually solve, because again, that is a pass-fail challenge. 31 00:04:18,600 --> 00:04:29,120 Yesterday, our teams collectively worked their way through Challenges Zero through Two, leaving with half of the challenges solved by at least one team, and three challenges remaining to be solved today. 32 00:04:29,720 --> 00:04:35,760 PFS grew their lead throughout the day yesterday, but the biggest drama occurred after hours. 33 00:04:35,760 --> 00:04:36,580 When the 4 p.m. 34 00:04:36,580 --> 00:04:43,300 Pacific deadline for the On-Orbit Challenge passed, only four teams had submitted solutions deemed acceptable. 35 00:04:43,360 --> 00:04:45,100 What's an acceptable solution? 36 00:04:46,440 --> 00:04:49,320 Let's take a look at solving the On-Orbit Challenge. 37 00:04:49,420 --> 00:04:51,940 First, some terms you'll want to know. 38 00:04:52,180 --> 00:05:00,000 Two-line element set, or TLE, a data format containing information about an object's position and velocity at a specific point in time. 39 00:05:00,000 --> 00:05:06,400 It is used to calculate where a satellite will be at some point in the future, with increasing uncertainty the further out in time. 40 00:05:06,420 --> 00:05:12,900 Window of opportunity, the period of time during which the satellite can be positioned to complete the desired goal. 41 00:05:13,480 --> 00:05:17,540 Vector, a line indicating a specific direction in magnitude. 42 00:05:17,720 --> 00:05:24,800 A satellite will have assigned X, Y, and Z vectors associated with the body of the vehicle that can be used in a coordinate system. 43 00:05:24,860 --> 00:05:36,780 Camera boresight, camera mounting position, and camera body vector all describe the satellite camera and where it's Quaternion, a number system that is handy for calculating 3D rotations. 44 00:05:37,340 --> 00:05:38,260 Got it? 45 00:05:38,260 --> 00:05:39,280 Here we go. 46 00:05:39,280 --> 00:05:43,620 The first step in solving the On-Orbit Challenge, identify the key data. 47 00:05:43,620 --> 00:05:51,680 The TLE, camera mounting position, target, and window of opportunity are all supplied in the challenge description or the On-Orbit Handbook. 48 00:05:51,680 --> 00:05:56,920 The data is used to calculate the orbit of both the satellite and the moon toward the window of opportunity. 49 00:05:56,920 --> 00:06:00,980 And don't forget to grab the camera body vector, which will be needed later. 50 00:06:01,180 --> 00:06:06,660 The second step, calculate the time of image by defining the relationship between these key vectors. 51 00:06:07,220 --> 00:06:12,420 One, determine the satellite to moon vector, which points directly from the satellite towards the moon. 52 00:06:12,420 --> 00:06:17,720 Two, determine the nadir vector, which points directly from the satellite towards the center of the earth. 53 00:06:17,720 --> 00:06:27,840 Three, determine the angle between one, the satellite to moon vector, and the nadir vector, and two, the angle between the satellite negative z vector and the camera body vector. 54 00:06:27,940 --> 00:06:38,500 The instance when the difference between the two angles is minimized gives us the time of image, the moment along its orbit when the satellite will be in position to take our all-important moon shot. 55 00:06:39,560 --> 00:06:47,060 The third step, calculate the attitude or the position within its orbit that the satellite must take for the camera to capture the image. 56 00:06:47,140 --> 00:06:50,380 This is accomplished by lots of math. 57 00:06:50,680 --> 00:06:56,200 Specifically, something called a Direction Cosine Matrix, DCM, or Rotation Matrix. 58 00:06:56,200 --> 00:07:08,000 The DCM calculates a satellite attitude that points one, the camera boresight to the moon, and two, the satellite's negative z vector to earth's center, which is the attitude needed to accomplish the goal. 59 00:07:08,680 --> 00:07:20,080 The DCM supplies us with a specific quaternion, which when uploaded and applied to the satellite's attitude determination and control system, ADCS, moves the satellite into the desired position. 60 00:07:20,300 --> 00:07:25,800 On to the final step, apply all that information and get the image we're after. 61 00:07:26,700 --> 00:07:35,880 We take the time of image and back out the commands around it, giving the satellite enough time to apply the quaternion and be in position when it arrives at the window of opportunity. 62 00:07:35,960 --> 00:07:48,980 The proper order of commands would be as follows, turn on the ADCS, slew to the commanded quaternion, turn the camera on, set the exposure time, capture the image, and finally, turn the camera off. 63 00:07:48,980 --> 00:07:50,180 That's it. 64 00:07:50,180 --> 00:07:51,740 Challenge accomplished. 65 00:07:52,100 --> 00:07:56,820 But what does all of this have to do with hacking and keeping our satellites secure? 66 00:07:56,860 --> 00:08:00,320 The on-orbit challenge was completed with full trust. 67 00:08:00,320 --> 00:08:05,080 Our satellites rely on data and sensors from multiple sources in order to complete an objective. 68 00:08:05,080 --> 00:08:09,080 The TLE that was provided relied on data from the satellite and ground stations. 69 00:08:09,080 --> 00:08:13,200 Authenticated communications were required to upload the proper command sequence. 70 00:08:13,200 --> 00:08:18,720 Trusted execution was required to process sensor and actuator data to close control loops. 71 00:08:18,720 --> 00:08:22,960 Secure onboard communications were required to carry out operations in orbit. 72 00:08:23,020 --> 00:08:39,920 We need security focused people to help with these problems because just as much as it takes a team of people to strap explosives to a computer to get a satellite into orbit, it takes a team of people from both space and security communities to ensure that space remains a viable usable resource. 73 00:08:42,160 --> 00:09:03,900 The four teams with successful on-orbit solutions during the time period were Poland Cannon to Space, in fact theirs came well over an hour before anyone else's, ADD Vulcan, Flux Rocket Repeat, and Samurai all came in within about 10 minutes of each other within the last 15 minutes of that window. 74 00:09:04,160 --> 00:09:10,460 Remember, the on-orbit portion involves a team computing a mission plan for an actual satellite to take a picture of the moon. 75 00:09:10,660 --> 00:09:16,040 All acceptable solutions were evaluated and the most accurate solution submitted before the 4 p.m. 76 00:09:16,040 --> 00:09:19,960 deadline will be chosen to be sent into space into our orbiting satellite. 77 00:09:19,960 --> 00:09:24,580 We'll learn whose solution that was amongst those four later on today. 78 00:09:24,660 --> 00:09:28,440 As we entered into our overtime period after the 4 p.m. 79 00:09:28,440 --> 00:09:32,480 deadline yesterday, the alternate acceptance criteria kicked into play. 80 00:09:32,480 --> 00:09:34,980 Well, the four teams submitting before 4 p.m. 81 00:09:34,980 --> 00:09:40,240 were automatically eligible for their solution to be sent and automatically into prize eligibility. 82 00:09:40,240 --> 00:09:42,580 We had to get more teams available. 83 00:09:42,580 --> 00:09:44,300 The limit was six. 84 00:09:44,300 --> 00:09:50,240 This meant that two teams of the remaining four would be out of contention for the final prize pool. 85 00:09:50,240 --> 00:09:58,940 The four teams fighting for those two spots included PFS, 1553, 1064 Seabred, and Solarwine. 86 00:09:59,060 --> 00:10:06,000 1553 managed to submit a solution that was valid only three minutes after the quickly grabbing that fifth spot. 87 00:10:06,360 --> 00:10:12,140 That left PFS, 1064 Seabred, and Solarwine on the ropes for that last spot. 88 00:10:12,340 --> 00:10:22,040 PFS and 1064 Seabred were number one and number four on the scoreboard at that point, so no matter what happened, someone in contention for the podium would not be eligible. 89 00:10:22,220 --> 00:10:27,620 All of the contest organizers were on a shared video chat waiting to see the results as they came in. 90 00:10:27,700 --> 00:10:36,020 1064 Seabred had what looked to be an extremely close solution that was just outside the acceptance criteria, and PFS didn't seem to be close. 91 00:10:36,020 --> 00:10:48,780 Then at 7 48 p.m eastern or 4 48 p.m pacific, PFS came in with a valid solution just edging out 1064 Seabred and Solarwine on the list of on-orbit acceptance. 92 00:10:50,920 --> 00:10:56,780 Unfortunately, that means that 1064 Seabred and Solarwine are both ineligible for a spot on the podium. 93 00:10:56,780 --> 00:10:59,960 That said, they can still have an impact on the game. 94 00:10:59,960 --> 00:11:07,340 Either team scoring first blood will potentially change the number of available points left on the board for the competitors and impact the final result. 95 00:11:07,340 --> 00:11:16,360 It's sad to see two great teams out of contention for the prize pool, but they can still end up on the leaderboard from a points perspective and attain the associated bragging rights. 96 00:11:16,560 --> 00:11:20,980 In fact, let's go ahead and take a look at the scoreboard now in our live octagon feed. 97 00:11:21,640 --> 00:11:23,800 And they definitely haven't slowed down. 98 00:11:23,800 --> 00:11:28,120 You'll notice that Solarwine actually scored first blood on challenge three. 99 00:11:28,200 --> 00:11:31,200 Congratulations to them for the great work overnight. 100 00:11:31,280 --> 00:11:38,160 The pressure is now on the remaining teams to show that they made good use of the downtime as well to land challenge three. 101 00:11:38,160 --> 00:11:45,280 You can also see Flux Repeat Rocket scoring just before this broadcast with only a 5% reduction in total points. 102 00:11:45,280 --> 00:11:47,060 So that's a good amount of points for them. 103 00:11:47,300 --> 00:11:52,220 That means Solarwine and Flux Repeat Rocket are both moving on to challenge four. 104 00:11:55,810 --> 00:11:57,110 Challenge four. 105 00:11:57,910 --> 00:11:59,170 Here's what we know. 106 00:11:59,170 --> 00:12:03,550 We've restored communication with the payload module, but we still can't operate it. 107 00:12:03,550 --> 00:12:04,630 The challenge? 108 00:12:04,670 --> 00:12:09,470 Now teams must restore normal operations of the payload module so we can access the imager. 109 00:12:18,230 --> 00:12:22,610 This is the first time we've seen Flux Repeat Rocket make a big move on the scoreboard. 110 00:12:22,610 --> 00:12:24,190 Let's check out their team bio. 111 00:12:53,780 --> 00:13:01,180 Like many of the combined CTF teams that we've seen here today, I have good memories of playing Hack Lou CTF. 112 00:13:01,180 --> 00:13:06,240 In fact, it's often the case that the competition participants are also organizers in other times. 113 00:13:06,240 --> 00:13:15,500 So one of those teams that makes up the composition of Flux Repeat Rocket, FluxFingers, runs Hack Lou, which is another great CTF competition you should check out. 114 00:13:15,740 --> 00:13:17,340 What an exciting first day. 115 00:13:17,340 --> 00:13:21,880 I'm looking forward to seeing what happens today as our teams battle through these last few challenges. 116 00:13:22,140 --> 00:13:24,140 Come back and join us at our 10 50 a.m. 117 00:13:24,140 --> 00:13:25,560 Pacific, 1 50 p.m. 118 00:13:25,560 --> 00:13:28,100 Eastern for our next competition update.