start	end	text
75780	82560	Welcome to Space Security Challenge 2020, HackASAT, the final event. As the democratization
82560	88020	of space opens up a new frontier for exploration and innovation, we see new cybersecurity
88020	94660	vulnerabilities emerging. The Space Security Challenge is designed to inspire the world's
94660	100360	top cybersecurity talent to develop the skills necessary to secure this last frontier of
100360	107900	cybersecurity, space. And already we've made a ton of progress. I'll catch you up. This
107900	112700	spring, we hosted over 2,000 teams who worked their way through a set of foundational space
112700	118620	cybersecurity challenges in our HackASAT qualification round. Now, eight finalist
118620	124700	teams are stepping up to the ultimate challenge. They are hacking a satellite.
132080	137960	Welcome back to the second and final day of the competition portion of HackASAT. Are you excited?
137960	144400	As always, I'm your host, Jordan Wines. First, a quick recap of the game to this point.
150140	155280	The game has actually been underway for one hour now, and our team's first challenge has been to
155280	160460	regain control of the ground station that they'll be using to communicate with their Flatsats. In
160460	166060	fact, just before this broadcast went live, we received word that this challenge was actually
166060	172180	solved by Team Samurai. Congratulations to them. Right after our last update ended with only a
172180	178420	Samurai solve, several other teams came in with solutions for Challenge Zero. PFS and Solarwine
178420	184580	were solvers two and three on that challenge. After those two teams scored on Challenge Zero,
184580	187640	every other team was eventually able to solve Challenge Zero over the next several hours.
187640	192980	Taking a look at the scoreboard so far, we've had an eventful last hour. Our teams continue to make
192980	197920	progress, with four teams now having solved Challenge One. Unfortunately, the window of time
197920	203440	after first solve has expired, and the remaining four teams were given a solution with no points.
203520	211580	PFS and Colon Can Into Space were joined by 1553 and 1064 Seabred with solutions for Challenge One.
211740	216420	Now, this was going to be where I signed off for this update, but as we were live,
216420	222560	PFS actually jumped up on the scoreboard, yet again, solving Challenge Two. Most teams are now
222560	228280	working on two or three challenges. The On-Orbit Challenge, Challenge Two, and Challenge Three.
228280	233120	PFS has been pulling away to a healthy lead. They still have a critical problem to solve.
233120	238260	Specifically, the On-Orbit Challenge. While Colon Can Into Space is only nipping at their heels at
238260	242980	number two on the scoreboard, they are critically not only the first team with an attempted solution
242980	247460	to their On-Orbit Challenge, but the first with an accepted solution. That would mean that they
247460	253080	would be able to pass PFS if PFS is not able to actually solve, because again, that is a pass-fail
253080	263160	challenge. Yesterday, our teams collectively worked their way through Challenges Zero through Two,
263160	267740	leaving with half of the challenges solved by at least one team, and three challenges remaining
267740	274340	to be solved today. PFS grew their lead throughout the day yesterday, but the biggest drama occurred
274340	280840	after hours. When the 4 p.m. Pacific deadline for the On-Orbit Challenge passed, only four teams
280840	287520	had submitted solutions deemed acceptable. What's an acceptable solution? Let's take a look at
287520	294500	solving the On-Orbit Challenge. First, some terms you'll want to know. Two-line element set, or TLE,
294640	298900	a data format containing information about an object's position and velocity at a specific
298900	303440	point in time. It is used to calculate where a satellite will be at some point in the future,
303440	309000	with increasing uncertainty the further out in time. Window of opportunity, the period of time
309000	314680	during which the satellite can be positioned to complete the desired goal. Vector, a line
314680	320480	indicating a specific direction in magnitude. A satellite will have assigned X, Y, and Z vectors
320480	326020	associated with the body of the vehicle that can be used in a coordinate system. Camera boresight,
326020	331160	camera mounting position, and camera body vector all describe the satellite camera and where it's
332180	336780	Quaternion, a number system that is handy for calculating 3D rotations.
337340	344620	Got it? Here we go. The first step in solving the On-Orbit Challenge, identify the key data. The TLE,
344620	349360	camera mounting position, target, and window of opportunity are all supplied in the challenge
349360	354380	description or the On-Orbit Handbook. The data is used to calculate the orbit of both the satellite
354380	359400	and the moon toward the window of opportunity. And don't forget to grab the camera body vector,
359400	364440	which will be needed later. The second step, calculate the time of image by defining the
364440	369880	relationship between these key vectors. One, determine the satellite to moon vector, which
369880	374780	points directly from the satellite towards the moon. Two, determine the nadir vector, which points
374780	380140	directly from the satellite towards the center of the earth. Three, determine the angle between one,
380140	384800	the satellite to moon vector, and the nadir vector, and two, the angle between the satellite
384800	389860	negative z vector and the camera body vector. The instance when the difference between the two
389860	394620	angles is minimized gives us the time of image, the moment along its orbit when the satellite
394620	402220	will be in position to take our all-important moon shot. The third step, calculate the attitude or
402220	407060	the position within its orbit that the satellite must take for the camera to capture the image.
407140	414780	This is accomplished by lots of math. Specifically, something called a Direction Cosine Matrix, DCM,
414780	420540	or Rotation Matrix. The DCM calculates a satellite attitude that points one, the camera boresight to
420540	425860	the moon, and two, the satellite's negative z vector to earth's center, which is the attitude
425860	432540	needed to accomplish the goal. The DCM supplies us with a specific quaternion, which when uploaded
432540	437680	and applied to the satellite's attitude determination and control system, ADCS, moves the
437680	444160	satellite into the desired position. On to the final step, apply all that information and get
444160	450180	the image we're after. We take the time of image and back out the commands around it, giving the
450180	454780	satellite enough time to apply the quaternion and be in position when it arrives at the window of
454780	461140	opportunity. The proper order of commands would be as follows, turn on the ADCS, slew to the commanded
461140	468060	quaternion, turn the camera on, set the exposure time, capture the image, and finally, turn the camera
468060	474420	off. That's it. Challenge accomplished. But what does all of this have to do with
474420	480320	hacking and keeping our satellites secure? The on-orbit challenge was completed with full trust.
480320	485080	Our satellites rely on data and sensors from multiple sources in order to complete an objective.
485080	489080	The TLE that was provided relied on data from the satellite and ground stations.
489080	493200	Authenticated communications were required to upload the proper command sequence.
493200	498720	Trusted execution was required to process sensor and actuator data to close control loops.
498720	504140	Secure onboard communications were required to carry out operations in orbit. We need security
504140	508880	focused people to help with these problems because just as much as it takes a team of people to strap
508880	514200	explosives to a computer to get a satellite into orbit, it takes a team of people from both space
514200	519920	and security communities to ensure that space remains a viable usable resource.
522160	529100	The four teams with successful on-orbit solutions during the time period were Poland Cannon to Space,
529100	536260	in fact theirs came well over an hour before anyone else's, ADD Vulcan, Flux Rocket Repeat,
536260	543900	and Samurai all came in within about 10 minutes of each other within the last 15 minutes of that window.
544160	548680	Remember, the on-orbit portion involves a team computing a mission plan for an actual satellite
548680	553720	to take a picture of the moon. All acceptable solutions were evaluated and the most accurate
553720	559060	solution submitted before the 4 p.m. deadline will be chosen to be sent into space into our orbiting
559060	565640	satellite. We'll learn whose solution that was amongst those four later on today. As we entered
565640	571600	into our overtime period after the 4 p.m. deadline yesterday, the alternate acceptance criteria kicked
571600	576700	into play. Well, the four teams submitting before 4 p.m. were automatically eligible for their
576700	582580	solution to be sent and automatically into prize eligibility. We had to get more teams available.
582580	588380	The limit was six. This meant that two teams of the remaining four would be out of contention
588380	597300	for the final prize pool. The four teams fighting for those two spots included PFS, 1553, 1064 Seabred,
597300	603480	and Solarwine. 1553 managed to submit a solution that was valid only three minutes after the
603480	610840	quickly grabbing that fifth spot. That left PFS, 1064 Seabred, and Solarwine on the ropes for that
610840	617160	last spot. PFS and 1064 Seabred were number one and number four on the scoreboard at that point,
617160	622780	so no matter what happened, someone in contention for the podium would not be eligible. All of the
622780	627620	contest organizers were on a shared video chat waiting to see the results as they came in.
627700	632880	1064 Seabred had what looked to be an extremely close solution that was just outside the acceptance
632880	641560	criteria, and PFS didn't seem to be close. Then at 7 48 p.m eastern or 4 48 p.m pacific,
641560	647380	PFS came in with a valid solution just edging out 1064 Seabred and Solarwine on the list of
647380	655460	on-orbit acceptance. Unfortunately, that means that 1064 Seabred and Solarwine are both ineligible for
655620	660880	a spot on the podium. That said, they can still have an impact on the game. Either team scoring
660880	664780	first blood will potentially change the number of available points left on the board for the
664780	670200	competitors and impact the final result. It's sad to see two great teams out of contention for the
670200	674440	prize pool, but they can still end up on the leaderboard from a points perspective and attain
674440	679020	the associated bragging rights. In fact, let's go ahead and take a look at the scoreboard now
679020	685580	in our live octagon feed. And they definitely haven't slowed down. You'll notice that Solarwine
685580	690240	actually scored first blood on challenge three. Congratulations to them for the great work
690240	694800	overnight. The pressure is now on the remaining teams to show that they made good use of
694800	700880	the downtime as well to land challenge three. You can also see Flux Repeat Rocket scoring
700880	705700	just before this broadcast with only a 5% reduction in total points. So that's a good
705700	711000	amount of points for them. That means Solarwine and Flux Repeat Rocket are both moving on to
711000	721130	challenge four. Challenge four. Here's what we know. We've restored communication with the payload
721130	726650	module, but we still can't operate it. The challenge? Now teams must restore normal operations
726650	740510	of the payload module so we can access the imager. This is the first time we've seen Flux Repeat
740510	775340	Rocket make a big move on the scoreboard. Let's check out their team bio. Like many of the combined
776200	781660	CTF teams that we've seen here today, I have good memories of playing Hack Lou CTF. In fact,
781660	786240	it's often the case that the competition participants are also organizers in other times.
786240	790440	So one of those teams that makes up the composition of Flux Repeat Rocket,
790440	795500	FluxFingers, runs Hack Lou, which is another great CTF competition you should check out.
795740	800120	What an exciting first day. I'm looking forward to seeing what happens today as our teams battle
800120	804760	through these last few challenges. Come back and join us at our 10 50 a.m. Pacific,
804760	808100	1 50 p.m. Eastern for our next competition update.