WEBVTT

04:35.980 --> 04:54.520
A little pause... and we are back.

04:54.520 --> 04:56.300
A little pause... and we are back.

14:26.290 --> 14:27.930
A little pause... and we are back.

15:56.360 --> 15:57.780
A little pause... and we are back.

26:02.690 --> 26:15.050
A little pause... and we are back.

27:38.920 --> 27:58.160
A little pause...

33:41.600 --> 33:41.780
and we are back.

34:33.570 --> 34:33.770
A little pause... and we are back.

01:00:22.490 --> 01:00:26.710
Welcome to Space Security Challenge 2020, HackASAP.

01:00:26.710 --> 01:00:28.750
The final event.

01:00:28.770 --> 01:00:37.570
As the democratization of space opens up a new frontier for exploration and innovation, we see new cybersecurity vulnerabilities emerging.

01:00:38.530 --> 01:00:48.790
The Space Security Challenge is designed to inspire the world's top cybersecurity talent to develop the skills necessary to secure this last frontier of cybersecurity.

01:00:48.970 --> 01:00:50.270
Space.

01:00:50.410 --> 01:00:52.990
And already we've made a ton of progress.

01:00:53.250 --> 01:00:54.690
I'll catch you up.

01:00:54.690 --> 01:01:04.310
This spring, we hosted over 2,000 teams who worked their way through a set of foundational space cybersecurity challenges in our HackASAP qualification round.

01:01:04.330 --> 01:01:08.710
Now, eight finalist teams are stepping up to the ultimate challenge.

01:01:08.930 --> 01:01:11.830
They are hacking a satellite.

01:01:19.330 --> 01:01:23.310
Welcome to Space Security Challenge 2020, or HackASAP.

01:01:23.310 --> 01:01:27.150
I'm your host, Jordan Wines, and I'm very excited to be with you today.

01:01:27.150 --> 01:01:41.010
I'm here in Melbourne, Florida, at HackASAP HQ, where eight satellites are spinning out of control as the teams do their best to restore functionality, all for a piece of a $100,000 prize pool.

01:01:41.130 --> 01:01:55.330
These teams, from 11 different countries around the world, include not only some that are very familiar to those of us from the Capture the Flag, or CTF, community, but also include many newcomers who assembled just to answer the call for HackASAP.

01:01:55.330 --> 01:01:56.850
Let's meet our teams.

01:02:37.920 --> 01:02:46.220
To get to this final event, individuals on these eight teams had to beat out over 6,000 other competitors for a coveted invitation.

01:02:46.220 --> 01:03:02.360
This required mastery not only in traditional CTF hacking skills, like reverse engineering, and vulnerability research, but also in areas new to the CTF community, including orbital mechanics, astrophysics, space-based communication systems, and many others.

01:03:02.360 --> 01:03:10.560
Today and tomorrow, each of our eight teams will race the others through a series of challenges to regain control over their Flatsat.

01:03:10.560 --> 01:03:29.740
If you've followed our story at hackasat.com and launch.com.com, you might know that through some bad code and poor business choices, our defunct launch.com company has accidentally triggered a satellite intended for the year 2000 to be launched in 2020 with no one in control.

01:03:29.740 --> 01:03:38.100
In our fictional storyline, this satellite has been co-opted by nefarious forces, and it's up to our competitors to regain control over the many components.

01:03:38.100 --> 01:03:52.100
Since qualifying, each team was shipped a physical Flatsat, and these Flatsats are not only prizes for their qualifying performance, but also allow the teams to become familiar with the hardware and software before this final event.

01:03:52.100 --> 01:03:55.120
So what's the difference between a satellite and a Flatsat?

01:03:55.120 --> 01:04:03.840
Think of a Flatsat as a bench version for testing components of an actual satellite without necessarily being exactly what you would send into space.

01:04:03.840 --> 01:04:12.740
The satellites you can watch in our live webcams are Flatsats, but don't worry, not all of the competition this weekend will be terrestrial.

01:04:13.000 --> 01:04:23.120
The game has actually been underway for one hour now, and our team's first challenge has been to regain control of the ground station that they'll be using to communicate with their Flatsats.

01:04:23.120 --> 01:04:26.960
Being good hackers, of course, we call this Challenge Zero.

01:04:27.780 --> 01:04:29.060
Challenge Zero.

01:04:30.140 --> 01:04:31.600
Here's what we know.

01:04:31.600 --> 01:04:35.420
An adversary has obtained access to the satellite's ground station.

01:04:35.420 --> 01:04:38.400
Once they obtained access, they kicked us out.

01:04:38.620 --> 01:04:39.700
The challenge?

01:04:39.700 --> 01:04:43.060
Teams must obtain network access to the ground station.

01:04:49.980 --> 01:04:55.120
This is called Challenge Zero because it's required for the teams to even kick the game off.

01:04:55.700 --> 01:05:07.920
While most of our challenges will have teams focusing on components that are inside of their Flatsats, Challenge Zero is all about gaining access to the ground station that they'll be using to communicate with their Flatsat.

01:05:08.040 --> 01:05:09.640
And again, this is not a simulation.

01:05:09.640 --> 01:05:19.440
All of these eight Flatsats may be here on Earth, but they're completely untethered, floating on a cushion of air, and each one being connected wirelessly from a separate radio link.

01:05:19.680 --> 01:05:25.340
In the first hour of gameplay, teams have been getting their bearings and working on solving Challenge Zero.

01:05:25.340 --> 01:05:32.880
In fact, just before this broadcast went live, we received word that this challenge was actually solved by Team Samurai.

01:05:33.040 --> 01:05:34.660
Congratulations to them.

01:05:34.660 --> 01:05:38.320
Let's go ahead and see a little bit more about Team Samurai.

01:06:07.720 --> 01:06:10.840
Team Samurai is a mainstay in the CTF community.

01:06:10.840 --> 01:06:18.040
In fact, one of the fun facts about this community is that I've competed against Samurai about as many times as I've actually competed with them.

01:06:18.040 --> 01:06:24.980
This community is tight-knit, people move around between them, and it's good to see them jump into the lead and take a start on the scoreboard.

01:06:24.980 --> 01:06:31.020
They're now going to be focusing on Challenge One, which we're going to give you a little bit of a hint on what that entails now.

01:06:43.160 --> 01:06:44.520
The Challenge.

01:06:44.520 --> 01:06:47.560
Teams must regain communication with a satellite.

01:06:57.790 --> 01:07:10.910
While this event was originally planned to be in-person during DEF CON in the Aerospace Village, thanks to the tireless efforts of dozens of people involved behind the scenes, we're instead streaming to you live throughout the event.

01:07:10.910 --> 01:07:19.890
Not only has the game itself been adapted to allow for remote participation from our eight teams over VPN, but the spectator experience has changed as well.

01:07:19.890 --> 01:07:23.450
There are many different ways you can now experience HackASAT.

01:07:23.510 --> 01:07:33.130
For a simpler interface, just visit hackasat.com with a web-based scoreboard, these periodic live updates streamed right in center, and links to other resources.

01:07:33.210 --> 01:07:48.270
For a more immersive experience, head over to virtual.hackasat.com, where you can get all of the above and more, including watching our satellites live via one of four dedicated webcam feeds, get more technical game data from the 3D Octagon scoreboard,

01:07:48.270 --> 01:07:58.690
as well as many other resources about our competitors, the flatsats, the technologies involved in space, and even communicate with other viewers in a dedicated chat and have a few social interactions.

01:07:58.930 --> 01:08:07.530
No need to remember all that just now though, all you have to remember is that you can find it all on hackasat.com and virtual.hackasat.com.

01:08:07.530 --> 01:08:14.630
The HackASAT team is also partnering with the Aerospace Village, one of the many villages you'd normally get to experience in person at DEF CON.

01:08:14.630 --> 01:08:21.290
After 15 years of attendance, I know I'm not the only one missing many of my friends and our hallway conversations at DEF CON.

01:08:21.650 --> 01:08:25.010
Hopefully, we can recreate a little bit of that experience here.

01:08:25.470 --> 01:08:34.910
In addition to all of that we have going on at HackASAT, make sure you check out the rest of what DEF CON, the Aerospace Village, and our friends over at Defense Digital Service are doing this weekend.

01:08:34.910 --> 01:08:42.110
And hope to see you back here as we check in on how our teams are doing and hear more about the vision behind HackASAT at our next update at 11 a.m.

01:08:42.110 --> 01:08:43.330
Pacific, 2 p.m.

01:08:43.330 --> 01:08:43.990
Eastern.

01:18:52.480 --> 01:18:53.880
Thanks for

01:20:21.550 --> 01:20:39.370
watching.

02:01:46.900 --> 02:01:48.300
And

02:01:51.680 --> 02:01:53.080
I hope to see you back here at 11 a.m.

02:01:53.080 --> 02:01:53.080
Pacific, 2 p.m.

02:01:53.080 --> 02:01:53.080
Eastern.

02:10:15.680 --> 02:10:16.200
Thanks for watching.

02:10:16.200 --> 02:10:20.200
And I hope to see you back here at 11 a.m.

02:10:20.320 --> 02:10:20.380
Pacific,

02:22:21.080 --> 02:22:21.140
2 p.m.

02:22:21.140 --> 02:22:21.140
Eastern.

02:46:43.720 --> 02:46:46.000
Thanks for watching.

02:46:46.000 --> 02:46:46.000
And

02:47:34.600 --> 02:47:37.540
I hope to see you back here at 11

02:48:42.560 --> 02:48:42.560
a.m.

02:48:42.560 --> 02:48:42.560
Pacific, 2 p.m.

02:48:42.560 --> 02:48:42.560
Eastern.

02:48:42.560 --> 02:48:43.560
And I hope to see you back here at 11 a.m.

02:48:43.560 --> 02:48:44.100
Pacific, 2 p.m.

02:48:44.100 --> 02:48:44.120
Eastern.

03:39:29.920 --> 03:39:30.020
Thanks for watching.

03:43:09.400 --> 03:43:09.920
And

03:51:02.720 --> 03:56:22.160
I hope to see you back here at 11 a.m.

03:56:22.160 --> 03:56:22.240
Pacific, 2 p.m.

03:56:22.240 --> 03:56:22.240
Eastern.

04:00:29.070 --> 04:00:29.710
Thanks for watching.

04:00:29.710 --> 04:00:30.890
Welcome back to HackASAT.

04:00:30.890 --> 04:00:33.150
I'm your host, Jordan Wines.

04:00:33.150 --> 04:00:40.030
Right after our last update ended with only a samurai solve, several other teams came in with solutions for Challenge Zero.

04:00:40.170 --> 04:00:44.890
PFS and SolarWine were solvers two and three on that challenge.

04:00:46.890 --> 04:00:51.590
Let's go ahead and take a look at those two teams and see what we know about them.

04:01:50.550 --> 04:01:57.110
I particularly enjoy the contrast between these two teams that joined samurai at the top of the leaderboard earlier today.

04:01:57.170 --> 04:02:03.650
SolarWine has decidedly not from a CTF background, whereas PFS definitely has a strong background in the CTF community.

04:02:03.650 --> 04:02:09.090
In fact, I only found out after they'd already qualified that I actually knew some of those members of that team.

04:02:09.090 --> 04:02:19.850
After those two teams scored on Challenge Zero, every other team was eventually able to solve Challenge Zero over the next several hours, though you'll notice on the scoreboard that some of them received less points.

04:02:20.490 --> 04:02:23.870
This is because each challenge has a degradation period.

04:02:23.870 --> 04:02:34.450
This means that for 30 minutes after the first solve, all other teams have a chance to score for full points, but after that, they only have an additional two hours to solve that particular challenge.

04:02:34.450 --> 04:02:39.410
During the two-hour period, the points available for that challenge slowly go to zero.

04:02:39.510 --> 04:02:47.710
While it puts the pressure on our teams to stay up with their peers, it means that no one can get stuck on a single challenge that leaves them behind for the entire event.

04:02:47.790 --> 04:02:54.410
At the end of that two-and-a-half-hour period, we give all teams our solution, though of course those old points are gone forever.

04:02:54.650 --> 04:02:57.690
This is primarily a facet of being a serial CTF.

04:02:57.690 --> 04:03:05.670
In many CTFs, challenges can be solved in parallel, so this was an attempt to keep the game going even if you get stuck on one challenge.

04:03:06.090 --> 04:03:11.190
Of course, one concern was that this would unfairly punish some teams in different time zones.

04:03:11.190 --> 04:03:19.210
Thankfully, we are only running the satellites for nine hours of gameplay each day, and it lines up fairly well with hacker standard time, anywhere from 4 p.m.

04:03:19.210 --> 04:03:21.190
to 1 a.m., depending on the team.

04:03:21.590 --> 04:03:28.730
One advantage of this particular scheme of point degradation is that we can explain in detail the solution for challenges that have expired.

04:03:28.730 --> 04:03:31.590
Here's our official explainer for Challenge Zero.

04:03:32.770 --> 04:03:36.730
Challenge Zero Here's what we know.

04:03:36.730 --> 04:03:41.750
An attacker has obtained access to the satellite's ground station through an internet-facing website.

04:03:41.750 --> 04:03:44.550
Once they obtained access, they kicked us out.

04:03:44.550 --> 04:03:45.530
The challenge?

04:03:45.530 --> 04:03:48.970
Teams must regain network access to the ground station.

04:03:49.050 --> 04:03:50.530
Here's how they do it.

04:03:50.530 --> 04:03:54.830
An internet-facing website exists on the same subnet as the ground station.

04:03:54.830 --> 04:04:03.290
Teams must identify and exploit a vulnerability in the web server, then use it as a foothold within the network to pivot to the ground station and gain access.

04:04:08.320 --> 04:04:14.240
So for Challenge Zero, teams first had to extract a key from the Ruby web service used to generate sessions.

04:04:14.240 --> 04:04:17.740
Then they used that to forge credentials to the service as an admin user.

04:04:17.820 --> 04:04:22.720
Finally, the admin page, they could actually find a piece of it where they could execute shell commands.

04:04:22.720 --> 04:04:26.160
They were sued, and there were some other intricacies they had to figure out.

04:04:26.160 --> 04:04:34.780
But eventually, they got a shell in the box, or they got access to an SSH key on that box, and that ultimately gave them connections to their Cosmos ground station.

04:04:34.940 --> 04:04:40.000
This is the machine that they would be using for the rest of the event to control their particular flatsats.

04:04:40.440 --> 04:04:44.860
They issue commands through the Cosmos server, goes over the RF link to their satellites.

04:04:45.260 --> 04:04:53.220
While Samurai had a head start with access to their server first, PFS was able to take the lead about an hour ago by solving Challenge One.

04:04:53.220 --> 04:05:03.240
As a reminder, the goal of Challenge One is to re-establish better communications with their flatsat, and we'll learn more about how they solved that once all teams have solved that challenge.

04:05:03.300 --> 04:05:09.720
Not to be up done, Poland Cannon to Space followed shortly thereafter, bringing them neck and neck for first and second.

04:05:09.820 --> 04:05:14.860
Poland Cannon to Space is actually a conglomeration of two teams, P4 and Dragon Sector.

04:05:46.140 --> 04:05:57.260
Both Dragon Sector and P4 are very recognizable names in the CTF community, with Dragon Sector having a pretty good claim maybe at one of the all-time winningest CTF teams, if not the most.

04:05:57.720 --> 04:06:01.400
And of course, P4 has done very, very well, especially this year in the competition.

04:06:01.980 --> 04:06:06.420
And of course, their team name itself is a reference to a funny webcomic that you should Google if you haven't seen it.

04:06:06.420 --> 04:06:08.000
It even has its own video game.

04:06:08.240 --> 04:06:21.560
If you're interested in some more of the history of these teams that have played CTFs before, make sure to check out ctftime.org, a website that actually tracks teams' performance across different events, and has a global yearly ranking system that's hotly contested.

04:06:22.100 --> 04:06:25.200
That's all for our next game update, but it's been a busy one.

04:06:25.780 --> 04:06:34.280
Next, HackASAT has been the work of many different organizations coming together, but the primary vision has come from two individuals that we wanted to let you hear from directly.

04:06:34.320 --> 04:06:35.340
They are Dr.

04:06:35.340 --> 04:06:40.620
Will Roper, Assistant Secretary for Acquisition Technology and Logistics, Department of the Air Force, and Mr.

04:06:40.620 --> 04:06:45.340
Brett Goldstein, Leader of the Rebel Alliance at the Pentagon, Director of Defense Digital Service.

04:06:46.080 --> 04:06:54.560
And they're joined by our intrepid interviewer, Roro, who will be asking them the hard-hitting questions in a segment we're calling Between Two Nerds.

04:07:07.800 --> 04:07:10.600
Welcome to Between Two Nerds.

04:07:10.600 --> 04:07:12.260
My name is Brett Goldstein.

04:07:12.260 --> 04:07:14.960
I'm the Director of the Defense Digital Service.

04:07:15.260 --> 04:07:16.420
And I'm Will Roper.

04:07:16.420 --> 04:07:19.980
I run all of the Air Force and Space Force programs.

04:07:19.980 --> 04:07:23.800
And we would like to introduce Roro, our moderator today.

04:07:23.800 --> 04:07:29.160
Roro is a member of the Defense Digital Service and has mad security skills.

04:07:29.160 --> 04:07:34.060
First things first, I wanted to ask you all the question that I've reached out to a bunch of hackers in the community about.

04:07:34.060 --> 04:07:38.820
And the most important thing that's on their minds right now is how do you attach the lanyard to the cassette tape?

04:07:38.820 --> 04:07:40.340
Well, that's a question for Dr.

04:07:40.340 --> 04:07:41.140
Roper, I think.

04:07:41.700 --> 04:07:42.400
Dr.

04:07:42.400 --> 04:07:44.800
Roper, considering your advanced work in this space...

04:07:46.720 --> 04:07:49.860
Well, I mean, first of all, there's a design issue here.

04:07:49.860 --> 04:07:54.240
So, whoever did this, you're fired if you're on the Air Force.

04:07:54.640 --> 04:07:58.340
Thing two, there's no place to immediately hook it.

04:07:58.340 --> 04:08:00.840
So, I'd say we just tie it.

04:08:00.940 --> 04:08:07.280
We just tie it here and then we hang it around our neck and get a better cassette next year, whoever did this.

04:08:07.280 --> 04:08:09.320
Do you have the duct tape?

04:08:09.320 --> 04:08:12.680
I mean, basically, if you have a small neck, you're okay.

04:08:12.680 --> 04:08:15.260
Like an actual duck.

04:08:15.260 --> 04:08:17.460
I could wear this if you don't have duct tape.

04:08:17.980 --> 04:08:24.200
So, the other question that has also been on their minds is why are y'all here at DEF CON safe mode?

04:08:24.480 --> 04:08:28.640
Sure, well, I mean, you had incriminating evidence on me, so I'm here.

04:08:29.400 --> 04:08:32.260
We're going to try to go flat the whole time, Roro.

04:08:32.260 --> 04:08:35.700
This is between two nerds, after all, the inaugural shooting.

04:08:35.720 --> 04:08:38.220
So , no laughter, no fun.

04:08:38.220 --> 04:08:39.460
This is serious business.

04:08:39.460 --> 04:08:41.800
We're hoping to be syndicated.

04:08:41.800 --> 04:08:43.100
Eventually.

04:08:43.160 --> 04:08:48.380
We can't afford ferns yet, but we're headed towards that next step.

04:08:48.380 --> 04:08:51.660
So , Roro, we need a bit more of a positive attitude on this.

04:08:51.660 --> 04:08:56.580
Like, as we think about sort of our future careers, there seems to be a lot of potential.

04:08:56.580 --> 04:08:58.820
Rho cubed today, Roro.

04:08:58.820 --> 04:09:03.620
So, Roro, in all seriousness, because we're being serious here between two nerds.

04:09:05.480 --> 04:09:07.700
Satellite security is a big deal.

04:09:08.060 --> 04:09:10.080
You know, all joking aside, it's a big deal.

04:09:10.080 --> 04:09:17.580
Our lives depend on space working in a benign, peaceful way that makes life better for everyone.

04:09:17.580 --> 04:09:20.900
You need it for the data that's coming to your phone right now.

04:09:20.900 --> 04:09:22.560
You need it for navigation.

04:09:22.560 --> 04:09:25.480
You even need it to get cash out of an ATM.

04:09:25.800 --> 04:09:30.120
Everyone's lives, as we sit here today, is connected to space.

04:09:30.280 --> 04:09:33.240
Well, you can imagine the military is no exception.

04:09:33.360 --> 04:09:35.060
We're connected to space.

04:09:35.060 --> 04:09:41.520
We use it to move planes from point A to point B, to guide weapons, to plan disaster relief missions.

04:09:41.540 --> 04:09:43.200
Everything we do.

04:09:43.480 --> 04:09:55.540
So, if you're thinking about a way to beat our military, holding space assets at risk is a pretty easy way to take a big leap forward in terms of your capabilities.

04:09:55.540 --> 04:10:00.320
And so we want to know if cyber is something we need to put more worry into.

04:10:00.320 --> 04:10:05.020
So we're here to see if people can hack a satellite, which we think they'll be able to.

04:10:05.020 --> 04:10:11.800
And we hope to learn from the community how to be better and more cyber resilient in systems we build in the future.

04:10:12.180 --> 04:10:18.900
As an international community of hackers and nerds, how can they help out?

04:10:18.900 --> 04:10:20.940
What is the call to action here if there is one?

04:10:20.940 --> 04:10:22.880
Sure, and I'm going to try to stay flat.

04:10:22.880 --> 04:10:25.180
But boy, it's really hard because I'm excited about this.

04:10:25.240 --> 04:10:27.100
Anyway, back to Between Two Nerds.

04:10:27.100 --> 04:10:30.420
Just being here and being interested is a huge deal.

04:10:30.420 --> 04:10:31.920
We want to learn from you.

04:10:31.920 --> 04:10:33.900
The military is here to learn.

04:10:34.700 --> 04:10:42.680
Historically, we have been secure by hiding behind our fence lines and keeping systems secret until they're used on the battlefield.

04:10:42.680 --> 04:10:44.460
Well, that doesn't work anymore.

04:10:44.460 --> 04:10:50.840
Software is increasingly the delineator in whether systems are dominant or out of the fight.

04:10:50.840 --> 04:11:00.640
So we're getting outside of our fence lines and involving communities that can help us, like DEFCON, to see if we need to up our game in cyber.

04:11:00.740 --> 04:11:12.080
And so if our satellites have to operate to make the military work the way it's supposed to, we want to expose opportunities to hack them ahead of us taking them into conflict.

04:11:12.080 --> 04:11:21.720
So what I hope to learn from DEFCON, from all the amazing community members here, is how good we are today and what we need to do to be better in the future.

04:11:21.760 --> 04:11:32.700
So the Department of Defense historically has operated cybersecurity through obscurity, and that is a culture that we're trying to change.

04:11:32.700 --> 04:11:39.760
So I'm fortunate I run the Defense Digital Service, which is affectionately known as a SWAT team of nerds.

04:11:39.760 --> 04:11:47.940
And we are out there, and we are trying to bring the very best in technical talent to the DoD.

04:11:47.940 --> 04:11:52.840
And part of that is about technology, but part of it is about culture.

04:11:52.840 --> 04:12:04.520
So when Will and I went to DEFCON last year, I'd been attending DEFCON for many years, but I brought Will, and I said to him, this is a community we need to embrace.

04:12:04.520 --> 04:12:09.940
And one, DoD does not need to be afraid of this community.

04:12:09.940 --> 04:12:12.340
These are folks who we should be friends with.

04:12:12.340 --> 04:12:15.400
But two, we need to raise our bar.

04:12:15.400 --> 04:12:17.580
We need to challenge our software.

04:12:17.600 --> 04:12:20.100
We need to try and test our systems.

04:12:20.100 --> 04:12:23.620
And by doing that, we bring the very best in cybersecurity.

04:12:23.800 --> 04:12:26.520
So I love this partnership.

04:12:26.680 --> 04:12:27.980
We learn a lot.

04:12:27.980 --> 04:12:29.420
We challenge ourselves.

04:12:29.420 --> 04:12:34.260
Sometimes we learn things that are hard, but this is a community we really want to embrace.

04:12:34.260 --> 04:12:40.580
So can you tell me a little bit more about how you got involved with the space, or what was the initial ask?

04:12:40.580 --> 04:12:45.220
So the first time I went to DEFCON, I was by myself.

04:12:45.340 --> 04:12:52.680
And I had recently left my first stint in government, and people were like, you have to go to DEFCON.

04:12:52.680 --> 04:13:00.720
And I went there, and I'm like, holy shit, there's a gazillion people here, there are crazy things going on, and people said, don't bring a phone in.

04:13:00.720 --> 04:13:05.040
And I was completely enamored with this community.

04:13:05.040 --> 04:13:23.960
And then I came to DoD, and as we're trying to change this culture, which is an obscurity culture, a security by checklist, I'm like, this is a community that can help make us smarter, and help us, again, raise the bar, even against ourselves.

04:13:23.960 --> 04:13:39.200
So by bringing Will, and then showing all of the crazy cool things that we're doing, it allowed for that DDS Air Force relationship, which we could then come back and try and do some really cool things.

04:13:39.340 --> 04:13:48.220
And the funny part was last year, when DEFCON was winding up, I go to Will, and I'm like, we should go back.

04:13:48.220 --> 04:13:50.040
And Will's like, yeah, we should go back.

04:13:50.040 --> 04:13:51.880
And I'm like, what do you think we should do?

04:13:51.880 --> 04:13:55.620
And DoD's like, we should bring a satellite.

04:13:55.660 --> 04:13:57.100
And that was crazy.

04:13:57.100 --> 04:13:58.580
But now it's real.

04:13:58.820 --> 04:14:04.260
Yeah, it's great when crazy and real can be the same inside the Pentagon.

04:14:04.480 --> 04:14:12.620
And Brett's exactly right, that this is a community that the Department and the Pentagon have been afraid of embracing.

04:14:13.440 --> 04:14:17.380
Partly because it's an old Cold War culture that's just behind the times.

04:14:17.380 --> 04:14:23.640
And another is simply because it doesn't get outside of its five-sided walls very often.

04:14:23.640 --> 04:14:26.640
And my first trip to DEFCON was amazing.

04:14:26.640 --> 04:14:28.880
I'm a string theorist by background.

04:14:28.880 --> 04:14:30.100
I work in physics.

04:14:30.100 --> 04:14:33.500
I crossed over into defense for really weird reasons.

04:14:33.500 --> 04:14:42.280
But it's been an awesome job of getting to run $60 billion of satellites and airplane and cyber capabilities every year.

04:14:42.280 --> 04:14:48.940
As I look at this amazing portfolio of programs, everything is driven by software.

04:14:49.080 --> 04:15:02.920
And the United States government and our amazing men and women in uniform have put so much time and treasure into these amazing military systems that increasingly operate based on their software.

04:15:02.920 --> 04:15:11.740
So if you're looking to defeat us, you don't have to recreate the same systems, build a fighter to match ours, build a satellite to match ours.

04:15:11.740 --> 04:15:13.900
You just need to be able to hack us.

04:15:13.940 --> 04:15:29.900
And so I came last year wanting to see could people who have a great amount of expertise but not a lot of hands-on capability inside the military get inside a system like an F-15 fighter or the systems that enable it.

04:15:29.900 --> 04:15:34.380
And so we brought some of those enabling systems and the hacker community got in.

04:15:34.380 --> 04:15:37.180
But getting in was not the point of being here.

04:15:37.180 --> 04:15:40.100
It was the learning that happened afterwards.

04:15:40.180 --> 04:15:47.520
The hacker community got to learn something about our military systems and we left knowing how to make them more secure.

04:15:47.640 --> 04:15:50.240
And so we want to do the same thing for satellites.

04:15:50.240 --> 04:15:55.940
It's a very different problem than handing you a piece of hardware and saying, can you get in?

04:15:55.940 --> 04:16:01.240
The satellite isn't here, it's overhead, moving at 7 kilometers a second.

04:16:01.240 --> 04:16:08.760
And it only talks to the ground at certain places where we have a ground station that uplinks and downlinks different commands.

04:16:08.760 --> 04:16:12.400
This is a wicked hard problem.

04:16:12.560 --> 04:16:15.920
But I expect the DEFCON community is going to get in again.

04:16:15.920 --> 04:16:19.400
And the question we're going to ask is what should we learn?

04:16:19.400 --> 04:16:20.920
What should we do better?

04:16:20.920 --> 04:16:26.920
Because cyber is something any country, any terrorist group can try to do against our military.

04:16:26.920 --> 04:16:32.120
It's quicker, easier, and more seductive than trying to take us head on.

04:16:32.120 --> 04:16:37.160
So this dark side of the force is something we're going to have to be able to defeat.

04:16:37.160 --> 04:16:40.300
And we're here to learn from people who know a lot more than we do.

04:16:51.420 --> 04:16:57.460
For the F-15 system, it was really to probe just how many different ways do people get in.

04:16:57.460 --> 04:16:59.300
Do we have a design flaw?

04:16:59.300 --> 04:17:00.760
Is it a design flaw?

04:17:00.760 --> 04:17:06.880
Is it a hardware flaw where we've got embedded systems that have back doors that can be accessed?

04:17:06.940 --> 04:17:10.340
Is it a software flaw or is it a little bit of all of the above?

04:17:10.540 --> 04:17:12.420
It's a little bit of all of the above.

04:17:12.680 --> 04:17:17.500
And so after doing a meeting with the hackers that got in, they walked through.

04:17:17.500 --> 04:17:18.820
I tried this and it worked.

04:17:18.820 --> 04:17:20.700
Then I tried this next path and it worked.

04:17:20.700 --> 04:17:32.560
And just like electricity always flowing through the path of least resistance, they kept trying methods that got increasingly harder, but they didn't have to pull their toughest tricks to get in.

04:17:32.680 --> 04:17:45.980
So the direction I think we're going, that we ought to go, is fully embracing the hacker community at DEF CON and not waiting until systems are built to create opportunities to learn and help us learn.

04:17:45.980 --> 04:17:50.840
We should bring the hacker community into systems as we design them.

04:17:50.840 --> 04:17:54.600
Help us make them more secure before we're producing them.

04:17:54.600 --> 04:17:56.900
And I think this could be win-win.

04:17:56.900 --> 04:18:05.640
We would learn a ton from this community, but also create some of the most interesting challenges because the systems we build are unique.

04:18:05.640 --> 04:18:16.060
They have some pretty amazing technology in them and I think the opportunity for the hacker community to get new hands-on experience would also be really energizing and cool.

04:18:16.060 --> 04:18:26.560
So events like HackASAT are awesome live events, but the relationship and continuing it across a broader set of opportunities is what's more exciting.

04:18:26.560 --> 04:18:37.560
There's an interesting synergy between, one, the hacker community can touch devices you never would think you'd be allowed to touch.

04:18:37.560 --> 04:18:42.920
Weapons, satellites, all the things that are pretty cool.

04:18:42.920 --> 04:18:49.980
It also helps us learn commonalities where we build a lot of different things.

04:18:50.040 --> 04:18:57.360
And by learning those base cases of things we should do and should not do, that helps the design.

04:18:57.360 --> 04:19:03.800
But at the same time, people need to understand that there's a creativity to hacking.

04:19:03.800 --> 04:19:09.760
We often in the military, we think about checklists and spreadsheets and things like that.

04:19:09.760 --> 04:19:16.040
But I know people who have done red team and hacking exercises, it's much more of an art.

04:19:16.040 --> 04:19:20.320
And we want to bring that art into making our system safer.

04:19:21.000 --> 04:19:24.940
So we started this planning a little bit last year and then COVID hit.

04:19:24.940 --> 04:19:26.540
How did that change the plans?

04:19:28.620 --> 04:19:33.120
So there were moments where it was insanely stressful.

04:19:33.120 --> 04:19:39.620
Where it's, we are charging ahead and I'm sitting there, oh my God, what's going to happen with DEF CON?

04:19:39.620 --> 04:19:45.100
But then we realized we're perfectly situated for a virtual event.

04:19:45.200 --> 04:19:47.340
We have a VR environment.

04:19:47.340 --> 04:19:49.220
We have all of these workshops.

04:19:49.340 --> 04:19:52.460
Everything is now accessible from anywhere.

04:19:52.460 --> 04:19:59.240
And where I think it's really interesting is we can now provide access to these workshops at a much larger scale.

04:19:59.240 --> 04:20:04.880
Whereas last year, like the workshops were awesome, but we were swamped.

04:20:04.880 --> 04:20:13.560
But now in the VR environment, we can take thousands of people and also for access to the actual hack a set on event.

04:20:13.820 --> 04:20:17.280
It's open to the world now and it's going to be super cool.

04:20:17.300 --> 04:20:20.980
So a little anxiety, but we are good to go.

04:20:20.980 --> 04:20:22.400
And I'm really excited.

04:20:22.620 --> 04:20:28.000
I'm more excited about the virtual event than I would have been doing a live event at DEF CON.

04:20:28.000 --> 04:20:42.140
And don't get me wrong, it would be awesome to have an event, live event with people attending, being able to shake hands and give high fives to the team that pull off what is going to be a very difficult challenge.

04:20:42.300 --> 04:20:54.180
But the virtual event is going to allow so many more people to be part of this experience, part of the community that gets to attempt this for the very first time at DEF CON.

04:20:54.180 --> 04:21:03.720
And I am so much more excited about a bigger community than I am about putting up a stage at Las Vegas and then taking it down after the event is over.

04:21:03.720 --> 04:21:09.360
We got to do this a few months ago when we were kicking off our flying car program.

04:21:09.360 --> 04:21:16.080
Long story, but pretty awesome that we're creating a new initiative to accelerate flying cars for the country.

04:21:16.180 --> 04:21:21.460
Well, that program was supposed to be a major kickoff at South by Southwest, which canceled.

04:21:21.460 --> 04:21:24.140
And we had to decide, what do we do?

04:21:24.140 --> 04:21:31.340
Well, we kept the event rolling through a virtual event and had over 60,000 people participate.

04:21:31.340 --> 04:21:40.280
We would have never had that number be able to make it down to Austin and get to an event that could probably hold no more than 2,000 tops.

04:21:40.340 --> 04:21:45.480
So the potential for a greater community is huge doing the event this way.

04:21:45.480 --> 04:21:56.320
We will still get all of the cool factor from multiple hacker teams having the opportunity to let their code run live in space, which is just an awesome opportunity.

04:21:56.420 --> 04:21:57.960
But imagine this, Roro.

04:21:57.960 --> 04:22:03.040
We had over 2,000 different teams just go through the qualls.

04:22:03.040 --> 04:22:08.800
We had over 6,000 people who have already raised their hand to be a hands-on participant.

04:22:08.800 --> 04:22:12.380
So who knows how many people will tune in during this week.

04:22:12.380 --> 04:22:18.180
But the opportunity to have a broad group of people is the most exciting thing about being virtual.

04:22:18.180 --> 04:22:22.960
And I hope everyone that is logging in and participating, I hope that you're safe and well.

04:22:22.960 --> 04:22:29.920
So we're super excited that besides HackASet, we are also having a series of workshops.

04:22:30.020 --> 04:22:32.380
We have bricks in the air again.

04:22:32.580 --> 04:22:34.940
We have a ground station exercise.

04:22:34.940 --> 04:22:40.500
Now, the thing that's important here is HackASet was extraordinarily competitive.

04:22:40.500 --> 04:22:46.620
As Will mentioned, thousands of folks tried out for it and it got narrowed down to eight.

04:22:46.760 --> 04:22:48.740
Eight teams, that's right.

04:22:48.760 --> 04:22:52.680
And so we have eight rockstar teams doing that.

04:22:52.680 --> 04:22:59.220
But part of what we want to do here is help people learn about the variety of technologies.

04:22:59.220 --> 04:23:04.320
Because what's really interesting to me is this is a different type of hacking.

04:23:04.320 --> 04:23:11.060
This is not your traditional going after a web property or a traditional software app.

04:23:11.060 --> 04:23:13.600
There's a new set of skills to learn.

04:23:13.600 --> 04:23:21.380
So we have workshops all available via VR, ranging from beginner level all the way up to advanced.

04:23:21.380 --> 04:23:26.760
Because we want to help you learn more about the tooling and the skills you need for these types of systems.

04:23:26.760 --> 04:23:32.860
And then when you get toward advanced, then you'll be ready to work on the HackASet type of events.

04:23:32.860 --> 04:23:35.300
So we have the full stack ready for you.

04:23:35.460 --> 04:23:44.900
One of my favorite comments coming out of one of the teammates that participated in the quals was, I didn't know I needed a degree in physics to hack a satellite.

04:23:45.140 --> 04:23:49.960
We don't actually need the degree, but you do need to know a little about physics to hack it.

04:23:49.960 --> 04:23:56.320
And part of the purpose of these workshops are to introduce the peculiar new trade craft that will be needed.

04:23:56.320 --> 04:24:03.680
So that you can take hacker skills you have today and apply them to these very different opportunities in space and in the air.

04:24:03.900 --> 04:24:08.520
So I think we really crushed doing the virtual piece.

04:24:08.520 --> 04:24:10.420
What do we do about stickers?

04:24:10.880 --> 04:24:13.420
Like the whole Defcon sticker swap?

04:24:14.100 --> 04:24:15.500
A little stressful.

04:24:15.900 --> 04:24:18.000
Maybe we could do them like Bitcoin.

04:24:18.620 --> 04:24:20.600
Crypto coins, that could be the new...

04:24:20.600 --> 04:24:22.140
Because I can't get coins out right now.

04:24:22.140 --> 04:24:23.320
I have a bunch in my office.

04:24:23.760 --> 04:24:27.020
So we can mail them, but crypto coins could be the wave of the future.

04:24:27.080 --> 04:24:30.020
Yeah, for everyone watching, everyone in the Pentagon has coins.

04:24:30.020 --> 04:24:35.180
They're things that you give out when someone's really done something great or helped you out.

04:24:35.180 --> 04:24:40.460
So it goes well back in military tradition, but you give them out via handshake.

04:24:40.460 --> 04:24:45.020
With the coin in your hand, you shake hands, it transfers from one person to the other.

04:24:45.020 --> 04:24:50.340
So COVID-19 has put a serious dent in this time-honored tradition.

04:24:50.360 --> 04:24:52.320
So crypto coins...

04:24:52.320 --> 04:24:53.820
You throw the coin first, right?

04:24:53.820 --> 04:24:55.580
But then it gets... it's a hot mess.

04:24:55.580 --> 04:24:56.600
It's even worse than that.

04:24:56.600 --> 04:25:01.720
We have them in little plastic bags, and we dump them from one hand to the other.

04:25:01.720 --> 04:25:04.560
It completely has lost the sense of ceremony.

04:25:05.000 --> 04:25:07.540
Tap it in the bag first, and then dump them in the hands?

04:25:07.720 --> 04:25:12.200
There's no way to say, congratulations, stick out your hand, and then dump a coin in it.

04:25:12.240 --> 04:25:16.200
The firm handshake is needed to say, thank you for what you've done.

04:25:27.350 --> 04:25:30.190
I thought it was interesting last year.

04:25:31.150 --> 04:25:35.830
The expectation of DoD was sadly pretty low.

04:25:36.470 --> 04:25:44.490
Expecting someone in a suit, expecting someone in a uniform, who would not engage this community.

04:25:44.490 --> 04:25:52.010
And I remember after we gave a talk last year, a bunch of folks came up and they're like, you're not what we expected.

04:25:52.010 --> 04:25:55.230
And you're doing super cool shit.

04:25:55.230 --> 04:25:57.050
How can we help?

04:25:57.050 --> 04:26:00.810
And those are the discussions we want to have.

04:26:00.810 --> 04:26:03.370
Because Will and I are constantly worried.

04:26:03.370 --> 04:26:08.770
We're constantly working to raise the bar and make things better.

04:26:08.770 --> 04:26:12.470
But we need that level of expertise and partnerships.

04:26:12.470 --> 04:26:16.710
So I was thrilled that last year we could go directly engage.

04:26:16.710 --> 04:26:22.890
Show that we aren't what you expect, and we do really, really cool things.

04:26:23.250 --> 04:26:26.050
And the opportunities are really broad.

04:26:26.050 --> 04:26:33.770
So if someone's out thinking, well, I'm interested in helping the military, but I don't know if I want to work on a weapons system.

04:26:33.910 --> 04:26:37.050
Every technology under the sun is part of the military.

04:26:37.050 --> 04:26:40.650
We do disaster relief every year during the hurricane season.

04:26:40.650 --> 04:26:46.770
The Air Force is flying planes in to move people that are under stress and deliver supplies.

04:26:46.770 --> 04:26:51.630
And that is a major part of what the military does that doesn't make the news.

04:26:51.630 --> 04:26:57.590
We work in energy, we work in medicine, providing a lot of frontline responders to COVID-19.

04:26:57.810 --> 04:27:00.670
All of this is empowered by software.

04:27:00.670 --> 04:27:05.950
We need digital experts who want to help us take our game to the next level.

04:27:05.970 --> 04:27:11.390
So no matter what you are interested in working with us on, the opportunity is there.

04:27:11.390 --> 04:27:17.530
And we will be here year after year at DEFCON bringing opportunities for you to participate in our mission.

04:27:17.590 --> 04:27:20.510
Learn more about us so that we can learn from you.

04:27:20.510 --> 04:27:28.130
So when we were building mysymptoms.mil earlier this year, which is part of our COVID-19 response.

04:27:28.130 --> 04:27:32.610
Before we let it out the door, we reached out to someone in the DEFCON community.

04:27:32.610 --> 04:27:35.790
Because that needs to be part of our culture.

04:27:36.110 --> 04:27:38.870
We're creating software, we think it's pretty good.

04:27:38.870 --> 04:27:42.630
We have a pretty good SWAT team, but we want those outside eyes.

04:27:42.630 --> 04:27:46.610
And this is for something, COVID-19 is something that's bringing us all together.

04:27:46.610 --> 04:27:49.510
And that's a perfect example of community engagement.

04:27:49.510 --> 04:27:52.290
And we tightened it up and we got it out the door.

04:27:52.750 --> 04:27:55.970
From my view, the defense companies mirror the government.

04:27:55.970 --> 04:28:00.890
And the government is slow and 20 years, if not more, behind the time.

04:28:00.910 --> 04:28:04.030
So it has to start with the government leading the dance.

04:28:04.030 --> 04:28:10.010
And having more people who have technical backgrounds who don't look like what you expect in the Pentagon.

04:28:10.010 --> 04:28:14.890
Start bringing in new ideas, new technologies, and just a new culture.

04:28:14.890 --> 04:28:17.610
And that's part of why we're here as part of DEFCON.

04:28:17.610 --> 04:28:24.390
And part of why we're talking with you through a very different venue than you normally get out of this five-sided building.

04:28:24.390 --> 04:28:26.070
So that's step one.

04:28:26.070 --> 04:28:27.850
The government's got to change.

04:28:27.850 --> 04:28:30.850
Step two is government doesn't make much.

04:28:30.850 --> 04:28:34.010
We have amazing airmen who write code for us every day.

04:28:34.010 --> 04:28:39.370
And sci-fi inspired organizations called Kessel Run, Kobayashi Maru.

04:28:39.370 --> 04:28:46.490
And 60 more names covering the sci-fi and comic book universe.

04:28:46.490 --> 04:28:52.250
They're awesome teams, but they're a small component of what industry provides.

04:28:52.250 --> 04:28:53.450
We don't build airplanes.

04:28:53.450 --> 04:28:55.610
We don't build satellites ourselves.

04:28:55.610 --> 04:28:56.730
Rarely.

04:28:56.810 --> 04:29:00.070
And so if industry doesn't learn to adopt these new techniques.

04:29:00.070 --> 04:29:05.810
If they don't become better at software and shift to new trends and development like containerization.

04:29:05.810 --> 04:29:12.990
And shift to open approaches to determining errors in code like bug bounties and open sourcing of code.

04:29:13.030 --> 04:29:16.190
Then we will continue to be further and further behind the times.

04:29:16.190 --> 04:29:19.030
And ultimately, our model's got to be hybrid.

04:29:19.070 --> 04:29:21.310
We won't open source all of our code.

04:29:21.310 --> 04:29:24.770
We will always have things we reserve for conflict.

04:29:24.770 --> 04:29:27.210
But we don't open source anything today.

04:29:27.210 --> 04:29:30.330
We did that for the first time this year.

04:29:30.330 --> 04:29:35.590
The first time we have open source code that's needed for operations.

04:29:35.590 --> 04:29:39.870
I expect that's the most secure code we have right now in the Air Force.

04:29:39.870 --> 04:29:41.010
So what's next?

04:29:41.010 --> 04:29:45.150
The question I have for industry is what's next?

04:29:45.150 --> 04:29:47.810
And when are you going to be part of the solution?

04:29:48.310 --> 04:29:51.450
There's a cultural piece we need to get at here.

04:29:51.450 --> 04:29:54.950
A couple things that drive me crazy.

04:29:54.950 --> 04:29:57.410
One, good enough for government work.

04:29:57.410 --> 04:29:59.450
Like that is absolute bullshit.

04:30:00.090 --> 04:30:01.270
End of sentence.

04:30:01.350 --> 04:30:06.590
Two is, you know, Will mentioned that government is behind.

04:30:06.590 --> 04:30:08.230
How is that okay?

04:30:08.510 --> 04:30:13.610
And this is one of the reasons I left the private sector and came into government.

04:30:13.610 --> 04:30:17.230
Because we can't be okay with this.

04:30:17.230 --> 04:30:21.110
So part of what Will and I do is reset this culture.

04:30:21.270 --> 04:30:25.750
And challenge ourselves, never have acceptance for that.

04:30:25.950 --> 04:30:29.370
Because neither one of those statements make any sense to me.

04:30:29.450 --> 04:30:31.090
So do you both have tenure in your jobs?

04:30:31.090 --> 04:30:33.470
Because this seems like a really bad idea.

04:30:33.910 --> 04:30:35.610
The hacking satellites...

04:30:37.710 --> 04:30:42.150
Well, as long as it doesn't come crashing down through the roof anytime soon.

04:30:42.150 --> 04:30:45.470
We're probably going to make it a few months more.

04:30:46.390 --> 04:30:50.150
I will say we've taken extraordinary security precautions.

04:30:50.150 --> 04:30:54.830
To make sure that everything is going to be okay up in orbital land.

04:30:54.970 --> 04:30:58.510
But we are going to let teams move the satellite.

04:30:58.530 --> 04:31:02.050
So not move it in a translational sense.

04:31:02.050 --> 04:31:04.810
But we're going to let teams rotate it.

04:31:04.810 --> 04:31:08.550
And if they're good enough and they can do their orbital mechanics quickly enough.

04:31:08.550 --> 04:31:11.050
We're asking them to take a picture of the moon.

04:31:11.050 --> 04:31:16.030
So what we hope to send out to the hacker community is a wonderful image of the moon.

04:31:16.150 --> 04:31:19.410
Brought courtesy of the hacker team that won.

04:31:19.450 --> 04:31:25.750
So that's a pretty, pretty awesome opportunity to have that code actually change something in orbit.

04:31:25.810 --> 04:31:31.870
But we've taken extraordinary procedures to make sure that's all that that code will be able to do.

04:31:32.170 --> 04:31:34.950
But Auro, your question is actually an important one.

04:31:34.950 --> 04:31:39.730
So in terms of tenure, no, I have no idea how long I have in this job.

04:31:39.730 --> 04:31:42.510
I came into defense through happenstance.

04:31:42.510 --> 04:31:45.490
Worked for a couple of secretaries of defense.

04:31:45.630 --> 04:31:50.510
Built a lot of awesome systems, very few of which I can talk about.

04:31:50.510 --> 04:31:54.950
But amazing capabilities, swarming things, etc.

04:31:55.090 --> 04:31:58.350
Made with a lot of incredible men and women in uniform.

04:31:58.350 --> 04:32:04.630
But crossing over into this job, running all the Air Force and Space Force programs, which is an awesome job.

04:32:04.630 --> 04:32:06.450
If you're ever asked to do it, say yes.

04:32:06.450 --> 04:32:13.890
Because you get all of these amazing technologies, satellites and airplanes and cyber tools and amazing people to work with.

04:32:14.090 --> 04:32:18.310
But you only get to be in the job as long as you're asked to do it.

04:32:18.310 --> 04:32:21.310
And so my tenure could be very short.

04:32:21.350 --> 04:32:30.730
And what I hope, what I pray for the Pentagon is that people in leadership will keep asking technical people to come and serve.

04:32:30.730 --> 04:32:36.250
So if you're out there thinking, I'd love to be part of an Air Force hacking team, then come find us.

04:32:36.250 --> 04:32:36.970
Come join us.

04:32:36.970 --> 04:32:44.190
If you want to be part of Defense Digital Service, which would be an amazing job where you wouldn't have to wear a suit to work every day.

04:32:44.190 --> 04:32:45.110
Come join them.

04:32:45.110 --> 04:32:48.970
Be one of the squadron of nerds.

04:32:48.970 --> 04:32:49.650
I'm using Air Force.

04:32:49.650 --> 04:32:51.270
Can you be a squadron of nerds?

04:32:51.270 --> 04:32:54.070
So the squadron of nerds is part of the SWAT team of nerds?

04:32:54.230 --> 04:32:56.410
Squadron of nerds would be like the Air Force.

04:32:56.410 --> 04:32:57.510
We're all squadrons.

04:32:57.510 --> 04:33:00.270
So we could have like an auxiliary squadron of nerds.

04:33:00.770 --> 04:33:02.170
Well, there you go.

04:33:02.170 --> 04:33:04.270
But take the opportunity up.

04:33:04.270 --> 04:33:05.690
You won't be sorry.

04:33:05.690 --> 04:33:12.930
But that's ultimately the trend we need are people that have technical talent who don't want to work in the government forever.

04:33:13.150 --> 04:33:23.310
But that say, you know, for for one, two, three years, I want to go take on some new opportunities for the government to make it easy and energizing to do that.

04:33:23.750 --> 04:33:26.090
So I'm I'm here on a two year tour.

04:33:26.090 --> 04:33:27.650
I am halfway through.

04:33:27.650 --> 04:33:33.150
But the story is like I'm part of the story, but I'm not the story.

04:33:33.150 --> 04:33:35.310
I'm part of an 80 person team.

04:33:35.310 --> 04:33:39.170
And this is the best team I've ever been part of.

04:33:39.170 --> 04:33:44.350
And there will be another director after me who will represent the team.

04:33:44.350 --> 04:33:49.110
But every day, the SWAT team of nerds goes out and works on projects.

04:33:49.110 --> 04:33:52.990
You really you can't believe it makes insane impact.

04:33:53.070 --> 04:33:54.870
So I'll do my two years.

04:33:54.870 --> 04:33:59.510
And but the mission will go on and the team will continue to rock.

04:33:59.890 --> 04:34:03.830
I can see if the Air Force can make DDS an honorary squadron.

04:34:03.830 --> 04:34:05.010
That'd be cool.

04:34:05.010 --> 04:34:06.870
I'm taking that action.

04:34:06.930 --> 04:34:09.190
Colonel Bailey, action taken.

04:34:09.690 --> 04:34:10.690
That's a colonel.

04:34:10.690 --> 04:34:12.970
Colonel, I just promoted you to Colonel Captain Bailey.

04:34:12.970 --> 04:34:14.110
Action taken.

04:34:14.390 --> 04:34:16.210
Can can.

04:34:16.210 --> 04:34:18.090
Does that mean we can go to space?

04:34:19.170 --> 04:34:20.170
This is important.

04:34:20.170 --> 04:34:22.190
Can we just work this through?

04:34:23.150 --> 04:34:26.850
I think astronaut training should be required for that, Brad.

04:34:27.070 --> 04:34:31.270
So I was watching Picard with the kids last night.

04:34:31.670 --> 04:34:34.510
And they have that transport thing.

04:34:34.510 --> 04:34:37.150
I figured somewhere in the classified portfolio.

04:34:37.630 --> 04:34:38.810
We're working it.

04:34:38.810 --> 04:34:39.490
OK.

04:34:39.770 --> 04:34:42.050
So if that works, can I go to space?

04:34:42.050 --> 04:34:46.850
It's right next to the warp drive, right next to the photon torpedo.

04:34:46.850 --> 04:34:52.550
So yes, when we've got teleportation done, Brad, I will personally teleport you up to the space station.

04:34:52.690 --> 04:34:53.590
Got it.

04:34:53.690 --> 04:34:55.250
How's the food up there?

04:34:56.170 --> 04:34:58.170
NASA provides that, so I don't know.

04:34:58.970 --> 04:35:00.910
Do you think there are any gummy products?

04:35:00.910 --> 04:35:03.030
I'm going to guess... oh, I don't know, Brad.

04:35:03.030 --> 04:35:06.010
Because gummy products have a high degree of water content.

04:35:06.010 --> 04:35:08.290
And all that's going to outgas.

04:35:08.370 --> 04:35:11.610
So how would mayonnaise perform in space?

04:35:11.610 --> 04:35:12.490
Not well.

04:35:12.890 --> 04:35:14.190
That's a critical issue.

04:35:14.190 --> 04:35:14.910
Not well.

04:35:14.910 --> 04:35:21.650
So you'd have to get at least a pressure-sealed vessel, but all things we can work on.

04:35:21.650 --> 04:35:22.930
Science never stops.

04:35:22.930 --> 04:35:27.830
I'm a little fussy about mayonnaise, so we'd want to work that through before the transporter.

04:35:27.830 --> 04:35:31.370
So spam sandwiches not going to be on your list for astronaut?

04:35:31.370 --> 04:35:31.790
No.

04:35:31.790 --> 04:35:32.690
And a tank?

04:35:33.210 --> 04:35:34.050
No, no.

04:35:34.050 --> 04:35:40.090
I was figuring... well, I am fussy about the mayonnaise, but you can actually put mayonnaise with most foods.

04:35:40.910 --> 04:35:42.530
Just something to ponder.

04:35:53.200 --> 04:35:58.860
So I'm often asked, why don't we have more artificial intelligence in the Air Force than we do today?

04:35:58.860 --> 04:36:01.660
Something I'm working very hard to change.

04:36:01.760 --> 04:36:06.100
Well, one is it's really hard to certify something that changes all the time.

04:36:06.100 --> 04:36:16.420
But what isn't well understood in the Pentagon, and I find through the country as a whole, is that artificial intelligence is very fragile in the face of an adversary.

04:36:16.420 --> 04:36:18.280
It's very easy to beat.

04:36:18.280 --> 04:36:30.820
And so we need to get into the game more and bring the DEFCON and the hacker community into our world and give them opportunities to start beating AI ahead of those opportunities being available commercially.

04:36:30.820 --> 04:36:35.200
So that's where I'd like to see us go, is into algorithmic defeat.

04:36:35.200 --> 04:36:38.360
Because that's the next generation of warfare.

04:36:38.360 --> 04:36:44.040
And the earlier we can determine how to make it safe and secure, the better off everyone's going to be.

04:36:44.840 --> 04:36:49.420
So I think you'll find that we're good listeners.

04:36:49.560 --> 04:36:51.580
So we have ideas.

04:36:51.580 --> 04:36:55.680
We just talked about AI and potential issues with that.

04:36:55.680 --> 04:36:57.800
We're talking about satellites now.

04:36:57.800 --> 04:37:00.000
But we're curious what you think.

04:37:00.000 --> 04:37:12.380
What are things, whether design flaws we should be thinking about, which can be really portable, or other types of exploits that might not be on our radar.

04:37:12.380 --> 04:37:15.280
So we'd love to just hear your thoughts.

04:37:15.280 --> 04:37:16.800
We're going to listen.

04:37:17.760 --> 04:37:20.480
And tell us things we don't know.

04:37:20.480 --> 04:37:23.980
Or tell us about challenges which are really hard.

04:37:23.980 --> 04:37:28.480
Like, a year ago, hacking a satellite felt pretty hard.

04:37:28.480 --> 04:37:29.980
But we're there now.

04:37:29.980 --> 04:37:36.600
What is a really hard one that you're thinking about, that we can challenge ourselves for, for next year?

04:37:36.740 --> 04:37:39.740
Why did you pick Steve Carell for Space Force?

04:37:43.600 --> 04:37:47.340
I mean, you have to love Steve Carell, right?

04:37:47.340 --> 04:37:49.800
I mean, I'm such a huge Office fan.

04:37:49.800 --> 04:37:54.140
And so when that came out, I thought, you know, money just because of that.

04:37:54.140 --> 04:38:14.520
But on the whole, when I get to talk Space Force, beyond the hype and, you know, the glitz that the public media often shine on it, it gets really simple to explain that, you know, do you think that adversaries will try to take on the military in space,

04:38:14.520 --> 04:38:20.060
given we have a ton of communications and navigation satellites?

04:38:20.160 --> 04:38:25.800
Satellites of all kinds, whose data we pump to the systems we take into a fight.

04:38:25.800 --> 04:38:28.400
Everyone says, well, yeah, of course, no duh.

04:38:28.640 --> 04:38:33.720
Well, if we think adversaries are going to challenge us there, then we've got to be ready there.

04:38:33.720 --> 04:38:39.960
But fighting in space is going to be really different than fighting in the air, on the sea, or under it.

04:38:39.980 --> 04:38:46.920
It's a domain that's governed almost entirely by physics in a way that makes it predictable.

04:38:46.960 --> 04:38:55.100
We know where satellites are going to be minute by minute, second by second, on forever, ad infinitum, unless we decide to move them.

04:38:55.120 --> 04:39:01.340
But moving satellites using that precious propellant, that's a big choice in space.

04:39:01.340 --> 04:39:04.440
Because there are no gas stations, no place to fill up.

04:39:04.440 --> 04:39:06.480
So it is a very different domain.

04:39:06.480 --> 04:39:16.160
And we're just here talking about low-Earth orbit constellations, those that are very near the Earth, that are moving around at 7 kilometers a second.

04:39:16.160 --> 04:39:23.380
But GPS satellites are much further out, in what are medium-altitude orbits.

04:39:23.380 --> 04:39:29.000
And satellites that do communication and detection are all the way out in geosynchronous orbit.

04:39:29.000 --> 04:39:32.760
And though they're moving really fast relative to the Earth, they're not.

04:39:32.760 --> 04:39:34.060
They're stationary overhead.

04:39:34.060 --> 04:39:41.120
Every one of these is a very different domain governed by apparently different physics.

04:39:41.180 --> 04:39:49.600
And that's why we've got men and women getting ready, who are thinking about warfare in space, and they've got a clean sheet of paper in their hands.

04:39:49.620 --> 04:39:53.680
How do we fight in this domain where things are very predictable?

04:39:53.820 --> 04:39:56.700
And you can guess what answers are coming to the forefront.

04:39:56.700 --> 04:39:58.940
We're going to have to rely on autonomy.

04:39:58.940 --> 04:40:04.640
And that means the software that we put is going to be so important to whether we win or lose.

04:40:04.700 --> 04:40:06.400
But then that brings you in.

04:40:06.400 --> 04:40:14.180
If our software is going to be the cutting edge, and the autonomy it runs on is going to be how we win, then how do we make it secure?

04:40:14.780 --> 04:40:22.460
So I think we went through this period where, at least we as a society, didn't talk a lot about space.

04:40:22.460 --> 04:40:26.980
And I'm happy to see that change.

04:40:26.980 --> 04:40:31.620
Will talked about all the critical things about space.

04:40:31.620 --> 04:40:34.720
Timing, ATMs, GPS, all of these different things.

04:40:34.720 --> 04:40:36.580
And that is super critical.

04:40:36.620 --> 04:40:47.500
But I guess I bring out my inner kid now, where a couple months ago I sat down, I have three little kids, and we watched a SpaceX launch.

04:40:47.500 --> 04:40:53.240
And there was an excitement there that I feel it's been a long time.

04:40:54.900 --> 04:40:58.080
It's been missing from society for a bit.

04:40:58.080 --> 04:41:01.760
There's something aspirational, inspirational about it.

04:41:01.760 --> 04:41:13.400
And seeing the launch, seeing the landing, talking about space, thinking about the importance of it, and all the critical things that it does, it excites me for the future.

04:41:14.040 --> 04:41:16.740
So I'm excited that we're talking about space.

04:41:16.740 --> 04:41:19.460
I still would like to go to space.

04:41:19.700 --> 04:41:24.680
I don't think, Will, you've gotten your transporter done.

04:41:24.900 --> 04:41:33.440
But with all that being said, I'm really also, until you actually take me to space, I look forward to helping protect space.

04:41:33.600 --> 04:41:34.820
Sounds good, Brett.

04:41:34.820 --> 04:41:41.820
And aside from just watching SpaceX, you know, just the other day we watched Perseverance and Ingenuity head up.

04:41:41.820 --> 04:41:45.860
And so we're really, really excited about the enthusiasm in space.

04:41:45.860 --> 04:41:51.980
And Space Force gets to provide most of the rocketry that the entire government and commercial industry uses.

04:41:52.100 --> 04:41:54.720
So it's going to be a little while until we beam you to space.

04:41:54.720 --> 04:41:59.080
But we've got some excellent works in rockets that can help push you there.

04:41:59.220 --> 04:42:02.820
Do you think I could do that training thing in a couple weeks?

04:42:03.180 --> 04:42:04.360
Just banging it out?

04:42:04.420 --> 04:42:08.700
Let's talk about that next time on Between Two Nerds.

04:42:08.700 --> 04:42:10.020
Thanks for coming.

04:42:10.880 --> 04:42:11.800
Okay.

04:42:29.540 --> 04:42:31.640
So we're really easy.

04:42:32.120 --> 04:42:33.700
We're on the Twitters.

04:42:34.040 --> 04:42:35.580
At least I'm on the Twitters.

04:42:35.580 --> 04:42:36.380
Are you on the Twitters?

04:42:36.380 --> 04:42:41.520
I promised Brett that for DEFCON, I would send out my first tweet.

04:42:41.520 --> 04:42:44.560
So I'm really looking forward to seeing Will on the Twitters.

04:42:44.560 --> 04:42:50.800
We're also going to be... Will and I will be in the VRs during DEFCON.

04:42:50.800 --> 04:42:52.380
You can find us there.

04:42:52.500 --> 04:42:54.080
We'll be on Twitch.

04:42:54.080 --> 04:42:55.680
We'll be all over.

04:42:55.680 --> 04:42:59.660
And we'll make sure that we leave a link on our HackASAP site.

04:42:59.660 --> 04:43:11.900
If you are interested in finding out more about participating in future hacking events with the Air Force or DDS, we will leave a place for you to find us, for us to contact you.

04:43:11.900 --> 04:43:14.100
And we also want to hear your suggestions.

04:43:14.100 --> 04:43:20.380
And when COVID is done, if you're in D.C., come to the Pentagon.

04:43:20.380 --> 04:43:22.280
We'd love to hear your ideas.

04:43:31.050 --> 04:43:33.910
So can zombies swim?

04:43:34.650 --> 04:43:36.250
I don't know, Brett.

04:43:36.250 --> 04:43:43.130
I think it probably depends on what movie we're in and whether they knew how to swim before they were zombified.

04:43:43.190 --> 04:43:49.430
So I intentionally moved to an island where part of my intent was being zombie safe.

04:43:49.430 --> 04:43:50.750
How deep is the water?

04:43:50.750 --> 04:43:51.930
Pretty deep.

04:43:51.930 --> 04:43:53.710
Did you see World War Z?

04:43:53.710 --> 04:43:54.390
I did.

04:43:54.390 --> 04:43:55.550
Is it that deep?

04:43:56.970 --> 04:43:58.870
It might not be deep enough.

04:43:58.870 --> 04:44:00.430
You might need a better island.

04:44:05.650 --> 04:44:08.130
Thanks, RoRo, for the Q&A and Dr.

04:44:08.130 --> 04:44:10.750
Roper and Brett for your vision behind HackASAP.

04:44:10.990 --> 04:44:15.510
Remember at the beginning of the day I told you that not all of this event would happen on the Earth?

04:44:15.510 --> 04:44:20.390
Well, I hope teams are ready because we are about to throw them a massive curveball.

04:44:20.390 --> 04:44:24.190
The on-orbit challenge is about to drop on our unsuspecting teams.

04:44:24.190 --> 04:44:26.070
Well, okay, they have a little bit of suspicion.

04:44:26.070 --> 04:44:31.650
But our teams have only a few hours to create a mission plan for an actual satellite in space.

04:44:31.770 --> 04:44:39.070
Their task is to orient a spinning satellite, point its camera at the moon, take a photograph, and send it back home to the HackASAP contest officials.

04:44:39.170 --> 04:44:46.490
The team with the best solution will win what might even be a more valuable prize than the cash part of this competition, bragging rights.

04:44:46.490 --> 04:44:47.310
That's right.

04:44:47.310 --> 04:44:53.710
One team in this competition can say that their code directed a real satellite in space and took a proverbial moon shot.

04:44:55.370 --> 04:44:58.390
Stop everything and look up.

04:44:58.590 --> 04:45:02.230
Starting now, teams shift to the on-orbit challenge.

04:45:02.290 --> 04:45:06.590
Their primary goal is to capture a picture of the moon using this satellite.

04:45:07.270 --> 04:45:12.970
Competitors will have access to the two-line element of the vehicle and the camera's foresight vector.

04:45:12.970 --> 04:45:20.650
Each team is tasked with creating a mission plan that transitions a satellite from a tumbling state to one where it points the camera at the moon.

04:45:21.250 --> 04:45:26.710
The team will reach a successful status once their resulting mission plan meets key criteria.

04:45:27.130 --> 04:45:27.710
1.

04:45:27.710 --> 04:45:32.330
The commands are generated in the correct order and are within the specified period.

04:45:32.590 --> 04:45:33.470
2.

04:45:33.470 --> 04:45:36.990
The image capture angle of the moon is within specifications.

04:45:36.990 --> 04:45:38.370
3.

04:45:38.370 --> 04:45:46.190
The team's negative z-axis is pointed as close to the Earth's center as possible without affecting the camera-to-moon pointing error.

04:45:46.410 --> 04:45:51.810
The teams are given a command dictionary with the format for submitting the commands and parameters.

04:45:51.890 --> 04:45:54.110
The rest is up to them.

04:45:58.470 --> 04:46:02.010
There's one final important fact for this on-orbit challenge.

04:46:02.010 --> 04:46:07.710
While there's no score associated with it like the other challenges, it is a pass-fail challenge.

04:46:07.710 --> 04:46:13.330
Teams must produce a successful solution to be eligible for the prize money in this competition.

04:46:13.450 --> 04:46:17.070
If they want to end up on the podium, they have to be successful in this challenge.

04:46:17.070 --> 04:46:18.630
No pressure or anything.

04:46:19.150 --> 04:46:28.610
I'll see you back here in about an hour at 12.50pm Pacific, 3.50pm Eastern as we check in with our teams on both their Earth-based and extraterrestrial challenges.

05:18:41.940 --> 05:18:43.340
EARTH

05:18:53.060 --> 05:18:53.980
-BASED CHALLENGE

05:45:45.810 --> 05:45:48.950
Welcome back to a Hackistat competition update.

05:45:48.950 --> 05:45:51.130
I'm your host Jordan Wines.

05:45:51.170 --> 05:45:55.650
Taking a look at the scoreboard so far we've had an eventful last hour.

05:45:55.650 --> 05:46:00.330
Our teams continue to make progress with four teams now having solved challenge one.

05:46:00.330 --> 05:46:07.490
Unfortunately the window of time after first solve has expired and the remaining four teams were given a solution with no points.

05:46:07.490 --> 05:46:15.390
PFS and colon can into space were joined by 1553 and 1064 seabread with solutions for challenge one.

05:47:16.900 --> 05:47:23.460
1064 seabread has been around for several years going all the way back to when they were first high school friends playing as CTFs.

05:47:23.460 --> 05:47:32.060
In fact I first met them five years ago as the only team of high school students at a collegiate CTF competition and the team even included a standout freshman.

05:47:32.060 --> 05:47:36.200
Yep a high school freshman competing with college freshmen and college seniors.

05:47:36.580 --> 05:47:42.920
And while I don't personally know any of 1553 after they gave me some interesting facts about them I kind of feel like I do.

05:47:42.920 --> 05:47:49.460
For example one team member has additional sound dampening around his office due to his above-average laughter volume.

05:47:49.500 --> 05:47:56.720
One member was fired from a previous job for quote smiling too much quote and another member was a college mascot.

05:47:56.900 --> 05:48:07.540
Finally their team logo or team motto rather is preparation is the enemy of innovation which sounds a little bit like an excuse but you can't argue with their results.

05:48:08.260 --> 05:48:12.740
Let's take a look at the solution for challenge one now that all teams have it.

05:48:14.040 --> 05:48:15.940
Challenge number one.

05:48:16.040 --> 05:48:17.240
Here's what we know.

05:48:17.240 --> 05:48:24.760
Having access to the ground station means we can attempt communication but the satellite is spinning out of control which complicates everything.

05:48:24.980 --> 05:48:25.900
The challenge.

05:48:25.900 --> 05:48:28.840
Teams must regain communication with the satellite.

05:48:29.700 --> 05:48:31.380
Here's how they do it.

05:48:31.380 --> 05:48:37.380
To get started teams must set the command and telemetry rates appropriately and the power output to maximum.

05:48:37.380 --> 05:48:40.600
Because the satellite is spinning additional link margin is required.

05:48:40.600 --> 05:48:45.100
The teams receive periodic telemetry but are not able to command the vehicle.

05:48:45.200 --> 05:48:54.460
Based on the review of the anomaly resolution section in the user's guide they realize that to increase the link margin they should increase radio output power and decrease link rate.

05:48:54.460 --> 05:48:59.560
They command the radio to high power and low rate mode and regain communications with the satellite.

05:48:59.560 --> 05:49:04.560
The link is limited to low rate meaning that what they can send and receive from the satellite is limited.

05:49:13.030 --> 05:49:19.750
This is a good example of the type of challenge that is a little different in this type of CTF versus many other types of CTF.

05:49:19.750 --> 05:49:31.590
While teams were told to quote restore communication quote that goal was much more ambiguous than often traditional CTF challenges and mirrors more of the real-world problem-solving you run into in space-based applications.

05:49:31.630 --> 05:49:40.710
Because our imaginary bad actors had intentionally modified the satellite's orientation and they were moving around uncontrollably communication between the ground station and the satellite was not stable.

05:49:40.710 --> 05:49:54.030
To fix this teams needed to both lower the transfer rates boost the power and that would finally let them enable ground-based communications and that would let them control all the components of the satellite or at least the ones that they've been able to figure out so far.

05:49:54.130 --> 05:50:03.610
In fact the challenge was real-world enough that at least one team was able to solve it in the normal order of just working with the satellite without even specifically realizing they had solved the challenge.

05:50:03.670 --> 05:50:06.330
All that brings us to challenge two.

05:50:07.890 --> 05:50:09.030
Challenge two.

05:50:09.690 --> 05:50:11.450
Here's what we know.

05:50:11.450 --> 05:50:17.710
The satellite is spinning out of control because the guidance navigation and control system or GNC is inoperable.

05:50:17.710 --> 05:50:20.010
We suspect sabotage.

05:50:20.130 --> 05:50:26.390
The challenge teams must repair the GNC system as quickly as possible to stop the dangerous spinning.

05:50:35.240 --> 05:50:46.840
As teams begin to as teams now have regular communication with their satellites they'll need to get the movement under control but it's also worth mentioning at this point that these satellites do actually have their own battery and power supply.

05:50:46.960 --> 05:51:01.220
They're taken off each night to be charged and while power utilization is not a scored metric in the game if one team does manage to cause too much movement or otherwise drain all of their power that could impact their ability to interact with the satellite for the remainder of the day.

05:51:01.320 --> 05:51:03.060
Looking forward to seeing what they do.

05:51:03.060 --> 05:51:05.380
We'll see you back here in another hour for our next competition

06:44:42.010 --> 06:44:47.450
Welcome back to the competition formerly known as Space Security Challenge 2020 now HackASat.

06:44:47.530 --> 06:44:49.450
Well it's actually still known by Moth.

06:44:49.450 --> 06:44:53.210
I just wanted to change the intro because they're gonna get pretty repetitive.

06:44:53.330 --> 06:44:55.250
I'm your host Jordan Wines.

06:44:55.390 --> 06:45:00.670
The game has been a little bit slower this hour but that makes sense because teams are starting to get into the harder challenges.

06:45:00.770 --> 06:45:04.470
As a reminder teams are currently working on two separate challenges.

06:45:04.510 --> 06:45:15.430
First the on-orbit challenge is it as it the on-orbit challenge involves them designing a payload that will execute a moonshot taking a picture of the moon from an actual orbiting satellite.

06:45:15.430 --> 06:45:20.550
While that challenge won't show up on the scoreboard with points it is a pass-fail challenge.

06:45:20.550 --> 06:45:29.070
Only teams that score within a time window will be eligible for podium placement and the related $50,000 $30,000 and $20,000 prizes.

06:45:29.510 --> 06:45:39.970
Since there's a lot of data being displayed on our octagon scoreboard otherwise known as that thing you're looking at when it's not my face on this YouTube feed here's a quick primer on some of the elements.

06:45:40.330 --> 06:45:52.910
First the display on the left shows a scoreboard breakdown that breaks down each team's points earned per challenge, shows the total score and includes a log of recent solves and messages sent from each team to their flat sat.

06:45:52.950 --> 06:45:59.290
Note that the message contents have actually been sanitized to not give away answers but you might find some other things there instead.

06:46:00.590 --> 06:46:05.990
On the right scoreboard you'll see the time of the teams you see the score of the teams over time.

06:46:06.030 --> 06:46:13.390
Right now it's skewed a little bit to the left but as the game progresses it will stretch out and we'll see how they do on each of these new challenges.

06:46:13.650 --> 06:46:19.750
Finally each team has a dedicated panel with a main view and three supplementary views.

06:46:19.870 --> 06:46:32.610
Technically we can change the supplementary views but right now the main view shows a team logo with their color, a representation of the team's flat sat including the rotation, position over the earth and messages sent.

06:46:32.610 --> 06:46:39.490
Note that the little pew-pew you see are just for visual effect and not actually representative of actual messages being sent.

06:46:39.810 --> 06:46:54.450
On the graph right now on the right, excuse me, the three graphs on the right, the top graph is yaw, the middle graph is angular velocity and the bottom graph is total messages all done over time which makes for a nice overview of the different activity from each team's flat sat.

06:46:54.630 --> 06:47:00.830
Remember you can vote to control which of these views you're looking at in the virtual environment inside of the Stardome.

06:47:00.850 --> 06:47:04.650
That feed doesn't cut over these live updates and always shows the Octagon.

06:47:05.170 --> 06:47:12.530
While we wait on our teams to continue to solve these challenges they're working on, now's a great time to introduce another segment we call Space Talk.

06:47:12.530 --> 06:47:20.190
If, like me, you're a hacker who might know about computers but is ignorant of what goes into making code run in space, there's a lot of new things to learn.

06:47:20.270 --> 06:47:24.750
Our first Space Talk episode is about how to keep track of time in space.

06:47:39.610 --> 06:47:41.990
So what time is it in space?

06:47:41.990 --> 06:47:44.630
Well that's a complicated question.

06:47:45.090 --> 06:47:52.910
For the astronauts on the International Space Station and for most orbiting satellites they run on Coordinated Universal Time or UTC.

06:47:53.230 --> 06:47:59.710
It's not actually a time zone but rather a time standard that just so happens to be the same as GMT.

06:47:59.710 --> 06:48:04.810
It's used to prevent time zone confusion and give a standard time to reference.

06:48:04.850 --> 06:48:08.730
But for astronauts especially it's just a number.

06:48:09.010 --> 06:48:18.450
On the International Space Station the Sun rises and sets about every 90 minutes so there isn't any relationship between the Sun and what time it is that's meaningful to the astronauts.

06:48:18.810 --> 06:48:20.350
Satellites are the same way.

06:48:20.350 --> 06:48:25.490
Time is primarily used to inform them when to execute commands and perform operations.

06:48:25.930 --> 06:48:31.790
Universal time is just a reference number that's easy to relate back to your local time.

06:48:31.790 --> 06:48:35.730
But that's not the only time that's used for space applications.

06:48:36.330 --> 06:48:48.290
UTC is not an exact accounting of the passage of time but rather strives to stay aligned with the rotation of the Earth because it's primarily people on Earth that are using it.

06:48:48.450 --> 06:48:53.930
Earth's rotation is both irregular in the short term and slowing down permanently in the long term.

06:48:53.930 --> 06:48:58.830
Earth days are getting about 1.6 milliseconds longer every single day.

06:48:58.830 --> 06:49:04.330
This isn't in any way noticeable in daily life but can be very significant over time.

06:49:04.330 --> 06:49:08.890
As a result we use a different time scale when dealing with orbital motion.

06:49:09.090 --> 06:49:12.250
Orbital motion doesn't care about the Earth's rotation at all.

06:49:12.250 --> 06:49:17.410
It must be extremely precise because of the massive distances involved.

06:49:17.410 --> 06:49:26.110
The most common time standards used are Julian date and terrestrial time which are both entirely independent of Earth's rotation.

06:49:26.110 --> 06:49:38.690
To give an idea of just how different these time scales can be, over the last century between 1900 and 2000, universal time was about 64 seconds slower than terrestrial time.

06:49:38.690 --> 06:49:46.750
It's a tiny difference to us but when you're dealing with precise predictions over millions of miles it gets very significant.

06:49:46.790 --> 06:49:47.850
And that's the key.

06:49:47.850 --> 06:49:55.250
What time it is in space isn't important so you can look at the clock on the wall and know if you need to go to bed.

06:49:55.250 --> 06:50:00.290
It's important so you can know where you are and know where things are.

06:50:00.350 --> 06:50:05.110
Everything in space is constantly moving, orbiting one object or another.

06:50:05.170 --> 06:50:09.350
Telling where it's located is intrinsically linked to what time it is.

06:50:09.350 --> 06:50:11.370
This gets to our next question.

06:50:11.490 --> 06:50:14.390
How do you tell where something is in space?

06:50:14.390 --> 06:50:19.610
As I said before, everything in space is constantly moving and orbiting around something else.

06:50:19.610 --> 06:50:22.490
All this motion is primarily controlled by gravity.

06:50:22.490 --> 06:50:32.010
So to know where something is right now, we use where it was at some time in the past and we predict where it is now based on the laws of gravitational motion.

06:50:32.010 --> 06:50:35.870
Now you might ask how do I tell you where it is or even where it was?

06:50:35.870 --> 06:50:46.730
On Earth I could tell you where to go based on your address or some landmark and these are useful frames of reference that we can use to fully communicate where something is.

06:50:46.730 --> 06:50:53.450
In space there are an infinite number of reference frames that we can use but we also have an added complexity.

06:50:53.450 --> 06:51:00.110
Since again everything is moving all the time, to have a frame of reference we need to incorporate time.

06:51:00.350 --> 06:51:06.130
There are several different ways of describing where things are but we typically focus on two reference frames.

06:51:06.350 --> 06:51:09.030
One, what's easiest for us to use.

06:51:09.030 --> 06:51:16.410
For example, if I want to take a photo of the moon I would want to know where the moon is in relation to where I'm going to be when I have my camera.

06:51:16.410 --> 06:51:19.650
And two, what's easiest to calculate.

06:51:19.650 --> 06:51:29.190
Orbital math is hard and many times impossible so picking a reference frame that makes your calculation as easy as possible is often necessary.

06:51:29.190 --> 06:51:36.570
This reference point is usually whatever has the most significant gravitational effect and ignores all other motion.

06:51:36.570 --> 06:51:38.290
For satellites we use Earth.

06:51:38.290 --> 06:51:41.530
We want to know where they are relative to our location on the Earth.

06:51:41.530 --> 06:51:49.890
This frame of reference is called Earth Centered Earth Fixed or ECEF as it is rotating with the Earth and is fixed to it.

06:51:49.890 --> 06:52:02.850
It's the same as GPS coordinates but it's much much easier to calculate the position of the satellite when we ignore the rotation of the Earth which is a different frame of reference called Earth Centered Inertial or ECI.

06:52:02.850 --> 06:52:19.610
So if I saw where a satellite was in relation to me in the ECEF frame at time t0 and I need to know where the satellite will be in relation to me in the ECEF frame at time t1, we actually need to calculate three different steps.

06:52:19.610 --> 06:52:27.230
One, translate the coordinates I observed at t0 in ECEF to ECI at t0.

06:52:27.230 --> 06:52:36.290
Two, translate the orbital motion of the satellite in ECI from t0 to t1 where our calculations are easier.

06:52:36.290 --> 06:52:44.150
And three, translate the coordinates I calculated at t1 back to ECEF from ECI.

06:52:44.150 --> 06:52:51.070
Steps one and three both require translating between these coordinate frames ECEF and ECI.

06:52:51.070 --> 06:52:53.050
So how do we do that translation?

06:52:53.050 --> 06:52:55.790
Here is where we now introduce the idea of an epoch.

06:52:55.790 --> 06:53:01.330
An epoch is a point in time that we use as a reference to translate between these types of frames.

06:53:01.330 --> 06:53:16.470
Specifically we use the J2000 or Julian date 2000 epoch to translate between ECEI and ECEF as we set the ECEI reference frame to be the same as the ECEF at that time.

06:53:16.470 --> 06:53:24.810
That way we can calculate the translation between them by calculating how much the earth has rotated since Julian date 2000.

06:53:24.810 --> 06:53:32.370
This is a simplification of the constant translation and calculation done throughout satellites, space technology, and astronomy.

06:53:32.370 --> 06:53:39.650
But that is why time and space are both extremely important and highly dependent on really what you're looking to do with them.

06:53:54.100 --> 06:53:56.840
Thanks to Jess Coffey for putting those videos together.

06:53:56.840 --> 06:53:58.900
That one was epic.

06:53:59.240 --> 06:54:09.160
Now this was going to be where I signed off for this update but as we were live PFS actually jumped up on the scoreboard yet again solving challenge 2.

06:54:09.160 --> 06:54:13.940
This means that we can now move on to exposing all teams to challenge 3.

06:54:14.880 --> 06:54:16.580
Challenge 3.

06:54:17.700 --> 06:54:19.220
Here's what we know.

06:54:19.220 --> 06:54:27.040
With the repair complete on the GNC the satellite has stopped spinning but we still can't communicate with the payload module or operate the imager.

06:54:27.040 --> 06:54:31.220
We have to ask ourselves what else did they damage on this satellite?

06:54:31.340 --> 06:54:32.380
The challenge?

06:54:32.380 --> 06:54:36.760
Teams must restore communication with the payload module so we can get it working again.

06:54:43.500 --> 06:54:46.000
This has been our last hourly update for the day.

06:54:46.000 --> 06:54:48.700
I'm looking forward to seeing everyone back here at 4 p.m.

06:54:48.700 --> 06:54:49.920
Pacific 7 p.m.

06:54:49.920 --> 06:54:53.260
Eastern for a daily recap of all that's happened so far.

08:57:22.420 --> 08:57:26.680
Welcome to Space Security Challenge 2020, HackASAP.

08:57:26.680 --> 08:57:37.520
The final event of the As the democratization of space opens up a new frontier for exploration and innovation, we see new cybersecurity vulnerabilities emerging.

08:57:38.460 --> 08:57:49.980
The Space Security Challenge is designed to inspire the world's top cybersecurity talent to develop the skills necessary to secure this last frontier of cybersecurity, space.

08:57:49.980 --> 08:57:53.180
And already we've made a ton of progress.

08:57:53.180 --> 08:57:54.580
I'll catch you up.

08:57:54.580 --> 08:58:04.280
This spring we hosted over 2,000 teams who worked their way through a set of foundational space cybersecurity challenges in our HackASAP qualification round.

08:58:04.280 --> 08:58:08.400
Now, eight finalist teams are stepping up to the ultimate challenge.

08:58:08.860 --> 08:58:11.900
They are hacking a satellite.

08:58:17.840 --> 08:58:23.440
Welcome to the first of two daily recaps for the Space Security Challenge 2020 or HackASAP.

08:58:23.440 --> 08:58:26.040
I'm still your host, Jordan Wines.

08:58:26.820 --> 08:58:34.400
As our eight teams have been vying for a share of a $100,000 prize pool, we're going to check in and summarize the status of the day.

08:58:34.400 --> 08:58:39.240
Of course, they also received $15,000 just to get here as a finalist.

08:58:39.300 --> 08:58:41.640
The competition for that was fierce.

08:58:41.660 --> 08:58:47.280
Our finalists beat out over 2,000 other teams made up of over 6,000 other competitors.

08:58:47.520 --> 08:58:58.860
Of course, the biggest prize of all might not even be the money or even the friends we made along the way, but the bragging rights for your code to be selected to take an actual photograph of the moon from a satellite in space.

08:58:59.000 --> 08:59:07.720
While this event was originally planned to be in person during DEF CON in the Aerospace Village, the global pandemic has caused us to reimagine the event experience.

08:59:07.720 --> 08:59:14.880
The result is an immersive 3D environment where you can stay up-to-date with the competition while learning all about space security and the event itself.

08:59:14.880 --> 08:59:19.240
You can connect with other spectators and even play games and add to our graffiti wall.

08:59:19.280 --> 08:59:26.240
So if you aren't already watching this from our immersive 3D environment, check it out at virtual.hackasat.com.

08:59:26.480 --> 08:59:33.720
As prior DEF CON attendees, some of you are very familiar with the many flavors of contests that test your hacking skills.

08:59:33.720 --> 08:59:36.620
But for others, we realize this is a whole new world.

08:59:36.620 --> 08:59:43.200
There are many types of hacking contests and Hackasat falls into the category of Capture the Flag or CTF.

08:59:46.140 --> 08:59:50.400
Remember the game you played as a kid with flags hitting an opponent's terrain?

08:59:50.400 --> 08:59:54.520
Now imagine the field or code and the flags are secret data.

08:59:54.520 --> 09:00:00.880
Players exploit security flaws to capture the flags while at the same time defending their networks from opposing teams.

09:00:00.880 --> 09:00:06.140
These Capture the Flag CTF events are as diverse as the teams that play them.

09:00:06.320 --> 09:00:10.620
This is a global competitive community with thousands of players and global rankings.

09:00:10.620 --> 09:00:15.440
It's been a part of the origin story for a great many prominent security experts.

09:00:15.440 --> 09:00:18.260
So what do these hacking games look like?

09:00:18.260 --> 09:00:24.000
CTFs can be either in-person or online and usually take place over a weekend or other short period.

09:00:24.000 --> 09:00:28.660
They often have a qualification round that determines who gets to participate in the finals.

09:00:28.660 --> 09:00:38.880
CTFs are sometimes themed around a specific domain like space for Hackasat, but more commonly they are not specialized and include a wide variety of different types of challenges.

09:00:38.880 --> 09:00:48.520
The most common types of CTFs include Jeopardy CTFs, sometimes called Red Team CTFs, are named for their use of the classic game board as a scoreboard.

09:00:48.520 --> 09:00:50.120
These are more offensive focused.

09:00:50.120 --> 09:00:58.460
Each team is given infrastructure to attack and the number of successful attacks, the difficulty, or the speed at which they succeed is factored into their score.

09:00:58.460 --> 09:01:05.280
Attack Defense, A slash D, or Full Spectrum CTFs, which are closer to the original game you might have played as a kid.

09:01:05.280 --> 09:01:11.960
Each team has a server or set of servers to defend and must attack other teams while also protecting their own infrastructure.

09:01:11.960 --> 09:01:20.080
Key of the Hill style CTFs are Full Spectrum CTFs, in which teams score points by gaining and maintaining control of individual systems.

09:01:20.160 --> 09:01:25.300
And finally, the less common Blue Team exercises, which are primarily defensive events.

09:01:25.300 --> 09:01:31.740
Game organizers host an environment and often a professional team of attackers to test the participants defensive skills.

09:01:31.740 --> 09:01:34.680
These are more common in the high school and collegiate level.

09:01:34.680 --> 09:01:35.940
How do you win?

09:01:35.980 --> 09:01:42.540
Even though the goal of the CTFs are to find and exploit vulnerabilities in computer systems, fair play is essential.

09:01:42.540 --> 09:01:48.140
There are lots of ways to win, but to get the respect of your peers, you need to have good technical solutions.

09:01:48.160 --> 09:01:55.080
Nobody is impressed if you use a network flood to knock the scoreboard offline, and those kinds of shenanigans will get you shunned quickly.

09:01:55.080 --> 09:02:02.960
The best CTF players have built specialized tools, practice within their domains, and include domain experts in many aspects of security.

09:02:03.700 --> 09:02:04.720
Why CTF?

09:02:04.720 --> 09:02:12.940
At their core, CTF challenges are a way for hackers to build community and demonstrate and hone their skills with other equally skilled people.

09:02:12.940 --> 09:02:20.660
Competitions are also a chance to experience the joy of learning about a new programming language or a new piece of technology hackers haven't used before.

09:02:20.660 --> 09:02:27.900
Capture the Flag challenges have also been used to help train cyber security teams and to get new hackers interested in security research.

09:02:27.900 --> 09:02:33.920
Some companies even use competitions similar to CTFs to recruit and vet potential candidates for employment.

09:02:33.920 --> 09:02:40.320
And CTFs have had real-world impact with competitors finding actual security flaws in contest infrastructure.

09:02:40.320 --> 09:02:46.160
Their solutions, while not counting towards winning the game, are often implemented in a real-world context.

09:02:46.280 --> 09:02:57.960
With HackASat, we have a CTF game designed to raise awareness about cyber security issues in space and help researchers develop specific skills and domain knowledge they'll need to help secure this new frontier.

09:02:58.220 --> 09:03:05.140
But as many of the players during our quals round found out, there are a lot of problems unique to the environments outside our atmosphere.

09:03:05.140 --> 09:03:12.260
To learn more about hacking in space, check out our space talk videos that explain some of the most interesting space-specific challenges.

09:03:13.480 --> 09:03:21.420
For more on CTFs and other hacking and space related topics, go to the research room in the virtual environment or check out the related YouTube playlist.

09:03:21.820 --> 09:03:25.500
Okay, let's go ahead and recap the whole day so far.

09:03:31.340 --> 09:03:41.500
The game has actually been underway for one hour now and our team's first challenge has been to regain control of the ground station that they'll be using to communicate with their Flatsats.

09:03:41.500 --> 09:03:49.180
In fact, just before this broadcast went live, we received word that this challenge was actually solved by Team Samurai.

09:03:49.400 --> 09:03:50.760
Congratulations to them!

09:03:50.760 --> 09:03:57.360
Right after our last update ended with only a Samurai solve, several other teams came in with solutions for Challenge Zero.

09:03:57.500 --> 09:04:02.100
PFS and Solarwine were solvers 2 and 3 on that challenge.

09:04:02.420 --> 09:04:08.860
After those two teams scored on Challenge Zero, every other team was eventually able to solve Challenge Zero over the next several hours.

09:04:08.860 --> 09:04:13.160
Taking a look at the scoreboard so far, we've had an eventful last hour.

09:04:13.160 --> 09:04:17.540
Our teams continue to make progress with four teams now having solved Challenge One.

09:04:17.620 --> 09:04:24.620
Unfortunately, the window of time after first solve has expired and the remaining four teams were given a solution with no points.

09:04:24.660 --> 09:04:32.700
PFS and Colon Can Into Space were joined by 1553 and 1064 Seabred with solutions for Challenge One.

09:04:32.820 --> 09:04:42.780
Now this was going to be where I signed off with this update, but as we were live, PFS actually jumped up on the scoreboard yet again, solving Challenge Two.

09:04:48.330 --> 09:04:52.250
You may have noticed that first blood overlay and sound effect in that summary.

09:04:52.250 --> 09:05:02.730
While it was originally used in Unreal Tournament to indicate a kill , the phrase and even sometimes the sound effects are often used in CTF competitions to indicate the first team to solve a particular challenge.

09:05:03.810 --> 09:05:21.490
The challenges that teams have solved so far include a Challenge Zero, which required exploiting an insecure web application to steal credentials for the ground station controller, and then using that Cosmos ground station, the teams had to restore communication with their flatsats as they were tumbling and not communicating well.

09:05:21.730 --> 09:05:32.450
The Challenge One involved connecting to the satellites, connecting to the ground station, turning up the power, turning down the bandwidth, which is very much a real-world troubleshooting step.

09:05:32.610 --> 09:05:40.670
Next, the teams have to restore proper orientation control over their flatsat, but only one team so far has managed to accomplish this feat.

09:05:40.670 --> 09:05:44.570
That brings us to what's happened in the last two hours of the competition.

09:05:44.590 --> 09:05:47.470
Most teams are now working on two or three challenges.

09:05:47.630 --> 09:05:51.230
The on-orbit challenge, Challenge Two, and Challenge Three.

09:05:53.450 --> 09:05:58.470
PFS has been pulling away to a healthy lead that is going to be hard to catch up to tomorrow.

09:05:58.470 --> 09:06:00.950
Hard, but definitely not impossible.

09:06:01.330 --> 09:06:07.650
All it takes is for them to get stuck in a problem and be passed in turn, much like they did to Samurai at the start of the game.

09:06:08.550 --> 09:06:19.990
It's also interesting to note that PFS, which is actually short for Pwn First Search, and Pulling Can Into Space, are number one and number two on the leaderboard, are two of the smallest teams in the competition.

09:06:20.370 --> 09:06:29.150
Having a large team is sometimes an advantage, but it definitely comes with logistical issues, and in this case, where the challenges are serial in nature, it isn't always helpful.

09:06:29.510 --> 09:06:33.810
Let's take a look again at the PFS team bio.

09:07:02.340 --> 09:07:08.380
If you were here with us live, you might remember that right in the middle of teams working on their challenges at around 12 p.m.

09:07:08.380 --> 09:07:13.900
Pacific, all teams had to stop what they were doing and shift focus to the on-orbit challenge.

09:07:15.060 --> 09:07:18.080
Stop everything and look up.

09:07:18.280 --> 09:07:21.600
Starting now, teams shift to the on-orbit challenge.

09:07:21.840 --> 09:07:26.280
Their primary goal is to capture a picture of the moon using the satellite.

09:07:26.880 --> 09:07:32.660
Competitors will have access to the two-line element of the vehicle and the camera's foresight vector.

09:07:33.080 --> 09:07:40.300
Each team is tasked with creating a mission plan that transitions a satellite from a tumbling state to one where it points the camera at the moon.

09:07:40.940 --> 09:07:46.380
The team will reach a successful status once the resulting mission plan meets key criteria.

09:07:46.800 --> 09:07:52.020
One, the commands are generated in the correct order and are within the specified period.

09:07:52.200 --> 09:07:56.980
Two, the image capture angle of the moon is within specifications.

09:07:57.540 --> 09:08:05.840
Three, the team's negative z-axis is pointed as close to the Earth's center as possible without affecting the camera to moon pointing error.

09:08:06.200 --> 09:08:11.480
The teams are given a command dictionary with the format for submitting the commands and parameters.

09:08:11.540 --> 09:08:13.800
The rest is up to them.

09:08:16.720 --> 09:08:24.760
Of course, while PFS is currently in the lead, they still have a critical problem to solve, specifically, the on-orbit challenge.

09:08:24.860 --> 09:08:36.020
While Poland can into space is only nipping at their heels at number two on the scoreboard, they are critically not only the first team with an attempted solution to their on-orbit challenge, but the first with an accepted solution.

09:08:36.340 --> 09:08:49.920
That would mean that they would be able to pass PFS if PFS is not able to actually solve because, again, that is a pass-fail challenge and it will be critical to see what happens in the last few minutes of gameplay today as well as tomorrow in the on-orbit challenge.

09:08:50.180 --> 09:09:05.800
Now that the day is wrapping up, hopefully some of the organizers have a little bit more time, so we're going to see if we can bring into video chat Vito Genovese, who many of you may recognize from his time as a member of LegitBS, the team that organized the DEF CON CTF for five years prior to the current organizers,

09:09:05.800 --> 09:09:07.040
the Order of the Overflow.

09:09:07.280 --> 09:09:12.440
Vito is also currently with Chromulence, the creators of the flatsats and many of the challenges in Hackasat.

09:09:12.660 --> 09:09:13.840
Vito, can you hear me?

09:09:13.840 --> 09:09:14.440
Are you there?

09:09:15.180 --> 09:09:16.140
Yes, loud and clear.

09:09:16.140 --> 09:09:16.840
Good evening.

09:09:17.040 --> 09:09:17.560
Excellent.

09:09:17.560 --> 09:09:18.480
Glad we got you.

09:09:18.480 --> 09:09:19.200
Thanks for stopping by.

09:09:19.200 --> 09:09:23.840
I know you guys have been very, very busy kind of manning the systems and talking to the teams.

09:09:23.860 --> 09:09:25.740
How's the game going so far?

09:09:26.420 --> 09:09:27.560
It's been going.

09:09:27.680 --> 09:09:30.060
We've kind of had some, you know, rough times today.

09:09:30.060 --> 09:09:34.200
The flatsats are, you know, small run hardware, which always has issues.

09:09:34.200 --> 09:09:41.340
But we're super, super thankful the teams are being patient with us, and they're putting up a good fight and making really, really good progress in the game.

09:09:41.620 --> 09:09:45.640
So tomorrow we're hoping for... Sorry, is this pacing what you expected?

09:09:45.640 --> 09:09:51.380
Speaking of like how they're kind of doing, is this about where you thought they would be, or you wanted them to be, or how does this fit with your expectations?

09:09:52.180 --> 09:09:55.140
It's really hard to set expectations for these games.

09:09:55.140 --> 09:09:57.700
A lot of it is, you know, throwing, you know, stuff around.

09:09:57.700 --> 09:10:00.760
We can't even be in the same room doodling on a whiteboard while we do it.

09:10:01.100 --> 09:10:07.600
So, you know, the expectations are not necessarily what's been happening, but we'll survive.

09:10:07.600 --> 09:10:12.220
It's a difficult game and, you know, we'll see what happens tomorrow.

09:10:12.500 --> 09:10:17.900
And I mean, it does seem like that if they're made good progress up to here, they could have been a lot further behind.

09:10:17.900 --> 09:10:21.700
It would be nice to see them maybe a challenge ahead, but this is certainly within reach, right?

09:10:21.700 --> 09:10:24.680
Like there's nothing kind of too crazy about what they have remaining.

09:10:24.840 --> 09:10:25.580
This could be doable.

09:10:25.580 --> 09:10:28.660
We know these are good teams that are capable of more, it seems like, right?

09:10:29.600 --> 09:10:30.860
Right, yeah, absolutely.

09:10:31.260 --> 09:10:35.040
The, you know, challenges zero, challenges one, they're hard challenges.

09:10:35.080 --> 09:10:38.060
And the teams that took time on them, they still took time on them.

09:10:38.060 --> 09:10:40.360
They did make progress and they did get through eventually.

09:10:40.800 --> 09:10:45.640
It's, you know, admirable work and it's, you know, it's great to see everybody involved.

09:10:46.000 --> 09:10:50.880
Now, do you miss actually being in Vegas and going to DEF CON or you actually kind of prefer being remote?

09:10:50.880 --> 09:10:52.540
What's your take on that?

09:10:52.840 --> 09:10:54.460
Oh, I absolutely miss it.

09:10:54.600 --> 09:11:00.020
You know, my favorite restaurant in Vegas, I miss, or my favorite restaurants plural in Vegas, I miss that.

09:11:00.020 --> 09:11:01.240
I miss seeing my friends.

09:11:01.240 --> 09:11:05.600
I miss wearing my, you know, special DEF CON shoes, which are behind me on the shelf.

09:11:05.600 --> 09:11:12.100
They're not in frame yet, but, you know, it's better than getting really, really sick, I guess.

09:11:12.740 --> 09:11:17.100
Given the alternative, yeah, we're all kind of doing what we can and should there.

09:11:17.100 --> 09:11:25.120
In fact, even you were originally supposed to be on stream with me and we just thought for safety reasons that we would do this via Zoom and we'd be able to work it out that way.

09:11:25.120 --> 09:11:27.620
So thanks for doing that.

09:11:27.620 --> 09:11:31.880
Tell me a little bit more about the rationale behind the scoring algorithm and the game design.

09:11:31.880 --> 09:11:38.160
This decay and the kind of the grace window, what design constraints went into that decision?

09:11:38.720 --> 09:11:43.300
Okay, so the main design constraint with this is it's a very linear capture-the-flag game.

09:11:44.360 --> 09:11:52.320
So what has to happen is we're trying to get teams to take over this or regain control of this, you know, tumbling satellite lost in space.

09:11:52.320 --> 09:11:54.760
And that is a complicated operation.

09:11:55.040 --> 09:12:03.280
And instead of just having, you know, one single, you know, you get this chunk of points if you win the game, we split it up into different little gates that teams have to pass through.

09:12:03.420 --> 09:12:08.980
So, you know, challenge zero or the first gate is getting control of a machine in the ground station.

09:12:09.080 --> 09:12:13.540
Challenge one after that is being able to actually talk and receive messages with the satellite.

09:12:13.560 --> 09:12:19.200
So we had to split this up in order to keep, you know, make the game actually have points before you get to the end.

09:12:19.780 --> 09:12:28.820
And at the same time, in order to make the points actually meaningful, we wanted to make sure there is some time pressure for teams to go quickly and make progress throughout the whole weekend.

09:12:28.940 --> 09:12:31.660
So we have this kind of decay system implemented.

09:12:31.860 --> 09:12:35.020
So each challenge is worth a fixed number of points at the beginning.

09:12:35.240 --> 09:12:39.840
And as soon as the team solves it the first time, the clock starts ticking.

09:12:39.840 --> 09:12:45.440
So within that first 30 minutes, anybody else who solves that challenge is also going to get the full points.

09:12:45.440 --> 09:12:47.220
For challenge zero, that would be 50 points.

09:12:47.220 --> 09:12:50.940
For challenge two or for challenge one, that was 200 points.

09:12:51.340 --> 09:12:59.760
Beyond that, after that first 30 minutes, we have another two-hour interval where that point amount starts gradually ticking down towards zero.

09:12:59.860 --> 09:13:02.500
Once it's hit zero, we don't award points for it.

09:13:02.500 --> 09:13:07.700
And at that point, it also means that we share hints to, you know, nudge teams along to get them to the next phase of the competition.

09:13:08.440 --> 09:13:19.480
And that's one of the advantages, I think, is that, you know, that a team, if they happen to get stuck on one particular problem in a serial event in particular, there's just not much you can do in fairness to the other teams in terms of, you know, kind of,

09:13:19.480 --> 09:13:23.120
you don't want to give a team a hint just because they're behind, because that actually hurts them.

09:13:23.120 --> 09:13:29.060
But by having the score drop off at a point which they have to be done or else they're just given a hint, well, then they've lost all the points for it.

09:13:29.060 --> 09:13:32.840
And so it keeps them up with the game while not punishing the teams that do well.

09:13:32.840 --> 09:13:34.380
So that makes a lot of sense.

09:13:34.380 --> 09:13:37.420
If you had a favorite challenge, what's the number?

09:13:37.420 --> 09:13:41.600
And if it's one we haven't seen yet, like, no spoilers, of course, but what do you like best?

09:13:42.040 --> 09:13:49.420
So it's honestly, for me, it's probably challenge one, which is kind of where the game starts to diverge from a normal capture the flag contest.

09:13:49.500 --> 09:13:54.320
With challenge zero, we had a web app that teams had to, I think, determine a cookie secret in.

09:13:54.580 --> 09:13:55.460
And that's very...

09:13:58.460 --> 09:14:00.800
Nudge one is where we start to diverge.

09:14:00.960 --> 09:14:17.280
That's where we have to, once we've gotten into the ground station and are able to talk to the satellite control system, Cosmos, that's where teams have to figure out how to turn telemetry on on the satellite, because it's not just another machine on the network with an IP address.

09:14:17.280 --> 09:14:27.080
And where teams have to figure out how to tell the satellite's radio to configure itself in a way that it's actually functional for the rest of the game, for sending messages back and forth.

09:14:27.080 --> 09:14:35.860
I saw a great quote go over the team communication channel from the organizers that said, these are not like traditional network devices.

09:14:35.860 --> 09:14:52.860
And if you think sending two requests a second will get you more reliability the way you would in a normal network, that may be counterproductive here, which I thought was a great kind of nod towards the, yeah, there's some different constraints and different concerns that maybe are not the folks' first instincts are accurate on,

09:14:52.860 --> 09:14:53.860
given the environment.

09:14:53.860 --> 09:14:55.320
So that makes a lot of sense.

09:14:55.800 --> 09:14:56.920
Yeah, absolutely.

09:14:56.920 --> 09:15:01.020
It's a satellite is, in some senses, it is still a computer.

09:15:01.020 --> 09:15:06.240
But the problem is, is it's a computer that costs millions and millions of dollars to, you know, install.

09:15:06.300 --> 09:15:07.840
And it costs, you know, billions of...

09:15:09.600 --> 09:15:12.380
No, I think we might have lost you a little bit there for some network.

09:15:12.380 --> 09:15:13.060
Oh, you're back now.

09:15:13.060 --> 09:15:13.620
Go ahead.

09:15:13.820 --> 09:15:14.020
Yeah.

09:15:14.020 --> 09:15:14.580
OK.

09:15:14.680 --> 09:15:15.000
Yeah.

09:15:15.000 --> 09:15:18.580
It costs, you know, millions to put it in place in the first place.

09:15:18.580 --> 09:15:22.080
And it costs billions to send somebody up there to push a button to restart it.

09:15:22.680 --> 09:15:26.240
Beyond that, it's, you know, a computer that you only talk to on RF.

09:15:26.260 --> 09:15:30.900
And it's moving in a way that whatever you can see it, you can probably talk to it.

09:15:30.900 --> 09:15:34.620
But there's a lot of time from any given ground station where you can't see it at all.

09:15:34.960 --> 09:15:37.280
And that's a very unique challenge.

09:15:38.320 --> 09:15:43.060
Vito, thank you very much for both your work on the game and for taking some time to talk to us tonight.

09:15:43.060 --> 09:15:45.080
Look forward to seeing how the teams do tomorrow.

09:15:45.260 --> 09:15:49.140
I look forward to talking to some more as we see their progress.

09:15:50.100 --> 09:15:50.600
Excellent.

09:15:50.600 --> 09:15:50.940
Thanks.

09:15:50.940 --> 09:15:51.640
Take care.

09:15:51.940 --> 09:15:52.540
Take care.

09:15:53.780 --> 09:15:59.060
That's it for this first day of the Space Security Challenge 2020 HackASet final event.

09:15:59.140 --> 09:16:03.400
Overnight, we'll be taking our FlatSats offline so they can get a good rest, a.k.a.

09:16:03.400 --> 09:16:08.380
have their batteries charged, and so the competition organizers can recharge their batteries, a.k.a.

09:16:08.380 --> 09:16:09.800
have a good night's rest.

09:16:09.840 --> 09:16:17.460
Of course, in addition to sleep, the teams will need to continue working on some of the components in between game shutdown and game start tomorrow morning at 7 a.m.

09:16:17.460 --> 09:16:18.540
Pacific and 10 a.m.

09:16:18.540 --> 09:16:19.240
Eastern.

09:16:19.240 --> 09:16:23.940
They've actually been given a firmware image that will help them for the upcoming Challenge 3.

09:16:24.600 --> 09:16:26.320
Thanks for spending your day with us.

09:16:26.320 --> 09:16:32.200
Make sure to check out the rest of what's happening at DEFCON, the Aerospace Village and our Aerospace Workshops.

09:16:32.200 --> 09:16:35.140
And I look forward to seeing you all tomorrow morning at 9 a.m.

09:16:35.140 --> 09:16:36.120
Pacific, 12 p.m.

09:16:36.120 --> 09:16:37.860
Eastern for our next game update.