So, let's get started.
♪♫♪
Welcome to Space Security Challenge 2020, HackASAT, the final event. As the democratization
of space opens up a new frontier for exploration and innovation, we see new cybersecurity vulnerabilities
emerging. The Space Security Challenge is designed to inspire the world's top cybersecurity talent
to develop the skills necessary to secure this last frontier of cybersecurity,
space. And already we've made a ton of progress. I'll catch you up. This spring we hosted over
2,000 teams who worked their way through a set of foundational space cybersecurity challenges
in our HackASAT qualification round. Now eight finalist teams are stepping up to
the ultimate challenge. They are hacking a satellite. Welcome back to the second and
final day of the competition portion of HackASAT. Are you excited? As always,
I'm your host Jordan Wines. First, a quick recap of the game to this point.
The game has actually been underway for one hour now, and our team's first challenge has been to
regain control of the ground station that they'll be using to communicate with their FlatSats. In
fact, just before this broadcast went live, we received word that this challenge was actually
solved by Team Samurai. Congratulations to them. Right after our last update ended with only a
Samurai solve, several other teams came in with solutions for Challenge Zero. PFS and SolarWine
were solvers two and three on that challenge. After those two teams scored on Challenge Zero,
every other team was eventually able to solve Challenge Zero over the next several hours.
Taking a look at the scoreboard so far, we've had an eventful last hour. Our teams continue to make
progress with four teams now having solved Challenge One. Unfortunately, the window of
time after first solve has expired, and the remaining four teams were given the solution
with no points. PFS and Colon Can Into Space were joined by 1553 and 1064 Seabred with solutions for
Challenge One. Now, this was going to be where I signed off for this update, but as we were live,
PFS actually jumped up on the scoreboard yet again, solving Challenge Two. Most teams are now
working on two or three challenges. The On-Orbit Challenge, Challenge Two, and Challenge Three. PFS
has been pulling away to a healthy lead. They still have a critical problem to solve, specifically
the On-Orbit Challenge. While Colon Can Into Space is only nipping at their heels at number two on
the scoreboard, they are critically not only the first team with an attempted solution to the
On-Orbit Challenge, but the first with an accepted solution. That would mean that they would be able
to pass PFS if PFS is not able to actually solve, because again, that is a pass-fail challenge.
Yesterday, our teams collectively worked their way through Challenges Zero through Two, leaving
with half of the challenges solved by at least one team, and three challenges remaining to be
solved today. PFS grew their lead throughout the day yesterday, but the biggest drama occurred
after hours. When the 4 p.m. Pacific deadline for the On-Orbit Challenge passed, only four teams
had submitted solutions deemed acceptable. What's an acceptable solution? Let's take a look at
solving the On-Orbit Challenge. First, some terms you'll want to know. Two-Line Element Set, or TLE.
A data format containing information about an object's position and velocity at a specific
point in time. It is used to calculate where a satellite will be at some point in the future,
with increasing uncertainty the further out in time. Window of Opportunity. The period of time
during which the satellite can be positioned to complete the desired goal. Vector. A line
indicating a specific direction in magnitude. A satellite will have assigned X, Y, and Z vectors
associated with the body of the vehicle that can be used in a coordinate system. Camera Boresight,
Camera Mounting Position, and Camera Body Vector all describe the satellite camera and where it's
pointed. Quaternion. A number system that is handy for calculating 3D rotations. Got it? Here we go.
The first step in solving the On-Orbit Challenge. Identify the key data. The TLE, Camera Mounting
Position, Target, and Window of Opportunity are all supplied in the Challenge Description or the
On-Orbit Handbook. The data is used to calculate the orbit of both the satellite and the moon
toward the Window of Opportunity. And don't forget to grab the Camera Body Vector, which will be
needed later. The second step. Calculate the time of image by defining the relationship between these
key vectors. 1. Determine the satellite-to-moon vector, which points directly from the satellite
towards the moon. 2. Determine the nadir vector, which points directly from the satellite towards
the center of the earth. 3. Determine the angle between 1. The satellite-to-moon vector and the
nadir vector and 2. The angle between the satellite negative Z vector and the Camera Body Vector.
The instance when the difference between the two angles is minimized gives us the time of image,
the moment along its orbit when the satellite will be in position to take our all-important
moon shot. The third step. Calculate the attitude or the position within its orbit that the satellite
must take for the camera to capture the image. This is accomplished by lots of math. Specifically,
something called a Direction Cosine Matrix, DCM, or Rotation Matrix. The DCM calculates a satellite
attitude that points 1. The camera boresight to the moon and 2. The satellite's negative Z vector
to earth's center, which is the attitude needed to accomplish the goal. The DCM supplies us with a
specific quaternion which, when uploaded and applied to the satellite's Attitude Determination
and Control System, ADCS, moves the satellite into the desired position. On to the final step.
Apply all that information and get the image we're after. We take the time of image and back
out the commands around it, giving the satellite enough time to apply the quaternion and be in
position when it arrives at the window of opportunity. The proper order of commands
would be as follows. Turn on the ADCS, slew to the commanded quaternion, turn the camera on,
set the exposure time, capture the image, and finally, turn the camera off. That's it.
Challenge accomplished. But what does all of this have to do with hacking and keeping our
satellites secure? The on-orbit challenge was completed with full trust. Our satellites rely
on data and sensors from multiple sources in order to complete an objective. The TLE that
was provided relied on data from the satellite and ground stations. Authenticated communications
were required to upload the proper command sequence. Trusted execution was required to
process sensor and actuator data to close control loops. Secure on-board communications
were required to carry out operations in orbit. We need security-focused people to help with these
problems because just as much as it takes a team of people to strap explosives to a computer to
get a satellite into orbit, it takes a team of people from both space and security communities
to ensure that space remains a viable, usable resource.
The four teams with successful on-orbit solutions during the time period were Poland Cannon to
Space. In fact, theirs came well over an hour before anyone else's. ADD Vulcan, Flux Rocket
Repeat, and Samurai all came in within about 10 minutes of each other within the last 15 minutes
of that window. Remember, the on-orbit portion involves a team computing a mission plan for an
actual satellite to take a picture of the moon. All acceptable solutions were evaluated, and the
most accurate solution submitted before the 4 p.m. deadline will be chosen to be sent into space
into our orbiting satellite. We'll learn whose solution that was amongst those four later on
today. As we entered into our overtime period after the 4 p.m. deadline yesterday, the alternate
acceptance criteria kicked into play. Well, the four teams submitting before 4 p.m. were automatically
eligible for their solution to be sent and automatically in to prize eligibility. We had
to get more teams available. The limit was six. This meant that two teams of the remaining four
would be out of contention for the final prize pool. The four teams fighting for those two spots
included PFS, 1553, 1064 Seabred, and Solarwine. 1553 managed to submit a solution that was valid
only three minutes after the deadline, quickly grabbing that fifth spot. That left PFS, 1064
Seabred, and Solarwine on the ropes for that last spot. PFS and 1064 Seabred were number one and
number four on the scoreboard at that point, so no matter what happened, someone in contention for the
podium would not be eligible. All of the contest organizers were on a shared video chat waiting to
see the results as they came in. 1064 Seabred had what looked to be an extremely close solution that
was just outside the acceptance criteria, and PFS didn't seem to be close. Then at 7 48 p.m eastern
or 4 48 p.m pacific, PFS came in with a valid solution just edging out 1064 Seabred and Solarwine
on the list of on-orbit acceptance. Unfortunately, that means that 1064 Seabred and Solarwine are both
ineligible for a spot on the podium. That said, they can still have an impact on the game.
Either team scoring first blood will potentially change the number of available points left on the
board for the competitors and impact the final result. It's sad to see two great teams out of
contention for the prize pool, but they can still end up on the leaderboard from a points perspective
and attain the associated bragging rights. In fact, let's go ahead and take a look at the
scoreboard now in our live octagon feed. And they definitely haven't slowed down. You'll notice that
Solarwine actually scored first blood on challenge three. Congratulations to them for the great work
overnight. The pressure is now on the remaining teams to show that they can make they made good
use of the downtime as well to land challenge three. You can also see Flux Repeat Rocket
scoring just before this broadcast with only a five percent reduction in total points. So that's
a good amount of points for them. That means Solarwine and Flux Repeat Rocket are both moving
on to challenge four. Challenge four. Here's what we know. We've restored communication with the
payload module, but we still can't operate it. The challenge? Now teams must restore normal
operations of the payload module so we can access the imager. This is the first time we've seen
Flux Repeat Rocket make a big move on the scoreboard. Let's check out their team bio.
Like many of the combined CTF teams that we've seen here today,
I have good memories of playing HackLoo CTF. In fact, it's often the case that the competition
participants are also organizers in other times. So one of those teams that makes up the composition
of Flux Repeat Rocket, FluxFingers, runs HackLoo, which is another great CTF competition you should
check out. What an exciting first day. I'm looking forward to seeing what happens today as our teams
battle through these last few challenges. Come back and join us at our 10 50 a.m pacific 1 50 p.m
eastern for our next competition update.
So
Welcome back to Space Security Challenge 2020, or Math-A-Sat, as one of our competitors
fondly called it. At least, we hope it was fondly. Anyway, I'm your host, Jordan Wines.
It's been a quiet few hours since our last update, with, I think, no changes on the scoreboard.
However, the teams have surprised us in the past, scoring in the middle of updates. So
let's actually take a quick look at the scoreboard now to confirm that. If we look at the octagon,
it does indeed look like our teams are scoring the same. Our last two solves with Solarwine
and Flux Repeat Rocket in Challenge 3. So we're still looking at Challenge 4 and 5 for the rest
of the day. While the score hasn't changed, we have had one important game milestone pass us
by. We timed out unavailable points for Challenge 3. That means those two teams, Solarwine and Flux
Repeat Rocket, they've obtained points for that challenge, and all other teams were given a
solution script so they can focus on the next challenge. But before we move on to our explainer
video for Challenge 3, we actually missed getting you the full explanation for Challenge 2 during
our last update. So let's start with that. Challenge 2. The satellite is spinning out of
control because the Attitude Determination and Control System, ADCS, has been manipulated.
We suspect sabotage. The challenge? Teams must repair the ADCS system as quickly as possible
to stop the dangerous spinning. Here's how they do it. Teams may first search the provided
documentation for the appropriate command to reset the ADCS. They find it and execute it. But
the reset does not work. The ADCS system begins communicating again, but it is not functioning
properly. Teams discover that the ADCS configuration tables have been altered and must be restored.
They have to find the nominal parameters for the configuration tables from the provided user
documentation. The teams then have to upload a new table to the vehicle and command the ADCS to
load the table. This is how they will restore nominal operation of the ADCS. Good news! With the
ADCS configuration table updated, they receive nominal status from the ADCS, but the majority
of the ADCS commands still don't work. Teams realize that they can point the satellite by
uploading various ADCS configuration tables, each with different pointing modes and configuration
parameters, and loading them at different points in the orbit of the satellite. This allows the
teams to stop the spin of the vehicle and point the solar arrays at the sun to charge the batteries.
All right, now that we're caught up, here's a little bit more about the intended solution to
Challenge 3. Challenge 3. Here's what we know. With the update to the ADCS, the teams have regained
control of the satellite, but we still can't communicate with the payload module or operate
the imager. In addition, the majority of useful commands are not being accepted by the flight
software. We have to ask ourselves, what else did they damage on this satellite? The challenge? Teams
must restore communication with the payload module so we can get it working again. Here's how they do
it. The teams find that their initial commands to communicate with the payload module are not being
accepted by the flight software. It's clear that the command and data handling C and DH system is
not working appropriately. In fact, payload commands and the majority of the other commands have been
disabled in the C and DH system. It turns out the attacker has modified the C and DH flight software
and are now running their own code on board the space vehicle. The attacker code is rejecting the
majority of commands to the satellite, including firmware updates, firmware restore, and ADCS
commands. As a result, it is not possible to restore the failsafe image as the restore command has been
disabled. Lucky for the teams, the attacker was sloppy and inadvertently introduced a vulnerability
in the new firmware image. Teams exploit this vulnerability and use it to repair the system
and restore the C and DH software back to normal operation. Once that is complete, they are able to
communicate with the payload module once again. Challenge 3 happens to be my personal favorite,
as it, along with challenge 0, are probably the most similar to regular CTF challenges. I always
love a good pwnable. Since we have some time in this update, I want to introduce a new graphic
to you that we call the Race to Space. This will be a visualization we'll be using later on today
to measure the team's on-orbit submissions. The closer to the center of the bullseye,
the more accurate the solution. And, of course, the minimum acceptance bar will let us see the
solutions that were not accurate enough to be accepted. Each team gets their own little slice
of the pie, and we'll be able to see how many tries it took to become accepted and or how
accurate teams got. You may remember that we have four teams that all submitted
accepted solutions before the 4 p.m pacific cutoff yesterday. They were Poland Cannon to Space ahead
of the pack, and then ADD Vulcan, Flux Repeat Rocket, and finally Samurai. Speaking of ADD Vulcan,
we haven't yet had a chance to show off their biography, so let's check them out now
in recognition of them being the second accepted solution to the on-orbit challenge.
So
apparently the real reason ADD Vulcan is participating in HackASAT was just as an
excuse to make pink Starfleet uniforms. Go check out their Twitter team Twitter account for more
info on that. Also, one of the main team members, Amy Dede, was on the recent tv show Lego Masters
and also hosts an awesome STEM for Girls scholarship. That's it for this competition
update. I'll see you back here in one hour at 11 50 a.m pacific, 2 50 p.m eastern.
Welcome back to Space Security Challenge 2020, the final frontier. I'm your captain, Jordan.
I'm actually not anybody's captain, but I can play one on YouTube. With no game changes to report on
in the last hour, and the game infrastructure cooled down to a less-than-molten state as things
are a steady state, we're going to bring in some of the game organizers to talk a little bit more
about the behind-the-scenes and the game infrastructure. We were going to call this
segment Between Two Jasons because we've got Jason Williams and Jason Latimer of Cromulence
on the video chat, but I don't think you all need to see my face. So, Jasons, can you hear me?
Yeah, I can hear you. Excellent. All right, that was Latimer on the right and we got Jason Williams
on the left. Thanks for joining me, first of all. I appreciate it. You guys have been pretty busy,
I know, the last few days and, of course, even before that as well. Just first general impressions,
how are you feeling right now about how everything's going?
I think everything's going really well. Sorry. All right, I'll direct into one of you specifically,
so I don't make you talk over yourself. Latimer, how do you think this... are you happy right now
with things? How are you feeling? I'm happy. We've had a little bit of a lull as teams have
been working on challenge three and four, which are the harder challenges from the hacking
perspective. So, we're kind of sitting back and watching and it's going pretty well today,
for sure. One of my other questions for you each, and we'll stick with Latimer since you're going,
was what is your favorite challenge then? I think three was probably mine. Do you have a favorite,
either one you worked on or one you didn't? And if it's a later one, no spoilers, of course, but
feel free to tell us which one you like best. Yeah, I really like three a lot and I was super
excited. You know, we gave the team something to work on overnight and to come back in this morning
and have a couple solves right away, that was awesome. Challenge four is going to be a challenge,
so I'm hoping that we get some teams that actually solve that this afternoon. We're going to, you
know, looking at when we give, you know, a hint or two coming up. But yeah, I like four. I think
you guys described to me that four was probably, would you say, the hardest overall of all the
challenges. That was kind of the impression I got from talking to the folks that made them all. So,
this is like, this is going to be important too. And certainly for the score in the game,
a lot could happen in these last two solves. And so, this is going to be a big moment.
All right, so Jason Williams, same to you. Do you have a favorite challenge? Yeah, I think it's,
for me, it's going to be challenge four without trying to give too much away. As you know,
we think this is the hardest challenge in the game and it exercises a lot of skills that the
teams are going to need to use in order for them to solve this challenge. So, I'm really excited to
see where they go with it. And hopefully in the next hour or two, we get a solve on this one.
Awesome. Now, I think you each may have some components of some of these flat sets that we
can see kind of up close and maybe talk a little bit more. Jason Williams, what you, just before
we went live, you were showing me one of the boards that you had there. Do you want to go
ahead and talk about that a little bit? Yeah. So, on the flat set, we have our own hardware
that we designed. And it's actually, I'll try to show it to you if you guys can see it here.
It consists of a carrier board followed by two boards on top of it. One of them is a ZX board,
which has on it an FPGA, an Artec 7 FPGA, which runs two soft core processors. Then the other
one at the bottom here is the Raspberry Pi Zero. And this one is running the payload module.
Yes. Yep. And so here you can see the ZX board and on there is actually two soft core processors,
MSP430, which we use for running the radio baseband, and then a Leon 3 processor from
Geissler, which Jason can talk more about that runs our flight software. Well, before we go Jason,
that MSP430 soft core FPGA sounds a little familiar to me. I think I see something behind
your shoulder. Was that related to that as well? Yes. If you can remember the badge service from
2013 DEF CON, it's actually the same soft core processor that was used for that competition.
Yeah. Badger was the name of the challenge and I remember working on it and we kind of had an
almost solution and then my team threw our broken solution and then another team fixed it and got
it right. So we scored more points than that, but I worked on it during the finals. I remember that
one. Yeah. That's really cool. A lot of the code is similar. That makes sense. Because you already
had the sort of soft core that you needed to implement and it was compatible with what you
do. So that makes sense. Awesome. Now the Leon processor then or the payload. Tell me a little
bit more about that, Latimer. What's involved in that one? Yeah. So we used a Leon 3 soft core that
Geissler developed. It's all open source. You can go out and get it. You can go buy an Arctic 7 FPGA
and run your own Leon 3 on it. And so it's a Spark processor that was developed in conjunction
with the European Space Agency. So this is legit. The same kind of processes that are utilized in
space. So that's why we picked it for the competition. And then on top of that, we're
running a NASA product called Core Flight Software. We picked that because that's a really legitimate
flight software. It's open source. NASA has been huge in the community as far as releasing
their flight software that they are updating periodically. And there's a number of
applications that they have provided. And so we use that as a basis. And on top of that, we've
developed some custom applications that actually interface to the hardware that we're using in the
game. So that was our approach there. Now Latimer, how much would you say of the overall
system that you've got from the case to the boards, to the payload, to all the different modules that
how much did you develop? How much were off the shelf commercial components? How much were there
other vendors? What was the sort of breakdown of the overall system? Yeah. So on the flat side
itself, there's really like two major components, each with subcomponents. We had kind of a short
timeframe to develop all of this. So we, when we met, you know, starting, we were talking more
details in November of last year, we decided we need something quick that we can do to get
sensors and actuators. So in order to do that, we bought an off the shelf training satellite that
provides sun sensors. It has an IMU. It provides a gyro and magnetometers. It has torque rods,
just like a real satellite. It has a reaction wheel, just like a real satellite. So, you know,
that's one of the primary components. But that training satellite from a game perspective,
wasn't really interesting. It didn't really mimic, you know, like the kind of processors
that are running on like real satellites in space. So that's where we came up with the
CNVH board that we developed that has, you know, that Arctic seven and, and the Raspberry Pi.
So those are the two kind of primary components on the, on the, on the flat side.
And is that where most of the sort of the game occurs, you know, where the challenge is people
interacting and except that is the payload module, then a part of that, or that I know we're going to
maybe that's coming a little bit later, but like, where, where is that going to get factored in?
Yeah, that's part of it. Okay. All right.
Not going to talk too much about that because the team still have some things to figure out there.
But, you know, the intent from the beginning was to take a picture of the moon. We've been telling
the teams that, so the Pi is there really to provide an interface to the camera to allow
them to do that. And we put some interesting things in there that the teams will soon find
out about. Yeah, that makes sense. And I don't think anyone is surprised. They knew, they knew
the end goal kind of going in. I've definitely seen some chatter from them. So that shouldn't
be too much of a surprise. That's cool. One of the other things I, you know, I've been hearing a lot
about stuff, but I was involved in a lot of production side. So I didn't know a lot of these
details. When I first saw the air bearings in real life and understood, oh, wait, that's how that
works. That's what's happening. That blew me away. Can you talk a little bit more? You've got one
there. Tell us about how that works and what's going on. Yeah. So the air bearing is like two
precision pieces of aluminum. It really works almost like an air hockey set, like we played
with when we were kids. Like a table hockey. Yeah. Yeah. Yeah. So it has, you know, eight
machines or eight precision holes in it. And you know, we hook an air compressor up to it. We set
it to 10 PSI or so. And the top plate just floats on top of the air bearing and the satellites are
sitting on top of that. A lot of work went into actually getting that to work consistently.
And challenge two, we made the teams point at the sun for an entire revolution. And, you know,
I've been playing with that for months. Air compressor in my office running consistently.
So it was neat to see the teams do that too. And we didn't make it easy for them.
So yeah, that's essentially how it works. Excellent. Now, Jason Williams, how do you
get air then on a thing that's moving? You have the carousel spinning around. What was, I mean,
was that like a thing that you designed or built or bought or how did that work?
So the center of the carousel is not moving and that's where we have the air hose come in.
And then we have it hooked up to a manifold that distributes air to each of the teams on
the carousel itself. And an interesting thing about the carousel is actually it's driven
off of a slew drive, which is somebody, if you're familiar with solar tracking arrays,
the slew drive is what causes this solar tracking arrays to track the sun. So we actually got that
from China, had it shipped here. It was kind of difficult to get, but that's what the centerpiece
you see in the room there that's rotating the carousel about 15 minutes rotation, sorry,
15 minutes per single rotation. Awesome. Well, thank you both for taking some time out to discuss
this. This was awesome. I'm sure the audience appreciates it. We'll let you go back to the game
and we'll see our audience in another hour or so at our next update. Take care.
Thank you. Thanks.
So
hello and welcome back live with another competition update for Hackassat.
I'm your host Jordan Wines. First, let's take a quick look at our current scoreboard,
which at this point should be pretty familiar to everyone. Since our last update an hour ago,
we've actually seen no movement on the scoreboard yet. Challenge four is proving to be difficult
for the teams as we predicted it would be. But from the sound of it on the team chats,
they might be getting a little closer. So hopefully we'll see some movement soon there.
While we wait a little bit more game action, let's learn about the complexities of navigation
in space from our resident expert, Jess Coffey, in another episode of Space Talk.
Now that we've seen how precession takes place, let's try to predict its direction in this case.
So how do satellites know where they are? There are actually two completely separate dimensions
that we need to consider with satellites. The first being orbital parameters. This describes
the movement of the satellite over time, kind of like referencing a flight plan to tell where a
Basically, what direction am I facing? This is entirely independent of location for satellites
because there's no natural state that it's expected to be in. On Earth, that natural state
is aligned with gravity, basically upright, and satellites have no force or no natural state to
adhere to. Figuring out the orbital parameters of a satellite requires taking several observations
and deriving them. One way to obtain these observations is to use the same technology
we use here on Earth, an onboard GPS receiver. Additionally, we can look for them through
external sensors. NORAD tracks all objects in space through the United States Space Surveillance
Network, primarily using radar. Each object in space gets a unique ID assigned to it called a
NORAD ID, which is universally used by satellite operators to reference it. NORAD uses these
observations to derive the orbital parameters and uses two-line elements, or TLEs, as a standard for
providing all the orbital information. Here's an example of one for the International Space
Station. You can see the ISS's NORAD ID at the beginning of each line, 25544. The rest is used
to describe the orbital motion. This TLE is simply an estimation of the orbital trajectory and there
are inherent inaccuracies. The way we propagate orbital trajectories introduces an error that
becomes significant over time. The TLE format accounts for this by having a timestamp, or epoch,
built into it to indicate when it was taken. It is then valid for only about a week or two
around that epoch, depending on how important accuracy is for that specific satellite. As a
result, they must be constantly updated to keep from going stale. Now we know our orbital parameters,
what about the second category? Attitude. Space is full of a lot of nothing, but there are still
a few somethings that you can sense. The most common sensors are magnetometers, sun sensors,
and star cameras. Magnetometers are used by satellites when they are within Earth's magnetic
field. This is a very low fidelity measurement though, so it's typically not used by itself.
Sun sensors are photodiodes that measure light intensity. By putting these sensors in several
places surrounding the satellite, we can measure sunlight on each sensor, giving us the direction
of the sun. That, combined with location data, can give us a pointing accuracy of 10 degrees or less.
And finally, star cameras are the primary means of precise attitude measurement. Stars are far
enough away from us and moving slowly enough that we can treat them as constant for all but the
highest precision tasks. This means we can create a map of the star field that surrounds Earth,
and we can reference it to calculate exactly where a camera mounted on the satellite is pointing.
Now that we have determined our orbital parameters and orientation, we have a natural follow-on
question. How do I change them? Getting around in space, meaning both changing your direction and
changing your orientation, are difficult primarily because there is simply very, very little to work
with. All the modes of transportation here on Earth require exerting a force on your external
environment. Cars push their tires against the friction of the roadway, planes pull air through
their engines, and ships push water with their propellers. Again, satellite orbit and satellite
attitude are generally disconnected, so we have to control them separately. First, we'll cover how
do I change my orbit. In orbital motion, we don't actually point to where we want to go and start
moving there. Satellites are already moving at a tremendous speed, around 17,000 miles per hour in
low Earth orbit. Changing orbit in space actually consists of carefully adding and subtracting energy
at the right times. Not electrical energy, but rather the satellite's combined kinetic and
potential energy. Adding energy raises the orbit farther away from Earth and subtracting brings you
closer. Notice I didn't say going faster raises the orbit, because as you get farther away from
Earth, you actually slow down due to the properties of orbital dynamics. So we'll stick with the term
energy. Since the satellite already has so much energy that it acquired from launch to stay in
orbit, most changes are very small by comparison. Raising or lowering orbits to maintain or change
certain orbital characteristics a small amount. There are all kinds of technologies being developed
and in use to add and subtract energy from satellites, but the most common are thrusters.
Thrusters exist to eject fuel out of a spacecraft fast enough to change its momentum significantly.
This is the same way rockets work, and it comes from one of the fundamental laws of physics,
conservation of momentum. There are several different types of thrusters for spacecraft
that each have different trade-offs, but all of them operate on the core principle,
throw stuff out the back really fast. There are cold gas thrusters, which are the simplest ones.
They released compressed air to generate a small amount of thrust. There are chemical thrusters,
or miniaturized rockets, that are harnessing a chemical reaction to energize and release
fuel to generate thrust. And finally there are ion thrusters, which use electromagnetic force
to control, accelerate, and release charged particles to generate thrust. Now how do I
control the attitude? Satellites again have the problem that they exist in a literal vacuum.
You can't change your direction with a steering wheel, rudder, or flaps. To tackle this, they
actually make use of the same law of physics, but with a slight twist, conservation of angular
momentum. This one is easier to demonstrate in your daily life. If you ever spun yourself on a
chair, you probably realized that pulling your arms in will make you go slightly faster. This
is a demonstration of that law. Satellites make use of this through a technology called reaction
wheels. The core concept is there are very small wheels contained within the spacecraft, and if you
spin that wheel very very fast, you'll cause the spacecraft to react and spin in the opposite
direction. The motors that spin that wheel need to exert a torque to make that happen, and the same
opposing torque is then exerted back on the spacecraft, causing it to spin as well. All of
these technologies put together that allow you to determine the orbit, determine the attitude, and
control the orbit, and control the attitude, make up the satellite's attitude and orbital control
system, or AOCS, which is the most complex subsystem on most satellites.
Thanks, Jess, for that update. Before we sign off here, I want to give another update on the progress
of the on-orbit mission. Remember, we chose a single team solution to send to our orbiting
satellite. The ground control team is telling me that we have those commands scheduled to be sent
between 1 p.m. and 4 30 p.m pacific, and we are just now starting that comms window. Given the
orbit predictions of our satellite and the moon, we expect the actual photo to be taken around 6 30
pacific this evening. With any luck, we expect to receive that moon shot back here at Earth at 1 a.m
pacific tonight, and we'll have it for you tomorrow at the closing awards. That's it for this hour's
update. We'll see you back here at 4 45 eastern, 1 4 50 eastern, 1 p.m 1 50 pacific for a final
hourly update before our end of day recap tonight. Thanks, and have a good one.
Welcome back to another episode of Competition Update, space security challenge style. I'm your
host, Jordan Wines. Several teams are showing indications that they're making progress on the
hardest challenge, number four, but we don't have any confirmed solutions yet. Be aware, though,
that at some point in the next few hours, the scoreboard might be going off. Depending on the
organizers, anyway, many in-person CTFs have a tradition of blanking the scoreboard toward the
end for a little bit of increased drama, and I'm told we might see that happen here, so teams could
slip in a surprise solution when that happens. With no point decay, you probably have no incentive
to hold back on an answer that you might otherwise do in a normal CTF. If you've been watching this
carousel webcams, you might have noticed the occasional astronaut heading into space around
our flatsats. Let's go ahead and take a look now. Oh, we've got some audio. Let's see if we can mute
that. I'm not sure if it's coming through on that. Yeah, unfortunately, we've got a little bit too
much audio on that video, so we're going to have to probably kill that one. The video that you're
not seeing actually has some of the CubeSats in slow motion. If you've been watching the webcams,
we've actually got different views showing each of the satellites, the flatsats, as they're spinning
around orienting themselves on top of the sun. If we can stop this video before we zoom, it's
going to be really good, or else you're going to hear some really, really interesting background
noise. So one of our explorers was able to get that video. It showed 1550 trees flatsat as it
actually orbited around the room. We'll make sure to get that up on the YouTube playlist afterwards
so you can catch it. It was able to keep itself oriented on the sun as it went around the room,
that of course being one of the previous challenges. All right, for more information
on the other things that have been going on behind the scenes, we're going to see if we can bring
Alex Taylor from CrimeAlerts into the feed as well. Alex, can you hear me first of all?
Yeah, I can hear you great.
And I hear you too. This is good. Awesome. All right, well, welcome to the stream. Thanks for
coming on.
Thank you.
Okay, so first, can you tell me a little bit about what's been happening behind the scenes? I talked
to Bryce, I talked to the Jasons, and they kind of gave me some updates on some of the design
things. But in terms of what's actually happening like today and yesterday, anything interesting
been going on?
Sure. So all of the flatsats in the room are connected to the ground stations that the teams
are on via radios. So one of the things that we have to do occasionally is move some of the radios
around the room. Sometimes there's some interference, either from other radios, or, you
know, just from things that they get moved around in the room.
Somebody starts to microwave a floor below or something, maybe?
Yeah, sure.
I mean, there's some bits of metal and stuff that might be in the way, too. So one of the
things that you might see people come into frame doing is moving some of those radios around just
to make sure that teams are not getting large amounts of packet loss when they're communicating
with the satellites.
Yeah, a little bit less deterministic than, I guess, a network challenge where the networks
are a little bit more reliable. When you're working with RF for every connection you make,
you've got to deal with a little bit of that. That makes sense.
Yeah, and something we had to communicate to teams earlier as well is that this isn't
a network service. So they have to be very careful with the amount of data that they're
sending. They don't want to trip over themselves and cause their messages to not get completely
sent.
I saw that message going on in the team chat. And I like that because you kind of, as an
organizer, you have to strike the balance between how much information you give. And,
you know, you don't want to give a hint on something that may help one team more than
others. But you want to also help everyone make productive progress. You don't want people
to be doing things that might hurt themselves. How else do you kind of have to deal with
fairness? Have any other kind of concerns that have come up throughout the game so far?
Sure, yeah. So actually, early on day one, we realized that we had left a couple of files
on certain teams' command and control systems from some earlier testing that we had done
to make sure the challenges were solvable. Fortunately, the files that were left behind,
you know, would have given teams an unfair advantage in the competition. But what we did
is we decided to put all those files together into a single archive and give those out to all
of the teams so that if we were wrong, and those files contained something that was useful,
at least every team had access to the same information before those challenges got released.
Yeah, no, that makes sense. And I think that's, you know, you always have to, as an organizer,
balance what decisions you make, and trying to be fair is certainly important. One thing I'm
asking everyone, what is your favorite challenge? And if it's not one we've seen yet, no spoilers,
but if it's one we've already seen about, you can, of course, talk in detail, or even just
which one you worked on that you thought was most interesting. Sure. Well, that's an interesting
question. So you might expect me to say challenge zero, since that was the one I worked on.
Yeah, yeah. Right. I would also say that challenge five, which is coming up, is pretty cool because
it's the culmination of everything that the teams have been doing. My personal favorite,
though, is probably challenge three, just because it's, it's the kind of challenge I would be
interested in solving. If I were playing this event, my background is very heavy on reverse
engineering and exploitation. And that's exactly what you have to do to solve the challenges,
have a heavy amount of reverse engineering, you wind up with an exploit. It's good stuff.
Yeah, I agree. That's why I highlighted that one as well. So Alex, thank you very much for taking
some time out from helping keep the game going. Let's get back to that and we'll continue wrapping
up this update. Thanks for having me. Finally, here's our last Space Talk episode of the event
from Just Coffee with a summary of how communications in space work, something our
teams have surely demonstrated competence with over these past few days. Why do we use satellites
like these for long distance communication?
Communicating with a satellite ranges from several buildings worth of highly specialized
equipment to a couple hundred dollars worth of handheld amateur radio hardware. LEOSATs,
only about 400 to 2000 kilometers up, are even close by terrestrial standards. That means simple
ham radios are often used to communicate with them. There's even one aboard the International
Space Station that you can use to talk to the astronauts if you catch them at the right time
and they're not too busy. The complexity with communicating with LEO satellites is actually
their orbital speed. LEOSATs are moving so quickly that we have to use antennas that track them as
they move rapidly across the sky. This tracking can be really difficult due to the uncertainty
of the satellite location and how fast they move in and out of view. A satellite coming in and out
of view from horizon to horizon is called a pass. Passes are the only times that we can actually
communicate with satellites. Management of LEO satellites especially revolves entirely around
this concept of passes and maximizing their effectiveness. For instance, it doesn't help
having an imaging satellite over the target location if you didn't have a pass before it
got to that location to tell it to take that photo. Similarly, you have to wait until the next pass
to be able to actually bring that data back down to ground. Passes are roughly about five to ten
minutes for LEO satellites. This duration changes drastically based on where the ground station is
located. Near the equator, the Earth's rotation actually causes the ground station and the
satellite to lose contact with each other faster. But near the poles, Earth's rotation is negligible
and the satellite is actually in view for almost twice as long, if not more. Essentially, the higher
the latitude of your ground station, the more useful your passes actually end up being. This
is the reason most ground stations are located in the higher latitudes, even in the very hard
to reach locations. One of the best examples of that is Svalbard, a Norwegian archipelago that's
extremely close to the North Pole. It has over a hundred commercial ground station antennas,
making it the largest commercial ground station in the world.
As always, thanks Jess for the content and thanks to the team at the different studios for that
awesome editing and animations that go into those Space Talk episodes. That's our last hourly update
of the competition. I look forward to seeing everyone at 4 p.m. Pacific, 7 p.m. Eastern, as we
will have our final daily recap where we will reveal which team's solution is being run on our satellite.
so
A little pause... and we are back.
A little pause... and we are back.
A little pause... and we are back.
A little pause... and we are back.
A little pause... and we are back.
A little pause... and we are back.
Welcome to Space Security Challenge 2020, HackASAT, the final event.
As the democratization of space opens up a new frontier for exploration and innovation,
we see new cybersecurity vulnerabilities emerging.
The Space Security Challenge is designed to inspire the world's top cybersecurity talent
to develop the skills necessary to secure this last frontier of cybersecurity,
space. And already we've made a ton of progress.
I'll catch you up. This spring we hosted over 2,000 teams who worked their way through a set
of foundational space cybersecurity challenges in our HackASAT qualification round. Now,
eight finalist teams are stepping up to the ultimate challenge. They are hacking a satellite.
Welcome to the Saturday Daily Recap of Space Security Challenge 2020, or HackASAT.
For the second to last time, I'm your host, Jordan Wines, and it's time to fill you in
on how our competitors did on day two of this first-of-its-kind satellite hacking competition.
Okay, let's get right to the moment everyone's been waiting for.
Here is our video to show which team was selected for the on-orbit challenge.
Oh, I'm sorry. Actually, it appears that we're experiencing some technical difficulties.
Yeah, I guess that means you're going to have to listen to the rest of this update.
And then we'll play the big reveal at the end instead. So let's take a look back at today's
action. In fact, let's go ahead and take a look at the scoreboard now in our live octagon feed.
And they definitely haven't slowed down. You'll notice that Solarwine actually scored first blood
on challenge three. Congratulations to them for the great work overnight. You can also see Flux
Repeat Rocket scoring just before this broadcast with only a 5% reduction in total points. That
means Solarwine and Flux Repeat Rocket are both moving on to challenge four. While the score
hasn't changed, we have had one important game milestone pass us by. We timed out unavailable
points for challenge three. That means those two teams, Solarwine and Flux Repeat Rocket,
they've obtained points for that challenge, and all other teams were given a solution script
so they can focus on the next challenge. If you've been following along at home,
you know that we sprung our on-orbit challenge on our teams yesterday. We had four teams submit
their solutions by 4 p.m. Pacific, our deadline for evaluation for on-orbit, but only one was
selected to have their code sent to the live satellite to capture a moonshot. We will learn
who that lucky team is later on in the broadcast. While today's action started strong with several
early scores, teams really struggled their way through challenge four today. While the organizers
knew it would be the hardest challenge, the hope was that it would be solved before this point.
In fact, in the last hour of the competitions, some team had run so low on power that the
organizers offered to take the flatsats offline so they could plug them into power. This would
mean teams would have challenges in solving challenge five, but hopefully it would give
them enough power and time to solve challenge four in the last few minutes. Given that,
here is our explanation for the challenge four solution.
Challenge four. Here's what we know. We've restored communication with the payload module,
but we still can't operate it. The challenge? Now teams must restore normal operations of the
payload module so we can access the imager. Here's how they do it. Teams discover that the payload
module bootloader has been corrupted, which is why the payload module is not operating normally.
The teams discover a system console to the payload module and the ability to access the
module system console by controlling an undocumented GPIO and multiplexer on the
CNDH board. The teams must write a custom flight software application that can control the GPIO
and enable access to the payload system console. After writing the application,
the teams must upload it to the CNDH and execute it. Once the teams have access to the system
console, they will identify that it has been corrupted. The teams will need to research
nominal kubos bootloader configuration and repair the payload module's bootloader to resume proper
operation of the payload module. As I mentioned during a previous update, there was always a
chance that the scoreboard was going to go dark. And sure enough, with 30 minutes left in the
competition, as teams were hopefully nearing it on a challenge 4 solution, the organizers decided
to keep us all in suspense. Here's a look at our final scoreboard that everyone saw before it went
dark. As we can tell, we had a couple of solves later on, but early was where most of the action
happened. However, with our accepted and rejected on orbit status, we knew that there was two teams
who would not be eligible for final prizes. We will make the final actual scores available tomorrow
during the closing ceremony. Before you make your predictions on our podium winners, let's
take a look at the final challenge 5 to see what it was teams would have had to solve after they
finished challenge 4. Challenge 5. Here's what we know. We've done our best work, and it seems that
we've regained control of the satellite. But how do we know for sure? The challenge? Teams must
prove that we are fully in control of the satellite system by successfully imaging the moon.
I thought I could have solved some of these challenges, and the answer was almost certainly
not. I've got a lot of respect for the teams out there who made progress at all through this event.
With a very difficult environment, very different to what many other CTFs have to do,
there's a lot of extra constraints you have to worry about. For more information on that, let's
do one last Q&A session with Jason Latimer to talk about how teams were approaching challenge 4.
Let's see if we can get him in here. Jason, do you hear me? Yeah, I got you. Excellent. I hear you as
well. Great. So, we're wrapped up. The game is over. I hopped into a couple of your calls,
and I was listening to you guys describe some of the approaches teams were taking on challenge 4.
I thought there's some really, really interesting things that came out. I'd love to hear a little
bit more from your perspective. Yeah, so the background on challenge 4 was that, you know,
the teams had gotten past the implant that the adversary had put on the satellite, and that they
were trying to use the payload, and quickly found that the payload wasn't functional.
So, what the adversary had done was corrupted the bootloader, and so they had to, you know,
uncorrupt the bootloader. There were a number of approaches. Teams seemed to be struggling in the
beginning. So, at one point, we gave a hint that said, hey, you need to write an application that's
capable of communicating with the system console and enabling that system console via GPIO.
Very quickly, teams started uploading their custom CFS applications. Some teams were just
trying to enable the GPIO to control the system console based on other GPIOs that were already on
the system, and they had done that successfully. And then we had some unique approaches where teams
were trying to upload applications that could do like TFTP transfers to the device. So, we had a
application that they're compiling. Was this like just a standard compiler they could use,
or what sort of information about that environment did they have to have to build
these custom applications? Yeah. So, it's actually a little bit more complicated than that, and we
didn't want that to be the challenge behind the whole, you know, restoring the bootloader. So,
we actually did provide to the teams ahead of time the RTEMs build environment they would need to
build an application. And then we provided also a set of example applications that they could use
as a template for creating this application that would restore the bootloader on the payload.
There was still quite a bit of challenges there because there were specific peripherals that
they'd have to be able to control. So, I'm talking to, you know, specific UART and GPIO drivers to
do that. So, it was non-trivial. Yeah. What did your solution look like? I mean, it just sort of
like did it rebuild it, or how did your intended solution work on that? Yeah. So, we had a custom
application that ran in CFS that could talk to the Raspberry Pi system console over the UART. So,
it was literally like talking to this, you know, system console. We would send a command and we
could, you know, do an LS on the shell or whatever it was. And through that, we could restore the
bootloader via just typical system console commands. But in order to actually enable that UART, we had
a GPIO that was hidden. So, one of the challenges for challenge four was actually looking through
the FPGA Verilog and VHDL code and finding that that actually existed. So, we had gotten some
feedback during quals that, you know, teams were really interested in doing that kind of
documentation reverse engineering. So, we went to a lot of effort to make sure that that existed. So,
to even identify that that was there, they were doing code inspections of the VHDL and the Verilog
for the FPGA. Now, I heard hints that, like, at least one team was doing something creative with,
like, direct memory writes. What do we know about that? All we know about that, well,
teams were doing uploads of applications, but it looked like some teams were using the direct
memory writes to actually interact with that shell, the Raspberry Pi shell. So,
a little different than our approach. But yeah, it was interesting. If it gets your code running,
it gets it working, right? There's no points for the jankiness or the cleverness. It's just,
does it solve the challenge, right? So, one of the things that I just mentioned to people,
of course, was the power constraints and how many of the satellites were running low on power at the
end from a lot of movement throughout the day and a lot of usage and the sort of option they had to
get connected to a ground power. Tell me how that changed the sort of Challenge 5 requirements. And
if a team was able to solve a Challenge 4 after the SCOVR went dark, would they have been able to
do it from the ground or was that completely impossible or what happened there? Yeah. So,
we talked with the organizers and based on the fact that we had these power constraints
and that the teams that had elected to be put on the ground wouldn't be able to get a picture of
the moon, we adjusted the criteria for Challenge 5 to just be get a picture. It was interesting to
see what the different... it was interesting to see what the different teams were doing as far
as power. Some teams had conserved their power throughout the day and other teams had not. So,
we had some teams that were in the running to solve Challenge 4 that said, hey, we don't want
to be put on the ground. We'll just stay on the carousel. We've been good with the batteries all
day. And we actually mentioned that in an earlier update here that power was potentially a concern
and it was nice that teams weren't entirely out of the running, right? There was sort of
a backup mechanism, but it cost them time while their flat set was taken down, was rewired in,
so that was sort of a penalty for exercising that option, although they weren't kind of out
of the running entirely. That works out great. All right, well, thank you very much for taking
time to talk to us and we'll continue on with the rest of our update. Thank you.
All right, now the moment that you hopefully have actually been waiting for. We're going
to answer the question as to which team had their code sent into space tonight.
So, the video that we're going to look at here is the same one that I previewed earlier. So,
we can see Poland Can is the very first team to get an acceptable payload. We knew that from
watching the scoreboard and got reasonably close. Next coming in are going to be several other
teams, ADD Vulcan number two, and then number three, Flux Repeat Rocket. So, we've got the
three quickest ones and then we're going to have right here a Samurai come in. So, these were the
four that came in before the timeline. So, if we stop right now, this is our launch cutoff, right?
So, these were the teams that came in and if we look at closest to the bullseye, you can see that
Poland Can did a space, just beat out Flux Repeat Rocket with the most accurate solution
during our window. And this is the payload that's being run on an actual satellite right now. So,
we're looking forward to getting the results back from that tonight as it runs. And then tomorrow
during the live event, we're going to show you, hopefully, the moonshot. We'll find out how
accurate it was. And of course, we're going to continue the run here because as I mentioned
earlier, we know there was that sort of like sudden death for the last two slots, right? And
we could see the teams that were two more slots that were available. And so, after that 7 p.m.
cutoff, we had a quick 1550 tree that was able to make it in. But we also noticed that Poland Can
really got in close. And so, they got a really, really nice solution. They kept iterating on it.
There was no points for it. There was no extra... it was not considered for the on-orbit. But it
was so good that the individuals we had evaluating all of the solutions, they had a lot of automation,
but there was also, I guess, a little bit of an art to it. They were explaining that they thought
that final Poland Can was so beautiful that it was like a piece of art. They loved that final
solution. And then, of course, we had our last solve here coming in that's going to be from
PFS, which we've already revealed. They were the last team to make it into the qualifying minimal
acceptable range, which unfortunately left our two other teams, which were SolarWind and 1064
Seabred, not in the running for that. So, first of all, congrats to Team Poland Can Into Space
for submitting not only the best solution overall throughout the whole evaluation period,
but the solution that is going to space. Let's see their team bio again.
And into space, I can confirm that your commands were uplinked in our comms window earlier today.
We expect the moonshot to happen in a couple of hours at 630 Pacific, and that picture will be
sent down to Earth at about 1 a.m. Pacific. We will reveal what is hopefully a clear moonshot
picture at tomorrow's closing ceremonies. It all depends on how accurate your command really was.
Fingers crossed. You'd think that just watching instead of playing would be less stressful,
and I'm sure it was worse for our competitors, but even in the production room, we were cheering
and sweating along with our teams as they worked their way through these challenges.
Thanks very much for joining us throughout this event. That's it for today's recap. Make sure you
tune in to Hackensack Closing Ceremonies tomorrow at 11 Pacific, where we will hopefully reveal the
world's first CTF moonshot taken by Poland Canada Space. We'll also show you the overall contest
results and award the prizes to our teams and reveal what happened after the scoreboard went
dark. We'll also hear closing remarks by Dr. Will Roper from the U.S. Space Force and Air Force
Acquisition Chief. Be sure to also check out all the great happenings going on at DEFCON
and in the Aerospace Village. See you tomorrow at 11 Pacific for the Closing Ceremonies.