1
00:04:35,980 --> 00:04:54,520
A little pause... and we are back.

2
00:04:54,520 --> 00:04:56,300
A little pause... and we are back.

3
00:14:26,290 --> 00:14:27,930
A little pause... and we are back.

4
00:15:56,360 --> 00:15:57,780
A little pause... and we are back.

5
00:26:02,690 --> 00:26:15,050
A little pause... and we are back.

6
00:27:38,920 --> 00:27:58,160
A little pause...

7
00:33:41,600 --> 00:33:41,780
and we are back.

8
00:34:33,570 --> 00:34:33,770
A little pause... and we are back.

9
01:00:22,490 --> 01:00:26,710
Welcome to Space Security Challenge 2020, HackASAP.

10
01:00:26,710 --> 01:00:28,750
The final event.

11
01:00:28,770 --> 01:00:37,570
As the democratization of space opens up a new frontier for exploration and innovation, we see new cybersecurity vulnerabilities emerging.

12
01:00:38,530 --> 01:00:48,790
The Space Security Challenge is designed to inspire the world's top cybersecurity talent to develop the skills necessary to secure this last frontier of cybersecurity.

13
01:00:48,970 --> 01:00:50,270
Space.

14
01:00:50,410 --> 01:00:52,990
And already we've made a ton of progress.

15
01:00:53,250 --> 01:00:54,690
I'll catch you up.

16
01:00:54,690 --> 01:01:04,310
This spring, we hosted over 2,000 teams who worked their way through a set of foundational space cybersecurity challenges in our HackASAP qualification round.

17
01:01:04,330 --> 01:01:08,710
Now, eight finalist teams are stepping up to the ultimate challenge.

18
01:01:08,930 --> 01:01:11,830
They are hacking a satellite.

19
01:01:19,330 --> 01:01:23,310
Welcome to Space Security Challenge 2020, or HackASAP.

20
01:01:23,310 --> 01:01:27,150
I'm your host, Jordan Wines, and I'm very excited to be with you today.

21
01:01:27,150 --> 01:01:41,010
I'm here in Melbourne, Florida, at HackASAP HQ, where eight satellites are spinning out of control as the teams do their best to restore functionality, all for a piece of a $100,000 prize pool.

22
01:01:41,130 --> 01:01:55,330
These teams, from 11 different countries around the world, include not only some that are very familiar to those of us from the Capture the Flag, or CTF, community, but also include many newcomers who assembled just to answer the call for HackASAP.

23
01:01:55,330 --> 01:01:56,850
Let's meet our teams.

24
01:02:37,920 --> 01:02:46,220
To get to this final event, individuals on these eight teams had to beat out over 6,000 other competitors for a coveted invitation.

25
01:02:46,220 --> 01:03:02,360
This required mastery not only in traditional CTF hacking skills, like reverse engineering, and vulnerability research, but also in areas new to the CTF community, including orbital mechanics, astrophysics, space-based communication systems, and many others.

26
01:03:02,360 --> 01:03:10,560
Today and tomorrow, each of our eight teams will race the others through a series of challenges to regain control over their Flatsat.

27
01:03:10,560 --> 01:03:29,740
If you've followed our story at hackasat.com and launch.com.com, you might know that through some bad code and poor business choices, our defunct launch.com company has accidentally triggered a satellite intended for the year 2000 to be launched in 2020 with no one in control.

28
01:03:29,740 --> 01:03:38,100
In our fictional storyline, this satellite has been co-opted by nefarious forces, and it's up to our competitors to regain control over the many components.

29
01:03:38,100 --> 01:03:52,100
Since qualifying, each team was shipped a physical Flatsat, and these Flatsats are not only prizes for their qualifying performance, but also allow the teams to become familiar with the hardware and software before this final event.

30
01:03:52,100 --> 01:03:55,120
So what's the difference between a satellite and a Flatsat?

31
01:03:55,120 --> 01:04:03,840
Think of a Flatsat as a bench version for testing components of an actual satellite without necessarily being exactly what you would send into space.

32
01:04:03,840 --> 01:04:12,740
The satellites you can watch in our live webcams are Flatsats, but don't worry, not all of the competition this weekend will be terrestrial.

33
01:04:13,000 --> 01:04:23,120
The game has actually been underway for one hour now, and our team's first challenge has been to regain control of the ground station that they'll be using to communicate with their Flatsats.

34
01:04:23,120 --> 01:04:26,960
Being good hackers, of course, we call this Challenge Zero.

35
01:04:27,780 --> 01:04:29,060
Challenge Zero.

36
01:04:30,140 --> 01:04:31,600
Here's what we know.

37
01:04:31,600 --> 01:04:35,420
An adversary has obtained access to the satellite's ground station.

38
01:04:35,420 --> 01:04:38,400
Once they obtained access, they kicked us out.

39
01:04:38,620 --> 01:04:39,700
The challenge?

40
01:04:39,700 --> 01:04:43,060
Teams must obtain network access to the ground station.

41
01:04:49,980 --> 01:04:55,120
This is called Challenge Zero because it's required for the teams to even kick the game off.

42
01:04:55,700 --> 01:05:07,920
While most of our challenges will have teams focusing on components that are inside of their Flatsats, Challenge Zero is all about gaining access to the ground station that they'll be using to communicate with their Flatsat.

43
01:05:08,040 --> 01:05:09,640
And again, this is not a simulation.

44
01:05:09,640 --> 01:05:19,440
All of these eight Flatsats may be here on Earth, but they're completely untethered, floating on a cushion of air, and each one being connected wirelessly from a separate radio link.

45
01:05:19,680 --> 01:05:25,340
In the first hour of gameplay, teams have been getting their bearings and working on solving Challenge Zero.

46
01:05:25,340 --> 01:05:32,880
In fact, just before this broadcast went live, we received word that this challenge was actually solved by Team Samurai.

47
01:05:33,040 --> 01:05:34,660
Congratulations to them.

48
01:05:34,660 --> 01:05:38,320
Let's go ahead and see a little bit more about Team Samurai.

49
01:06:07,720 --> 01:06:10,840
Team Samurai is a mainstay in the CTF community.

50
01:06:10,840 --> 01:06:18,040
In fact, one of the fun facts about this community is that I've competed against Samurai about as many times as I've actually competed with them.

51
01:06:18,040 --> 01:06:24,980
This community is tight-knit, people move around between them, and it's good to see them jump into the lead and take a start on the scoreboard.

52
01:06:24,980 --> 01:06:31,020
They're now going to be focusing on Challenge One, which we're going to give you a little bit of a hint on what that entails now.

53
01:06:43,160 --> 01:06:44,520
The Challenge.

54
01:06:44,520 --> 01:06:47,560
Teams must regain communication with a satellite.

55
01:06:57,790 --> 01:07:10,910
While this event was originally planned to be in-person during DEF CON in the Aerospace Village, thanks to the tireless efforts of dozens of people involved behind the scenes, we're instead streaming to you live throughout the event.

56
01:07:10,910 --> 01:07:19,890
Not only has the game itself been adapted to allow for remote participation from our eight teams over VPN, but the spectator experience has changed as well.

57
01:07:19,890 --> 01:07:23,450
There are many different ways you can now experience HackASAT.

58
01:07:23,510 --> 01:07:33,130
For a simpler interface, just visit hackasat.com with a web-based scoreboard, these periodic live updates streamed right in center, and links to other resources.

59
01:07:33,210 --> 01:07:48,270
For a more immersive experience, head over to virtual.hackasat.com, where you can get all of the above and more, including watching our satellites live via one of four dedicated webcam feeds, get more technical game data from the 3D Octagon scoreboard,

60
01:07:48,270 --> 01:07:58,690
as well as many other resources about our competitors, the flatsats, the technologies involved in space, and even communicate with other viewers in a dedicated chat and have a few social interactions.

61
01:07:58,930 --> 01:08:07,530
No need to remember all that just now though, all you have to remember is that you can find it all on hackasat.com and virtual.hackasat.com.

62
01:08:07,530 --> 01:08:14,630
The HackASAT team is also partnering with the Aerospace Village, one of the many villages you'd normally get to experience in person at DEF CON.

63
01:08:14,630 --> 01:08:21,290
After 15 years of attendance, I know I'm not the only one missing many of my friends and our hallway conversations at DEF CON.

64
01:08:21,650 --> 01:08:25,010
Hopefully, we can recreate a little bit of that experience here.

65
01:08:25,470 --> 01:08:34,910
In addition to all of that we have going on at HackASAT, make sure you check out the rest of what DEF CON, the Aerospace Village, and our friends over at Defense Digital Service are doing this weekend.

66
01:08:34,910 --> 01:08:42,110
And hope to see you back here as we check in on how our teams are doing and hear more about the vision behind HackASAT at our next update at 11 a.m.

67
01:08:42,110 --> 01:08:43,330
Pacific, 2 p.m.

68
01:08:43,330 --> 01:08:43,990
Eastern.

69
01:18:52,480 --> 01:18:53,880
Thanks for

70
01:20:21,550 --> 01:20:39,370
watching.

71
02:01:46,900 --> 02:01:48,300
And

72
02:01:51,680 --> 02:01:53,080
I hope to see you back here at 11 a.m.

73
02:01:53,080 --> 02:01:53,080
Pacific, 2 p.m.

74
02:01:53,080 --> 02:01:53,080
Eastern.

75
02:10:15,680 --> 02:10:16,200
Thanks for watching.

76
02:10:16,200 --> 02:10:20,200
And I hope to see you back here at 11 a.m.

77
02:10:20,320 --> 02:10:20,380
Pacific,

78
02:22:21,080 --> 02:22:21,140
2 p.m.

79
02:22:21,140 --> 02:22:21,140
Eastern.

80
02:46:43,720 --> 02:46:46,000
Thanks for watching.

81
02:46:46,000 --> 02:46:46,000
And

82
02:47:34,600 --> 02:47:37,540
I hope to see you back here at 11

83
02:48:42,560 --> 02:48:42,560
a.m.

84
02:48:42,560 --> 02:48:42,560
Pacific, 2 p.m.

85
02:48:42,560 --> 02:48:42,560
Eastern.

86
02:48:42,560 --> 02:48:43,560
And I hope to see you back here at 11 a.m.

87
02:48:43,560 --> 02:48:44,100
Pacific, 2 p.m.

88
02:48:44,100 --> 02:48:44,120
Eastern.

89
03:39:29,920 --> 03:39:30,020
Thanks for watching.

90
03:43:09,400 --> 03:43:09,920
And

91
03:51:02,720 --> 03:56:22,160
I hope to see you back here at 11 a.m.

92
03:56:22,160 --> 03:56:22,240
Pacific, 2 p.m.

93
03:56:22,240 --> 03:56:22,240
Eastern.

94
04:00:29,070 --> 04:00:29,710
Thanks for watching.

95
04:00:29,710 --> 04:00:30,890
Welcome back to HackASAT.

96
04:00:30,890 --> 04:00:33,150
I'm your host, Jordan Wines.

97
04:00:33,150 --> 04:00:40,030
Right after our last update ended with only a samurai solve, several other teams came in with solutions for Challenge Zero.

98
04:00:40,170 --> 04:00:44,890
PFS and SolarWine were solvers two and three on that challenge.

99
04:00:46,890 --> 04:00:51,590
Let's go ahead and take a look at those two teams and see what we know about them.

100
04:01:50,550 --> 04:01:57,110
I particularly enjoy the contrast between these two teams that joined samurai at the top of the leaderboard earlier today.

101
04:01:57,170 --> 04:02:03,650
SolarWine has decidedly not from a CTF background, whereas PFS definitely has a strong background in the CTF community.

102
04:02:03,650 --> 04:02:09,090
In fact, I only found out after they'd already qualified that I actually knew some of those members of that team.

103
04:02:09,090 --> 04:02:19,850
After those two teams scored on Challenge Zero, every other team was eventually able to solve Challenge Zero over the next several hours, though you'll notice on the scoreboard that some of them received less points.

104
04:02:20,490 --> 04:02:23,870
This is because each challenge has a degradation period.

105
04:02:23,870 --> 04:02:34,450
This means that for 30 minutes after the first solve, all other teams have a chance to score for full points, but after that, they only have an additional two hours to solve that particular challenge.

106
04:02:34,450 --> 04:02:39,410
During the two-hour period, the points available for that challenge slowly go to zero.

107
04:02:39,510 --> 04:02:47,710
While it puts the pressure on our teams to stay up with their peers, it means that no one can get stuck on a single challenge that leaves them behind for the entire event.

108
04:02:47,790 --> 04:02:54,410
At the end of that two-and-a-half-hour period, we give all teams our solution, though of course those old points are gone forever.

109
04:02:54,650 --> 04:02:57,690
This is primarily a facet of being a serial CTF.

110
04:02:57,690 --> 04:03:05,670
In many CTFs, challenges can be solved in parallel, so this was an attempt to keep the game going even if you get stuck on one challenge.

111
04:03:06,090 --> 04:03:11,190
Of course, one concern was that this would unfairly punish some teams in different time zones.

112
04:03:11,190 --> 04:03:19,210
Thankfully, we are only running the satellites for nine hours of gameplay each day, and it lines up fairly well with hacker standard time, anywhere from 4 p.m.

113
04:03:19,210 --> 04:03:21,190
to 1 a.m., depending on the team.

114
04:03:21,590 --> 04:03:28,730
One advantage of this particular scheme of point degradation is that we can explain in detail the solution for challenges that have expired.

115
04:03:28,730 --> 04:03:31,590
Here's our official explainer for Challenge Zero.

116
04:03:32,770 --> 04:03:36,730
Challenge Zero Here's what we know.

117
04:03:36,730 --> 04:03:41,750
An attacker has obtained access to the satellite's ground station through an internet-facing website.

118
04:03:41,750 --> 04:03:44,550
Once they obtained access, they kicked us out.

119
04:03:44,550 --> 04:03:45,530
The challenge?

120
04:03:45,530 --> 04:03:48,970
Teams must regain network access to the ground station.

121
04:03:49,050 --> 04:03:50,530
Here's how they do it.

122
04:03:50,530 --> 04:03:54,830
An internet-facing website exists on the same subnet as the ground station.

123
04:03:54,830 --> 04:04:03,290
Teams must identify and exploit a vulnerability in the web server, then use it as a foothold within the network to pivot to the ground station and gain access.

124
04:04:08,320 --> 04:04:14,240
So for Challenge Zero, teams first had to extract a key from the Ruby web service used to generate sessions.

125
04:04:14,240 --> 04:04:17,740
Then they used that to forge credentials to the service as an admin user.

126
04:04:17,820 --> 04:04:22,720
Finally, the admin page, they could actually find a piece of it where they could execute shell commands.

127
04:04:22,720 --> 04:04:26,160
They were sued, and there were some other intricacies they had to figure out.

128
04:04:26,160 --> 04:04:34,780
But eventually, they got a shell in the box, or they got access to an SSH key on that box, and that ultimately gave them connections to their Cosmos ground station.

129
04:04:34,940 --> 04:04:40,000
This is the machine that they would be using for the rest of the event to control their particular flatsats.

130
04:04:40,440 --> 04:04:44,860
They issue commands through the Cosmos server, goes over the RF link to their satellites.

131
04:04:45,260 --> 04:04:53,220
While Samurai had a head start with access to their server first, PFS was able to take the lead about an hour ago by solving Challenge One.

132
04:04:53,220 --> 04:05:03,240
As a reminder, the goal of Challenge One is to re-establish better communications with their flatsat, and we'll learn more about how they solved that once all teams have solved that challenge.

133
04:05:03,300 --> 04:05:09,720
Not to be up done, Poland Cannon to Space followed shortly thereafter, bringing them neck and neck for first and second.

134
04:05:09,820 --> 04:05:14,860
Poland Cannon to Space is actually a conglomeration of two teams, P4 and Dragon Sector.

135
04:05:46,140 --> 04:05:57,260
Both Dragon Sector and P4 are very recognizable names in the CTF community, with Dragon Sector having a pretty good claim maybe at one of the all-time winningest CTF teams, if not the most.

136
04:05:57,720 --> 04:06:01,400
And of course, P4 has done very, very well, especially this year in the competition.

137
04:06:01,980 --> 04:06:06,420
And of course, their team name itself is a reference to a funny webcomic that you should Google if you haven't seen it.

138
04:06:06,420 --> 04:06:08,000
It even has its own video game.

139
04:06:08,240 --> 04:06:21,560
If you're interested in some more of the history of these teams that have played CTFs before, make sure to check out ctftime.org, a website that actually tracks teams' performance across different events, and has a global yearly ranking system that's hotly contested.

140
04:06:22,100 --> 04:06:25,200
That's all for our next game update, but it's been a busy one.

141
04:06:25,780 --> 04:06:34,280
Next, HackASAT has been the work of many different organizations coming together, but the primary vision has come from two individuals that we wanted to let you hear from directly.

142
04:06:34,320 --> 04:06:35,340
They are Dr.

143
04:06:35,340 --> 04:06:40,620
Will Roper, Assistant Secretary for Acquisition Technology and Logistics, Department of the Air Force, and Mr.

144
04:06:40,620 --> 04:06:45,340
Brett Goldstein, Leader of the Rebel Alliance at the Pentagon, Director of Defense Digital Service.

145
04:06:46,080 --> 04:06:54,560
And they're joined by our intrepid interviewer, Roro, who will be asking them the hard-hitting questions in a segment we're calling Between Two Nerds.

146
04:07:07,800 --> 04:07:10,600
Welcome to Between Two Nerds.

147
04:07:10,600 --> 04:07:12,260
My name is Brett Goldstein.

148
04:07:12,260 --> 04:07:14,960
I'm the Director of the Defense Digital Service.

149
04:07:15,260 --> 04:07:16,420
And I'm Will Roper.

150
04:07:16,420 --> 04:07:19,980
I run all of the Air Force and Space Force programs.

151
04:07:19,980 --> 04:07:23,800
And we would like to introduce Roro, our moderator today.

152
04:07:23,800 --> 04:07:29,160
Roro is a member of the Defense Digital Service and has mad security skills.

153
04:07:29,160 --> 04:07:34,060
First things first, I wanted to ask you all the question that I've reached out to a bunch of hackers in the community about.

154
04:07:34,060 --> 04:07:38,820
And the most important thing that's on their minds right now is how do you attach the lanyard to the cassette tape?

155
04:07:38,820 --> 04:07:40,340
Well, that's a question for Dr.

156
04:07:40,340 --> 04:07:41,140
Roper, I think.

157
04:07:41,700 --> 04:07:42,400
Dr.

158
04:07:42,400 --> 04:07:44,800
Roper, considering your advanced work in this space...

159
04:07:46,720 --> 04:07:49,860
Well, I mean, first of all, there's a design issue here.

160
04:07:49,860 --> 04:07:54,240
So, whoever did this, you're fired if you're on the Air Force.

161
04:07:54,640 --> 04:07:58,340
Thing two, there's no place to immediately hook it.

162
04:07:58,340 --> 04:08:00,840
So, I'd say we just tie it.

163
04:08:00,940 --> 04:08:07,280
We just tie it here and then we hang it around our neck and get a better cassette next year, whoever did this.

164
04:08:07,280 --> 04:08:09,320
Do you have the duct tape?

165
04:08:09,320 --> 04:08:12,680
I mean, basically, if you have a small neck, you're okay.

166
04:08:12,680 --> 04:08:15,260
Like an actual duck.

167
04:08:15,260 --> 04:08:17,460
I could wear this if you don't have duct tape.

168
04:08:17,980 --> 04:08:24,200
So, the other question that has also been on their minds is why are y'all here at DEF CON safe mode?

169
04:08:24,480 --> 04:08:28,640
Sure, well, I mean, you had incriminating evidence on me, so I'm here.

170
04:08:29,400 --> 04:08:32,260
We're going to try to go flat the whole time, Roro.

171
04:08:32,260 --> 04:08:35,700
This is between two nerds, after all, the inaugural shooting.

172
04:08:35,720 --> 04:08:38,220
So , no laughter, no fun.

173
04:08:38,220 --> 04:08:39,460
This is serious business.

174
04:08:39,460 --> 04:08:41,800
We're hoping to be syndicated.

175
04:08:41,800 --> 04:08:43,100
Eventually.

176
04:08:43,160 --> 04:08:48,380
We can't afford ferns yet, but we're headed towards that next step.

177
04:08:48,380 --> 04:08:51,660
So , Roro, we need a bit more of a positive attitude on this.

178
04:08:51,660 --> 04:08:56,580
Like, as we think about sort of our future careers, there seems to be a lot of potential.

179
04:08:56,580 --> 04:08:58,820
Rho cubed today, Roro.

180
04:08:58,820 --> 04:09:03,620
So, Roro, in all seriousness, because we're being serious here between two nerds.

181
04:09:05,480 --> 04:09:07,700
Satellite security is a big deal.

182
04:09:08,060 --> 04:09:10,080
You know, all joking aside, it's a big deal.

183
04:09:10,080 --> 04:09:17,580
Our lives depend on space working in a benign, peaceful way that makes life better for everyone.

184
04:09:17,580 --> 04:09:20,900
You need it for the data that's coming to your phone right now.

185
04:09:20,900 --> 04:09:22,560
You need it for navigation.

186
04:09:22,560 --> 04:09:25,480
You even need it to get cash out of an ATM.

187
04:09:25,800 --> 04:09:30,120
Everyone's lives, as we sit here today, is connected to space.

188
04:09:30,280 --> 04:09:33,240
Well, you can imagine the military is no exception.

189
04:09:33,360 --> 04:09:35,060
We're connected to space.

190
04:09:35,060 --> 04:09:41,520
We use it to move planes from point A to point B, to guide weapons, to plan disaster relief missions.

191
04:09:41,540 --> 04:09:43,200
Everything we do.

192
04:09:43,480 --> 04:09:55,540
So, if you're thinking about a way to beat our military, holding space assets at risk is a pretty easy way to take a big leap forward in terms of your capabilities.

193
04:09:55,540 --> 04:10:00,320
And so we want to know if cyber is something we need to put more worry into.

194
04:10:00,320 --> 04:10:05,020
So we're here to see if people can hack a satellite, which we think they'll be able to.

195
04:10:05,020 --> 04:10:11,800
And we hope to learn from the community how to be better and more cyber resilient in systems we build in the future.

196
04:10:12,180 --> 04:10:18,900
As an international community of hackers and nerds, how can they help out?

197
04:10:18,900 --> 04:10:20,940
What is the call to action here if there is one?

198
04:10:20,940 --> 04:10:22,880
Sure, and I'm going to try to stay flat.

199
04:10:22,880 --> 04:10:25,180
But boy, it's really hard because I'm excited about this.

200
04:10:25,240 --> 04:10:27,100
Anyway, back to Between Two Nerds.

201
04:10:27,100 --> 04:10:30,420
Just being here and being interested is a huge deal.

202
04:10:30,420 --> 04:10:31,920
We want to learn from you.

203
04:10:31,920 --> 04:10:33,900
The military is here to learn.

204
04:10:34,700 --> 04:10:42,680
Historically, we have been secure by hiding behind our fence lines and keeping systems secret until they're used on the battlefield.

205
04:10:42,680 --> 04:10:44,460
Well, that doesn't work anymore.

206
04:10:44,460 --> 04:10:50,840
Software is increasingly the delineator in whether systems are dominant or out of the fight.

207
04:10:50,840 --> 04:11:00,640
So we're getting outside of our fence lines and involving communities that can help us, like DEFCON, to see if we need to up our game in cyber.

208
04:11:00,740 --> 04:11:12,080
And so if our satellites have to operate to make the military work the way it's supposed to, we want to expose opportunities to hack them ahead of us taking them into conflict.

209
04:11:12,080 --> 04:11:21,720
So what I hope to learn from DEFCON, from all the amazing community members here, is how good we are today and what we need to do to be better in the future.

210
04:11:21,760 --> 04:11:32,700
So the Department of Defense historically has operated cybersecurity through obscurity, and that is a culture that we're trying to change.

211
04:11:32,700 --> 04:11:39,760
So I'm fortunate I run the Defense Digital Service, which is affectionately known as a SWAT team of nerds.

212
04:11:39,760 --> 04:11:47,940
And we are out there, and we are trying to bring the very best in technical talent to the DoD.

213
04:11:47,940 --> 04:11:52,840
And part of that is about technology, but part of it is about culture.

214
04:11:52,840 --> 04:12:04,520
So when Will and I went to DEFCON last year, I'd been attending DEFCON for many years, but I brought Will, and I said to him, this is a community we need to embrace.

215
04:12:04,520 --> 04:12:09,940
And one, DoD does not need to be afraid of this community.

216
04:12:09,940 --> 04:12:12,340
These are folks who we should be friends with.

217
04:12:12,340 --> 04:12:15,400
But two, we need to raise our bar.

218
04:12:15,400 --> 04:12:17,580
We need to challenge our software.

219
04:12:17,600 --> 04:12:20,100
We need to try and test our systems.

220
04:12:20,100 --> 04:12:23,620
And by doing that, we bring the very best in cybersecurity.

221
04:12:23,800 --> 04:12:26,520
So I love this partnership.

222
04:12:26,680 --> 04:12:27,980
We learn a lot.

223
04:12:27,980 --> 04:12:29,420
We challenge ourselves.

224
04:12:29,420 --> 04:12:34,260
Sometimes we learn things that are hard, but this is a community we really want to embrace.

225
04:12:34,260 --> 04:12:40,580
So can you tell me a little bit more about how you got involved with the space, or what was the initial ask?

226
04:12:40,580 --> 04:12:45,220
So the first time I went to DEFCON, I was by myself.

227
04:12:45,340 --> 04:12:52,680
And I had recently left my first stint in government, and people were like, you have to go to DEFCON.

228
04:12:52,680 --> 04:13:00,720
And I went there, and I'm like, holy shit, there's a gazillion people here, there are crazy things going on, and people said, don't bring a phone in.

229
04:13:00,720 --> 04:13:05,040
And I was completely enamored with this community.

230
04:13:05,040 --> 04:13:23,960
And then I came to DoD, and as we're trying to change this culture, which is an obscurity culture, a security by checklist, I'm like, this is a community that can help make us smarter, and help us, again, raise the bar, even against ourselves.

231
04:13:23,960 --> 04:13:39,200
So by bringing Will, and then showing all of the crazy cool things that we're doing, it allowed for that DDS Air Force relationship, which we could then come back and try and do some really cool things.

232
04:13:39,340 --> 04:13:48,220
And the funny part was last year, when DEFCON was winding up, I go to Will, and I'm like, we should go back.

233
04:13:48,220 --> 04:13:50,040
And Will's like, yeah, we should go back.

234
04:13:50,040 --> 04:13:51,880
And I'm like, what do you think we should do?

235
04:13:51,880 --> 04:13:55,620
And DoD's like, we should bring a satellite.

236
04:13:55,660 --> 04:13:57,100
And that was crazy.

237
04:13:57,100 --> 04:13:58,580
But now it's real.

238
04:13:58,820 --> 04:14:04,260
Yeah, it's great when crazy and real can be the same inside the Pentagon.

239
04:14:04,480 --> 04:14:12,620
And Brett's exactly right, that this is a community that the Department and the Pentagon have been afraid of embracing.

240
04:14:13,440 --> 04:14:17,380
Partly because it's an old Cold War culture that's just behind the times.

241
04:14:17,380 --> 04:14:23,640
And another is simply because it doesn't get outside of its five-sided walls very often.

242
04:14:23,640 --> 04:14:26,640
And my first trip to DEFCON was amazing.

243
04:14:26,640 --> 04:14:28,880
I'm a string theorist by background.

244
04:14:28,880 --> 04:14:30,100
I work in physics.

245
04:14:30,100 --> 04:14:33,500
I crossed over into defense for really weird reasons.

246
04:14:33,500 --> 04:14:42,280
But it's been an awesome job of getting to run $60 billion of satellites and airplane and cyber capabilities every year.

247
04:14:42,280 --> 04:14:48,940
As I look at this amazing portfolio of programs, everything is driven by software.

248
04:14:49,080 --> 04:15:02,920
And the United States government and our amazing men and women in uniform have put so much time and treasure into these amazing military systems that increasingly operate based on their software.

249
04:15:02,920 --> 04:15:11,740
So if you're looking to defeat us, you don't have to recreate the same systems, build a fighter to match ours, build a satellite to match ours.

250
04:15:11,740 --> 04:15:13,900
You just need to be able to hack us.

251
04:15:13,940 --> 04:15:29,900
And so I came last year wanting to see could people who have a great amount of expertise but not a lot of hands-on capability inside the military get inside a system like an F-15 fighter or the systems that enable it.

252
04:15:29,900 --> 04:15:34,380
And so we brought some of those enabling systems and the hacker community got in.

253
04:15:34,380 --> 04:15:37,180
But getting in was not the point of being here.

254
04:15:37,180 --> 04:15:40,100
It was the learning that happened afterwards.

255
04:15:40,180 --> 04:15:47,520
The hacker community got to learn something about our military systems and we left knowing how to make them more secure.

256
04:15:47,640 --> 04:15:50,240
And so we want to do the same thing for satellites.

257
04:15:50,240 --> 04:15:55,940
It's a very different problem than handing you a piece of hardware and saying, can you get in?

258
04:15:55,940 --> 04:16:01,240
The satellite isn't here, it's overhead, moving at 7 kilometers a second.

259
04:16:01,240 --> 04:16:08,760
And it only talks to the ground at certain places where we have a ground station that uplinks and downlinks different commands.

260
04:16:08,760 --> 04:16:12,400
This is a wicked hard problem.

261
04:16:12,560 --> 04:16:15,920
But I expect the DEFCON community is going to get in again.

262
04:16:15,920 --> 04:16:19,400
And the question we're going to ask is what should we learn?

263
04:16:19,400 --> 04:16:20,920
What should we do better?

264
04:16:20,920 --> 04:16:26,920
Because cyber is something any country, any terrorist group can try to do against our military.

265
04:16:26,920 --> 04:16:32,120
It's quicker, easier, and more seductive than trying to take us head on.

266
04:16:32,120 --> 04:16:37,160
So this dark side of the force is something we're going to have to be able to defeat.

267
04:16:37,160 --> 04:16:40,300
And we're here to learn from people who know a lot more than we do.

268
04:16:51,420 --> 04:16:57,460
For the F-15 system, it was really to probe just how many different ways do people get in.

269
04:16:57,460 --> 04:16:59,300
Do we have a design flaw?

270
04:16:59,300 --> 04:17:00,760
Is it a design flaw?

271
04:17:00,760 --> 04:17:06,880
Is it a hardware flaw where we've got embedded systems that have back doors that can be accessed?

272
04:17:06,940 --> 04:17:10,340
Is it a software flaw or is it a little bit of all of the above?

273
04:17:10,540 --> 04:17:12,420
It's a little bit of all of the above.

274
04:17:12,680 --> 04:17:17,500
And so after doing a meeting with the hackers that got in, they walked through.

275
04:17:17,500 --> 04:17:18,820
I tried this and it worked.

276
04:17:18,820 --> 04:17:20,700
Then I tried this next path and it worked.

277
04:17:20,700 --> 04:17:32,560
And just like electricity always flowing through the path of least resistance, they kept trying methods that got increasingly harder, but they didn't have to pull their toughest tricks to get in.

278
04:17:32,680 --> 04:17:45,980
So the direction I think we're going, that we ought to go, is fully embracing the hacker community at DEF CON and not waiting until systems are built to create opportunities to learn and help us learn.

279
04:17:45,980 --> 04:17:50,840
We should bring the hacker community into systems as we design them.

280
04:17:50,840 --> 04:17:54,600
Help us make them more secure before we're producing them.

281
04:17:54,600 --> 04:17:56,900
And I think this could be win-win.

282
04:17:56,900 --> 04:18:05,640
We would learn a ton from this community, but also create some of the most interesting challenges because the systems we build are unique.

283
04:18:05,640 --> 04:18:16,060
They have some pretty amazing technology in them and I think the opportunity for the hacker community to get new hands-on experience would also be really energizing and cool.

284
04:18:16,060 --> 04:18:26,560
So events like HackASAT are awesome live events, but the relationship and continuing it across a broader set of opportunities is what's more exciting.

285
04:18:26,560 --> 04:18:37,560
There's an interesting synergy between, one, the hacker community can touch devices you never would think you'd be allowed to touch.

286
04:18:37,560 --> 04:18:42,920
Weapons, satellites, all the things that are pretty cool.

287
04:18:42,920 --> 04:18:49,980
It also helps us learn commonalities where we build a lot of different things.

288
04:18:50,040 --> 04:18:57,360
And by learning those base cases of things we should do and should not do, that helps the design.

289
04:18:57,360 --> 04:19:03,800
But at the same time, people need to understand that there's a creativity to hacking.

290
04:19:03,800 --> 04:19:09,760
We often in the military, we think about checklists and spreadsheets and things like that.

291
04:19:09,760 --> 04:19:16,040
But I know people who have done red team and hacking exercises, it's much more of an art.

292
04:19:16,040 --> 04:19:20,320
And we want to bring that art into making our system safer.

293
04:19:21,000 --> 04:19:24,940
So we started this planning a little bit last year and then COVID hit.

294
04:19:24,940 --> 04:19:26,540
How did that change the plans?

295
04:19:28,620 --> 04:19:33,120
So there were moments where it was insanely stressful.

296
04:19:33,120 --> 04:19:39,620
Where it's, we are charging ahead and I'm sitting there, oh my God, what's going to happen with DEF CON?

297
04:19:39,620 --> 04:19:45,100
But then we realized we're perfectly situated for a virtual event.

298
04:19:45,200 --> 04:19:47,340
We have a VR environment.

299
04:19:47,340 --> 04:19:49,220
We have all of these workshops.

300
04:19:49,340 --> 04:19:52,460
Everything is now accessible from anywhere.

301
04:19:52,460 --> 04:19:59,240
And where I think it's really interesting is we can now provide access to these workshops at a much larger scale.

302
04:19:59,240 --> 04:20:04,880
Whereas last year, like the workshops were awesome, but we were swamped.

303
04:20:04,880 --> 04:20:13,560
But now in the VR environment, we can take thousands of people and also for access to the actual hack a set on event.

304
04:20:13,820 --> 04:20:17,280
It's open to the world now and it's going to be super cool.

305
04:20:17,300 --> 04:20:20,980
So a little anxiety, but we are good to go.

306
04:20:20,980 --> 04:20:22,400
And I'm really excited.

307
04:20:22,620 --> 04:20:28,000
I'm more excited about the virtual event than I would have been doing a live event at DEF CON.

308
04:20:28,000 --> 04:20:42,140
And don't get me wrong, it would be awesome to have an event, live event with people attending, being able to shake hands and give high fives to the team that pull off what is going to be a very difficult challenge.

309
04:20:42,300 --> 04:20:54,180
But the virtual event is going to allow so many more people to be part of this experience, part of the community that gets to attempt this for the very first time at DEF CON.

310
04:20:54,180 --> 04:21:03,720
And I am so much more excited about a bigger community than I am about putting up a stage at Las Vegas and then taking it down after the event is over.

311
04:21:03,720 --> 04:21:09,360
We got to do this a few months ago when we were kicking off our flying car program.

312
04:21:09,360 --> 04:21:16,080
Long story, but pretty awesome that we're creating a new initiative to accelerate flying cars for the country.

313
04:21:16,180 --> 04:21:21,460
Well, that program was supposed to be a major kickoff at South by Southwest, which canceled.

314
04:21:21,460 --> 04:21:24,140
And we had to decide, what do we do?

315
04:21:24,140 --> 04:21:31,340
Well, we kept the event rolling through a virtual event and had over 60,000 people participate.

316
04:21:31,340 --> 04:21:40,280
We would have never had that number be able to make it down to Austin and get to an event that could probably hold no more than 2,000 tops.

317
04:21:40,340 --> 04:21:45,480
So the potential for a greater community is huge doing the event this way.

318
04:21:45,480 --> 04:21:56,320
We will still get all of the cool factor from multiple hacker teams having the opportunity to let their code run live in space, which is just an awesome opportunity.

319
04:21:56,420 --> 04:21:57,960
But imagine this, Roro.

320
04:21:57,960 --> 04:22:03,040
We had over 2,000 different teams just go through the qualls.

321
04:22:03,040 --> 04:22:08,800
We had over 6,000 people who have already raised their hand to be a hands-on participant.

322
04:22:08,800 --> 04:22:12,380
So who knows how many people will tune in during this week.

323
04:22:12,380 --> 04:22:18,180
But the opportunity to have a broad group of people is the most exciting thing about being virtual.

324
04:22:18,180 --> 04:22:22,960
And I hope everyone that is logging in and participating, I hope that you're safe and well.

325
04:22:22,960 --> 04:22:29,920
So we're super excited that besides HackASet, we are also having a series of workshops.

326
04:22:30,020 --> 04:22:32,380
We have bricks in the air again.

327
04:22:32,580 --> 04:22:34,940
We have a ground station exercise.

328
04:22:34,940 --> 04:22:40,500
Now, the thing that's important here is HackASet was extraordinarily competitive.

329
04:22:40,500 --> 04:22:46,620
As Will mentioned, thousands of folks tried out for it and it got narrowed down to eight.

330
04:22:46,760 --> 04:22:48,740
Eight teams, that's right.

331
04:22:48,760 --> 04:22:52,680
And so we have eight rockstar teams doing that.

332
04:22:52,680 --> 04:22:59,220
But part of what we want to do here is help people learn about the variety of technologies.

333
04:22:59,220 --> 04:23:04,320
Because what's really interesting to me is this is a different type of hacking.

334
04:23:04,320 --> 04:23:11,060
This is not your traditional going after a web property or a traditional software app.

335
04:23:11,060 --> 04:23:13,600
There's a new set of skills to learn.

336
04:23:13,600 --> 04:23:21,380
So we have workshops all available via VR, ranging from beginner level all the way up to advanced.

337
04:23:21,380 --> 04:23:26,760
Because we want to help you learn more about the tooling and the skills you need for these types of systems.

338
04:23:26,760 --> 04:23:32,860
And then when you get toward advanced, then you'll be ready to work on the HackASet type of events.

339
04:23:32,860 --> 04:23:35,300
So we have the full stack ready for you.

340
04:23:35,460 --> 04:23:44,900
One of my favorite comments coming out of one of the teammates that participated in the quals was, I didn't know I needed a degree in physics to hack a satellite.

341
04:23:45,140 --> 04:23:49,960
We don't actually need the degree, but you do need to know a little about physics to hack it.

342
04:23:49,960 --> 04:23:56,320
And part of the purpose of these workshops are to introduce the peculiar new trade craft that will be needed.

343
04:23:56,320 --> 04:24:03,680
So that you can take hacker skills you have today and apply them to these very different opportunities in space and in the air.

344
04:24:03,900 --> 04:24:08,520
So I think we really crushed doing the virtual piece.

345
04:24:08,520 --> 04:24:10,420
What do we do about stickers?

346
04:24:10,880 --> 04:24:13,420
Like the whole Defcon sticker swap?

347
04:24:14,100 --> 04:24:15,500
A little stressful.

348
04:24:15,900 --> 04:24:18,000
Maybe we could do them like Bitcoin.

349
04:24:18,620 --> 04:24:20,600
Crypto coins, that could be the new...

350
04:24:20,600 --> 04:24:22,140
Because I can't get coins out right now.

351
04:24:22,140 --> 04:24:23,320
I have a bunch in my office.

352
04:24:23,760 --> 04:24:27,020
So we can mail them, but crypto coins could be the wave of the future.

353
04:24:27,080 --> 04:24:30,020
Yeah, for everyone watching, everyone in the Pentagon has coins.

354
04:24:30,020 --> 04:24:35,180
They're things that you give out when someone's really done something great or helped you out.

355
04:24:35,180 --> 04:24:40,460
So it goes well back in military tradition, but you give them out via handshake.

356
04:24:40,460 --> 04:24:45,020
With the coin in your hand, you shake hands, it transfers from one person to the other.

357
04:24:45,020 --> 04:24:50,340
So COVID-19 has put a serious dent in this time-honored tradition.

358
04:24:50,360 --> 04:24:52,320
So crypto coins...

359
04:24:52,320 --> 04:24:53,820
You throw the coin first, right?

360
04:24:53,820 --> 04:24:55,580
But then it gets... it's a hot mess.

361
04:24:55,580 --> 04:24:56,600
It's even worse than that.

362
04:24:56,600 --> 04:25:01,720
We have them in little plastic bags, and we dump them from one hand to the other.

363
04:25:01,720 --> 04:25:04,560
It completely has lost the sense of ceremony.

364
04:25:05,000 --> 04:25:07,540
Tap it in the bag first, and then dump them in the hands?

365
04:25:07,720 --> 04:25:12,200
There's no way to say, congratulations, stick out your hand, and then dump a coin in it.

366
04:25:12,240 --> 04:25:16,200
The firm handshake is needed to say, thank you for what you've done.

367
04:25:27,350 --> 04:25:30,190
I thought it was interesting last year.

368
04:25:31,150 --> 04:25:35,830
The expectation of DoD was sadly pretty low.

369
04:25:36,470 --> 04:25:44,490
Expecting someone in a suit, expecting someone in a uniform, who would not engage this community.

370
04:25:44,490 --> 04:25:52,010
And I remember after we gave a talk last year, a bunch of folks came up and they're like, you're not what we expected.

371
04:25:52,010 --> 04:25:55,230
And you're doing super cool shit.

372
04:25:55,230 --> 04:25:57,050
How can we help?

373
04:25:57,050 --> 04:26:00,810
And those are the discussions we want to have.

374
04:26:00,810 --> 04:26:03,370
Because Will and I are constantly worried.

375
04:26:03,370 --> 04:26:08,770
We're constantly working to raise the bar and make things better.

376
04:26:08,770 --> 04:26:12,470
But we need that level of expertise and partnerships.

377
04:26:12,470 --> 04:26:16,710
So I was thrilled that last year we could go directly engage.

378
04:26:16,710 --> 04:26:22,890
Show that we aren't what you expect, and we do really, really cool things.

379
04:26:23,250 --> 04:26:26,050
And the opportunities are really broad.

380
04:26:26,050 --> 04:26:33,770
So if someone's out thinking, well, I'm interested in helping the military, but I don't know if I want to work on a weapons system.

381
04:26:33,910 --> 04:26:37,050
Every technology under the sun is part of the military.

382
04:26:37,050 --> 04:26:40,650
We do disaster relief every year during the hurricane season.

383
04:26:40,650 --> 04:26:46,770
The Air Force is flying planes in to move people that are under stress and deliver supplies.

384
04:26:46,770 --> 04:26:51,630
And that is a major part of what the military does that doesn't make the news.

385
04:26:51,630 --> 04:26:57,590
We work in energy, we work in medicine, providing a lot of frontline responders to COVID-19.

386
04:26:57,810 --> 04:27:00,670
All of this is empowered by software.

387
04:27:00,670 --> 04:27:05,950
We need digital experts who want to help us take our game to the next level.

388
04:27:05,970 --> 04:27:11,390
So no matter what you are interested in working with us on, the opportunity is there.

389
04:27:11,390 --> 04:27:17,530
And we will be here year after year at DEFCON bringing opportunities for you to participate in our mission.

390
04:27:17,590 --> 04:27:20,510
Learn more about us so that we can learn from you.

391
04:27:20,510 --> 04:27:28,130
So when we were building mysymptoms.mil earlier this year, which is part of our COVID-19 response.

392
04:27:28,130 --> 04:27:32,610
Before we let it out the door, we reached out to someone in the DEFCON community.

393
04:27:32,610 --> 04:27:35,790
Because that needs to be part of our culture.

394
04:27:36,110 --> 04:27:38,870
We're creating software, we think it's pretty good.

395
04:27:38,870 --> 04:27:42,630
We have a pretty good SWAT team, but we want those outside eyes.

396
04:27:42,630 --> 04:27:46,610
And this is for something, COVID-19 is something that's bringing us all together.

397
04:27:46,610 --> 04:27:49,510
And that's a perfect example of community engagement.

398
04:27:49,510 --> 04:27:52,290
And we tightened it up and we got it out the door.

399
04:27:52,750 --> 04:27:55,970
From my view, the defense companies mirror the government.

400
04:27:55,970 --> 04:28:00,890
And the government is slow and 20 years, if not more, behind the time.

401
04:28:00,910 --> 04:28:04,030
So it has to start with the government leading the dance.

402
04:28:04,030 --> 04:28:10,010
And having more people who have technical backgrounds who don't look like what you expect in the Pentagon.

403
04:28:10,010 --> 04:28:14,890
Start bringing in new ideas, new technologies, and just a new culture.

404
04:28:14,890 --> 04:28:17,610
And that's part of why we're here as part of DEFCON.

405
04:28:17,610 --> 04:28:24,390
And part of why we're talking with you through a very different venue than you normally get out of this five-sided building.

406
04:28:24,390 --> 04:28:26,070
So that's step one.

407
04:28:26,070 --> 04:28:27,850
The government's got to change.

408
04:28:27,850 --> 04:28:30,850
Step two is government doesn't make much.

409
04:28:30,850 --> 04:28:34,010
We have amazing airmen who write code for us every day.

410
04:28:34,010 --> 04:28:39,370
And sci-fi inspired organizations called Kessel Run, Kobayashi Maru.

411
04:28:39,370 --> 04:28:46,490
And 60 more names covering the sci-fi and comic book universe.

412
04:28:46,490 --> 04:28:52,250
They're awesome teams, but they're a small component of what industry provides.

413
04:28:52,250 --> 04:28:53,450
We don't build airplanes.

414
04:28:53,450 --> 04:28:55,610
We don't build satellites ourselves.

415
04:28:55,610 --> 04:28:56,730
Rarely.

416
04:28:56,810 --> 04:29:00,070
And so if industry doesn't learn to adopt these new techniques.

417
04:29:00,070 --> 04:29:05,810
If they don't become better at software and shift to new trends and development like containerization.

418
04:29:05,810 --> 04:29:12,990
And shift to open approaches to determining errors in code like bug bounties and open sourcing of code.

419
04:29:13,030 --> 04:29:16,190
Then we will continue to be further and further behind the times.

420
04:29:16,190 --> 04:29:19,030
And ultimately, our model's got to be hybrid.

421
04:29:19,070 --> 04:29:21,310
We won't open source all of our code.

422
04:29:21,310 --> 04:29:24,770
We will always have things we reserve for conflict.

423
04:29:24,770 --> 04:29:27,210
But we don't open source anything today.

424
04:29:27,210 --> 04:29:30,330
We did that for the first time this year.

425
04:29:30,330 --> 04:29:35,590
The first time we have open source code that's needed for operations.

426
04:29:35,590 --> 04:29:39,870
I expect that's the most secure code we have right now in the Air Force.

427
04:29:39,870 --> 04:29:41,010
So what's next?

428
04:29:41,010 --> 04:29:45,150
The question I have for industry is what's next?

429
04:29:45,150 --> 04:29:47,810
And when are you going to be part of the solution?

430
04:29:48,310 --> 04:29:51,450
There's a cultural piece we need to get at here.

431
04:29:51,450 --> 04:29:54,950
A couple things that drive me crazy.

432
04:29:54,950 --> 04:29:57,410
One, good enough for government work.

433
04:29:57,410 --> 04:29:59,450
Like that is absolute bullshit.

434
04:30:00,090 --> 04:30:01,270
End of sentence.

435
04:30:01,350 --> 04:30:06,590
Two is, you know, Will mentioned that government is behind.

436
04:30:06,590 --> 04:30:08,230
How is that okay?

437
04:30:08,510 --> 04:30:13,610
And this is one of the reasons I left the private sector and came into government.

438
04:30:13,610 --> 04:30:17,230
Because we can't be okay with this.

439
04:30:17,230 --> 04:30:21,110
So part of what Will and I do is reset this culture.

440
04:30:21,270 --> 04:30:25,750
And challenge ourselves, never have acceptance for that.

441
04:30:25,950 --> 04:30:29,370
Because neither one of those statements make any sense to me.

442
04:30:29,450 --> 04:30:31,090
So do you both have tenure in your jobs?

443
04:30:31,090 --> 04:30:33,470
Because this seems like a really bad idea.

444
04:30:33,910 --> 04:30:35,610
The hacking satellites...

445
04:30:37,710 --> 04:30:42,150
Well, as long as it doesn't come crashing down through the roof anytime soon.

446
04:30:42,150 --> 04:30:45,470
We're probably going to make it a few months more.

447
04:30:46,390 --> 04:30:50,150
I will say we've taken extraordinary security precautions.

448
04:30:50,150 --> 04:30:54,830
To make sure that everything is going to be okay up in orbital land.

449
04:30:54,970 --> 04:30:58,510
But we are going to let teams move the satellite.

450
04:30:58,530 --> 04:31:02,050
So not move it in a translational sense.

451
04:31:02,050 --> 04:31:04,810
But we're going to let teams rotate it.

452
04:31:04,810 --> 04:31:08,550
And if they're good enough and they can do their orbital mechanics quickly enough.

453
04:31:08,550 --> 04:31:11,050
We're asking them to take a picture of the moon.

454
04:31:11,050 --> 04:31:16,030
So what we hope to send out to the hacker community is a wonderful image of the moon.

455
04:31:16,150 --> 04:31:19,410
Brought courtesy of the hacker team that won.

456
04:31:19,450 --> 04:31:25,750
So that's a pretty, pretty awesome opportunity to have that code actually change something in orbit.

457
04:31:25,810 --> 04:31:31,870
But we've taken extraordinary procedures to make sure that's all that that code will be able to do.

458
04:31:32,170 --> 04:31:34,950
But Auro, your question is actually an important one.

459
04:31:34,950 --> 04:31:39,730
So in terms of tenure, no, I have no idea how long I have in this job.

460
04:31:39,730 --> 04:31:42,510
I came into defense through happenstance.

461
04:31:42,510 --> 04:31:45,490
Worked for a couple of secretaries of defense.

462
04:31:45,630 --> 04:31:50,510
Built a lot of awesome systems, very few of which I can talk about.

463
04:31:50,510 --> 04:31:54,950
But amazing capabilities, swarming things, etc.

464
04:31:55,090 --> 04:31:58,350
Made with a lot of incredible men and women in uniform.

465
04:31:58,350 --> 04:32:04,630
But crossing over into this job, running all the Air Force and Space Force programs, which is an awesome job.

466
04:32:04,630 --> 04:32:06,450
If you're ever asked to do it, say yes.

467
04:32:06,450 --> 04:32:13,890
Because you get all of these amazing technologies, satellites and airplanes and cyber tools and amazing people to work with.

468
04:32:14,090 --> 04:32:18,310
But you only get to be in the job as long as you're asked to do it.

469
04:32:18,310 --> 04:32:21,310
And so my tenure could be very short.

470
04:32:21,350 --> 04:32:30,730
And what I hope, what I pray for the Pentagon is that people in leadership will keep asking technical people to come and serve.

471
04:32:30,730 --> 04:32:36,250
So if you're out there thinking, I'd love to be part of an Air Force hacking team, then come find us.

472
04:32:36,250 --> 04:32:36,970
Come join us.

473
04:32:36,970 --> 04:32:44,190
If you want to be part of Defense Digital Service, which would be an amazing job where you wouldn't have to wear a suit to work every day.

474
04:32:44,190 --> 04:32:45,110
Come join them.

475
04:32:45,110 --> 04:32:48,970
Be one of the squadron of nerds.

476
04:32:48,970 --> 04:32:49,650
I'm using Air Force.

477
04:32:49,650 --> 04:32:51,270
Can you be a squadron of nerds?

478
04:32:51,270 --> 04:32:54,070
So the squadron of nerds is part of the SWAT team of nerds?

479
04:32:54,230 --> 04:32:56,410
Squadron of nerds would be like the Air Force.

480
04:32:56,410 --> 04:32:57,510
We're all squadrons.

481
04:32:57,510 --> 04:33:00,270
So we could have like an auxiliary squadron of nerds.

482
04:33:00,770 --> 04:33:02,170
Well, there you go.

483
04:33:02,170 --> 04:33:04,270
But take the opportunity up.

484
04:33:04,270 --> 04:33:05,690
You won't be sorry.

485
04:33:05,690 --> 04:33:12,930
But that's ultimately the trend we need are people that have technical talent who don't want to work in the government forever.

486
04:33:13,150 --> 04:33:23,310
But that say, you know, for for one, two, three years, I want to go take on some new opportunities for the government to make it easy and energizing to do that.

487
04:33:23,750 --> 04:33:26,090
So I'm I'm here on a two year tour.

488
04:33:26,090 --> 04:33:27,650
I am halfway through.

489
04:33:27,650 --> 04:33:33,150
But the story is like I'm part of the story, but I'm not the story.

490
04:33:33,150 --> 04:33:35,310
I'm part of an 80 person team.

491
04:33:35,310 --> 04:33:39,170
And this is the best team I've ever been part of.

492
04:33:39,170 --> 04:33:44,350
And there will be another director after me who will represent the team.

493
04:33:44,350 --> 04:33:49,110
But every day, the SWAT team of nerds goes out and works on projects.

494
04:33:49,110 --> 04:33:52,990
You really you can't believe it makes insane impact.

495
04:33:53,070 --> 04:33:54,870
So I'll do my two years.

496
04:33:54,870 --> 04:33:59,510
And but the mission will go on and the team will continue to rock.

497
04:33:59,890 --> 04:34:03,830
I can see if the Air Force can make DDS an honorary squadron.

498
04:34:03,830 --> 04:34:05,010
That'd be cool.

499
04:34:05,010 --> 04:34:06,870
I'm taking that action.

500
04:34:06,930 --> 04:34:09,190
Colonel Bailey, action taken.

501
04:34:09,690 --> 04:34:10,690
That's a colonel.

502
04:34:10,690 --> 04:34:12,970
Colonel, I just promoted you to Colonel Captain Bailey.

503
04:34:12,970 --> 04:34:14,110
Action taken.

504
04:34:14,390 --> 04:34:16,210
Can can.

505
04:34:16,210 --> 04:34:18,090
Does that mean we can go to space?

506
04:34:19,170 --> 04:34:20,170
This is important.

507
04:34:20,170 --> 04:34:22,190
Can we just work this through?

508
04:34:23,150 --> 04:34:26,850
I think astronaut training should be required for that, Brad.

509
04:34:27,070 --> 04:34:31,270
So I was watching Picard with the kids last night.

510
04:34:31,670 --> 04:34:34,510
And they have that transport thing.

511
04:34:34,510 --> 04:34:37,150
I figured somewhere in the classified portfolio.

512
04:34:37,630 --> 04:34:38,810
We're working it.

513
04:34:38,810 --> 04:34:39,490
OK.

514
04:34:39,770 --> 04:34:42,050
So if that works, can I go to space?

515
04:34:42,050 --> 04:34:46,850
It's right next to the warp drive, right next to the photon torpedo.

516
04:34:46,850 --> 04:34:52,550
So yes, when we've got teleportation done, Brad, I will personally teleport you up to the space station.

517
04:34:52,690 --> 04:34:53,590
Got it.

518
04:34:53,690 --> 04:34:55,250
How's the food up there?

519
04:34:56,170 --> 04:34:58,170
NASA provides that, so I don't know.

520
04:34:58,970 --> 04:35:00,910
Do you think there are any gummy products?

521
04:35:00,910 --> 04:35:03,030
I'm going to guess... oh, I don't know, Brad.

522
04:35:03,030 --> 04:35:06,010
Because gummy products have a high degree of water content.

523
04:35:06,010 --> 04:35:08,290
And all that's going to outgas.

524
04:35:08,370 --> 04:35:11,610
So how would mayonnaise perform in space?

525
04:35:11,610 --> 04:35:12,490
Not well.

526
04:35:12,890 --> 04:35:14,190
That's a critical issue.

527
04:35:14,190 --> 04:35:14,910
Not well.

528
04:35:14,910 --> 04:35:21,650
So you'd have to get at least a pressure-sealed vessel, but all things we can work on.

529
04:35:21,650 --> 04:35:22,930
Science never stops.

530
04:35:22,930 --> 04:35:27,830
I'm a little fussy about mayonnaise, so we'd want to work that through before the transporter.

531
04:35:27,830 --> 04:35:31,370
So spam sandwiches not going to be on your list for astronaut?

532
04:35:31,370 --> 04:35:31,790
No.

533
04:35:31,790 --> 04:35:32,690
And a tank?

534
04:35:33,210 --> 04:35:34,050
No, no.

535
04:35:34,050 --> 04:35:40,090
I was figuring... well, I am fussy about the mayonnaise, but you can actually put mayonnaise with most foods.

536
04:35:40,910 --> 04:35:42,530
Just something to ponder.

537
04:35:53,200 --> 04:35:58,860
So I'm often asked, why don't we have more artificial intelligence in the Air Force than we do today?

538
04:35:58,860 --> 04:36:01,660
Something I'm working very hard to change.

539
04:36:01,760 --> 04:36:06,100
Well, one is it's really hard to certify something that changes all the time.

540
04:36:06,100 --> 04:36:16,420
But what isn't well understood in the Pentagon, and I find through the country as a whole, is that artificial intelligence is very fragile in the face of an adversary.

541
04:36:16,420 --> 04:36:18,280
It's very easy to beat.

542
04:36:18,280 --> 04:36:30,820
And so we need to get into the game more and bring the DEFCON and the hacker community into our world and give them opportunities to start beating AI ahead of those opportunities being available commercially.

543
04:36:30,820 --> 04:36:35,200
So that's where I'd like to see us go, is into algorithmic defeat.

544
04:36:35,200 --> 04:36:38,360
Because that's the next generation of warfare.

545
04:36:38,360 --> 04:36:44,040
And the earlier we can determine how to make it safe and secure, the better off everyone's going to be.

546
04:36:44,840 --> 04:36:49,420
So I think you'll find that we're good listeners.

547
04:36:49,560 --> 04:36:51,580
So we have ideas.

548
04:36:51,580 --> 04:36:55,680
We just talked about AI and potential issues with that.

549
04:36:55,680 --> 04:36:57,800
We're talking about satellites now.

550
04:36:57,800 --> 04:37:00,000
But we're curious what you think.

551
04:37:00,000 --> 04:37:12,380
What are things, whether design flaws we should be thinking about, which can be really portable, or other types of exploits that might not be on our radar.

552
04:37:12,380 --> 04:37:15,280
So we'd love to just hear your thoughts.

553
04:37:15,280 --> 04:37:16,800
We're going to listen.

554
04:37:17,760 --> 04:37:20,480
And tell us things we don't know.

555
04:37:20,480 --> 04:37:23,980
Or tell us about challenges which are really hard.

556
04:37:23,980 --> 04:37:28,480
Like, a year ago, hacking a satellite felt pretty hard.

557
04:37:28,480 --> 04:37:29,980
But we're there now.

558
04:37:29,980 --> 04:37:36,600
What is a really hard one that you're thinking about, that we can challenge ourselves for, for next year?

559
04:37:36,740 --> 04:37:39,740
Why did you pick Steve Carell for Space Force?

560
04:37:43,600 --> 04:37:47,340
I mean, you have to love Steve Carell, right?

561
04:37:47,340 --> 04:37:49,800
I mean, I'm such a huge Office fan.

562
04:37:49,800 --> 04:37:54,140
And so when that came out, I thought, you know, money just because of that.

563
04:37:54,140 --> 04:38:14,520
But on the whole, when I get to talk Space Force, beyond the hype and, you know, the glitz that the public media often shine on it, it gets really simple to explain that, you know, do you think that adversaries will try to take on the military in space,

564
04:38:14,520 --> 04:38:20,060
given we have a ton of communications and navigation satellites?

565
04:38:20,160 --> 04:38:25,800
Satellites of all kinds, whose data we pump to the systems we take into a fight.

566
04:38:25,800 --> 04:38:28,400
Everyone says, well, yeah, of course, no duh.

567
04:38:28,640 --> 04:38:33,720
Well, if we think adversaries are going to challenge us there, then we've got to be ready there.

568
04:38:33,720 --> 04:38:39,960
But fighting in space is going to be really different than fighting in the air, on the sea, or under it.

569
04:38:39,980 --> 04:38:46,920
It's a domain that's governed almost entirely by physics in a way that makes it predictable.

570
04:38:46,960 --> 04:38:55,100
We know where satellites are going to be minute by minute, second by second, on forever, ad infinitum, unless we decide to move them.

571
04:38:55,120 --> 04:39:01,340
But moving satellites using that precious propellant, that's a big choice in space.

572
04:39:01,340 --> 04:39:04,440
Because there are no gas stations, no place to fill up.

573
04:39:04,440 --> 04:39:06,480
So it is a very different domain.

574
04:39:06,480 --> 04:39:16,160
And we're just here talking about low-Earth orbit constellations, those that are very near the Earth, that are moving around at 7 kilometers a second.

575
04:39:16,160 --> 04:39:23,380
But GPS satellites are much further out, in what are medium-altitude orbits.

576
04:39:23,380 --> 04:39:29,000
And satellites that do communication and detection are all the way out in geosynchronous orbit.

577
04:39:29,000 --> 04:39:32,760
And though they're moving really fast relative to the Earth, they're not.

578
04:39:32,760 --> 04:39:34,060
They're stationary overhead.

579
04:39:34,060 --> 04:39:41,120
Every one of these is a very different domain governed by apparently different physics.

580
04:39:41,180 --> 04:39:49,600
And that's why we've got men and women getting ready, who are thinking about warfare in space, and they've got a clean sheet of paper in their hands.

581
04:39:49,620 --> 04:39:53,680
How do we fight in this domain where things are very predictable?

582
04:39:53,820 --> 04:39:56,700
And you can guess what answers are coming to the forefront.

583
04:39:56,700 --> 04:39:58,940
We're going to have to rely on autonomy.

584
04:39:58,940 --> 04:40:04,640
And that means the software that we put is going to be so important to whether we win or lose.

585
04:40:04,700 --> 04:40:06,400
But then that brings you in.

586
04:40:06,400 --> 04:40:14,180
If our software is going to be the cutting edge, and the autonomy it runs on is going to be how we win, then how do we make it secure?

587
04:40:14,780 --> 04:40:22,460
So I think we went through this period where, at least we as a society, didn't talk a lot about space.

588
04:40:22,460 --> 04:40:26,980
And I'm happy to see that change.

589
04:40:26,980 --> 04:40:31,620
Will talked about all the critical things about space.

590
04:40:31,620 --> 04:40:34,720
Timing, ATMs, GPS, all of these different things.

591
04:40:34,720 --> 04:40:36,580
And that is super critical.

592
04:40:36,620 --> 04:40:47,500
But I guess I bring out my inner kid now, where a couple months ago I sat down, I have three little kids, and we watched a SpaceX launch.

593
04:40:47,500 --> 04:40:53,240
And there was an excitement there that I feel it's been a long time.

594
04:40:54,900 --> 04:40:58,080
It's been missing from society for a bit.

595
04:40:58,080 --> 04:41:01,760
There's something aspirational, inspirational about it.

596
04:41:01,760 --> 04:41:13,400
And seeing the launch, seeing the landing, talking about space, thinking about the importance of it, and all the critical things that it does, it excites me for the future.

597
04:41:14,040 --> 04:41:16,740
So I'm excited that we're talking about space.

598
04:41:16,740 --> 04:41:19,460
I still would like to go to space.

599
04:41:19,700 --> 04:41:24,680
I don't think, Will, you've gotten your transporter done.

600
04:41:24,900 --> 04:41:33,440
But with all that being said, I'm really also, until you actually take me to space, I look forward to helping protect space.

601
04:41:33,600 --> 04:41:34,820
Sounds good, Brett.

602
04:41:34,820 --> 04:41:41,820
And aside from just watching SpaceX, you know, just the other day we watched Perseverance and Ingenuity head up.

603
04:41:41,820 --> 04:41:45,860
And so we're really, really excited about the enthusiasm in space.

604
04:41:45,860 --> 04:41:51,980
And Space Force gets to provide most of the rocketry that the entire government and commercial industry uses.

605
04:41:52,100 --> 04:41:54,720
So it's going to be a little while until we beam you to space.

606
04:41:54,720 --> 04:41:59,080
But we've got some excellent works in rockets that can help push you there.

607
04:41:59,220 --> 04:42:02,820
Do you think I could do that training thing in a couple weeks?

608
04:42:03,180 --> 04:42:04,360
Just banging it out?

609
04:42:04,420 --> 04:42:08,700
Let's talk about that next time on Between Two Nerds.

610
04:42:08,700 --> 04:42:10,020
Thanks for coming.

611
04:42:10,880 --> 04:42:11,800
Okay.

612
04:42:29,540 --> 04:42:31,640
So we're really easy.

613
04:42:32,120 --> 04:42:33,700
We're on the Twitters.

614
04:42:34,040 --> 04:42:35,580
At least I'm on the Twitters.

615
04:42:35,580 --> 04:42:36,380
Are you on the Twitters?

616
04:42:36,380 --> 04:42:41,520
I promised Brett that for DEFCON, I would send out my first tweet.

617
04:42:41,520 --> 04:42:44,560
So I'm really looking forward to seeing Will on the Twitters.

618
04:42:44,560 --> 04:42:50,800
We're also going to be... Will and I will be in the VRs during DEFCON.

619
04:42:50,800 --> 04:42:52,380
You can find us there.

620
04:42:52,500 --> 04:42:54,080
We'll be on Twitch.

621
04:42:54,080 --> 04:42:55,680
We'll be all over.

622
04:42:55,680 --> 04:42:59,660
And we'll make sure that we leave a link on our HackASAP site.

623
04:42:59,660 --> 04:43:11,900
If you are interested in finding out more about participating in future hacking events with the Air Force or DDS, we will leave a place for you to find us, for us to contact you.

624
04:43:11,900 --> 04:43:14,100
And we also want to hear your suggestions.

625
04:43:14,100 --> 04:43:20,380
And when COVID is done, if you're in D.C., come to the Pentagon.

626
04:43:20,380 --> 04:43:22,280
We'd love to hear your ideas.

627
04:43:31,050 --> 04:43:33,910
So can zombies swim?

628
04:43:34,650 --> 04:43:36,250
I don't know, Brett.

629
04:43:36,250 --> 04:43:43,130
I think it probably depends on what movie we're in and whether they knew how to swim before they were zombified.

630
04:43:43,190 --> 04:43:49,430
So I intentionally moved to an island where part of my intent was being zombie safe.

631
04:43:49,430 --> 04:43:50,750
How deep is the water?

632
04:43:50,750 --> 04:43:51,930
Pretty deep.

633
04:43:51,930 --> 04:43:53,710
Did you see World War Z?

634
04:43:53,710 --> 04:43:54,390
I did.

635
04:43:54,390 --> 04:43:55,550
Is it that deep?

636
04:43:56,970 --> 04:43:58,870
It might not be deep enough.

637
04:43:58,870 --> 04:44:00,430
You might need a better island.

638
04:44:05,650 --> 04:44:08,130
Thanks, RoRo, for the Q&A and Dr.

639
04:44:08,130 --> 04:44:10,750
Roper and Brett for your vision behind HackASAP.

640
04:44:10,990 --> 04:44:15,510
Remember at the beginning of the day I told you that not all of this event would happen on the Earth?

641
04:44:15,510 --> 04:44:20,390
Well, I hope teams are ready because we are about to throw them a massive curveball.

642
04:44:20,390 --> 04:44:24,190
The on-orbit challenge is about to drop on our unsuspecting teams.

643
04:44:24,190 --> 04:44:26,070
Well, okay, they have a little bit of suspicion.

644
04:44:26,070 --> 04:44:31,650
But our teams have only a few hours to create a mission plan for an actual satellite in space.

645
04:44:31,770 --> 04:44:39,070
Their task is to orient a spinning satellite, point its camera at the moon, take a photograph, and send it back home to the HackASAP contest officials.

646
04:44:39,170 --> 04:44:46,490
The team with the best solution will win what might even be a more valuable prize than the cash part of this competition, bragging rights.

647
04:44:46,490 --> 04:44:47,310
That's right.

648
04:44:47,310 --> 04:44:53,710
One team in this competition can say that their code directed a real satellite in space and took a proverbial moon shot.

649
04:44:55,370 --> 04:44:58,390
Stop everything and look up.

650
04:44:58,590 --> 04:45:02,230
Starting now, teams shift to the on-orbit challenge.

651
04:45:02,290 --> 04:45:06,590
Their primary goal is to capture a picture of the moon using this satellite.

652
04:45:07,270 --> 04:45:12,970
Competitors will have access to the two-line element of the vehicle and the camera's foresight vector.

653
04:45:12,970 --> 04:45:20,650
Each team is tasked with creating a mission plan that transitions a satellite from a tumbling state to one where it points the camera at the moon.

654
04:45:21,250 --> 04:45:26,710
The team will reach a successful status once their resulting mission plan meets key criteria.

655
04:45:27,130 --> 04:45:27,710
1.

656
04:45:27,710 --> 04:45:32,330
The commands are generated in the correct order and are within the specified period.

657
04:45:32,590 --> 04:45:33,470
2.

658
04:45:33,470 --> 04:45:36,990
The image capture angle of the moon is within specifications.

659
04:45:36,990 --> 04:45:38,370
3.

660
04:45:38,370 --> 04:45:46,190
The team's negative z-axis is pointed as close to the Earth's center as possible without affecting the camera-to-moon pointing error.

661
04:45:46,410 --> 04:45:51,810
The teams are given a command dictionary with the format for submitting the commands and parameters.

662
04:45:51,890 --> 04:45:54,110
The rest is up to them.

663
04:45:58,470 --> 04:46:02,010
There's one final important fact for this on-orbit challenge.

664
04:46:02,010 --> 04:46:07,710
While there's no score associated with it like the other challenges, it is a pass-fail challenge.

665
04:46:07,710 --> 04:46:13,330
Teams must produce a successful solution to be eligible for the prize money in this competition.

666
04:46:13,450 --> 04:46:17,070
If they want to end up on the podium, they have to be successful in this challenge.

667
04:46:17,070 --> 04:46:18,630
No pressure or anything.

668
04:46:19,150 --> 04:46:28,610
I'll see you back here in about an hour at 12.50pm Pacific, 3.50pm Eastern as we check in with our teams on both their Earth-based and extraterrestrial challenges.

669
05:18:41,940 --> 05:18:43,340
EARTH

670
05:18:53,060 --> 05:18:53,980
-BASED CHALLENGE

671
05:45:45,810 --> 05:45:48,950
Welcome back to a Hackistat competition update.

672
05:45:48,950 --> 05:45:51,130
I'm your host Jordan Wines.

673
05:45:51,170 --> 05:45:55,650
Taking a look at the scoreboard so far we've had an eventful last hour.

674
05:45:55,650 --> 05:46:00,330
Our teams continue to make progress with four teams now having solved challenge one.

675
05:46:00,330 --> 05:46:07,490
Unfortunately the window of time after first solve has expired and the remaining four teams were given a solution with no points.

676
05:46:07,490 --> 05:46:15,390
PFS and colon can into space were joined by 1553 and 1064 seabread with solutions for challenge one.

677
05:47:16,900 --> 05:47:23,460
1064 seabread has been around for several years going all the way back to when they were first high school friends playing as CTFs.

678
05:47:23,460 --> 05:47:32,060
In fact I first met them five years ago as the only team of high school students at a collegiate CTF competition and the team even included a standout freshman.

679
05:47:32,060 --> 05:47:36,200
Yep a high school freshman competing with college freshmen and college seniors.

680
05:47:36,580 --> 05:47:42,920
And while I don't personally know any of 1553 after they gave me some interesting facts about them I kind of feel like I do.

681
05:47:42,920 --> 05:47:49,460
For example one team member has additional sound dampening around his office due to his above-average laughter volume.

682
05:47:49,500 --> 05:47:56,720
One member was fired from a previous job for quote smiling too much quote and another member was a college mascot.

683
05:47:56,900 --> 05:48:07,540
Finally their team logo or team motto rather is preparation is the enemy of innovation which sounds a little bit like an excuse but you can't argue with their results.

684
05:48:08,260 --> 05:48:12,740
Let's take a look at the solution for challenge one now that all teams have it.

685
05:48:14,040 --> 05:48:15,940
Challenge number one.

686
05:48:16,040 --> 05:48:17,240
Here's what we know.

687
05:48:17,240 --> 05:48:24,760
Having access to the ground station means we can attempt communication but the satellite is spinning out of control which complicates everything.

688
05:48:24,980 --> 05:48:25,900
The challenge.

689
05:48:25,900 --> 05:48:28,840
Teams must regain communication with the satellite.

690
05:48:29,700 --> 05:48:31,380
Here's how they do it.

691
05:48:31,380 --> 05:48:37,380
To get started teams must set the command and telemetry rates appropriately and the power output to maximum.

692
05:48:37,380 --> 05:48:40,600
Because the satellite is spinning additional link margin is required.

693
05:48:40,600 --> 05:48:45,100
The teams receive periodic telemetry but are not able to command the vehicle.

694
05:48:45,200 --> 05:48:54,460
Based on the review of the anomaly resolution section in the user's guide they realize that to increase the link margin they should increase radio output power and decrease link rate.

695
05:48:54,460 --> 05:48:59,560
They command the radio to high power and low rate mode and regain communications with the satellite.

696
05:48:59,560 --> 05:49:04,560
The link is limited to low rate meaning that what they can send and receive from the satellite is limited.

697
05:49:13,030 --> 05:49:19,750
This is a good example of the type of challenge that is a little different in this type of CTF versus many other types of CTF.

698
05:49:19,750 --> 05:49:31,590
While teams were told to quote restore communication quote that goal was much more ambiguous than often traditional CTF challenges and mirrors more of the real-world problem-solving you run into in space-based applications.

699
05:49:31,630 --> 05:49:40,710
Because our imaginary bad actors had intentionally modified the satellite's orientation and they were moving around uncontrollably communication between the ground station and the satellite was not stable.

700
05:49:40,710 --> 05:49:54,030
To fix this teams needed to both lower the transfer rates boost the power and that would finally let them enable ground-based communications and that would let them control all the components of the satellite or at least the ones that they've been able to figure out so far.

701
05:49:54,130 --> 05:50:03,610
In fact the challenge was real-world enough that at least one team was able to solve it in the normal order of just working with the satellite without even specifically realizing they had solved the challenge.

702
05:50:03,670 --> 05:50:06,330
All that brings us to challenge two.

703
05:50:07,890 --> 05:50:09,030
Challenge two.

704
05:50:09,690 --> 05:50:11,450
Here's what we know.

705
05:50:11,450 --> 05:50:17,710
The satellite is spinning out of control because the guidance navigation and control system or GNC is inoperable.

706
05:50:17,710 --> 05:50:20,010
We suspect sabotage.

707
05:50:20,130 --> 05:50:26,390
The challenge teams must repair the GNC system as quickly as possible to stop the dangerous spinning.

708
05:50:35,240 --> 05:50:46,840
As teams begin to as teams now have regular communication with their satellites they'll need to get the movement under control but it's also worth mentioning at this point that these satellites do actually have their own battery and power supply.

709
05:50:46,960 --> 05:51:01,220
They're taken off each night to be charged and while power utilization is not a scored metric in the game if one team does manage to cause too much movement or otherwise drain all of their power that could impact their ability to interact with the satellite for the remainder of the day.

710
05:51:01,320 --> 05:51:03,060
Looking forward to seeing what they do.

711
05:51:03,060 --> 05:51:05,380
We'll see you back here in another hour for our next competition

712
06:44:42,010 --> 06:44:47,450
Welcome back to the competition formerly known as Space Security Challenge 2020 now HackASat.

713
06:44:47,530 --> 06:44:49,450
Well it's actually still known by Moth.

714
06:44:49,450 --> 06:44:53,210
I just wanted to change the intro because they're gonna get pretty repetitive.

715
06:44:53,330 --> 06:44:55,250
I'm your host Jordan Wines.

716
06:44:55,390 --> 06:45:00,670
The game has been a little bit slower this hour but that makes sense because teams are starting to get into the harder challenges.

717
06:45:00,770 --> 06:45:04,470
As a reminder teams are currently working on two separate challenges.

718
06:45:04,510 --> 06:45:15,430
First the on-orbit challenge is it as it the on-orbit challenge involves them designing a payload that will execute a moonshot taking a picture of the moon from an actual orbiting satellite.

719
06:45:15,430 --> 06:45:20,550
While that challenge won't show up on the scoreboard with points it is a pass-fail challenge.

720
06:45:20,550 --> 06:45:29,070
Only teams that score within a time window will be eligible for podium placement and the related $50,000 $30,000 and $20,000 prizes.

721
06:45:29,510 --> 06:45:39,970
Since there's a lot of data being displayed on our octagon scoreboard otherwise known as that thing you're looking at when it's not my face on this YouTube feed here's a quick primer on some of the elements.

722
06:45:40,330 --> 06:45:52,910
First the display on the left shows a scoreboard breakdown that breaks down each team's points earned per challenge, shows the total score and includes a log of recent solves and messages sent from each team to their flat sat.

723
06:45:52,950 --> 06:45:59,290
Note that the message contents have actually been sanitized to not give away answers but you might find some other things there instead.

724
06:46:00,590 --> 06:46:05,990
On the right scoreboard you'll see the time of the teams you see the score of the teams over time.

725
06:46:06,030 --> 06:46:13,390
Right now it's skewed a little bit to the left but as the game progresses it will stretch out and we'll see how they do on each of these new challenges.

726
06:46:13,650 --> 06:46:19,750
Finally each team has a dedicated panel with a main view and three supplementary views.

727
06:46:19,870 --> 06:46:32,610
Technically we can change the supplementary views but right now the main view shows a team logo with their color, a representation of the team's flat sat including the rotation, position over the earth and messages sent.

728
06:46:32,610 --> 06:46:39,490
Note that the little pew-pew you see are just for visual effect and not actually representative of actual messages being sent.

729
06:46:39,810 --> 06:46:54,450
On the graph right now on the right, excuse me, the three graphs on the right, the top graph is yaw, the middle graph is angular velocity and the bottom graph is total messages all done over time which makes for a nice overview of the different activity from each team's flat sat.

730
06:46:54,630 --> 06:47:00,830
Remember you can vote to control which of these views you're looking at in the virtual environment inside of the Stardome.

731
06:47:00,850 --> 06:47:04,650
That feed doesn't cut over these live updates and always shows the Octagon.

732
06:47:05,170 --> 06:47:12,530
While we wait on our teams to continue to solve these challenges they're working on, now's a great time to introduce another segment we call Space Talk.

733
06:47:12,530 --> 06:47:20,190
If, like me, you're a hacker who might know about computers but is ignorant of what goes into making code run in space, there's a lot of new things to learn.

734
06:47:20,270 --> 06:47:24,750
Our first Space Talk episode is about how to keep track of time in space.

735
06:47:39,610 --> 06:47:41,990
So what time is it in space?

736
06:47:41,990 --> 06:47:44,630
Well that's a complicated question.

737
06:47:45,090 --> 06:47:52,910
For the astronauts on the International Space Station and for most orbiting satellites they run on Coordinated Universal Time or UTC.

738
06:47:53,230 --> 06:47:59,710
It's not actually a time zone but rather a time standard that just so happens to be the same as GMT.

739
06:47:59,710 --> 06:48:04,810
It's used to prevent time zone confusion and give a standard time to reference.

740
06:48:04,850 --> 06:48:08,730
But for astronauts especially it's just a number.

741
06:48:09,010 --> 06:48:18,450
On the International Space Station the Sun rises and sets about every 90 minutes so there isn't any relationship between the Sun and what time it is that's meaningful to the astronauts.

742
06:48:18,810 --> 06:48:20,350
Satellites are the same way.

743
06:48:20,350 --> 06:48:25,490
Time is primarily used to inform them when to execute commands and perform operations.

744
06:48:25,930 --> 06:48:31,790
Universal time is just a reference number that's easy to relate back to your local time.

745
06:48:31,790 --> 06:48:35,730
But that's not the only time that's used for space applications.

746
06:48:36,330 --> 06:48:48,290
UTC is not an exact accounting of the passage of time but rather strives to stay aligned with the rotation of the Earth because it's primarily people on Earth that are using it.

747
06:48:48,450 --> 06:48:53,930
Earth's rotation is both irregular in the short term and slowing down permanently in the long term.

748
06:48:53,930 --> 06:48:58,830
Earth days are getting about 1.6 milliseconds longer every single day.

749
06:48:58,830 --> 06:49:04,330
This isn't in any way noticeable in daily life but can be very significant over time.

750
06:49:04,330 --> 06:49:08,890
As a result we use a different time scale when dealing with orbital motion.

751
06:49:09,090 --> 06:49:12,250
Orbital motion doesn't care about the Earth's rotation at all.

752
06:49:12,250 --> 06:49:17,410
It must be extremely precise because of the massive distances involved.

753
06:49:17,410 --> 06:49:26,110
The most common time standards used are Julian date and terrestrial time which are both entirely independent of Earth's rotation.

754
06:49:26,110 --> 06:49:38,690
To give an idea of just how different these time scales can be, over the last century between 1900 and 2000, universal time was about 64 seconds slower than terrestrial time.

755
06:49:38,690 --> 06:49:46,750
It's a tiny difference to us but when you're dealing with precise predictions over millions of miles it gets very significant.

756
06:49:46,790 --> 06:49:47,850
And that's the key.

757
06:49:47,850 --> 06:49:55,250
What time it is in space isn't important so you can look at the clock on the wall and know if you need to go to bed.

758
06:49:55,250 --> 06:50:00,290
It's important so you can know where you are and know where things are.

759
06:50:00,350 --> 06:50:05,110
Everything in space is constantly moving, orbiting one object or another.

760
06:50:05,170 --> 06:50:09,350
Telling where it's located is intrinsically linked to what time it is.

761
06:50:09,350 --> 06:50:11,370
This gets to our next question.

762
06:50:11,490 --> 06:50:14,390
How do you tell where something is in space?

763
06:50:14,390 --> 06:50:19,610
As I said before, everything in space is constantly moving and orbiting around something else.

764
06:50:19,610 --> 06:50:22,490
All this motion is primarily controlled by gravity.

765
06:50:22,490 --> 06:50:32,010
So to know where something is right now, we use where it was at some time in the past and we predict where it is now based on the laws of gravitational motion.

766
06:50:32,010 --> 06:50:35,870
Now you might ask how do I tell you where it is or even where it was?

767
06:50:35,870 --> 06:50:46,730
On Earth I could tell you where to go based on your address or some landmark and these are useful frames of reference that we can use to fully communicate where something is.

768
06:50:46,730 --> 06:50:53,450
In space there are an infinite number of reference frames that we can use but we also have an added complexity.

769
06:50:53,450 --> 06:51:00,110
Since again everything is moving all the time, to have a frame of reference we need to incorporate time.

770
06:51:00,350 --> 06:51:06,130
There are several different ways of describing where things are but we typically focus on two reference frames.

771
06:51:06,350 --> 06:51:09,030
One, what's easiest for us to use.

772
06:51:09,030 --> 06:51:16,410
For example, if I want to take a photo of the moon I would want to know where the moon is in relation to where I'm going to be when I have my camera.

773
06:51:16,410 --> 06:51:19,650
And two, what's easiest to calculate.

774
06:51:19,650 --> 06:51:29,190
Orbital math is hard and many times impossible so picking a reference frame that makes your calculation as easy as possible is often necessary.

775
06:51:29,190 --> 06:51:36,570
This reference point is usually whatever has the most significant gravitational effect and ignores all other motion.

776
06:51:36,570 --> 06:51:38,290
For satellites we use Earth.

777
06:51:38,290 --> 06:51:41,530
We want to know where they are relative to our location on the Earth.

778
06:51:41,530 --> 06:51:49,890
This frame of reference is called Earth Centered Earth Fixed or ECEF as it is rotating with the Earth and is fixed to it.

779
06:51:49,890 --> 06:52:02,850
It's the same as GPS coordinates but it's much much easier to calculate the position of the satellite when we ignore the rotation of the Earth which is a different frame of reference called Earth Centered Inertial or ECI.

780
06:52:02,850 --> 06:52:19,610
So if I saw where a satellite was in relation to me in the ECEF frame at time t0 and I need to know where the satellite will be in relation to me in the ECEF frame at time t1, we actually need to calculate three different steps.

781
06:52:19,610 --> 06:52:27,230
One, translate the coordinates I observed at t0 in ECEF to ECI at t0.

782
06:52:27,230 --> 06:52:36,290
Two, translate the orbital motion of the satellite in ECI from t0 to t1 where our calculations are easier.

783
06:52:36,290 --> 06:52:44,150
And three, translate the coordinates I calculated at t1 back to ECEF from ECI.

784
06:52:44,150 --> 06:52:51,070
Steps one and three both require translating between these coordinate frames ECEF and ECI.

785
06:52:51,070 --> 06:52:53,050
So how do we do that translation?

786
06:52:53,050 --> 06:52:55,790
Here is where we now introduce the idea of an epoch.

787
06:52:55,790 --> 06:53:01,330
An epoch is a point in time that we use as a reference to translate between these types of frames.

788
06:53:01,330 --> 06:53:16,470
Specifically we use the J2000 or Julian date 2000 epoch to translate between ECEI and ECEF as we set the ECEI reference frame to be the same as the ECEF at that time.

789
06:53:16,470 --> 06:53:24,810
That way we can calculate the translation between them by calculating how much the earth has rotated since Julian date 2000.

790
06:53:24,810 --> 06:53:32,370
This is a simplification of the constant translation and calculation done throughout satellites, space technology, and astronomy.

791
06:53:32,370 --> 06:53:39,650
But that is why time and space are both extremely important and highly dependent on really what you're looking to do with them.

792
06:53:54,100 --> 06:53:56,840
Thanks to Jess Coffey for putting those videos together.

793
06:53:56,840 --> 06:53:58,900
That one was epic.

794
06:53:59,240 --> 06:54:09,160
Now this was going to be where I signed off for this update but as we were live PFS actually jumped up on the scoreboard yet again solving challenge 2.

795
06:54:09,160 --> 06:54:13,940
This means that we can now move on to exposing all teams to challenge 3.

796
06:54:14,880 --> 06:54:16,580
Challenge 3.

797
06:54:17,700 --> 06:54:19,220
Here's what we know.

798
06:54:19,220 --> 06:54:27,040
With the repair complete on the GNC the satellite has stopped spinning but we still can't communicate with the payload module or operate the imager.

799
06:54:27,040 --> 06:54:31,220
We have to ask ourselves what else did they damage on this satellite?

800
06:54:31,340 --> 06:54:32,380
The challenge?

801
06:54:32,380 --> 06:54:36,760
Teams must restore communication with the payload module so we can get it working again.

802
06:54:43,500 --> 06:54:46,000
This has been our last hourly update for the day.

803
06:54:46,000 --> 06:54:48,700
I'm looking forward to seeing everyone back here at 4 p.m.

804
06:54:48,700 --> 06:54:49,920
Pacific 7 p.m.

805
06:54:49,920 --> 06:54:53,260
Eastern for a daily recap of all that's happened so far.

806
08:57:22,420 --> 08:57:26,680
Welcome to Space Security Challenge 2020, HackASAP.

807
08:57:26,680 --> 08:57:37,520
The final event of the As the democratization of space opens up a new frontier for exploration and innovation, we see new cybersecurity vulnerabilities emerging.

808
08:57:38,460 --> 08:57:49,980
The Space Security Challenge is designed to inspire the world's top cybersecurity talent to develop the skills necessary to secure this last frontier of cybersecurity, space.

809
08:57:49,980 --> 08:57:53,180
And already we've made a ton of progress.

810
08:57:53,180 --> 08:57:54,580
I'll catch you up.

811
08:57:54,580 --> 08:58:04,280
This spring we hosted over 2,000 teams who worked their way through a set of foundational space cybersecurity challenges in our HackASAP qualification round.

812
08:58:04,280 --> 08:58:08,400
Now, eight finalist teams are stepping up to the ultimate challenge.

813
08:58:08,860 --> 08:58:11,900
They are hacking a satellite.

814
08:58:17,840 --> 08:58:23,440
Welcome to the first of two daily recaps for the Space Security Challenge 2020 or HackASAP.

815
08:58:23,440 --> 08:58:26,040
I'm still your host, Jordan Wines.

816
08:58:26,820 --> 08:58:34,400
As our eight teams have been vying for a share of a $100,000 prize pool, we're going to check in and summarize the status of the day.

817
08:58:34,400 --> 08:58:39,240
Of course, they also received $15,000 just to get here as a finalist.

818
08:58:39,300 --> 08:58:41,640
The competition for that was fierce.

819
08:58:41,660 --> 08:58:47,280
Our finalists beat out over 2,000 other teams made up of over 6,000 other competitors.

820
08:58:47,520 --> 08:58:58,860
Of course, the biggest prize of all might not even be the money or even the friends we made along the way, but the bragging rights for your code to be selected to take an actual photograph of the moon from a satellite in space.

821
08:58:59,000 --> 08:59:07,720
While this event was originally planned to be in person during DEF CON in the Aerospace Village, the global pandemic has caused us to reimagine the event experience.

822
08:59:07,720 --> 08:59:14,880
The result is an immersive 3D environment where you can stay up-to-date with the competition while learning all about space security and the event itself.

823
08:59:14,880 --> 08:59:19,240
You can connect with other spectators and even play games and add to our graffiti wall.

824
08:59:19,280 --> 08:59:26,240
So if you aren't already watching this from our immersive 3D environment, check it out at virtual.hackasat.com.

825
08:59:26,480 --> 08:59:33,720
As prior DEF CON attendees, some of you are very familiar with the many flavors of contests that test your hacking skills.

826
08:59:33,720 --> 08:59:36,620
But for others, we realize this is a whole new world.

827
08:59:36,620 --> 08:59:43,200
There are many types of hacking contests and Hackasat falls into the category of Capture the Flag or CTF.

828
08:59:46,140 --> 08:59:50,400
Remember the game you played as a kid with flags hitting an opponent's terrain?

829
08:59:50,400 --> 08:59:54,520
Now imagine the field or code and the flags are secret data.

830
08:59:54,520 --> 09:00:00,880
Players exploit security flaws to capture the flags while at the same time defending their networks from opposing teams.

831
09:00:00,880 --> 09:00:06,140
These Capture the Flag CTF events are as diverse as the teams that play them.

832
09:00:06,320 --> 09:00:10,620
This is a global competitive community with thousands of players and global rankings.

833
09:00:10,620 --> 09:00:15,440
It's been a part of the origin story for a great many prominent security experts.

834
09:00:15,440 --> 09:00:18,260
So what do these hacking games look like?

835
09:00:18,260 --> 09:00:24,000
CTFs can be either in-person or online and usually take place over a weekend or other short period.

836
09:00:24,000 --> 09:00:28,660
They often have a qualification round that determines who gets to participate in the finals.

837
09:00:28,660 --> 09:00:38,880
CTFs are sometimes themed around a specific domain like space for Hackasat, but more commonly they are not specialized and include a wide variety of different types of challenges.

838
09:00:38,880 --> 09:00:48,520
The most common types of CTFs include Jeopardy CTFs, sometimes called Red Team CTFs, are named for their use of the classic game board as a scoreboard.

839
09:00:48,520 --> 09:00:50,120
These are more offensive focused.

840
09:00:50,120 --> 09:00:58,460
Each team is given infrastructure to attack and the number of successful attacks, the difficulty, or the speed at which they succeed is factored into their score.

841
09:00:58,460 --> 09:01:05,280
Attack Defense, A slash D, or Full Spectrum CTFs, which are closer to the original game you might have played as a kid.

842
09:01:05,280 --> 09:01:11,960
Each team has a server or set of servers to defend and must attack other teams while also protecting their own infrastructure.

843
09:01:11,960 --> 09:01:20,080
Key of the Hill style CTFs are Full Spectrum CTFs, in which teams score points by gaining and maintaining control of individual systems.

844
09:01:20,160 --> 09:01:25,300
And finally, the less common Blue Team exercises, which are primarily defensive events.

845
09:01:25,300 --> 09:01:31,740
Game organizers host an environment and often a professional team of attackers to test the participants defensive skills.

846
09:01:31,740 --> 09:01:34,680
These are more common in the high school and collegiate level.

847
09:01:34,680 --> 09:01:35,940
How do you win?

848
09:01:35,980 --> 09:01:42,540
Even though the goal of the CTFs are to find and exploit vulnerabilities in computer systems, fair play is essential.

849
09:01:42,540 --> 09:01:48,140
There are lots of ways to win, but to get the respect of your peers, you need to have good technical solutions.

850
09:01:48,160 --> 09:01:55,080
Nobody is impressed if you use a network flood to knock the scoreboard offline, and those kinds of shenanigans will get you shunned quickly.

851
09:01:55,080 --> 09:02:02,960
The best CTF players have built specialized tools, practice within their domains, and include domain experts in many aspects of security.

852
09:02:03,700 --> 09:02:04,720
Why CTF?

853
09:02:04,720 --> 09:02:12,940
At their core, CTF challenges are a way for hackers to build community and demonstrate and hone their skills with other equally skilled people.

854
09:02:12,940 --> 09:02:20,660
Competitions are also a chance to experience the joy of learning about a new programming language or a new piece of technology hackers haven't used before.

855
09:02:20,660 --> 09:02:27,900
Capture the Flag challenges have also been used to help train cyber security teams and to get new hackers interested in security research.

856
09:02:27,900 --> 09:02:33,920
Some companies even use competitions similar to CTFs to recruit and vet potential candidates for employment.

857
09:02:33,920 --> 09:02:40,320
And CTFs have had real-world impact with competitors finding actual security flaws in contest infrastructure.

858
09:02:40,320 --> 09:02:46,160
Their solutions, while not counting towards winning the game, are often implemented in a real-world context.

859
09:02:46,280 --> 09:02:57,960
With HackASat, we have a CTF game designed to raise awareness about cyber security issues in space and help researchers develop specific skills and domain knowledge they'll need to help secure this new frontier.

860
09:02:58,220 --> 09:03:05,140
But as many of the players during our quals round found out, there are a lot of problems unique to the environments outside our atmosphere.

861
09:03:05,140 --> 09:03:12,260
To learn more about hacking in space, check out our space talk videos that explain some of the most interesting space-specific challenges.

862
09:03:13,480 --> 09:03:21,420
For more on CTFs and other hacking and space related topics, go to the research room in the virtual environment or check out the related YouTube playlist.

863
09:03:21,820 --> 09:03:25,500
Okay, let's go ahead and recap the whole day so far.

864
09:03:31,340 --> 09:03:41,500
The game has actually been underway for one hour now and our team's first challenge has been to regain control of the ground station that they'll be using to communicate with their Flatsats.

865
09:03:41,500 --> 09:03:49,180
In fact, just before this broadcast went live, we received word that this challenge was actually solved by Team Samurai.

866
09:03:49,400 --> 09:03:50,760
Congratulations to them!

867
09:03:50,760 --> 09:03:57,360
Right after our last update ended with only a Samurai solve, several other teams came in with solutions for Challenge Zero.

868
09:03:57,500 --> 09:04:02,100
PFS and Solarwine were solvers 2 and 3 on that challenge.

869
09:04:02,420 --> 09:04:08,860
After those two teams scored on Challenge Zero, every other team was eventually able to solve Challenge Zero over the next several hours.

870
09:04:08,860 --> 09:04:13,160
Taking a look at the scoreboard so far, we've had an eventful last hour.

871
09:04:13,160 --> 09:04:17,540
Our teams continue to make progress with four teams now having solved Challenge One.

872
09:04:17,620 --> 09:04:24,620
Unfortunately, the window of time after first solve has expired and the remaining four teams were given a solution with no points.

873
09:04:24,660 --> 09:04:32,700
PFS and Colon Can Into Space were joined by 1553 and 1064 Seabred with solutions for Challenge One.

874
09:04:32,820 --> 09:04:42,780
Now this was going to be where I signed off with this update, but as we were live, PFS actually jumped up on the scoreboard yet again, solving Challenge Two.

875
09:04:48,330 --> 09:04:52,250
You may have noticed that first blood overlay and sound effect in that summary.

876
09:04:52,250 --> 09:05:02,730
While it was originally used in Unreal Tournament to indicate a kill , the phrase and even sometimes the sound effects are often used in CTF competitions to indicate the first team to solve a particular challenge.

877
09:05:03,810 --> 09:05:21,490
The challenges that teams have solved so far include a Challenge Zero, which required exploiting an insecure web application to steal credentials for the ground station controller, and then using that Cosmos ground station, the teams had to restore communication with their flatsats as they were tumbling and not communicating well.

878
09:05:21,730 --> 09:05:32,450
The Challenge One involved connecting to the satellites, connecting to the ground station, turning up the power, turning down the bandwidth, which is very much a real-world troubleshooting step.

879
09:05:32,610 --> 09:05:40,670
Next, the teams have to restore proper orientation control over their flatsat, but only one team so far has managed to accomplish this feat.

880
09:05:40,670 --> 09:05:44,570
That brings us to what's happened in the last two hours of the competition.

881
09:05:44,590 --> 09:05:47,470
Most teams are now working on two or three challenges.

882
09:05:47,630 --> 09:05:51,230
The on-orbit challenge, Challenge Two, and Challenge Three.

883
09:05:53,450 --> 09:05:58,470
PFS has been pulling away to a healthy lead that is going to be hard to catch up to tomorrow.

884
09:05:58,470 --> 09:06:00,950
Hard, but definitely not impossible.

885
09:06:01,330 --> 09:06:07,650
All it takes is for them to get stuck in a problem and be passed in turn, much like they did to Samurai at the start of the game.

886
09:06:08,550 --> 09:06:19,990
It's also interesting to note that PFS, which is actually short for Pwn First Search, and Pulling Can Into Space, are number one and number two on the leaderboard, are two of the smallest teams in the competition.

887
09:06:20,370 --> 09:06:29,150
Having a large team is sometimes an advantage, but it definitely comes with logistical issues, and in this case, where the challenges are serial in nature, it isn't always helpful.

888
09:06:29,510 --> 09:06:33,810
Let's take a look again at the PFS team bio.

889
09:07:02,340 --> 09:07:08,380
If you were here with us live, you might remember that right in the middle of teams working on their challenges at around 12 p.m.

890
09:07:08,380 --> 09:07:13,900
Pacific, all teams had to stop what they were doing and shift focus to the on-orbit challenge.

891
09:07:15,060 --> 09:07:18,080
Stop everything and look up.

892
09:07:18,280 --> 09:07:21,600
Starting now, teams shift to the on-orbit challenge.

893
09:07:21,840 --> 09:07:26,280
Their primary goal is to capture a picture of the moon using the satellite.

894
09:07:26,880 --> 09:07:32,660
Competitors will have access to the two-line element of the vehicle and the camera's foresight vector.

895
09:07:33,080 --> 09:07:40,300
Each team is tasked with creating a mission plan that transitions a satellite from a tumbling state to one where it points the camera at the moon.

896
09:07:40,940 --> 09:07:46,380
The team will reach a successful status once the resulting mission plan meets key criteria.

897
09:07:46,800 --> 09:07:52,020
One, the commands are generated in the correct order and are within the specified period.

898
09:07:52,200 --> 09:07:56,980
Two, the image capture angle of the moon is within specifications.

899
09:07:57,540 --> 09:08:05,840
Three, the team's negative z-axis is pointed as close to the Earth's center as possible without affecting the camera to moon pointing error.

900
09:08:06,200 --> 09:08:11,480
The teams are given a command dictionary with the format for submitting the commands and parameters.

901
09:08:11,540 --> 09:08:13,800
The rest is up to them.

902
09:08:16,720 --> 09:08:24,760
Of course, while PFS is currently in the lead, they still have a critical problem to solve, specifically, the on-orbit challenge.

903
09:08:24,860 --> 09:08:36,020
While Poland can into space is only nipping at their heels at number two on the scoreboard, they are critically not only the first team with an attempted solution to their on-orbit challenge, but the first with an accepted solution.

904
09:08:36,340 --> 09:08:49,920
That would mean that they would be able to pass PFS if PFS is not able to actually solve because, again, that is a pass-fail challenge and it will be critical to see what happens in the last few minutes of gameplay today as well as tomorrow in the on-orbit challenge.

905
09:08:50,180 --> 09:09:05,800
Now that the day is wrapping up, hopefully some of the organizers have a little bit more time, so we're going to see if we can bring into video chat Vito Genovese, who many of you may recognize from his time as a member of LegitBS, the team that organized the DEF CON CTF for five years prior to the current organizers,

906
09:09:05,800 --> 09:09:07,040
the Order of the Overflow.

907
09:09:07,280 --> 09:09:12,440
Vito is also currently with Chromulence, the creators of the flatsats and many of the challenges in Hackasat.

908
09:09:12,660 --> 09:09:13,840
Vito, can you hear me?

909
09:09:13,840 --> 09:09:14,440
Are you there?

910
09:09:15,180 --> 09:09:16,140
Yes, loud and clear.

911
09:09:16,140 --> 09:09:16,840
Good evening.

912
09:09:17,040 --> 09:09:17,560
Excellent.

913
09:09:17,560 --> 09:09:18,480
Glad we got you.

914
09:09:18,480 --> 09:09:19,200
Thanks for stopping by.

915
09:09:19,200 --> 09:09:23,840
I know you guys have been very, very busy kind of manning the systems and talking to the teams.

916
09:09:23,860 --> 09:09:25,740
How's the game going so far?

917
09:09:26,420 --> 09:09:27,560
It's been going.

918
09:09:27,680 --> 09:09:30,060
We've kind of had some, you know, rough times today.

919
09:09:30,060 --> 09:09:34,200
The flatsats are, you know, small run hardware, which always has issues.

920
09:09:34,200 --> 09:09:41,340
But we're super, super thankful the teams are being patient with us, and they're putting up a good fight and making really, really good progress in the game.

921
09:09:41,620 --> 09:09:45,640
So tomorrow we're hoping for... Sorry, is this pacing what you expected?

922
09:09:45,640 --> 09:09:51,380
Speaking of like how they're kind of doing, is this about where you thought they would be, or you wanted them to be, or how does this fit with your expectations?

923
09:09:52,180 --> 09:09:55,140
It's really hard to set expectations for these games.

924
09:09:55,140 --> 09:09:57,700
A lot of it is, you know, throwing, you know, stuff around.

925
09:09:57,700 --> 09:10:00,760
We can't even be in the same room doodling on a whiteboard while we do it.

926
09:10:01,100 --> 09:10:07,600
So, you know, the expectations are not necessarily what's been happening, but we'll survive.

927
09:10:07,600 --> 09:10:12,220
It's a difficult game and, you know, we'll see what happens tomorrow.

928
09:10:12,500 --> 09:10:17,900
And I mean, it does seem like that if they're made good progress up to here, they could have been a lot further behind.

929
09:10:17,900 --> 09:10:21,700
It would be nice to see them maybe a challenge ahead, but this is certainly within reach, right?

930
09:10:21,700 --> 09:10:24,680
Like there's nothing kind of too crazy about what they have remaining.

931
09:10:24,840 --> 09:10:25,580
This could be doable.

932
09:10:25,580 --> 09:10:28,660
We know these are good teams that are capable of more, it seems like, right?

933
09:10:29,600 --> 09:10:30,860
Right, yeah, absolutely.

934
09:10:31,260 --> 09:10:35,040
The, you know, challenges zero, challenges one, they're hard challenges.

935
09:10:35,080 --> 09:10:38,060
And the teams that took time on them, they still took time on them.

936
09:10:38,060 --> 09:10:40,360
They did make progress and they did get through eventually.

937
09:10:40,800 --> 09:10:45,640
It's, you know, admirable work and it's, you know, it's great to see everybody involved.

938
09:10:46,000 --> 09:10:50,880
Now, do you miss actually being in Vegas and going to DEF CON or you actually kind of prefer being remote?

939
09:10:50,880 --> 09:10:52,540
What's your take on that?

940
09:10:52,840 --> 09:10:54,460
Oh, I absolutely miss it.

941
09:10:54,600 --> 09:11:00,020
You know, my favorite restaurant in Vegas, I miss, or my favorite restaurants plural in Vegas, I miss that.

942
09:11:00,020 --> 09:11:01,240
I miss seeing my friends.

943
09:11:01,240 --> 09:11:05,600
I miss wearing my, you know, special DEF CON shoes, which are behind me on the shelf.

944
09:11:05,600 --> 09:11:12,100
They're not in frame yet, but, you know, it's better than getting really, really sick, I guess.

945
09:11:12,740 --> 09:11:17,100
Given the alternative, yeah, we're all kind of doing what we can and should there.

946
09:11:17,100 --> 09:11:25,120
In fact, even you were originally supposed to be on stream with me and we just thought for safety reasons that we would do this via Zoom and we'd be able to work it out that way.

947
09:11:25,120 --> 09:11:27,620
So thanks for doing that.

948
09:11:27,620 --> 09:11:31,880
Tell me a little bit more about the rationale behind the scoring algorithm and the game design.

949
09:11:31,880 --> 09:11:38,160
This decay and the kind of the grace window, what design constraints went into that decision?

950
09:11:38,720 --> 09:11:43,300
Okay, so the main design constraint with this is it's a very linear capture-the-flag game.

951
09:11:44,360 --> 09:11:52,320
So what has to happen is we're trying to get teams to take over this or regain control of this, you know, tumbling satellite lost in space.

952
09:11:52,320 --> 09:11:54,760
And that is a complicated operation.

953
09:11:55,040 --> 09:12:03,280
And instead of just having, you know, one single, you know, you get this chunk of points if you win the game, we split it up into different little gates that teams have to pass through.

954
09:12:03,420 --> 09:12:08,980
So, you know, challenge zero or the first gate is getting control of a machine in the ground station.

955
09:12:09,080 --> 09:12:13,540
Challenge one after that is being able to actually talk and receive messages with the satellite.

956
09:12:13,560 --> 09:12:19,200
So we had to split this up in order to keep, you know, make the game actually have points before you get to the end.

957
09:12:19,780 --> 09:12:28,820
And at the same time, in order to make the points actually meaningful, we wanted to make sure there is some time pressure for teams to go quickly and make progress throughout the whole weekend.

958
09:12:28,940 --> 09:12:31,660
So we have this kind of decay system implemented.

959
09:12:31,860 --> 09:12:35,020
So each challenge is worth a fixed number of points at the beginning.

960
09:12:35,240 --> 09:12:39,840
And as soon as the team solves it the first time, the clock starts ticking.

961
09:12:39,840 --> 09:12:45,440
So within that first 30 minutes, anybody else who solves that challenge is also going to get the full points.

962
09:12:45,440 --> 09:12:47,220
For challenge zero, that would be 50 points.

963
09:12:47,220 --> 09:12:50,940
For challenge two or for challenge one, that was 200 points.

964
09:12:51,340 --> 09:12:59,760
Beyond that, after that first 30 minutes, we have another two-hour interval where that point amount starts gradually ticking down towards zero.

965
09:12:59,860 --> 09:13:02,500
Once it's hit zero, we don't award points for it.

966
09:13:02,500 --> 09:13:07,700
And at that point, it also means that we share hints to, you know, nudge teams along to get them to the next phase of the competition.

967
09:13:08,440 --> 09:13:19,480
And that's one of the advantages, I think, is that, you know, that a team, if they happen to get stuck on one particular problem in a serial event in particular, there's just not much you can do in fairness to the other teams in terms of, you know, kind of,

968
09:13:19,480 --> 09:13:23,120
you don't want to give a team a hint just because they're behind, because that actually hurts them.

969
09:13:23,120 --> 09:13:29,060
But by having the score drop off at a point which they have to be done or else they're just given a hint, well, then they've lost all the points for it.

970
09:13:29,060 --> 09:13:32,840
And so it keeps them up with the game while not punishing the teams that do well.

971
09:13:32,840 --> 09:13:34,380
So that makes a lot of sense.

972
09:13:34,380 --> 09:13:37,420
If you had a favorite challenge, what's the number?

973
09:13:37,420 --> 09:13:41,600
And if it's one we haven't seen yet, like, no spoilers, of course, but what do you like best?

974
09:13:42,040 --> 09:13:49,420
So it's honestly, for me, it's probably challenge one, which is kind of where the game starts to diverge from a normal capture the flag contest.

975
09:13:49,500 --> 09:13:54,320
With challenge zero, we had a web app that teams had to, I think, determine a cookie secret in.

976
09:13:54,580 --> 09:13:55,460
And that's very...

977
09:13:58,460 --> 09:14:00,800
Nudge one is where we start to diverge.

978
09:14:00,960 --> 09:14:17,280
That's where we have to, once we've gotten into the ground station and are able to talk to the satellite control system, Cosmos, that's where teams have to figure out how to turn telemetry on on the satellite, because it's not just another machine on the network with an IP address.

979
09:14:17,280 --> 09:14:27,080
And where teams have to figure out how to tell the satellite's radio to configure itself in a way that it's actually functional for the rest of the game, for sending messages back and forth.

980
09:14:27,080 --> 09:14:35,860
I saw a great quote go over the team communication channel from the organizers that said, these are not like traditional network devices.

981
09:14:35,860 --> 09:14:52,860
And if you think sending two requests a second will get you more reliability the way you would in a normal network, that may be counterproductive here, which I thought was a great kind of nod towards the, yeah, there's some different constraints and different concerns that maybe are not the folks' first instincts are accurate on,

982
09:14:52,860 --> 09:14:53,860
given the environment.

983
09:14:53,860 --> 09:14:55,320
So that makes a lot of sense.

984
09:14:55,800 --> 09:14:56,920
Yeah, absolutely.

985
09:14:56,920 --> 09:15:01,020
It's a satellite is, in some senses, it is still a computer.

986
09:15:01,020 --> 09:15:06,240
But the problem is, is it's a computer that costs millions and millions of dollars to, you know, install.

987
09:15:06,300 --> 09:15:07,840
And it costs, you know, billions of...

988
09:15:09,600 --> 09:15:12,380
No, I think we might have lost you a little bit there for some network.

989
09:15:12,380 --> 09:15:13,060
Oh, you're back now.

990
09:15:13,060 --> 09:15:13,620
Go ahead.

991
09:15:13,820 --> 09:15:14,020
Yeah.

992
09:15:14,020 --> 09:15:14,580
OK.

993
09:15:14,680 --> 09:15:15,000
Yeah.

994
09:15:15,000 --> 09:15:18,580
It costs, you know, millions to put it in place in the first place.

995
09:15:18,580 --> 09:15:22,080
And it costs billions to send somebody up there to push a button to restart it.

996
09:15:22,680 --> 09:15:26,240
Beyond that, it's, you know, a computer that you only talk to on RF.

997
09:15:26,260 --> 09:15:30,900
And it's moving in a way that whatever you can see it, you can probably talk to it.

998
09:15:30,900 --> 09:15:34,620
But there's a lot of time from any given ground station where you can't see it at all.

999
09:15:34,960 --> 09:15:37,280
And that's a very unique challenge.

1000
09:15:38,320 --> 09:15:43,060
Vito, thank you very much for both your work on the game and for taking some time to talk to us tonight.

1001
09:15:43,060 --> 09:15:45,080
Look forward to seeing how the teams do tomorrow.

1002
09:15:45,260 --> 09:15:49,140
I look forward to talking to some more as we see their progress.

1003
09:15:50,100 --> 09:15:50,600
Excellent.

1004
09:15:50,600 --> 09:15:50,940
Thanks.

1005
09:15:50,940 --> 09:15:51,640
Take care.

1006
09:15:51,940 --> 09:15:52,540
Take care.

1007
09:15:53,780 --> 09:15:59,060
That's it for this first day of the Space Security Challenge 2020 HackASet final event.

1008
09:15:59,140 --> 09:16:03,400
Overnight, we'll be taking our FlatSats offline so they can get a good rest, a.k.a.

1009
09:16:03,400 --> 09:16:08,380
have their batteries charged, and so the competition organizers can recharge their batteries, a.k.a.

1010
09:16:08,380 --> 09:16:09,800
have a good night's rest.

1011
09:16:09,840 --> 09:16:17,460
Of course, in addition to sleep, the teams will need to continue working on some of the components in between game shutdown and game start tomorrow morning at 7 a.m.

1012
09:16:17,460 --> 09:16:18,540
Pacific and 10 a.m.

1013
09:16:18,540 --> 09:16:19,240
Eastern.

1014
09:16:19,240 --> 09:16:23,940
They've actually been given a firmware image that will help them for the upcoming Challenge 3.

1015
09:16:24,600 --> 09:16:26,320
Thanks for spending your day with us.

1016
09:16:26,320 --> 09:16:32,200
Make sure to check out the rest of what's happening at DEFCON, the Aerospace Village and our Aerospace Workshops.

1017
09:16:32,200 --> 09:16:35,140
And I look forward to seeing you all tomorrow morning at 9 a.m.

1018
09:16:35,140 --> 09:16:36,120
Pacific, 12 p.m.

1019
09:16:36,120 --> 09:16:37,860
Eastern for our next game update.