start	end	text
275980	294520	A little pause... and we are back.
294520	296300	A little pause... and we are back.
866290	867930	A little pause... and we are back.
956360	957780	A little pause... and we are back.
1562690	1575050	A little pause... and we are back.
1658920	2021780	A little pause... and we are back.
2073570	2073770	A little pause... and we are back.
3622490	3626710	Welcome to Space Security Challenge 2020, HackASAP.
3626710	3628750	The final event.
3628770	3633910	As the democratization of space opens up a new frontier for exploration and innovation,
3633910	3637570	we see new cybersecurity vulnerabilities emerging.
3638530	3643350	The Space Security Challenge is designed to inspire the world's top cybersecurity talent
3643350	3648790	to develop the skills necessary to secure this last frontier of cybersecurity.
3648970	3650270	Space.
3650410	3652990	And already we've made a ton of progress.
3653250	3654690	I'll catch you up.
3654690	3659370	This spring, we hosted over 2,000 teams who worked their way through a set of foundational
3659370	3664310	space cybersecurity challenges in our HackASAP qualification round.
3664330	3668710	Now, eight finalist teams are stepping up to the ultimate challenge.
3668930	3671830	They are hacking a satellite.
3679330	3683310	Welcome to Space Security Challenge 2020, or HackASAP.
3683310	3687150	I'm your host, Jordan Wines, and I'm very excited to be with you today.
3687150	3692430	I'm here in Melbourne, Florida, at HackASAP HQ, where eight satellites are spinning out
3692430	3699630	of control as the teams do their best to restore functionality, all for a piece of a $100,000
3699630	3701010	prize pool.
3701130	3705590	These teams, from 11 different countries around the world, include not only some that are
3705590	3711130	very familiar to those of us from the Capture the Flag, or CTF, community, but also include
3711130	3715330	many newcomers who assembled just to answer the call for HackASAP.
3715330	3716850	Let's meet our teams.
3757920	3763680	To get to this final event, individuals on these eight teams had to beat out over 6,000
3763680	3766220	other competitors for a coveted invitation.
3766220	3771380	This required mastery not only in traditional CTF hacking skills, like reverse engineering,
3771380	3776620	and vulnerability research, but also in areas new to the CTF community, including orbital
3776620	3782360	mechanics, astrophysics, space-based communication systems, and many others.
3782360	3787680	Today and tomorrow, each of our eight teams will race the others through a series of challenges
3787680	3790560	to regain control over their Flatsat.
3790560	3797740	If you've followed our story at hackasat.com and launch.com.com, you might know that through
3797740	3803500	some bad code and poor business choices, our defunct launch.com company has accidentally
3803500	3808840	triggered a satellite intended for the year 2000 to be launched in 2020 with no one in
3808840	3809740	control.
3809740	3814360	In our fictional storyline, this satellite has been co-opted by nefarious forces, and
3814360	3818100	it's up to our competitors to regain control over the many components.
3818100	3823780	Since qualifying, each team was shipped a physical Flatsat, and these Flatsats are not
3823780	3828460	only prizes for their qualifying performance, but also allow the teams to become familiar
3828460	3832100	with the hardware and software before this final event.
3832100	3835120	So what's the difference between a satellite and a Flatsat?
3835120	3839540	Think of a Flatsat as a bench version for testing components of an actual satellite
3839540	3843840	without necessarily being exactly what you would send into space.
3843840	3849500	The satellites you can watch in our live webcams are Flatsats, but don't worry, not
3849500	3852740	all of the competition this weekend will be terrestrial.
3853000	3857260	The game has actually been underway for one hour now, and our team's first challenge
3857260	3861780	has been to regain control of the ground station that they'll be using to communicate with
3861780	3863120	their Flatsats.
3863120	3866960	Being good hackers, of course, we call this Challenge Zero.
3867780	3869060	Challenge Zero.
3870140	3875420	Here's what we know. An adversary has obtained access to the satellite's ground station.
3875420	3878400	Once they obtained access, they kicked us out.
3878620	3883060	The challenge? Teams must obtain network access to the ground station.
3889980	3895120	This is called Challenge Zero because it's required for the teams to even kick the game off.
3895700	3900240	While most of our challenges will have teams focusing on components that are inside of
3900240	3905140	their Flatsats, Challenge Zero is all about gaining access to the ground station that
3905140	3907920	they'll be using to communicate with their Flatsat.
3908040	3912120	And again, this is not a simulation. All of these eight Flatsats may be here on Earth,
3912120	3916960	but they're completely untethered, floating on a cushion of air, and each one being connected
3916960	3919440	wirelessly from a separate radio link.
3919680	3924180	In the first hour of gameplay, teams have been getting their bearings and working on
3924180	3929180	solving Challenge Zero. In fact, just before this broadcast went live, we received word
3929180	3934660	that this challenge was actually solved by Team Samurai. Congratulations to them.
3934660	3938320	Let's go ahead and see a little bit more about Team Samurai.
3967720	3972920	Team Samurai is a mainstay in the CTF community. In fact, one of the fun facts about this community
3972920	3978040	is that I've competed against Samurai about as many times as I've actually competed with them.
3978040	3982200	This community is tight-knit, people move around between them, and it's good to see them jump
3982200	3984980	into the lead and take a start on the scoreboard.
3984980	3988620	They're now going to be focusing on Challenge One, which we're going to give you a little
3988620	3991020	bit of a hint on what that entails now.
4003160	4007560	The Challenge. Teams must regain communication with a satellite.
4017790	4023070	While this event was originally planned to be in-person during DEF CON in the Aerospace
4023070	4027830	Village, thanks to the tireless efforts of dozens of people involved behind the scenes,
4027830	4030910	we're instead streaming to you live throughout the event.
4030910	4034990	Not only has the game itself been adapted to allow for remote participation from our
4034990	4039890	eight teams over VPN, but the spectator experience has changed as well.
4039890	4043450	There are many different ways you can now experience HackASAT.
4043510	4049430	For a simpler interface, just visit hackasat.com with a web-based scoreboard, these periodic
4049430	4053130	live updates streamed right in center, and links to other resources.
4053210	4058270	For a more immersive experience, head over to virtual.hackasat.com, where you can get
4058270	4063230	all of the above and more, including watching our satellites live via one of four dedicated
4063230	4068770	webcam feeds, get more technical game data from the 3D Octagon scoreboard, as well as
4068770	4073370	many other resources about our competitors, the flatsats, the technologies involved in
4073370	4077690	space, and even communicate with other viewers in a dedicated chat and have a few social
4077690	4078690	interactions.
4078930	4082890	No need to remember all that just now though, all you have to remember is that you can find
4082890	4087530	it all on hackasat.com and virtual.hackasat.com.
4087530	4091890	The HackASAT team is also partnering with the Aerospace Village, one of the many villages
4091890	4094630	you'd normally get to experience in person at DEF CON.
4094630	4099230	After 15 years of attendance, I know I'm not the only one missing many of my friends
4099230	4101290	and our hallway conversations at DEF CON.
4101650	4105010	Hopefully, we can recreate a little bit of that experience here.
4105470	4109550	In addition to all of that we have going on at HackASAT, make sure you check out the rest
4109550	4113530	of what DEF CON, the Aerospace Village, and our friends over at Defense Digital Service
4113530	4114910	are doing this weekend.
4114910	4118790	And hope to see you back here as we check in on how our teams are doing and hear more
4118790	4123990	about the vision behind HackASAT at our next update at 11 a.m. Pacific, 2 p.m. Eastern.
4732480	4839370	Thanks for watching.
7306900	7313080	And I hope to see you back here at 11 a.m. Pacific, 2 p.m. Eastern.
7815680	7816200	Thanks for watching.
7816200	8541140	And I hope to see you back here at 11 a.m. Pacific, 2 p.m. Eastern.
10003720	10006000	Thanks for watching.
10006000	10122560	And I hope to see you back here at 11 a.m. Pacific, 2 p.m. Eastern.
10122560	10124120	And I hope to see you back here at 11 a.m. Pacific, 2 p.m. Eastern.
13169920	13170020	Thanks for watching.
13389400	14182240	And I hope to see you back here at 11 a.m. Pacific, 2 p.m. Eastern.
14429070	14429710	Thanks for watching.
14429710	14433150	Welcome back to HackASAT. I'm your host, Jordan Wines.
14433150	14440030	Right after our last update ended with only a samurai solve, several other teams came in with solutions for Challenge Zero.
14440170	14444890	PFS and SolarWine were solvers two and three on that challenge.
14446890	14451590	Let's go ahead and take a look at those two teams and see what we know about them.
14510550	14517110	I particularly enjoy the contrast between these two teams that joined samurai at the top of the leaderboard earlier today.
14517170	14523650	SolarWine has decidedly not from a CTF background, whereas PFS definitely has a strong background in the CTF community.
14523650	14529090	In fact, I only found out after they'd already qualified that I actually knew some of those members of that team.
14529090	14535810	After those two teams scored on Challenge Zero, every other team was eventually able to solve Challenge Zero over the next several hours,
14535810	14539850	though you'll notice on the scoreboard that some of them received less points.
14540490	14543870	This is because each challenge has a degradation period.
14543870	14549570	This means that for 30 minutes after the first solve, all other teams have a chance to score for full points,
14549570	14554450	but after that, they only have an additional two hours to solve that particular challenge.
14554450	14559410	During the two-hour period, the points available for that challenge slowly go to zero.
14559510	14562670	While it puts the pressure on our teams to stay up with their peers,
14562670	14567710	it means that no one can get stuck on a single challenge that leaves them behind for the entire event.
14567790	14574410	At the end of that two-and-a-half-hour period, we give all teams our solution, though of course those old points are gone forever.
14574650	14577690	This is primarily a facet of being a serial CTF.
14577690	14580970	In many CTFs, challenges can be solved in parallel,
14580970	14585670	so this was an attempt to keep the game going even if you get stuck on one challenge.
14586090	14591190	Of course, one concern was that this would unfairly punish some teams in different time zones.
14591190	14595430	Thankfully, we are only running the satellites for nine hours of gameplay each day,
14595430	14601190	and it lines up fairly well with hacker standard time, anywhere from 4 p.m. to 1 a.m., depending on the team.
14601590	14608730	One advantage of this particular scheme of point degradation is that we can explain in detail the solution for challenges that have expired.
14608730	14611590	Here's our official explainer for Challenge Zero.
14612770	14613850	Challenge Zero
14615250	14621750	Here's what we know. An attacker has obtained access to the satellite's ground station through an internet-facing website.
14621750	14624550	Once they obtained access, they kicked us out.
14624550	14628970	The challenge? Teams must regain network access to the ground station.
14629050	14630530	Here's how they do it.
14630530	14634830	An internet-facing website exists on the same subnet as the ground station.
14634830	14638450	Teams must identify and exploit a vulnerability in the web server,
14638450	14643290	then use it as a foothold within the network to pivot to the ground station and gain access.
14648320	14654240	So for Challenge Zero, teams first had to extract a key from the Ruby web service used to generate sessions.
14654240	14657740	Then they used that to forge credentials to the service as an admin user.
14657820	14662720	Finally, the admin page, they could actually find a piece of it where they could execute shell commands.
14662720	14666160	They were sued, and there were some other intricacies they had to figure out.
14666160	14670680	But eventually, they got a shell in the box, or they got access to an SSH key on that box,
14670680	14674780	and that ultimately gave them connections to their Cosmos ground station.
14674940	14680000	This is the machine that they would be using for the rest of the event to control their particular flatsats.
14680440	14684860	They issue commands through the Cosmos server, goes over the RF link to their satellites.
14685260	14688840	While Samurai had a head start with access to their server first,
14688840	14693220	PFS was able to take the lead about an hour ago by solving Challenge One.
14693220	14698720	As a reminder, the goal of Challenge One is to re-establish better communications with their flatsat,
14698720	14703240	and we'll learn more about how they solved that once all teams have solved that challenge.
14703300	14709720	Not to be up done, Poland Cannon to Space followed shortly thereafter, bringing them neck and neck for first and second.
14709820	14714860	Poland Cannon to Space is actually a conglomeration of two teams, P4 and Dragon Sector.
14746140	14750880	Both Dragon Sector and P4 are very recognizable names in the CTF community,
14750880	14757260	with Dragon Sector having a pretty good claim maybe at one of the all-time winningest CTF teams, if not the most.
14757720	14761400	And of course, P4 has done very, very well, especially this year in the competition.
14761980	14766420	And of course, their team name itself is a reference to a funny webcomic that you should Google if you haven't seen it.
14766420	14768000	It even has its own video game.
14768240	14772220	If you're interested in some more of the history of these teams that have played CTFs before,
14772220	14777820	make sure to check out ctftime.org, a website that actually tracks teams' performance across different events,
14777820	14781560	and has a global yearly ranking system that's hotly contested.
14782100	14785200	That's all for our next game update, but it's been a busy one.
14785780	14789740	Next, HackASAT has been the work of many different organizations coming together,
14789740	14794280	but the primary vision has come from two individuals that we wanted to let you hear from directly.
14794320	14799960	They are Dr. Will Roper, Assistant Secretary for Acquisition Technology and Logistics, Department of the Air Force,
14799960	14805340	and Mr. Brett Goldstein, Leader of the Rebel Alliance at the Pentagon, Director of Defense Digital Service.
14806080	14810740	And they're joined by our intrepid interviewer, Roro, who will be asking them the hard-hitting questions
14810740	14814560	in a segment we're calling Between Two Nerds.
14827800	14834960	Welcome to Between Two Nerds. My name is Brett Goldstein. I'm the Director of the Defense Digital Service.
14835260	14839980	And I'm Will Roper. I run all of the Air Force and Space Force programs.
14839980	14843800	And we would like to introduce Roro, our moderator today.
14843800	14849160	Roro is a member of the Defense Digital Service and has mad security skills.
14849160	14854060	First things first, I wanted to ask you all the question that I've reached out to a bunch of hackers in the community about.
14854060	14858820	And the most important thing that's on their minds right now is how do you attach the lanyard to the cassette tape?
14858820	14861140	Well, that's a question for Dr. Roper, I think.
14861700	14864800	Dr. Roper, considering your advanced work in this space...
14866720	14869860	Well, I mean, first of all, there's a design issue here.
14869860	14874240	So, whoever did this, you're fired if you're on the Air Force.
14874640	14878340	Thing two, there's no place to immediately hook it.
14878340	14880840	So, I'd say we just tie it.
14880940	14887280	We just tie it here and then we hang it around our neck and get a better cassette next year, whoever did this.
14887280	14889320	Do you have the duct tape?
14889320	14892680	I mean, basically, if you have a small neck, you're okay.
14892680	14897460	Like an actual duck. I could wear this if you don't have duct tape.
14897980	14904200	So, the other question that has also been on their minds is why are y'all here at DEF CON safe mode?
14904480	14908640	Sure, well, I mean, you had incriminating evidence on me, so I'm here.
14909400	14912260	We're going to try to go flat the whole time, Roro.
14912260	14915700	This is between two nerds, after all, the inaugural shooting.
14915720	14919460	So, no laughter, no fun. This is serious business.
14919460	14921800	We're hoping to be syndicated.
14921800	14928380	Eventually. We can't afford ferns yet, but we're headed towards that next step.
14928380	14931660	So, Roro, we need a bit more of a positive attitude on this.
14931660	14936580	Like, as we think about sort of our future careers, there seems to be a lot of potential.
14936580	14938820	Rho cubed today, Roro.
14938820	14943620	So, Roro, in all seriousness, because we're being serious here between two nerds.
14945480	14947700	Satellite security is a big deal.
14948060	14950080	You know, all joking aside, it's a big deal.
14950080	14957580	Our lives depend on space working in a benign, peaceful way that makes life better for everyone.
14957580	14960900	You need it for the data that's coming to your phone right now.
14960900	14962560	You need it for navigation.
14962560	14965480	You even need it to get cash out of an ATM.
14965800	14970120	Everyone's lives, as we sit here today, is connected to space.
14970280	14973240	Well, you can imagine the military is no exception.
14973360	14975060	We're connected to space.
14975060	14981520	We use it to move planes from point A to point B, to guide weapons, to plan disaster relief missions.
14981540	14983200	Everything we do.
14983480	14995540	So, if you're thinking about a way to beat our military, holding space assets at risk is a pretty easy way to take a big leap forward in terms of your capabilities.
14995540	15000320	And so we want to know if cyber is something we need to put more worry into.
15000320	15005020	So we're here to see if people can hack a satellite, which we think they'll be able to.
15005020	15011800	And we hope to learn from the community how to be better and more cyber resilient in systems we build in the future.
15012180	15020940	As an international community of hackers and nerds, how can they help out? What is the call to action here if there is one?
15020940	15025180	Sure, and I'm going to try to stay flat. But boy, it's really hard because I'm excited about this.
15025240	15027100	Anyway, back to Between Two Nerds.
15027100	15033900	Just being here and being interested is a huge deal. We want to learn from you. The military is here to learn.
15034700	15042680	Historically, we have been secure by hiding behind our fence lines and keeping systems secret until they're used on the battlefield.
15042680	15044460	Well, that doesn't work anymore.
15044460	15050840	Software is increasingly the delineator in whether systems are dominant or out of the fight.
15050840	15060640	So we're getting outside of our fence lines and involving communities that can help us, like DEFCON, to see if we need to up our game in cyber.
15060740	15072080	And so if our satellites have to operate to make the military work the way it's supposed to, we want to expose opportunities to hack them ahead of us taking them into conflict.
15072080	15081720	So what I hope to learn from DEFCON, from all the amazing community members here, is how good we are today and what we need to do to be better in the future.
15081760	15092700	So the Department of Defense historically has operated cybersecurity through obscurity, and that is a culture that we're trying to change.
15092700	15099760	So I'm fortunate I run the Defense Digital Service, which is affectionately known as a SWAT team of nerds.
15099760	15107940	And we are out there, and we are trying to bring the very best in technical talent to the DoD.
15107940	15112840	And part of that is about technology, but part of it is about culture.
15112840	15124520	So when Will and I went to DEFCON last year, I'd been attending DEFCON for many years, but I brought Will, and I said to him, this is a community we need to embrace.
15124520	15132340	And one, DoD does not need to be afraid of this community. These are folks who we should be friends with.
15132340	15140100	But two, we need to raise our bar. We need to challenge our software. We need to try and test our systems.
15140100	15143620	And by doing that, we bring the very best in cybersecurity.
15143800	15149420	So I love this partnership. We learn a lot. We challenge ourselves.
15149420	15154260	Sometimes we learn things that are hard, but this is a community we really want to embrace.
15154260	15160580	So can you tell me a little bit more about how you got involved with the space, or what was the initial ask?
15160580	15165220	So the first time I went to DEFCON, I was by myself.
15165340	15172680	And I had recently left my first stint in government, and people were like, you have to go to DEFCON.
15172680	15180720	And I went there, and I'm like, holy shit, there's a gazillion people here, there are crazy things going on, and people said, don't bring a phone in.
15180720	15185040	And I was completely enamored with this community.
15185040	15194840	And then I came to DoD, and as we're trying to change this culture, which is an obscurity culture, a security by checklist,
15194840	15203960	I'm like, this is a community that can help make us smarter, and help us, again, raise the bar, even against ourselves.
15203960	15213900	So by bringing Will, and then showing all of the crazy cool things that we're doing, it allowed for that DDS Air Force relationship,
15214420	15219200	which we could then come back and try and do some really cool things.
15219340	15228220	And the funny part was last year, when DEFCON was winding up, I go to Will, and I'm like, we should go back.
15228220	15231880	And Will's like, yeah, we should go back. And I'm like, what do you think we should do?
15231880	15238580	And DoD's like, we should bring a satellite. And that was crazy. But now it's real.
15238820	15244260	Yeah, it's great when crazy and real can be the same inside the Pentagon.
15244480	15252620	And Brett's exactly right, that this is a community that the Department and the Pentagon have been afraid of embracing.
15253440	15257380	Partly because it's an old Cold War culture that's just behind the times.
15257380	15263640	And another is simply because it doesn't get outside of its five-sided walls very often.
15263640	15268880	And my first trip to DEFCON was amazing. I'm a string theorist by background.
15268880	15273500	I work in physics. I crossed over into defense for really weird reasons.
15273500	15282280	But it's been an awesome job of getting to run $60 billion of satellites and airplane and cyber capabilities every year.
15282280	15288940	As I look at this amazing portfolio of programs, everything is driven by software.
15289080	15302920	And the United States government and our amazing men and women in uniform have put so much time and treasure into these amazing military systems that increasingly operate based on their software.
15302920	15311740	So if you're looking to defeat us, you don't have to recreate the same systems, build a fighter to match ours, build a satellite to match ours.
15311740	15313900	You just need to be able to hack us.
15313940	15329900	And so I came last year wanting to see could people who have a great amount of expertise but not a lot of hands-on capability inside the military get inside a system like an F-15 fighter or the systems that enable it.
15329900	15334380	And so we brought some of those enabling systems and the hacker community got in.
15334380	15340100	But getting in was not the point of being here. It was the learning that happened afterwards.
15340180	15347520	The hacker community got to learn something about our military systems and we left knowing how to make them more secure.
15347640	15350240	And so we want to do the same thing for satellites.
15350240	15355940	It's a very different problem than handing you a piece of hardware and saying, can you get in?
15355940	15361240	The satellite isn't here, it's overhead, moving at 7 kilometers a second.
15361240	15368760	And it only talks to the ground at certain places where we have a ground station that uplinks and downlinks different commands.
15368760	15372400	This is a wicked hard problem.
15372560	15375920	But I expect the DEFCON community is going to get in again.
15375920	15379400	And the question we're going to ask is what should we learn?
15379400	15380920	What should we do better?
15380920	15386920	Because cyber is something any country, any terrorist group can try to do against our military.
15386920	15392120	It's quicker, easier, and more seductive than trying to take us head on.
15392120	15397160	So this dark side of the force is something we're going to have to be able to defeat.
15397160	15400300	And we're here to learn from people who know a lot more than we do.
15411420	15417460	For the F-15 system, it was really to probe just how many different ways do people get in.
15417460	15420760	Do we have a design flaw? Is it a design flaw?
15420760	15426880	Is it a hardware flaw where we've got embedded systems that have back doors that can be accessed?
15426940	15430340	Is it a software flaw or is it a little bit of all of the above?
15430540	15432420	It's a little bit of all of the above.
15432680	15437500	And so after doing a meeting with the hackers that got in, they walked through.
15437500	15440700	I tried this and it worked. Then I tried this next path and it worked.
15440700	15445140	And just like electricity always flowing through the path of least resistance,
15445140	15452560	they kept trying methods that got increasingly harder, but they didn't have to pull their toughest tricks to get in.
15452680	15458840	So the direction I think we're going, that we ought to go, is fully embracing the hacker community at DEF CON
15458840	15465980	and not waiting until systems are built to create opportunities to learn and help us learn.
15465980	15470840	We should bring the hacker community into systems as we design them.
15470840	15474600	Help us make them more secure before we're producing them.
15474600	15479860	And I think this could be win-win. We would learn a ton from this community,
15479860	15485640	but also create some of the most interesting challenges because the systems we build are unique.
15485640	15490580	They have some pretty amazing technology in them and I think the opportunity for the hacker community
15490580	15496060	to get new hands-on experience would also be really energizing and cool.
15496060	15499080	So events like HackASAT are awesome live events,
15499080	15506560	but the relationship and continuing it across a broader set of opportunities is what's more exciting.
15506560	15517560	There's an interesting synergy between, one, the hacker community can touch devices you never would think you'd be allowed to touch.
15517560	15522920	Weapons, satellites, all the things that are pretty cool.
15522920	15529980	It also helps us learn commonalities where we build a lot of different things.
15530040	15537360	And by learning those base cases of things we should do and should not do, that helps the design.
15537360	15543800	But at the same time, people need to understand that there's a creativity to hacking.
15543800	15549760	We often in the military, we think about checklists and spreadsheets and things like that.
15549760	15556040	But I know people who have done red team and hacking exercises, it's much more of an art.
15556040	15560320	And we want to bring that art into making our system safer.
15561000	15566540	So we started this planning a little bit last year and then COVID hit. How did that change the plans?
15568620	15573120	So there were moments where it was insanely stressful.
15573120	15579620	Where it's, we are charging ahead and I'm sitting there, oh my God, what's going to happen with DEF CON?
15579620	15585100	But then we realized we're perfectly situated for a virtual event.
15585200	15592460	We have a VR environment. We have all of these workshops. Everything is now accessible from anywhere.
15592460	15599240	And where I think it's really interesting is we can now provide access to these workshops at a much larger scale.
15599240	15604880	Whereas last year, like the workshops were awesome, but we were swamped.
15604880	15613560	But now in the VR environment, we can take thousands of people and also for access to the actual hack a set on event.
15613820	15617280	It's open to the world now and it's going to be super cool.
15617300	15622400	So a little anxiety, but we are good to go. And I'm really excited.
15622620	15628000	I'm more excited about the virtual event than I would have been doing a live event at DEF CON.
15628000	15634460	And don't get me wrong, it would be awesome to have an event, live event with people attending,
15634460	15642140	being able to shake hands and give high fives to the team that pull off what is going to be a very difficult challenge.
15642300	15648320	But the virtual event is going to allow so many more people to be part of this experience,
15648320	15654180	part of the community that gets to attempt this for the very first time at DEF CON.
15654180	15661020	And I am so much more excited about a bigger community than I am about putting up a stage at Las Vegas
15661020	15663720	and then taking it down after the event is over.
15663720	15669360	We got to do this a few months ago when we were kicking off our flying car program.
15669360	15676080	Long story, but pretty awesome that we're creating a new initiative to accelerate flying cars for the country.
15676180	15681460	Well, that program was supposed to be a major kickoff at South by Southwest, which canceled.
15681460	15684140	And we had to decide, what do we do?
15684140	15691340	Well, we kept the event rolling through a virtual event and had over 60,000 people participate.
15691340	15700280	We would have never had that number be able to make it down to Austin and get to an event that could probably hold no more than 2,000 tops.
15700340	15705480	So the potential for a greater community is huge doing the event this way.
15705480	15716320	We will still get all of the cool factor from multiple hacker teams having the opportunity to let their code run live in space, which is just an awesome opportunity.
15716420	15723040	But imagine this, Roro. We had over 2,000 different teams just go through the qualls.
15723040	15728800	We had over 6,000 people who have already raised their hand to be a hands-on participant.
15728800	15732380	So who knows how many people will tune in during this week.
15732380	15738180	But the opportunity to have a broad group of people is the most exciting thing about being virtual.
15738180	15742960	And I hope everyone that is logging in and participating, I hope that you're safe and well.
15742960	15749920	So we're super excited that besides HackASet, we are also having a series of workshops.
15750020	15754940	We have bricks in the air again. We have a ground station exercise.
15754940	15760500	Now, the thing that's important here is HackASet was extraordinarily competitive.
15760500	15766620	As Will mentioned, thousands of folks tried out for it and it got narrowed down to eight.
15766760	15768740	Eight teams, that's right.
15768760	15772680	And so we have eight rockstar teams doing that.
15772680	15779220	But part of what we want to do here is help people learn about the variety of technologies.
15779220	15784320	Because what's really interesting to me is this is a different type of hacking.
15784320	15791060	This is not your traditional going after a web property or a traditional software app.
15791060	15793600	There's a new set of skills to learn.
15793600	15801380	So we have workshops all available via VR, ranging from beginner level all the way up to advanced.
15801380	15806760	Because we want to help you learn more about the tooling and the skills you need for these types of systems.
15806760	15812860	And then when you get toward advanced, then you'll be ready to work on the HackASet type of events.
15812860	15815300	So we have the full stack ready for you.
15815460	15821260	One of my favorite comments coming out of one of the teammates that participated in the quals was,
15821260	15824900	I didn't know I needed a degree in physics to hack a satellite.
15825140	15829960	We don't actually need the degree, but you do need to know a little about physics to hack it.
15829960	15836320	And part of the purpose of these workshops are to introduce the peculiar new trade craft that will be needed.
15836320	15843680	So that you can take hacker skills you have today and apply them to these very different opportunities in space and in the air.
15843900	15848520	So I think we really crushed doing the virtual piece.
15848520	15850420	What do we do about stickers?
15850880	15853420	Like the whole Defcon sticker swap?
15854100	15855500	A little stressful.
15855900	15858000	Maybe we could do them like Bitcoin.
15858620	15860600	Crypto coins, that could be the new...
15860600	15863320	Because I can't get coins out right now. I have a bunch in my office.
15863760	15867020	So we can mail them, but crypto coins could be the wave of the future.
15867080	15870020	Yeah, for everyone watching, everyone in the Pentagon has coins.
15870020	15875180	They're things that you give out when someone's really done something great or helped you out.
15875180	15880460	So it goes well back in military tradition, but you give them out via handshake.
15880460	15885020	With the coin in your hand, you shake hands, it transfers from one person to the other.
15885020	15890340	So COVID-19 has put a serious dent in this time-honored tradition.
15890360	15892320	So crypto coins...
15892320	15895580	You throw the coin first, right? But then it gets... it's a hot mess.
15895580	15901720	It's even worse than that. We have them in little plastic bags, and we dump them from one hand to the other.
15901720	15904560	It completely has lost the sense of ceremony.
15905000	15907540	Tap it in the bag first, and then dump them in the hands?
15907720	15912200	There's no way to say, congratulations, stick out your hand, and then dump a coin in it.
15912240	15916200	The firm handshake is needed to say, thank you for what you've done.
15927350	15930190	I thought it was interesting last year.
15931150	15935830	The expectation of DoD was sadly pretty low.
15936470	15944490	Expecting someone in a suit, expecting someone in a uniform, who would not engage this community.
15944490	15952010	And I remember after we gave a talk last year, a bunch of folks came up and they're like, you're not what we expected.
15952010	15957050	And you're doing super cool shit. How can we help?
15957050	15960810	And those are the discussions we want to have.
15960810	15968770	Because Will and I are constantly worried. We're constantly working to raise the bar and make things better.
15968770	15972470	But we need that level of expertise and partnerships.
15972470	15976710	So I was thrilled that last year we could go directly engage.
15976710	15982890	Show that we aren't what you expect, and we do really, really cool things.
15983250	15986050	And the opportunities are really broad.
15986050	15993770	So if someone's out thinking, well, I'm interested in helping the military, but I don't know if I want to work on a weapons system.
15993910	15997050	Every technology under the sun is part of the military.
15997050	16000650	We do disaster relief every year during the hurricane season.
16000650	16006770	The Air Force is flying planes in to move people that are under stress and deliver supplies.
16006770	16011630	And that is a major part of what the military does that doesn't make the news.
16011630	16017590	We work in energy, we work in medicine, providing a lot of frontline responders to COVID-19.
16017810	16020670	All of this is empowered by software.
16020670	16025950	We need digital experts who want to help us take our game to the next level.
16025970	16031390	So no matter what you are interested in working with us on, the opportunity is there.
16031390	16037530	And we will be here year after year at DEFCON bringing opportunities for you to participate in our mission.
16037590	16040510	Learn more about us so that we can learn from you.
16040510	16048130	So when we were building mysymptoms.mil earlier this year, which is part of our COVID-19 response.
16048130	16052610	Before we let it out the door, we reached out to someone in the DEFCON community.
16052610	16055790	Because that needs to be part of our culture.
16056110	16058870	We're creating software, we think it's pretty good.
16058870	16062630	We have a pretty good SWAT team, but we want those outside eyes.
16062630	16066610	And this is for something, COVID-19 is something that's bringing us all together.
16066610	16069510	And that's a perfect example of community engagement.
16069510	16072290	And we tightened it up and we got it out the door.
16072750	16075970	From my view, the defense companies mirror the government.
16075970	16080890	And the government is slow and 20 years, if not more, behind the time.
16080910	16084030	So it has to start with the government leading the dance.
16084030	16090010	And having more people who have technical backgrounds who don't look like what you expect in the Pentagon.
16090010	16094890	Start bringing in new ideas, new technologies, and just a new culture.
16094890	16097610	And that's part of why we're here as part of DEFCON.
16097610	16104390	And part of why we're talking with you through a very different venue than you normally get out of this five-sided building.
16104390	16107850	So that's step one. The government's got to change.
16107850	16110850	Step two is government doesn't make much.
16110850	16114010	We have amazing airmen who write code for us every day.
16114010	16119370	And sci-fi inspired organizations called Kessel Run, Kobayashi Maru.
16119370	16126490	And 60 more names covering the sci-fi and comic book universe.
16126490	16132250	They're awesome teams, but they're a small component of what industry provides.
16132250	16136730	We don't build airplanes. We don't build satellites ourselves. Rarely.
16136810	16140070	And so if industry doesn't learn to adopt these new techniques.
16140070	16145810	If they don't become better at software and shift to new trends and development like containerization.
16145810	16152990	And shift to open approaches to determining errors in code like bug bounties and open sourcing of code.
16153030	16156190	Then we will continue to be further and further behind the times.
16156190	16159030	And ultimately, our model's got to be hybrid.
16159070	16164770	We won't open source all of our code. We will always have things we reserve for conflict.
16164770	16167210	But we don't open source anything today.
16167210	16170330	We did that for the first time this year.
16170330	16175590	The first time we have open source code that's needed for operations.
16175590	16179870	I expect that's the most secure code we have right now in the Air Force.
16179870	16185150	So what's next? The question I have for industry is what's next?
16185150	16187810	And when are you going to be part of the solution?
16188310	16191450	There's a cultural piece we need to get at here.
16191450	16194950	A couple things that drive me crazy.
16194950	16197410	One, good enough for government work.
16197410	16201270	Like that is absolute bullshit. End of sentence.
16201350	16206590	Two is, you know, Will mentioned that government is behind.
16206590	16208230	How is that okay?
16208510	16213610	And this is one of the reasons I left the private sector and came into government.
16213610	16217230	Because we can't be okay with this.
16217230	16221110	So part of what Will and I do is reset this culture.
16221270	16225750	And challenge ourselves, never have acceptance for that.
16225950	16229370	Because neither one of those statements make any sense to me.
16229450	16231090	So do you both have tenure in your jobs?
16231090	16233470	Because this seems like a really bad idea.
16233910	16235610	The hacking satellites...
16237710	16242150	Well, as long as it doesn't come crashing down through the roof anytime soon.
16242150	16245470	We're probably going to make it a few months more.
16246390	16250150	I will say we've taken extraordinary security precautions.
16250150	16254830	To make sure that everything is going to be okay up in orbital land.
16254970	16258510	But we are going to let teams move the satellite.
16258530	16262050	So not move it in a translational sense.
16262050	16264810	But we're going to let teams rotate it.
16264810	16268550	And if they're good enough and they can do their orbital mechanics quickly enough.
16268550	16271050	We're asking them to take a picture of the moon.
16271050	16276030	So what we hope to send out to the hacker community is a wonderful image of the moon.
16276150	16279410	Brought courtesy of the hacker team that won.
16279450	16285750	So that's a pretty, pretty awesome opportunity to have that code actually change something in orbit.
16285810	16291870	But we've taken extraordinary procedures to make sure that's all that that code will be able to do.
16292170	16294950	But Auro, your question is actually an important one.
16294950	16299730	So in terms of tenure, no, I have no idea how long I have in this job.
16299730	16302510	I came into defense through happenstance.
16302510	16305490	Worked for a couple of secretaries of defense.
16305630	16310510	Built a lot of awesome systems, very few of which I can talk about.
16310510	16314950	But amazing capabilities, swarming things, etc.
16315090	16318350	Made with a lot of incredible men and women in uniform.
16318350	16324630	But crossing over into this job, running all the Air Force and Space Force programs, which is an awesome job.
16324630	16326450	If you're ever asked to do it, say yes.
16326450	16333890	Because you get all of these amazing technologies, satellites and airplanes and cyber tools and amazing people to work with.
16334090	16338310	But you only get to be in the job as long as you're asked to do it.
16338310	16341310	And so my tenure could be very short.
16341350	16350730	And what I hope, what I pray for the Pentagon is that people in leadership will keep asking technical people to come and serve.
16350730	16356250	So if you're out there thinking, I'd love to be part of an Air Force hacking team, then come find us.
16356250	16356970	Come join us.
16356970	16364190	If you want to be part of Defense Digital Service, which would be an amazing job where you wouldn't have to wear a suit to work every day.
16364190	16365110	Come join them.
16365110	16368970	Be one of the squadron of nerds.
16368970	16369650	I'm using Air Force.
16369650	16371270	Can you be a squadron of nerds?
16371270	16374070	So the squadron of nerds is part of the SWAT team of nerds?
16374230	16376410	Squadron of nerds would be like the Air Force.
16376410	16377510	We're all squadrons.
16377510	16380270	So we could have like an auxiliary squadron of nerds.
16380770	16382170	Well, there you go.
16382170	16384270	But take the opportunity up.
16384270	16385690	You won't be sorry.
16385690	16392930	But that's ultimately the trend we need are people that have technical talent who don't want to work in the government forever.
16393150	16403310	But that say, you know, for for one, two, three years, I want to go take on some new opportunities for the government to make it easy and energizing to do that.
16403750	16406090	So I'm I'm here on a two year tour.
16406090	16407650	I am halfway through.
16407650	16413150	But the story is like I'm part of the story, but I'm not the story.
16413150	16415310	I'm part of an 80 person team.
16415310	16419170	And this is the best team I've ever been part of.
16419170	16424350	And there will be another director after me who will represent the team.
16424350	16429110	But every day, the SWAT team of nerds goes out and works on projects.
16429110	16432990	You really you can't believe it makes insane impact.
16433070	16434870	So I'll do my two years.
16434870	16439510	And but the mission will go on and the team will continue to rock.
16439890	16443830	I can see if the Air Force can make DDS an honorary squadron.
16443830	16445010	That'd be cool.
16445010	16446870	I'm taking that action.
16446930	16449190	Colonel Bailey, action taken.
16449690	16450690	That's a colonel.
16450690	16452970	Colonel, I just promoted you to Colonel Captain Bailey.
16452970	16454110	Action taken.
16454390	16456210	Can can.
16456210	16458090	Does that mean we can go to space?
16459170	16460170	This is important.
16460170	16462190	Can we just work this through?
16463150	16466850	I think astronaut training should be required for that, Brad.
16467070	16471270	So I was watching Picard with the kids last night.
16471670	16474510	And they have that transport thing.
16474510	16477150	I figured somewhere in the classified portfolio.
16477630	16478810	We're working it.
16478810	16479490	OK.
16479770	16482050	So if that works, can I go to space?
16482050	16486850	It's right next to the warp drive, right next to the photon torpedo.
16486850	16492550	So yes, when we've got teleportation done, Brad, I will personally teleport you up to the space station.
16492690	16493590	Got it.
16493690	16495250	How's the food up there?
16496170	16498170	NASA provides that, so I don't know.
16498970	16500910	Do you think there are any gummy products?
16500910	16503030	I'm going to guess... oh, I don't know, Brad.
16503030	16506010	Because gummy products have a high degree of water content.
16506010	16508290	And all that's going to outgas.
16508370	16511610	So how would mayonnaise perform in space?
16511610	16512490	Not well.
16512890	16514190	That's a critical issue.
16514190	16514910	Not well.
16514910	16521650	So you'd have to get at least a pressure-sealed vessel, but all things we can work on.
16521650	16522930	Science never stops.
16522930	16527830	I'm a little fussy about mayonnaise, so we'd want to work that through before the transporter.
16527830	16531370	So spam sandwiches not going to be on your list for astronaut?
16531370	16531790	No.
16531790	16532690	And a tank?
16533210	16534050	No, no.
16534050	16540090	I was figuring... well, I am fussy about the mayonnaise, but you can actually put mayonnaise with most foods.
16540910	16542530	Just something to ponder.
16553200	16558860	So I'm often asked, why don't we have more artificial intelligence in the Air Force than we do today?
16558860	16561660	Something I'm working very hard to change.
16561760	16566100	Well, one is it's really hard to certify something that changes all the time.
16566100	16571460	But what isn't well understood in the Pentagon, and I find through the country as a whole,
16571460	16576420	is that artificial intelligence is very fragile in the face of an adversary.
16576420	16578280	It's very easy to beat.
16578280	16584560	And so we need to get into the game more and bring the DEFCON and the hacker community into our world
16584560	16590820	and give them opportunities to start beating AI ahead of those opportunities being available commercially.
16590820	16595200	So that's where I'd like to see us go, is into algorithmic defeat.
16595200	16598360	Because that's the next generation of warfare.
16598360	16604040	And the earlier we can determine how to make it safe and secure, the better off everyone's going to be.
16604840	16609420	So I think you'll find that we're good listeners.
16609560	16615680	So we have ideas. We just talked about AI and potential issues with that.
16615680	16617800	We're talking about satellites now.
16617800	16620000	But we're curious what you think.
16620000	16627640	What are things, whether design flaws we should be thinking about, which can be really portable,
16627640	16632380	or other types of exploits that might not be on our radar.
16632380	16635280	So we'd love to just hear your thoughts.
16635280	16636800	We're going to listen.
16637760	16640480	And tell us things we don't know.
16640480	16643980	Or tell us about challenges which are really hard.
16643980	16648480	Like, a year ago, hacking a satellite felt pretty hard.
16648480	16649980	But we're there now.
16649980	16656600	What is a really hard one that you're thinking about, that we can challenge ourselves for, for next year?
16656740	16659740	Why did you pick Steve Carell for Space Force?
16663600	16667340	I mean, you have to love Steve Carell, right?
16667340	16669800	I mean, I'm such a huge Office fan.
16669800	16674140	And so when that came out, I thought, you know, money just because of that.
16674140	16677880	But on the whole, when I get to talk Space Force,
16677880	16687100	beyond the hype and, you know, the glitz that the public media often shine on it,
16687100	16690680	it gets really simple to explain that, you know,
16690680	16694520	do you think that adversaries will try to take on the military in space,
16694520	16700060	given we have a ton of communications and navigation satellites?
16700160	16705800	Satellites of all kinds, whose data we pump to the systems we take into a fight.
16705800	16708400	Everyone says, well, yeah, of course, no duh.
16708640	16713720	Well, if we think adversaries are going to challenge us there, then we've got to be ready there.
16713720	16719960	But fighting in space is going to be really different than fighting in the air, on the sea, or under it.
16719980	16726920	It's a domain that's governed almost entirely by physics in a way that makes it predictable.
16726960	16732800	We know where satellites are going to be minute by minute, second by second, on forever, ad infinitum,
16732800	16735100	unless we decide to move them.
16735120	16741340	But moving satellites using that precious propellant, that's a big choice in space.
16741340	16744440	Because there are no gas stations, no place to fill up.
16744440	16746480	So it is a very different domain.
16746480	16749820	And we're just here talking about low-Earth orbit constellations,
16749820	16756160	those that are very near the Earth, that are moving around at 7 kilometers a second.
16756160	16763380	But GPS satellites are much further out, in what are medium-altitude orbits.
16763380	16769000	And satellites that do communication and detection are all the way out in geosynchronous orbit.
16769000	16772760	And though they're moving really fast relative to the Earth, they're not.
16772760	16774060	They're stationary overhead.
16774060	16781120	Every one of these is a very different domain governed by apparently different physics.
16781180	16786360	And that's why we've got men and women getting ready, who are thinking about warfare in space,
16786360	16789600	and they've got a clean sheet of paper in their hands.
16789620	16793680	How do we fight in this domain where things are very predictable?
16793820	16796700	And you can guess what answers are coming to the forefront.
16796700	16798940	We're going to have to rely on autonomy.
16798940	16804640	And that means the software that we put is going to be so important to whether we win or lose.
16804700	16806400	But then that brings you in.
16806400	16812560	If our software is going to be the cutting edge, and the autonomy it runs on is going to be how we win,
16812560	16814180	then how do we make it secure?
16814780	16822460	So I think we went through this period where, at least we as a society, didn't talk a lot about space.
16822460	16826980	And I'm happy to see that change.
16826980	16831620	Will talked about all the critical things about space.
16831620	16834720	Timing, ATMs, GPS, all of these different things.
16834720	16836580	And that is super critical.
16836620	16843420	But I guess I bring out my inner kid now, where a couple months ago I sat down,
16843420	16847500	I have three little kids, and we watched a SpaceX launch.
16847500	16853240	And there was an excitement there that I feel it's been a long time.
16854900	16858080	It's been missing from society for a bit.
16858080	16861760	There's something aspirational, inspirational about it.
16861760	16868120	And seeing the launch, seeing the landing, talking about space, thinking about the importance of it,
16868120	16873400	and all the critical things that it does, it excites me for the future.
16874040	16876740	So I'm excited that we're talking about space.
16876740	16879460	I still would like to go to space.
16879700	16884680	I don't think, Will, you've gotten your transporter done.
16884900	16893440	But with all that being said, I'm really also, until you actually take me to space, I look forward to helping protect space.
16893600	16894820	Sounds good, Brett.
16894820	16901820	And aside from just watching SpaceX, you know, just the other day we watched Perseverance and Ingenuity head up.
16901820	16905860	And so we're really, really excited about the enthusiasm in space.
16905860	16911980	And Space Force gets to provide most of the rocketry that the entire government and commercial industry uses.
16912100	16914720	So it's going to be a little while until we beam you to space.
16914720	16919080	But we've got some excellent works in rockets that can help push you there.
16919220	16922820	Do you think I could do that training thing in a couple weeks?
16923180	16924360	Just banging it out?
16924420	16928700	Let's talk about that next time on Between Two Nerds.
16928700	16930020	Thanks for coming.
16930880	16931800	Okay.
16949540	16956380	So we're really easy. We're on the Twitters. At least I'm on the Twitters. Are you on the Twitters?
16956380	16961520	I promised Brett that for DEFCON, I would send out my first tweet.
16961520	16964560	So I'm really looking forward to seeing Will on the Twitters.
16964560	16972380	We're also going to be... Will and I will be in the VRs during DEFCON. You can find us there.
16972500	16975680	We'll be on Twitch. We'll be all over.
16975680	16979660	And we'll make sure that we leave a link on our HackASAP site.
16979660	16987580	If you are interested in finding out more about participating in future hacking events with the Air Force or DDS,
16987580	16991900	we will leave a place for you to find us, for us to contact you.
16991900	16994100	And we also want to hear your suggestions.
16994100	17002280	And when COVID is done, if you're in D.C., come to the Pentagon. We'd love to hear your ideas.
17011050	17013910	So can zombies swim?
17014650	17023130	I don't know, Brett. I think it probably depends on what movie we're in and whether they knew how to swim before they were zombified.
17023190	17029430	So I intentionally moved to an island where part of my intent was being zombie safe.
17029430	17030750	How deep is the water?
17030750	17031930	Pretty deep.
17031930	17033710	Did you see World War Z?
17033710	17034390	I did.
17034390	17035550	Is it that deep?
17036970	17038870	It might not be deep enough.
17038870	17040430	You might need a better island.
17045650	17050750	Thanks, RoRo, for the Q&A and Dr. Roper and Brett for your vision behind HackASAP.
17050990	17055510	Remember at the beginning of the day I told you that not all of this event would happen on the Earth?
17055510	17060390	Well, I hope teams are ready because we are about to throw them a massive curveball.
17060390	17064190	The on-orbit challenge is about to drop on our unsuspecting teams.
17064190	17066070	Well, okay, they have a little bit of suspicion.
17066070	17071650	But our teams have only a few hours to create a mission plan for an actual satellite in space.
17071770	17079070	Their task is to orient a spinning satellite, point its camera at the moon, take a photograph, and send it back home to the HackASAP contest officials.
17079170	17086490	The team with the best solution will win what might even be a more valuable prize than the cash part of this competition, bragging rights.
17086490	17093710	That's right. One team in this competition can say that their code directed a real satellite in space and took a proverbial moon shot.
17095370	17098390	Stop everything and look up.
17098590	17102230	Starting now, teams shift to the on-orbit challenge.
17102290	17106590	Their primary goal is to capture a picture of the moon using this satellite.
17107270	17112970	Competitors will have access to the two-line element of the vehicle and the camera's foresight vector.
17112970	17120650	Each team is tasked with creating a mission plan that transitions a satellite from a tumbling state to one where it points the camera at the moon.
17121250	17126710	The team will reach a successful status once their resulting mission plan meets key criteria.
17127130	17132330	1. The commands are generated in the correct order and are within the specified period.
17132590	17136990	2. The image capture angle of the moon is within specifications.
17136990	17146190	3. The team's negative z-axis is pointed as close to the Earth's center as possible without affecting the camera-to-moon pointing error.
17146410	17154110	The teams are given a command dictionary with the format for submitting the commands and parameters. The rest is up to them.
17158470	17162010	There's one final important fact for this on-orbit challenge.
17162010	17167710	While there's no score associated with it like the other challenges, it is a pass-fail challenge.
17167710	17173330	Teams must produce a successful solution to be eligible for the prize money in this competition.
17173450	17178630	If they want to end up on the podium, they have to be successful in this challenge. No pressure or anything.
17179150	17188610	I'll see you back here in about an hour at 12.50pm Pacific, 3.50pm Eastern as we check in with our teams on both their Earth-based and extraterrestrial challenges.
19121940	19133980	EARTH-BASED CHALLENGE
20745810	20751770	Welcome back to a Hackistat competition update. I'm your host Jordan Wines. Taking a look
20751770	20756550	at the scoreboard so far we've had an eventful last hour. Our teams continue to
20756550	20761210	make progress with four teams now having solved challenge one. Unfortunately the
20761210	20764910	window of time after first solve has expired and the remaining four teams
20764910	20770530	were given a solution with no points. PFS and colon can into space were joined by
20770530	20775390	1553 and 1064 seabread with solutions for challenge one.
20836900	20840480	1064 seabread has been around for several years going all the way back to
20840480	20844480	when they were first high school friends playing as CTFs. In fact I first met
20844480	20848820	them five years ago as the only team of high school students at a collegiate CTF
20848820	20853200	competition and the team even included a standout freshman. Yep a high school
20853200	20857040	freshman competing with college freshmen and college seniors. And while I don't
20857040	20860960	personally know any of 1553 after they gave me some interesting facts about
20860960	20865400	them I kind of feel like I do. For example one team member has additional
20865400	20869780	sound dampening around his office due to his above-average laughter volume. One
20869780	20874700	member was fired from a previous job for quote smiling too much quote and another
20874700	20880380	member was a college mascot. Finally their team logo or team motto rather is
20880380	20884600	preparation is the enemy of innovation which sounds a little bit like an excuse
20884600	20890260	but you can't argue with their results. Let's take a look at the solution for
20890260	20896660	challenge one now that all teams have it. Challenge number one. Here's what we
20896660	20900760	know. Having access to the ground station means we can attempt communication but
20900760	20905100	the satellite is spinning out of control which complicates everything. The
20905100	20910260	challenge. Teams must regain communication with the satellite. Here's
20910260	20914480	how they do it. To get started teams must set the command and telemetry rates
20914480	20918340	appropriately and the power output to maximum. Because the satellite is
20918340	20922100	spinning additional link margin is required. The teams receive periodic
20922100	20926100	telemetry but are not able to command the vehicle. Based on the review of the
20926100	20930180	anomaly resolution section in the user's guide they realize that to increase the
20930180	20934640	link margin they should increase radio output power and decrease link rate. They
20934640	20938600	command the radio to high power and low rate mode and regain communications with
20938600	20942560	the satellite. The link is limited to low rate meaning that what they can send and
20942560	20954990	receive from the satellite is limited. This is a good example of the type of
20954990	20958810	challenge that is a little different in this type of CTF versus many other types
20958810	20963410	of CTF. While teams were told to quote restore communication quote that goal
20963410	20967210	was much more ambiguous than often traditional CTF challenges and mirrors
20967210	20971590	more of the real-world problem-solving you run into in space-based applications.
20971630	20974790	Because our imaginary bad actors had intentionally modified the satellite's
20974790	20978270	orientation and they were moving around uncontrollably communication between the
20978270	20982430	ground station and the satellite was not stable. To fix this teams needed to both
20982430	20986150	lower the transfer rates boost the power and that would finally let them
20986150	20989870	enable ground-based communications and that would let them control all the
20989870	20992870	components of the satellite or at least the ones that they've been able to
20992870	20997030	figure out so far. In fact the challenge was real-world enough that at least one
20997030	21000150	team was able to solve it in the normal order of just working with the satellite
21000150	21004630	without even specifically realizing they had solved the challenge. All that brings
21004630	21012190	us to challenge two. Challenge two. Here's what we know. The satellite is
21012190	21015530	spinning out of control because the guidance navigation and control system
21015530	21022870	or GNC is inoperable. We suspect sabotage. The challenge teams must repair the GNC
21022870	21036600	system as quickly as possible to stop the dangerous spinning. As teams begin to
21036600	21040060	as teams now have regular communication with their satellites they'll need to
21040060	21043480	get the movement under control but it's also worth mentioning at this point that
21043480	21047060	these satellites do actually have their own battery and power supply. They're
21047060	21051400	taken off each night to be charged and while power utilization is not a scored
21051400	21055380	metric in the game if one team does manage to cause too much movement or
21055380	21058820	otherwise drain all of their power that could impact their ability to interact
21058820	21062500	with the satellite for the remainder of the day. Looking forward to seeing what
21062500	21065380	they do. We'll see you back here in another hour for our next competition
24282010	24285810	Welcome back to the competition formerly known as Space Security Challenge 2020
24285810	24290990	now HackASat. Well it's actually still known by Moth. I just wanted to change
24290990	24294310	the intro because they're gonna get pretty repetitive. I'm your host Jordan
24294310	24298110	Wines. The game has been a little bit slower this hour but that makes sense
24298110	24301390	because teams are starting to get into the harder challenges. As a reminder
24301390	24305790	teams are currently working on two separate challenges. First the on-orbit
24305790	24310310	challenge is it as it the on-orbit challenge involves them designing a
24310310	24313870	payload that will execute a moonshot taking a picture of the moon from an
24313870	24317150	actual orbiting satellite. While that challenge won't show up on the
24317150	24321830	scoreboard with points it is a pass-fail challenge. Only teams that score within
24321990	24325550	a time window will be eligible for podium placement and the related
24325550	24331590	$50,000 $30,000 and $20,000 prizes. Since there's a lot of data being displayed on
24331590	24335290	our octagon scoreboard otherwise known as that thing you're looking at when
24335290	24339150	it's not my face on this YouTube feed here's a quick primer on some of the
24339150	24344110	elements. First the display on the left shows a scoreboard breakdown that
24344110	24348170	breaks down each team's points earned per challenge, shows the total score and
24348170	24351910	includes a log of recent solves and messages sent from each team to their
24351910	24355790	flat sat. Note that the message contents have actually been sanitized to not
24355790	24361170	give away answers but you might find some other things there instead. On the
24361170	24364770	right scoreboard you'll see the time of the teams you see the score of the teams
24364770	24368550	over time. Right now it's skewed a little bit to the left but as the game
24368550	24372230	progresses it will stretch out and we'll see how they do on each of these
24372230	24377790	new challenges. Finally each team has a dedicated panel with a main view and
24377790	24382290	three supplementary views. Technically we can change the supplementary views but
24382290	24387350	right now the main view shows a team logo with their color, a representation
24387350	24391450	of the team's flat sat including the rotation, position over the earth and
24391450	24395390	messages sent. Note that the little pew-pew you see are just for visual
24395390	24400090	effect and not actually representative of actual messages being sent. On the
24400090	24403710	graph right now on the right, excuse me, the three graphs on the right, the top
24403710	24408390	graph is yaw, the middle graph is angular velocity and the bottom graph is total
24408390	24412170	messages all done over time which makes for a nice overview of the different
24412170	24416830	activity from each team's flat sat. Remember you can vote to control which
24416830	24419950	of these views you're looking at in the virtual environment inside of the
24419950	24423850	Stardome. That feed doesn't cut over these live updates and always shows the
24423850	24427810	Octagon. While we wait on our teams to continue to solve these challenges
24427810	24431790	they're working on, now's a great time to introduce another segment we call Space
24431790	24435750	Talk. If, like me, you're a hacker who might know about computers but is
24435750	24439330	ignorant of what goes into making code run in space, there's a lot of new things
24439330	24444750	to learn. Our first Space Talk episode is about how to keep track of time in space.
24459610	24465470	So what time is it in space? Well that's a complicated question. For the
24465470	24468930	astronauts on the International Space Station and for most orbiting satellites
24468930	24474970	they run on Coordinated Universal Time or UTC. It's not actually a time zone but
24474970	24480330	rather a time standard that just so happens to be the same as GMT. It's used
24480330	24485670	to prevent time zone confusion and give a standard time to reference. But for
24485670	24490750	astronauts especially it's just a number. On the International Space Station the
24490750	24494870	Sun rises and sets about every 90 minutes so there isn't any relationship
24494870	24498450	between the Sun and what time it is that's meaningful to the astronauts.
24498810	24502910	Satellites are the same way. Time is primarily used to inform them when to
24502910	24507970	execute commands and perform operations. Universal time is just a reference
24507970	24513270	number that's easy to relate back to your local time. But that's not the only
24513270	24518730	time that's used for space applications. UTC is not an exact accounting of the
24518730	24523690	passage of time but rather strives to stay aligned with the rotation of the
24524290	24528930	Earth because it's primarily people on Earth that are using it. Earth's rotation
24528930	24533190	is both irregular in the short term and slowing down permanently in the long
24533190	24538830	term. Earth days are getting about 1.6 milliseconds longer every single day.
24538830	24543110	This isn't in any way noticeable in daily life but can be very significant
24543110	24547870	over time. As a result we use a different time scale when dealing with orbital
24547870	24552930	motion. Orbital motion doesn't care about the Earth's rotation at all. It must be
24552930	24557670	extremely precise because of the massive distances involved. The most
24557670	24563090	common time standards used are Julian date and terrestrial time which are both
24563090	24567550	entirely independent of Earth's rotation. To give an idea of just how different
24567550	24574090	these time scales can be, over the last century between 1900 and 2000, universal
24574090	24580370	time was about 64 seconds slower than terrestrial time. It's a tiny difference
24580370	24584670	to us but when you're dealing with precise predictions over millions of
24584670	24589110	miles it gets very significant. And that's the key. What time it is in space
24589110	24594450	isn't important so you can look at the clock on the wall and know if you need
24594450	24599370	to go to bed. It's important so you can know where you are and know where things
24599370	24605110	are. Everything in space is constantly moving, orbiting one object or another.
24605170	24609350	Telling where it's located is intrinsically linked to what time it is.
24609350	24614650	This gets to our next question. How do you tell where something is in space? As
24614650	24618430	I said before, everything in space is constantly moving and orbiting around
24618430	24622790	something else. All this motion is primarily controlled by gravity. So to
24622790	24627490	know where something is right now, we use where it was at some time in the past
24627490	24632310	and we predict where it is now based on the laws of gravitational motion. Now you
24632310	24636510	might ask how do I tell you where it is or even where it was? On Earth I could
24636510	24641670	tell you where to go based on your address or some landmark and these are
24641670	24646210	useful frames of reference that we can use to fully communicate where something
24646210	24651490	is. In space there are an infinite number of reference frames that we can use but
24651490	24656490	we also have an added complexity. Since again everything is moving all the time,
24656490	24660870	to have a frame of reference we need to incorporate time. There are several
24660870	24664670	different ways of describing where things are but we typically focus on two
24664670	24670230	reference frames. One, what's easiest for us to use. For example, if I want to take
24670370	24674050	a photo of the moon I would want to know where the moon is in relation to where
24674050	24679650	I'm going to be when I have my camera. And two, what's easiest to calculate.
24679650	24684690	Orbital math is hard and many times impossible so picking a reference frame
24684690	24689710	that makes your calculation as easy as possible is often necessary. This
24689710	24693470	reference point is usually whatever has the most significant gravitational
24693470	24698990	effect and ignores all other motion. For satellites we use Earth. We want to know
24698990	24702510	where they are relative to our location on the Earth. This frame of reference is
24702510	24707950	called Earth Centered Earth Fixed or ECEF as it is rotating with the Earth
24707950	24713970	and is fixed to it. It's the same as GPS coordinates but it's much much easier to
24713970	24717990	calculate the position of the satellite when we ignore the rotation of the Earth
24717990	24723050	which is a different frame of reference called Earth Centered Inertial or ECI. So
24723050	24728290	if I saw where a satellite was in relation to me in the ECEF frame at time
24728290	24733210	t0 and I need to know where the satellite will be in relation to me in
24733210	24739610	the ECEF frame at time t1, we actually need to calculate three different steps.
24739610	24748130	One, translate the coordinates I observed at t0 in ECEF to ECI at t0. Two,
24748130	24754390	translate the orbital motion of the satellite in ECI from t0 to t1 where our
24754390	24759070	calculations are easier. And three, translate the coordinates I calculated
24759070	24766790	at t1 back to ECEF from ECI. Steps one and three both require translating
24766790	24773050	between these coordinate frames ECEF and ECI. So how do we do that translation?
24773050	24777250	Here is where we now introduce the idea of an epoch. An epoch is a point in time
24777250	24781330	that we use as a reference to translate between these types of frames.
24781330	24787830	Specifically we use the J2000 or Julian date 2000 epoch to translate between
24787830	24794230	ECEI and ECEF as we set the ECEI reference frame to be the same as the
24794230	24798830	ECEF at that time. That way we can calculate the translation between them
24798830	24805270	by calculating how much the earth has rotated since Julian date 2000. This is a
24805270	24808610	simplification of the constant translation and calculation done
24808610	24813810	throughout satellites, space technology, and astronomy. But that is why time and
24813810	24817870	space are both extremely important and highly dependent on really what you're
24817870	24836840	looking to do with them. Thanks to Jess Coffey for putting those videos together.
24836840	24841840	That one was epic. Now this was going to be where I signed off for this update
24841840	24847840	but as we were live PFS actually jumped up on the scoreboard yet again solving
24847840	24852500	challenge 2. This means that we can now move on to exposing all teams to
24852500	24861160	challenge 3. Challenge 3. Here's what we know. With the repair complete on the GNC
24861160	24864880	the satellite has stopped spinning but we still can't communicate with the
24864880	24869580	payload module or operate the imager. We have to ask ourselves what else did they
24869580	24874100	damage on this satellite? The challenge? Teams must restore communication with
24874100	24884640	the payload module so we can get it working again. This has been our last
24884640	24888160	hourly update for the day. I'm looking forward to seeing everyone back here at
24888160	24893260	4 p.m. Pacific 7 p.m. Eastern for a daily recap of all that's happened so far.
32242420	32248300	Welcome to Space Security Challenge 2020, HackASAP. The final event of the
32248300	32252680	As the democratization of space opens up a new frontier for exploration and
32252680	32258940	innovation, we see new cybersecurity vulnerabilities emerging. The Space
32258940	32262660	Security Challenge is designed to inspire the world's top cybersecurity
32262660	32267460	talent to develop the skills necessary to secure this last frontier of
32267460	32274580	cybersecurity, space. And already we've made a ton of progress. I'll catch you up.
32274580	32278720	This spring we hosted over 2,000 teams who worked their way through a set of
32278720	32283280	foundational space cybersecurity challenges in our HackASAP qualification
32283280	32288400	round. Now, eight finalist teams are stepping up to the ultimate challenge.
32288860	32291900	They are hacking a satellite.
32297840	32302900	Welcome to the first of two daily recaps for the Space Security Challenge 2020 or
32302900	32308260	HackASAP. I'm still your host, Jordan Wines. As our eight teams have been
32308260	32312500	vying for a share of a $100,000 prize pool, we're going to check in and
32312500	32317460	summarize the status of the day. Of course, they also received $15,000 just
32317460	32321820	to get here as a finalist. The competition for that was fierce. Our
32321820	32326420	finalists beat out over 2,000 other teams made up of over 6,000 other
32326420	32330880	competitors. Of course, the biggest prize of all might not even be the money or
32330880	32334300	even the friends we made along the way, but the bragging rights for your code to
32334300	32338860	be selected to take an actual photograph of the moon from a satellite in space.
32339000	32342900	While this event was originally planned to be in person during DEF CON in the
32342900	32346760	Aerospace Village, the global pandemic has caused us to reimagine the event
32346760	32350980	experience. The result is an immersive 3D environment where you can stay up-to-date
32350980	32354240	with the competition while learning all about space security and the event
32354240	32357820	itself. You can connect with other spectators and even play games and add
32357820	32362040	to our graffiti wall. So if you aren't already watching this from our immersive
32362040	32367460	3D environment, check it out at virtual.hackasat.com. As prior DEF CON
32367460	32371520	attendees, some of you are very familiar with the many flavors of
32371520	32375620	contests that test your hacking skills. But for others, we realize this is a
32375620	32379920	whole new world. There are many types of hacking contests and Hackasat falls
32379920	32387780	into the category of Capture the Flag or CTF. Remember the game you played as a
32387780	32392460	kid with flags hitting an opponent's terrain? Now imagine the field or code
32392460	32397020	and the flags are secret data. Players exploit security flaws to capture the
32397020	32401200	flags while at the same time defending their networks from opposing teams. These
32401200	32406480	Capture the Flag CTF events are as diverse as the teams that play them. This
32406480	32410620	is a global competitive community with thousands of players and global rankings.
32410620	32415440	It's been a part of the origin story for a great many prominent security experts.
32415440	32420420	So what do these hacking games look like? CTFs can be either in-person or online
32420420	32425180	and usually take place over a weekend or other short period. They often have a
32425180	32429340	qualification round that determines who gets to participate in the finals. CTFs
32429340	32434340	are sometimes themed around a specific domain like space for Hackasat, but more
32434340	32437940	commonly they are not specialized and include a wide variety of different
32437940	32443100	types of challenges. The most common types of CTFs include Jeopardy CTFs,
32443100	32447180	sometimes called Red Team CTFs, are named for their use of the classic game
32447180	32450940	board as a scoreboard. These are more offensive focused. Each team is given
32450940	32455180	infrastructure to attack and the number of successful attacks, the difficulty, or
32455180	32458720	the speed at which they succeed is factored into their score. Attack
32458720	32463720	Defense, A slash D, or Full Spectrum CTFs, which are closer to the original game
32463720	32467900	you might have played as a kid. Each team has a server or set of servers to defend
32467900	32471960	and must attack other teams while also protecting their own infrastructure.
32471960	32476100	Key of the Hill style CTFs are Full Spectrum CTFs, in which teams score
32476100	32480280	points by gaining and maintaining control of individual systems. And
32480280	32484480	finally, the less common Blue Team exercises, which are primarily defensive
32484480	32488300	events. Game organizers host an environment and often a professional
32488300	32492020	team of attackers to test the participants defensive skills. These are
32492020	32496260	more common in the high school and collegiate level. How do you win? Even
32496260	32499980	though the goal of the CTFs are to find and exploit vulnerabilities in computer
32499980	32504560	systems, fair play is essential. There are lots of ways to win, but to get the
32504560	32508720	respect of your peers, you need to have good technical solutions. Nobody is
32508720	32512260	impressed if you use a network flood to knock the scoreboard offline, and those
32512260	32516340	kinds of shenanigans will get you shunned quickly. The best CTF players
32516340	32520360	have built specialized tools, practice within their domains, and include domain
32520360	32527340	experts in many aspects of security. Why CTF? At their core, CTF challenges are a
32527340	32530980	way for hackers to build community and demonstrate and hone their skills with
32530980	32534400	other equally skilled people. Competitions are also a chance to
32534400	32538140	experience the joy of learning about a new programming language or a new piece
32538140	32542040	of technology hackers haven't used before. Capture the Flag challenges have
32542040	32545680	also been used to help train cyber security teams and to get new hackers
32545680	32550120	interested in security research. Some companies even use competitions similar
32550120	32554760	to CTFs to recruit and vet potential candidates for employment. And CTFs have
32554760	32559200	had real-world impact with competitors finding actual security flaws in contest
32559200	32563460	infrastructure. Their solutions, while not counting towards winning the game, are
32563460	32568420	often implemented in a real-world context. With HackASat, we have a CTF
32568420	32572440	game designed to raise awareness about cyber security issues in space and help
32572440	32576000	researchers develop specific skills and domain knowledge they'll need to help
32576000	32580460	secure this new frontier. But as many of the players during our quals round found
32580460	32584220	out, there are a lot of problems unique to the environments outside our
32584220	32588260	atmosphere. To learn more about hacking in space, check out our space talk videos
32588260	32592260	that explain some of the most interesting space-specific challenges.
32593480	32597620	For more on CTFs and other hacking and space related topics, go to the research
32597620	32602440	room in the virtual environment or check out the related YouTube playlist. Okay,
32602440	32612680	let's go ahead and recap the whole day so far. The game has actually been
32612680	32616760	underway for one hour now and our team's first challenge has been to regain
32616760	32620360	control of the ground station that they'll be using to communicate with
32620360	32625340	their Flatsats. In fact, just before this broadcast went live, we received word
32625340	32630760	that this challenge was actually solved by Team Samurai. Congratulations to them!
32630760	32634920	Right after our last update ended with only a Samurai solve, several other teams
32634920	32639980	came in with solutions for Challenge Zero. PFS and Solarwine were solvers 2
32639980	32645240	and 3 on that challenge. After those two teams scored on Challenge Zero, every
32645240	32648200	other team was eventually able to solve Challenge Zero over the next several
32648200	32653320	hours. Taking a look at the scoreboard so far, we've had an eventful last hour. Our
32653320	32656920	teams continue to make progress with four teams now having solved Challenge
32656920	32661300	One. Unfortunately, the window of time after first solve has expired and the
32661300	32665900	remaining four teams were given a solution with no points. PFS and Colon
32665900	32671620	Can Into Space were joined by 1553 and 1064 Seabred with solutions for
32671620	32675840	Challenge One. Now this was going to be where I signed off with this update, but
32675840	32681360	as we were live, PFS actually jumped up on the scoreboard yet again, solving
32681360	32691530	Challenge Two. You may have noticed that first blood overlay and sound effect in
32691530	32694950	that summary. While it was originally used in Unreal Tournament to indicate a
32694950	32698810	kill, the phrase and even sometimes the sound effects are often used in CTF
32698810	32704330	competitions to indicate the first team to solve a particular challenge. The
32704330	32709370	challenges that teams have solved so far include a Challenge Zero, which required
32709370	32712870	exploiting an insecure web application to steal credentials for the ground
32712870	32716670	station controller, and then using that Cosmos ground station, the teams had to
32716670	32720150	restore communication with their flatsats as they were tumbling and not
32720150	32724770	communicating well. The Challenge One involved connecting to the
32724770	32728670	satellites, connecting to the ground station, turning up the power, turning
32728670	32733410	down the bandwidth, which is very much a real-world troubleshooting step. Next, the
32733410	32737670	teams have to restore proper orientation control over their flatsat, but only one
32737670	32741910	team so far has managed to accomplish this feat. That brings us to what's
32741910	32745770	happened in the last two hours of the competition. Most teams are now working
32745770	32750390	on two or three challenges. The on-orbit challenge, Challenge Two, and Challenge
32750390	32757050	Three. PFS has been pulling away to a healthy lead that is going to be hard to
32757050	32762370	catch up to tomorrow. Hard, but definitely not impossible. All it takes is for them
32762370	32766290	to get stuck in a problem and be passed in turn, much like they did to Samurai at
32766290	32770970	the start of the game. It's also interesting to note that PFS, which is
32770970	32775770	actually short for Pwn First Search, and Pulling Can Into Space, are number one
32775770	32779110	and number two on the leaderboard, are two of the smallest teams in the
32779110	32783470	competition. Having a large team is sometimes an advantage, but it definitely
32783470	32786930	comes with logistical issues, and in this case, where the challenges are serial in
32786930	32792130	nature, it isn't always helpful. Let's take a look again at
32792130	32825580	the PFS team bio. If you were here with us live, you might remember that right in
32825580	32829460	the middle of teams working on their challenges at around 12 p.m. Pacific, all
32829460	32833900	teams had to stop what they were doing and shift focus to the on-orbit challenge.
32835060	32841600	Stop everything and look up. Starting now, teams shift to the on-orbit challenge.
32841840	32846280	Their primary goal is to capture a picture of the moon using the satellite.
32846880	32850820	Competitors will have access to the two-line element of the vehicle and the
32850820	32855380	camera's foresight vector. Each team is tasked with creating a mission plan that
32855380	32859260	transitions a satellite from a tumbling state to one where it points the camera
32859260	32864060	at the moon. The team will reach a successful status once the resulting
32864060	32869360	mission plan meets key criteria. One, the commands are generated in the correct
32869360	32874600	order and are within the specified period. Two, the image capture angle of
32874600	32880920	the moon is within specifications. Three, the team's negative z-axis is pointed as
32880920	32884520	close to the Earth's center as possible without affecting the camera to moon
32884520	32889260	pointing error. The teams are given a command dictionary with the format for
32889260	32897940	submitting the commands and parameters. The rest is up to them. Of course, while
32897940	32902260	PFS is currently in the lead, they still have a critical problem to solve,
32902260	32906600	specifically, the on-orbit challenge. While Poland can into space is only
32906600	32910220	nipping at their heels at number two on the scoreboard, they are critically not
32910220	32914100	only the first team with an attempted solution to their on-orbit challenge, but
32914100	32918280	the first with an accepted solution. That would mean that they would be able to
32918280	32923040	pass PFS if PFS is not able to actually solve because, again, that is a pass-fail
32923040	32926560	challenge and it will be critical to see what happens in the last few minutes of
32926560	32931100	gameplay today as well as tomorrow in the on-orbit challenge. Now that the day
32931100	32934740	is wrapping up, hopefully some of the organizers have a little bit more time,
32934740	32938500	so we're going to see if we can bring into video chat Vito Genovese, who many
32938500	32941880	of you may recognize from his time as a member of LegitBS, the team that
32941880	32945880	organized the DEF CON CTF for five years prior to the current organizers, the
32945880	32949400	Order of the Overflow. Vito is also currently with Chromulence, the creators
32949400	32953460	of the flatsats and many of the challenges in Hackasat. Vito, can you
32953460	32956840	hear me? Are you there? Yes, loud and clear. Good evening.
32957040	32959920	Excellent. Glad we got you. Thanks for stopping by. I know you guys have been
32959920	32964120	very, very busy kind of manning the systems and talking to the teams. How's
32964120	32969020	the game going so far? It's been going. We've kind of had some, you
32969020	32973160	know, rough times today. The flatsats are, you know, small run hardware, which
32973160	32976920	always has issues. But we're super, super thankful the teams are being
32976920	32979980	patient with us, and they're putting up a good fight and making really, really
32979980	32985640	good progress in the game. So tomorrow we're hoping for... Sorry, is this pacing what you expected?
32985640	32988500	Speaking of like how they're kind of doing, is this about where you thought
32988500	32990560	they would be, or you wanted them to be, or how does this fit with your
32990560	32995360	expectations? It's really hard to set expectations for these games. A lot
32995360	32998420	of it is, you know, throwing, you know, stuff around. We can't even be in the
32998420	33003640	same room doodling on a whiteboard while we do it. So, you know, the expectations
33004360	33008440	are not necessarily what's been happening, but we'll survive. It's a
33008440	33013660	difficult game and, you know, we'll see what happens tomorrow. And I mean, it does
33013660	33016900	seem like that if they're made good progress up to here, they could have been
33017080	33019880	a lot further behind. It would be nice to see them maybe a challenge ahead, but
33019880	33023100	this is certainly within reach, right? Like there's nothing kind of too crazy
33023100	33026300	about what they have remaining. This could be doable. We know these are
33026300	33030860	good teams that are capable of more, it seems like, right? Right, yeah, absolutely.
33031260	33035920	The, you know, challenges zero, challenges one, they're hard challenges. And the
33035920	33038920	teams that took time on them, they still took time on them. They did make progress
33038920	33044980	and they did get through eventually. It's, you know, admirable work and it's, you
33044980	33047660	know, it's great to see everybody involved. Now, do you miss actually being
33047660	33050880	in Vegas and going to DEF CON or you actually kind of prefer being remote?
33050880	33055500	What's your take on that? Oh, I absolutely miss it. You know, my
33056020	33059360	favorite restaurant in Vegas, I miss, or my favorite restaurants plural in Vegas,
33059360	33063460	I miss that. I miss seeing my friends. I miss wearing my, you know, special DEF CON
33063460	33069280	shoes, which are behind me on the shelf. They're not in frame yet, but, you know,
33069280	33073900	it's better than getting really, really sick, I guess. Given the alternative,
33073900	33077760	yeah, we're all kind of doing what we can and should there. In fact, even you
33077760	33081360	were originally supposed to be on stream with me and we just thought for safety
33081360	33085120	reasons that we would do this via Zoom and we'd be able to work it out that way.
33085120	33089640	So thanks for doing that. Tell me a little bit more about the rationale behind the
33089640	33094200	scoring algorithm and the game design. This decay and the kind of the grace
33094200	33098160	window, what design constraints went into that decision?
33098720	33101820	Okay, so the main design constraint with this is it's a very linear
33101820	33107300	capture-the-flag game. So what has to happen is we're trying to get teams to
33107300	33111480	take over this or regain control of this, you know, tumbling satellite lost in
33111480	33116220	space. And that is a complicated operation. And instead of just having, you
33116220	33120080	know, one single, you know, you get this chunk of points if you win the game, we
33120080	33123820	split it up into different little gates that teams have to pass through. So, you
33123820	33127940	know, challenge zero or the first gate is getting control of a machine in the
33127940	33131700	ground station. Challenge one after that is being able to actually talk and
33131700	33136240	receive messages with the satellite. So we had to split this up in order to keep,
33136240	33140320	you know, make the game actually have points before you get to the end. And at
33140320	33143800	the same time, in order to make the points actually meaningful, we wanted to
33143800	33147040	make sure there is some time pressure for teams to go quickly and make
33147040	33150980	progress throughout the whole weekend. So we have this kind of decay system
33150980	33155020	implemented. So each challenge is worth a fixed number of points at the beginning.
33155240	33160240	And as soon as the team solves it the first time, the clock starts ticking. So
33160240	33164020	within that first 30 minutes, anybody else who solves that challenge is also
33164020	33167220	going to get the full points. For challenge zero, that would be 50 points.
33167220	33172100	For challenge two or for challenge one, that was 200 points. Beyond that, after
33172100	33176040	that first 30 minutes, we have another two-hour interval where that point
33176820	33181020	amount starts gradually ticking down towards zero. Once it's hit zero, we
33181020	33184420	don't award points for it. And at that point, it also means that we share hints
33184420	33187700	to, you know, nudge teams along to get them to the next phase of the competition.
33188440	33191980	And that's one of the advantages, I think, is that, you know, that a team, if
33191980	33194800	they happen to get stuck on one particular problem in a serial event in
33194800	33198540	particular, there's just not much you can do in fairness to the other teams in
33198540	33200980	terms of, you know, kind of, you don't want to give a team a hint just because
33200980	33204160	they're behind, because that actually hurts them. But by having the score drop
33204160	33207560	off at a point which they have to be done or else they're just given a hint,
33207560	33210640	well, then they've lost all the points for it. And so it keeps them up with the
33210640	33214660	game while not punishing the teams that do well. So that makes a lot of sense. If
33214660	33218260	you had a favorite challenge, what's the number? And if it's one we haven't seen
33218260	33221600	yet, like, no spoilers, of course, but what do you like best?
33222040	33226220	So it's honestly, for me, it's probably challenge one, which is kind of where the
33226220	33229860	game starts to diverge from a normal capture the flag contest. With challenge
33229860	33234320	zero, we had a web app that teams had to, I think, determine a cookie secret in.
33234580	33235460	And that's very...
33238460	33243440	Nudge one is where we start to diverge. That's where we have to, once we've
33243440	33248100	gotten into the ground station and are able to talk to the satellite control
33248100	33252900	system, Cosmos, that's where teams have to figure out how to turn telemetry on on
33252900	33256720	the satellite, because it's not just another machine on the network with an IP
33256720	33261800	address. And where teams have to figure out how to tell the satellite's radio to
33261800	33264820	configure itself in a way that it's actually functional for the rest of the
33264820	33267080	game, for sending messages back and forth.
33267080	33270500	I saw a great quote go over the team communication channel from the organizers
33270500	33275860	that said, these are not like traditional network devices.
33275860	33280180	And if you think sending two requests a second will get you more reliability the
33280180	33284140	way you would in a normal network, that may be counterproductive here, which I
33284140	33286500	thought was a great kind of nod towards the, yeah, there's some different
33286500	33291300	constraints and different concerns that maybe are not the folks' first instincts
33291300	33293860	are accurate on, given the environment.
33293860	33295320	So that makes a lot of sense.
33295800	33300360	Yeah, absolutely. It's a satellite is, in some senses, it is still a
33300360	33303780	computer. But the problem is, is it's a computer that costs millions and
33303780	33306240	millions of dollars to, you know, install.
33306300	33307840	And it costs, you know, billions of...
33309600	33312380	No, I think we might have lost you a little bit there for some network.
33312380	33313620	Oh, you're back now. Go ahead.
33313820	33315000	Yeah. OK. Yeah.
33315000	33318580	It costs, you know, millions to put it in place in the first place.
33318580	33322080	And it costs billions to send somebody up there to push a button to restart it.
33322680	33326240	Beyond that, it's, you know, a computer that you only talk to on RF.
33326260	33330240	And it's moving in a way that whatever you can see it, you can probably
33330240	33333460	talk to it. But there's a lot of time from any given ground station where you
33333460	33337280	can't see it at all. And that's a very unique challenge.
33338320	33342160	Vito, thank you very much for both your work on the game and for taking some
33342160	33345080	time to talk to us tonight. Look forward to seeing how the teams do tomorrow.
33345260	33349140	I look forward to talking to some more as we see their progress.
33350100	33351640	Excellent. Thanks. Take care.
33351940	33357220	Take care. That's it for this first day of the Space Security Challenge 2020
33357220	33361800	HackASet final event. Overnight, we'll be taking our FlatSats offline so they can
33361800	33365560	get a good rest, a.k.a. have their batteries charged, and so the competition
33365560	33369800	organizers can recharge their batteries, a.k.a. have a good night's rest.
33369840	33373360	Of course, in addition to sleep, the teams will need to continue working on some of
33373360	33377460	the components in between game shutdown and game start tomorrow morning at 7 a.m.
33377460	33378540	Pacific and 10 a.m.
33378540	33382260	Eastern. They've actually been given a firmware image that will help them for
33382260	33383940	the upcoming Challenge 3.
33384600	33386320	Thanks for spending your day with us.
33386320	33390000	Make sure to check out the rest of what's happening at DEFCON, the Aerospace
33390000	33392200	Village and our Aerospace Workshops.
33392200	33395140	And I look forward to seeing you all tomorrow morning at 9 a.m.
33395140	33396120	Pacific, 12 p.m.
33396120	33397860	Eastern for our next game update.