start	end	text
4964440	5211280	So, let's get started.
5228130	5229530	♪♫♪
5747410	5754610	Welcome to Space Security Challenge 2020, HackASAT, the final event. As the democratization
5754610	5760990	of space opens up a new frontier for exploration and innovation, we see new cybersecurity vulnerabilities
5760990	5768230	emerging. The Space Security Challenge is designed to inspire the world's top cybersecurity talent
5768230	5773310	to develop the skills necessary to secure this last frontier of cybersecurity,
5773870	5781030	space. And already we've made a ton of progress. I'll catch you up. This spring we hosted over
5781030	5786130	2,000 teams who worked their way through a set of foundational space cybersecurity challenges
5786130	5791830	in our HackASAT qualification round. Now eight finalist teams are stepping up to
5791830	5806090	the ultimate challenge. They are hacking a satellite. Welcome back to the second and
5806090	5810850	final day of the competition portion of HackASAT. Are you excited? As always,
5810850	5816550	I'm your host Jordan Wines. First, a quick recap of the game to this point.
5822160	5827340	The game has actually been underway for one hour now, and our team's first challenge has been to
5827340	5832520	regain control of the ground station that they'll be using to communicate with their FlatSats. In
5832520	5838100	fact, just before this broadcast went live, we received word that this challenge was actually
5838100	5844260	solved by Team Samurai. Congratulations to them. Right after our last update ended with only a
5844260	5849880	Samurai solve, several other teams came in with solutions for Challenge Zero. PFS and SolarWine
5849880	5855760	were solvers two and three on that challenge. After those two teams scored on Challenge Zero,
5855760	5859700	every other team was eventually able to solve Challenge Zero over the next several hours.
5859700	5865040	Taking a look at the scoreboard so far, we've had an eventful last hour. Our teams continue to make
5865040	5869740	progress with four teams now having solved Challenge One. Unfortunately, the window of
5869740	5874000	time after first solve has expired, and the remaining four teams were given the solution
5874000	5882520	with no points. PFS and Colon Can Into Space were joined by 1553 and 1064 Seabred with solutions for
5882520	5888500	Challenge One. Now, this was going to be where I signed off for this update, but as we were live,
5888500	5894620	PFS actually jumped up on the scoreboard yet again, solving Challenge Two. Most teams are now
5894620	5900780	working on two or three challenges. The On-Orbit Challenge, Challenge Two, and Challenge Three. PFS
5900780	5905720	has been pulling away to a healthy lead. They still have a critical problem to solve, specifically
5905720	5910900	the On-Orbit Challenge. While Colon Can Into Space is only nipping at their heels at number two on
5910900	5915340	the scoreboard, they are critically not only the first team with an attempted solution to the
5915340	5920220	On-Orbit Challenge, but the first with an accepted solution. That would mean that they would be able
5920220	5926080	to pass PFS if PFS is not able to actually solve, because again, that is a pass-fail challenge.
5930470	5935410	Yesterday, our teams collectively worked their way through Challenges Zero through Two, leaving
5935410	5940090	with half of the challenges solved by at least one team, and three challenges remaining to be
5940090	5946390	solved today. PFS grew their lead throughout the day yesterday, but the biggest drama occurred
5946390	5952890	after hours. When the 4 p.m. Pacific deadline for the On-Orbit Challenge passed, only four teams
5952890	5958770	had submitted solutions deemed acceptable. What's an acceptable solution? Let's take a look at
5958770	5966490	solving the On-Orbit Challenge. First, some terms you'll want to know. Two-Line Element Set, or TLE.
5966630	5970950	A data format containing information about an object's position and velocity at a specific
5970950	5975510	point in time. It is used to calculate where a satellite will be at some point in the future,
5975510	5981050	with increasing uncertainty the further out in time. Window of Opportunity. The period of time
5981050	5986750	during which the satellite can be positioned to complete the desired goal. Vector. A line
5986750	5992550	indicating a specific direction in magnitude. A satellite will have assigned X, Y, and Z vectors
5992550	5998070	associated with the body of the vehicle that can be used in a coordinate system. Camera Boresight,
5998070	6003210	Camera Mounting Position, and Camera Body Vector all describe the satellite camera and where it's
6003210	6011290	pointed. Quaternion. A number system that is handy for calculating 3D rotations. Got it? Here we go.
6011290	6017330	The first step in solving the On-Orbit Challenge. Identify the key data. The TLE, Camera Mounting
6017330	6022310	Position, Target, and Window of Opportunity are all supplied in the Challenge Description or the
6022310	6027250	On-Orbit Handbook. The data is used to calculate the orbit of both the satellite and the moon
6027250	6031850	toward the Window of Opportunity. And don't forget to grab the Camera Body Vector, which will be
6031850	6037590	needed later. The second step. Calculate the time of image by defining the relationship between these
6037590	6043330	key vectors. 1. Determine the satellite-to-moon vector, which points directly from the satellite
6043330	6048290	towards the moon. 2. Determine the nadir vector, which points directly from the satellite towards
6048290	6053990	the center of the earth. 3. Determine the angle between 1. The satellite-to-moon vector and the
6053990	6059670	nadir vector and 2. The angle between the satellite negative Z vector and the Camera Body Vector.
6059670	6064810	The instance when the difference between the two angles is minimized gives us the time of image,
6064810	6068870	the moment along its orbit when the satellite will be in position to take our all-important
6068870	6076130	moon shot. The third step. Calculate the attitude or the position within its orbit that the satellite
6076130	6083730	must take for the camera to capture the image. This is accomplished by lots of math. Specifically,
6083730	6089890	something called a Direction Cosine Matrix, DCM, or Rotation Matrix. The DCM calculates a satellite
6089890	6095770	attitude that points 1. The camera boresight to the moon and 2. The satellite's negative Z vector
6095770	6102870	to earth's center, which is the attitude needed to accomplish the goal. The DCM supplies us with a
6102870	6107050	specific quaternion which, when uploaded and applied to the satellite's Attitude Determination
6107050	6114110	and Control System, ADCS, moves the satellite into the desired position. On to the final step.
6114110	6120490	Apply all that information and get the image we're after. We take the time of image and back
6120490	6125070	out the commands around it, giving the satellite enough time to apply the quaternion and be in
6125070	6129170	position when it arrives at the window of opportunity. The proper order of commands
6129170	6135510	would be as follows. Turn on the ADCS, slew to the commanded quaternion, turn the camera on,
6135510	6142210	set the exposure time, capture the image, and finally, turn the camera off. That's it.
6142210	6147490	Challenge accomplished. But what does all of this have to do with hacking and keeping our
6147490	6153250	satellites secure? The on-orbit challenge was completed with full trust. Our satellites rely
6153250	6157730	on data and sensors from multiple sources in order to complete an objective. The TLE that
6157730	6162350	was provided relied on data from the satellite and ground stations. Authenticated communications
6162350	6167130	were required to upload the proper command sequence. Trusted execution was required to
6167130	6172170	process sensor and actuator data to close control loops. Secure on-board communications
6172170	6177570	were required to carry out operations in orbit. We need security-focused people to help with these
6177570	6182510	problems because just as much as it takes a team of people to strap explosives to a computer to
6182510	6187390	get a satellite into orbit, it takes a team of people from both space and security communities
6187390	6192090	to ensure that space remains a viable, usable resource.
6194270	6200490	The four teams with successful on-orbit solutions during the time period were Poland Cannon to
6200490	6207290	Space. In fact, theirs came well over an hour before anyone else's. ADD Vulcan, Flux Rocket
6207290	6214350	Repeat, and Samurai all came in within about 10 minutes of each other within the last 15 minutes
6214350	6220090	of that window. Remember, the on-orbit portion involves a team computing a mission plan for an
6220090	6225150	actual satellite to take a picture of the moon. All acceptable solutions were evaluated, and the
6225150	6230550	most accurate solution submitted before the 4 p.m. deadline will be chosen to be sent into space
6230550	6235750	into our orbiting satellite. We'll learn whose solution that was amongst those four later on
6235750	6242410	today. As we entered into our overtime period after the 4 p.m. deadline yesterday, the alternate
6242410	6247930	acceptance criteria kicked into play. Well, the four teams submitting before 4 p.m. were automatically
6247930	6252770	eligible for their solution to be sent and automatically in to prize eligibility. We had
6252770	6259050	to get more teams available. The limit was six. This meant that two teams of the remaining four
6259050	6264670	would be out of contention for the final prize pool. The four teams fighting for those two spots
6264670	6273770	included PFS, 1553, 1064 Seabred, and Solarwine. 1553 managed to submit a solution that was valid
6273770	6280130	only three minutes after the deadline, quickly grabbing that fifth spot. That left PFS, 1064
6280130	6287310	Seabred, and Solarwine on the ropes for that last spot. PFS and 1064 Seabred were number one and
6287310	6291970	number four on the scoreboard at that point, so no matter what happened, someone in contention for the
6291970	6297630	podium would not be eligible. All of the contest organizers were on a shared video chat waiting to
6297630	6303410	see the results as they came in. 1064 Seabred had what looked to be an extremely close solution that
6303410	6310650	was just outside the acceptance criteria, and PFS didn't seem to be close. Then at 7 48 p.m eastern
6310650	6318690	or 4 48 p.m pacific, PFS came in with a valid solution just edging out 1064 Seabred and Solarwine
6318690	6326690	on the list of on-orbit acceptance. Unfortunately, that means that 1064 Seabred and Solarwine are both
6326690	6331930	ineligible for a spot on the podium. That said, they can still have an impact on the game.
6331930	6336390	Either team scoring first blood will potentially change the number of available points left on the
6336390	6341490	board for the competitors and impact the final result. It's sad to see two great teams out of
6341490	6345790	contention for the prize pool, but they can still end up on the leaderboard from a points perspective
6345790	6350330	and attain the associated bragging rights. In fact, let's go ahead and take a look at the
6350330	6356730	scoreboard now in our live octagon feed. And they definitely haven't slowed down. You'll notice that
6356730	6362290	Solarwine actually scored first blood on challenge three. Congratulations to them for the great work
6362290	6366570	overnight. The pressure is now on the remaining teams to show that they can make they made good
6366570	6371970	use of the downtime as well to land challenge three. You can also see Flux Repeat Rocket
6372490	6377590	scoring just before this broadcast with only a five percent reduction in total points. So that's
6377670	6382650	a good amount of points for them. That means Solarwine and Flux Repeat Rocket are both moving
6382650	6392940	on to challenge four. Challenge four. Here's what we know. We've restored communication with the
6392940	6398180	payload module, but we still can't operate it. The challenge? Now teams must restore normal
6398180	6412040	operations of the payload module so we can access the imager. This is the first time we've seen
6412040	6416260	Flux Repeat Rocket make a big move on the scoreboard. Let's check out their team bio.
6445840	6450180	Like many of the combined CTF teams that we've seen here today,
6450180	6455560	I have good memories of playing HackLoo CTF. In fact, it's often the case that the competition
6455560	6461120	participants are also organizers in other times. So one of those teams that makes up the composition
6461120	6466680	of Flux Repeat Rocket, FluxFingers, runs HackLoo, which is another great CTF competition you should
6466680	6471800	check out. What an exciting first day. I'm looking forward to seeing what happens today as our teams
6471800	6477560	battle through these last few challenges. Come back and join us at our 10 50 a.m pacific 1 50 p.m
6477560	6480720	eastern for our next competition update.
9572440	9573840	So
12621810	12627470	Welcome back to Space Security Challenge 2020, or Math-A-Sat, as one of our competitors
12627470	12633270	fondly called it. At least, we hope it was fondly. Anyway, I'm your host, Jordan Wines.
12633690	12638550	It's been a quiet few hours since our last update, with, I think, no changes on the scoreboard.
12638550	12643470	However, the teams have surprised us in the past, scoring in the middle of updates. So
12643470	12648550	let's actually take a quick look at the scoreboard now to confirm that. If we look at the octagon,
12648550	12654310	it does indeed look like our teams are scoring the same. Our last two solves with Solarwine
12654310	12659930	and Flux Repeat Rocket in Challenge 3. So we're still looking at Challenge 4 and 5 for the rest
12659930	12665070	of the day. While the score hasn't changed, we have had one important game milestone pass us
12665070	12670470	by. We timed out unavailable points for Challenge 3. That means those two teams, Solarwine and Flux
12670470	12674970	Repeat Rocket, they've obtained points for that challenge, and all other teams were given a
12674970	12679690	solution script so they can focus on the next challenge. But before we move on to our explainer
12679690	12683810	video for Challenge 3, we actually missed getting you the full explanation for Challenge 2 during
12683810	12692690	our last update. So let's start with that. Challenge 2. The satellite is spinning out of
12692690	12697750	control because the Attitude Determination and Control System, ADCS, has been manipulated.
12697830	12704250	We suspect sabotage. The challenge? Teams must repair the ADCS system as quickly as possible
12704250	12709410	to stop the dangerous spinning. Here's how they do it. Teams may first search the provided
12709410	12715370	documentation for the appropriate command to reset the ADCS. They find it and execute it. But
12715370	12720810	the reset does not work. The ADCS system begins communicating again, but it is not functioning
12720810	12727310	properly. Teams discover that the ADCS configuration tables have been altered and must be restored.
12727410	12731430	They have to find the nominal parameters for the configuration tables from the provided user
12731430	12736590	documentation. The teams then have to upload a new table to the vehicle and command the ADCS to
12736590	12743150	load the table. This is how they will restore nominal operation of the ADCS. Good news! With the
12743150	12749090	ADCS configuration table updated, they receive nominal status from the ADCS, but the majority
12749090	12753970	of the ADCS commands still don't work. Teams realize that they can point the satellite by
12753970	12759410	uploading various ADCS configuration tables, each with different pointing modes and configuration
12759410	12764730	parameters, and loading them at different points in the orbit of the satellite. This allows the
12764730	12770250	teams to stop the spin of the vehicle and point the solar arrays at the sun to charge the batteries.
12774390	12778270	All right, now that we're caught up, here's a little bit more about the intended solution to
12778270	12787410	Challenge 3. Challenge 3. Here's what we know. With the update to the ADCS, the teams have regained
12787410	12791790	control of the satellite, but we still can't communicate with the payload module or operate
12791790	12796570	the imager. In addition, the majority of useful commands are not being accepted by the flight
12796570	12802290	software. We have to ask ourselves, what else did they damage on this satellite? The challenge? Teams
12802290	12807930	must restore communication with the payload module so we can get it working again. Here's how they do
12807930	12812330	it. The teams find that their initial commands to communicate with the payload module are not being
12812330	12818210	accepted by the flight software. It's clear that the command and data handling C and DH system is
12818210	12823750	not working appropriately. In fact, payload commands and the majority of the other commands have been
12823750	12830190	disabled in the C and DH system. It turns out the attacker has modified the C and DH flight software
12830190	12835850	and are now running their own code on board the space vehicle. The attacker code is rejecting the
12835850	12841210	majority of commands to the satellite, including firmware updates, firmware restore, and ADCS
12841210	12847150	commands. As a result, it is not possible to restore the failsafe image as the restore command has been
12847150	12853090	disabled. Lucky for the teams, the attacker was sloppy and inadvertently introduced a vulnerability
12853090	12858690	in the new firmware image. Teams exploit this vulnerability and use it to repair the system
12858690	12864950	and restore the C and DH software back to normal operation. Once that is complete, they are able to
12864950	12874050	communicate with the payload module once again. Challenge 3 happens to be my personal favorite,
12874050	12878690	as it, along with challenge 0, are probably the most similar to regular CTF challenges. I always
12878690	12883410	love a good pwnable. Since we have some time in this update, I want to introduce a new graphic
12883410	12889250	to you that we call the Race to Space. This will be a visualization we'll be using later on today
12889250	12893890	to measure the team's on-orbit submissions. The closer to the center of the bullseye,
12893890	12898450	the more accurate the solution. And, of course, the minimum acceptance bar will let us see the
12898450	12902610	solutions that were not accurate enough to be accepted. Each team gets their own little slice
12902610	12908270	of the pie, and we'll be able to see how many tries it took to become accepted and or how
12908270	12914290	accurate teams got. You may remember that we have four teams that all submitted
12914290	12920050	accepted solutions before the 4 p.m pacific cutoff yesterday. They were Poland Cannon to Space ahead
12920050	12926570	of the pack, and then ADD Vulcan, Flux Repeat Rocket, and finally Samurai. Speaking of ADD Vulcan,
12926570	12930690	we haven't yet had a chance to show off their biography, so let's check them out now
12931510	12936130	in recognition of them being the second accepted solution to the on-orbit challenge.
12964440	12965000	So
12965000	12969040	apparently the real reason ADD Vulcan is participating in HackASAT was just as an
12969040	12973600	excuse to make pink Starfleet uniforms. Go check out their Twitter team Twitter account for more
12973600	12979040	info on that. Also, one of the main team members, Amy Dede, was on the recent tv show Lego Masters
12979040	12983640	and also hosts an awesome STEM for Girls scholarship. That's it for this competition
12983640	12988920	update. I'll see you back here in one hour at 11 50 a.m pacific, 2 50 p.m eastern.
15805630	15810830	Welcome back to Space Security Challenge 2020, the final frontier. I'm your captain, Jordan.
15810830	15816510	I'm actually not anybody's captain, but I can play one on YouTube. With no game changes to report on
15816510	15821370	in the last hour, and the game infrastructure cooled down to a less-than-molten state as things
15821370	15825510	are a steady state, we're going to bring in some of the game organizers to talk a little bit more
15825510	15831070	about the behind-the-scenes and the game infrastructure. We were going to call this
15831070	15835610	segment Between Two Jasons because we've got Jason Williams and Jason Latimer of Cromulence
15835610	15840130	on the video chat, but I don't think you all need to see my face. So, Jasons, can you hear me?
15842350	15845970	Yeah, I can hear you. Excellent. All right, that was Latimer on the right and we got Jason Williams
15845970	15849990	on the left. Thanks for joining me, first of all. I appreciate it. You guys have been pretty busy,
15849990	15855410	I know, the last few days and, of course, even before that as well. Just first general impressions,
15855410	15857910	how are you feeling right now about how everything's going?
15860910	15867490	I think everything's going really well. Sorry. All right, I'll direct into one of you specifically,
15867490	15871470	so I don't make you talk over yourself. Latimer, how do you think this... are you happy right now
15871470	15875850	with things? How are you feeling? I'm happy. We've had a little bit of a lull as teams have
15875850	15881130	been working on challenge three and four, which are the harder challenges from the hacking
15881130	15887190	perspective. So, we're kind of sitting back and watching and it's going pretty well today,
15887190	15892630	for sure. One of my other questions for you each, and we'll stick with Latimer since you're going,
15892630	15898230	was what is your favorite challenge then? I think three was probably mine. Do you have a favorite,
15898230	15901750	either one you worked on or one you didn't? And if it's a later one, no spoilers, of course, but
15901750	15908750	feel free to tell us which one you like best. Yeah, I really like three a lot and I was super
15908750	15913590	excited. You know, we gave the team something to work on overnight and to come back in this morning
15913590	15919830	and have a couple solves right away, that was awesome. Challenge four is going to be a challenge,
15919830	15925110	so I'm hoping that we get some teams that actually solve that this afternoon. We're going to, you
15925110	15931450	know, looking at when we give, you know, a hint or two coming up. But yeah, I like four. I think
15931450	15934830	you guys described to me that four was probably, would you say, the hardest overall of all the
15934830	15938370	challenges. That was kind of the impression I got from talking to the folks that made them all. So,
15938370	15942630	this is like, this is going to be important too. And certainly for the score in the game,
15943270	15947570	a lot could happen in these last two solves. And so, this is going to be a big moment.
15948510	15954030	All right, so Jason Williams, same to you. Do you have a favorite challenge? Yeah, I think it's,
15954030	15958230	for me, it's going to be challenge four without trying to give too much away. As you know,
15958230	15963450	we think this is the hardest challenge in the game and it exercises a lot of skills that the
15963450	15968030	teams are going to need to use in order for them to solve this challenge. So, I'm really excited to
15968030	15973130	see where they go with it. And hopefully in the next hour or two, we get a solve on this one.
15973570	15977930	Awesome. Now, I think you each may have some components of some of these flat sets that we
15977930	15982490	can see kind of up close and maybe talk a little bit more. Jason Williams, what you, just before
15982490	15986730	we went live, you were showing me one of the boards that you had there. Do you want to go
15986730	15992190	ahead and talk about that a little bit? Yeah. So, on the flat set, we have our own hardware
15992190	15997290	that we designed. And it's actually, I'll try to show it to you if you guys can see it here.
15997810	16003450	It consists of a carrier board followed by two boards on top of it. One of them is a ZX board,
16003450	16009790	which has on it an FPGA, an Artec 7 FPGA, which runs two soft core processors. Then the other
16009790	16015050	one at the bottom here is the Raspberry Pi Zero. And this one is running the payload module.
16015050	16021050	Yes. Yep. And so here you can see the ZX board and on there is actually two soft core processors,
16021050	16028030	MSP430, which we use for running the radio baseband, and then a Leon 3 processor from
16028030	16034650	Geissler, which Jason can talk more about that runs our flight software. Well, before we go Jason,
16034650	16039210	that MSP430 soft core FPGA sounds a little familiar to me. I think I see something behind
16039210	16045670	your shoulder. Was that related to that as well? Yes. If you can remember the badge service from
16045670	16052290	2013 DEF CON, it's actually the same soft core processor that was used for that competition.
16052550	16056610	Yeah. Badger was the name of the challenge and I remember working on it and we kind of had an
16056610	16060910	almost solution and then my team threw our broken solution and then another team fixed it and got
16060910	16065170	it right. So we scored more points than that, but I worked on it during the finals. I remember that
16065170	16069750	one. Yeah. That's really cool. A lot of the code is similar. That makes sense. Because you already
16069750	16072970	had the sort of soft core that you needed to implement and it was compatible with what you
16072970	16079310	do. So that makes sense. Awesome. Now the Leon processor then or the payload. Tell me a little
16079310	16086310	bit more about that, Latimer. What's involved in that one? Yeah. So we used a Leon 3 soft core that
16086310	16091410	Geissler developed. It's all open source. You can go out and get it. You can go buy an Arctic 7 FPGA
16091410	16098250	and run your own Leon 3 on it. And so it's a Spark processor that was developed in conjunction
16098250	16103250	with the European Space Agency. So this is legit. The same kind of processes that are utilized in
16103250	16108410	space. So that's why we picked it for the competition. And then on top of that, we're
16108410	16116850	running a NASA product called Core Flight Software. We picked that because that's a really legitimate
16116850	16121750	flight software. It's open source. NASA has been huge in the community as far as releasing
16122270	16128870	their flight software that they are updating periodically. And there's a number of
16128870	16134510	applications that they have provided. And so we use that as a basis. And on top of that, we've
16134510	16138290	developed some custom applications that actually interface to the hardware that we're using in the
16138290	16144330	game. So that was our approach there. Now Latimer, how much would you say of the overall
16144330	16149370	system that you've got from the case to the boards, to the payload, to all the different modules that
16149370	16154390	how much did you develop? How much were off the shelf commercial components? How much were there
16154390	16160570	other vendors? What was the sort of breakdown of the overall system? Yeah. So on the flat side
16160570	16169050	itself, there's really like two major components, each with subcomponents. We had kind of a short
16169050	16173790	timeframe to develop all of this. So we, when we met, you know, starting, we were talking more
16173790	16179070	details in November of last year, we decided we need something quick that we can do to get
16179070	16183930	sensors and actuators. So in order to do that, we bought an off the shelf training satellite that
16183930	16191410	provides sun sensors. It has an IMU. It provides a gyro and magnetometers. It has torque rods,
16191410	16195250	just like a real satellite. It has a reaction wheel, just like a real satellite. So, you know,
16195250	16201970	that's one of the primary components. But that training satellite from a game perspective,
16201970	16206130	wasn't really interesting. It didn't really mimic, you know, like the kind of processors
16207070	16212430	that are running on like real satellites in space. So that's where we came up with the
16212430	16218410	CNVH board that we developed that has, you know, that Arctic seven and, and the Raspberry Pi.
16218890	16223610	So those are the two kind of primary components on the, on the, on the flat side.
16223750	16227970	And is that where most of the sort of the game occurs, you know, where the challenge is people
16227970	16232010	interacting and except that is the payload module, then a part of that, or that I know we're going to
16232010	16236110	maybe that's coming a little bit later, but like, where, where is that going to get factored in?
16237410	16239650	Yeah, that's part of it. Okay. All right.
16239870	16245470	Not going to talk too much about that because the team still have some things to figure out there.
16245610	16251630	But, you know, the intent from the beginning was to take a picture of the moon. We've been telling
16251630	16256130	the teams that, so the Pi is there really to provide an interface to the camera to allow
16256130	16262170	them to do that. And we put some interesting things in there that the teams will soon find
16262170	16265850	out about. Yeah, that makes sense. And I don't think anyone is surprised. They knew, they knew
16265850	16269550	the end goal kind of going in. I've definitely seen some chatter from them. So that shouldn't
16269550	16273450	be too much of a surprise. That's cool. One of the other things I, you know, I've been hearing a lot
16273450	16276450	about stuff, but I was involved in a lot of production side. So I didn't know a lot of these
16276450	16282270	details. When I first saw the air bearings in real life and understood, oh, wait, that's how that
16282270	16285470	works. That's what's happening. That blew me away. Can you talk a little bit more? You've got one
16285470	16293490	there. Tell us about how that works and what's going on. Yeah. So the air bearing is like two
16293490	16299770	precision pieces of aluminum. It really works almost like an air hockey set, like we played
16299770	16304710	with when we were kids. Like a table hockey. Yeah. Yeah. Yeah. So it has, you know, eight
16305750	16311910	machines or eight precision holes in it. And you know, we hook an air compressor up to it. We set
16311910	16318610	it to 10 PSI or so. And the top plate just floats on top of the air bearing and the satellites are
16318610	16324750	sitting on top of that. A lot of work went into actually getting that to work consistently.
16325030	16330770	And challenge two, we made the teams point at the sun for an entire revolution. And, you know,
16330770	16336330	I've been playing with that for months. Air compressor in my office running consistently.
16336550	16340590	So it was neat to see the teams do that too. And we didn't make it easy for them.
16340910	16346170	So yeah, that's essentially how it works. Excellent. Now, Jason Williams, how do you
16346170	16350050	get air then on a thing that's moving? You have the carousel spinning around. What was, I mean,
16350050	16353790	was that like a thing that you designed or built or bought or how did that work?
16354810	16359790	So the center of the carousel is not moving and that's where we have the air hose come in.
16360250	16365050	And then we have it hooked up to a manifold that distributes air to each of the teams on
16365050	16368790	the carousel itself. And an interesting thing about the carousel is actually it's driven
16369290	16374290	off of a slew drive, which is somebody, if you're familiar with solar tracking arrays,
16374290	16378510	the slew drive is what causes this solar tracking arrays to track the sun. So we actually got that
16378930	16383490	from China, had it shipped here. It was kind of difficult to get, but that's what the centerpiece
16383490	16389010	you see in the room there that's rotating the carousel about 15 minutes rotation, sorry,
16389010	16394890	15 minutes per single rotation. Awesome. Well, thank you both for taking some time out to discuss
16394890	16398570	this. This was awesome. I'm sure the audience appreciates it. We'll let you go back to the game
16398570	16404870	and we'll see our audience in another hour or so at our next update. Take care.
16404870	16407170	Thank you. Thanks.
19569780	19570300	So
19570300	19573960	hello and welcome back live with another competition update for Hackassat.
19573960	19578520	I'm your host Jordan Wines. First, let's take a quick look at our current scoreboard,
19578520	19583640	which at this point should be pretty familiar to everyone. Since our last update an hour ago,
19583640	19588200	we've actually seen no movement on the scoreboard yet. Challenge four is proving to be difficult
19588200	19593060	for the teams as we predicted it would be. But from the sound of it on the team chats,
19593060	19597820	they might be getting a little closer. So hopefully we'll see some movement soon there.
19598240	19602940	While we wait a little bit more game action, let's learn about the complexities of navigation
19602940	19608520	in space from our resident expert, Jess Coffey, in another episode of Space Talk.
19608780	19614380	Now that we've seen how precession takes place, let's try to predict its direction in this case.
19623780	19629280	So how do satellites know where they are? There are actually two completely separate dimensions
19629280	19634500	that we need to consider with satellites. The first being orbital parameters. This describes
19634500	19641000	the movement of the satellite over time, kind of like referencing a flight plan to tell where a
19641640	19646280	Basically, what direction am I facing? This is entirely independent of location for satellites
19646280	19652320	because there's no natural state that it's expected to be in. On Earth, that natural state
19652320	19660220	is aligned with gravity, basically upright, and satellites have no force or no natural state to
19660220	19665260	adhere to. Figuring out the orbital parameters of a satellite requires taking several observations
19665260	19669820	and deriving them. One way to obtain these observations is to use the same technology
19669820	19675440	we use here on Earth, an onboard GPS receiver. Additionally, we can look for them through
19675440	19681120	external sensors. NORAD tracks all objects in space through the United States Space Surveillance
19681120	19686980	Network, primarily using radar. Each object in space gets a unique ID assigned to it called a
19686980	19693780	NORAD ID, which is universally used by satellite operators to reference it. NORAD uses these
19693780	19699080	observations to derive the orbital parameters and uses two-line elements, or TLEs, as a standard for
19699080	19704200	providing all the orbital information. Here's an example of one for the International Space
19704200	19711100	Station. You can see the ISS's NORAD ID at the beginning of each line, 25544. The rest is used
19711100	19716420	to describe the orbital motion. This TLE is simply an estimation of the orbital trajectory and there
19716420	19721940	are inherent inaccuracies. The way we propagate orbital trajectories introduces an error that
19721940	19727580	becomes significant over time. The TLE format accounts for this by having a timestamp, or epoch,
19727580	19731860	built into it to indicate when it was taken. It is then valid for only about a week or two
19731860	19737320	around that epoch, depending on how important accuracy is for that specific satellite. As a
19737320	19742860	result, they must be constantly updated to keep from going stale. Now we know our orbital parameters,
19742860	19748320	what about the second category? Attitude. Space is full of a lot of nothing, but there are still
19748320	19753280	a few somethings that you can sense. The most common sensors are magnetometers, sun sensors,
19753280	19757880	and star cameras. Magnetometers are used by satellites when they are within Earth's magnetic
19757880	19763080	field. This is a very low fidelity measurement though, so it's typically not used by itself.
19763080	19768360	Sun sensors are photodiodes that measure light intensity. By putting these sensors in several
19768360	19774100	places surrounding the satellite, we can measure sunlight on each sensor, giving us the direction
19774100	19780080	of the sun. That, combined with location data, can give us a pointing accuracy of 10 degrees or less.
19780080	19785880	And finally, star cameras are the primary means of precise attitude measurement. Stars are far
19785880	19790740	enough away from us and moving slowly enough that we can treat them as constant for all but the
19790740	19796480	highest precision tasks. This means we can create a map of the star field that surrounds Earth,
19796480	19801600	and we can reference it to calculate exactly where a camera mounted on the satellite is pointing.
19801600	19806140	Now that we have determined our orbital parameters and orientation, we have a natural follow-on
19806140	19811140	question. How do I change them? Getting around in space, meaning both changing your direction and
19811140	19816580	changing your orientation, are difficult primarily because there is simply very, very little to work
19816580	19822000	with. All the modes of transportation here on Earth require exerting a force on your external
19822000	19827020	environment. Cars push their tires against the friction of the roadway, planes pull air through
19827020	19832180	their engines, and ships push water with their propellers. Again, satellite orbit and satellite
19832180	19837460	attitude are generally disconnected, so we have to control them separately. First, we'll cover how
19837460	19842460	do I change my orbit. In orbital motion, we don't actually point to where we want to go and start
19842460	19848300	moving there. Satellites are already moving at a tremendous speed, around 17,000 miles per hour in
19848300	19853640	low Earth orbit. Changing orbit in space actually consists of carefully adding and subtracting energy
19853640	19858820	at the right times. Not electrical energy, but rather the satellite's combined kinetic and
19858820	19864140	potential energy. Adding energy raises the orbit farther away from Earth and subtracting brings you
19864140	19868660	closer. Notice I didn't say going faster raises the orbit, because as you get farther away from
19868660	19874480	Earth, you actually slow down due to the properties of orbital dynamics. So we'll stick with the term
19874480	19880060	energy. Since the satellite already has so much energy that it acquired from launch to stay in
19880060	19885700	orbit, most changes are very small by comparison. Raising or lowering orbits to maintain or change
19885700	19890380	certain orbital characteristics a small amount. There are all kinds of technologies being developed
19890380	19895900	and in use to add and subtract energy from satellites, but the most common are thrusters.
19896060	19901300	Thrusters exist to eject fuel out of a spacecraft fast enough to change its momentum significantly.
19901300	19905840	This is the same way rockets work, and it comes from one of the fundamental laws of physics,
19905840	19909880	conservation of momentum. There are several different types of thrusters for spacecraft
19909880	19913800	that each have different trade-offs, but all of them operate on the core principle,
19913800	19919620	throw stuff out the back really fast. There are cold gas thrusters, which are the simplest ones.
19919620	19924580	They released compressed air to generate a small amount of thrust. There are chemical thrusters,
19924580	19929940	or miniaturized rockets, that are harnessing a chemical reaction to energize and release
19929940	19935020	fuel to generate thrust. And finally there are ion thrusters, which use electromagnetic force
19935020	19940120	to control, accelerate, and release charged particles to generate thrust. Now how do I
19940120	19944680	control the attitude? Satellites again have the problem that they exist in a literal vacuum.
19944680	19950200	You can't change your direction with a steering wheel, rudder, or flaps. To tackle this, they
19950200	19955020	actually make use of the same law of physics, but with a slight twist, conservation of angular
19955020	19960780	momentum. This one is easier to demonstrate in your daily life. If you ever spun yourself on a
19960780	19965440	chair, you probably realized that pulling your arms in will make you go slightly faster. This
19965440	19970780	is a demonstration of that law. Satellites make use of this through a technology called reaction
19970780	19976520	wheels. The core concept is there are very small wheels contained within the spacecraft, and if you
19976520	19981940	spin that wheel very very fast, you'll cause the spacecraft to react and spin in the opposite
19981940	19987240	direction. The motors that spin that wheel need to exert a torque to make that happen, and the same
19987240	19993060	opposing torque is then exerted back on the spacecraft, causing it to spin as well. All of
19993060	19998180	these technologies put together that allow you to determine the orbit, determine the attitude, and
19998180	20003340	control the orbit, and control the attitude, make up the satellite's attitude and orbital control
20003340	20008260	system, or AOCS, which is the most complex subsystem on most satellites.
20020700	20025320	Thanks, Jess, for that update. Before we sign off here, I want to give another update on the progress
20025320	20030940	of the on-orbit mission. Remember, we chose a single team solution to send to our orbiting
20030940	20035160	satellite. The ground control team is telling me that we have those commands scheduled to be sent
20035160	20040980	between 1 p.m. and 4 30 p.m pacific, and we are just now starting that comms window. Given the
20040980	20045840	orbit predictions of our satellite and the moon, we expect the actual photo to be taken around 6 30
20045840	20051020	pacific this evening. With any luck, we expect to receive that moon shot back here at Earth at 1 a.m
20051020	20056200	pacific tonight, and we'll have it for you tomorrow at the closing awards. That's it for this hour's
20056200	20063520	update. We'll see you back here at 4 45 eastern, 1 4 50 eastern, 1 p.m 1 50 pacific for a final
20063520	20067700	hourly update before our end of day recap tonight. Thanks, and have a good one.
23017800	23023000	Welcome back to another episode of Competition Update, space security challenge style. I'm your
23023000	23028060	host, Jordan Wines. Several teams are showing indications that they're making progress on the
23028060	23033220	hardest challenge, number four, but we don't have any confirmed solutions yet. Be aware, though,
23033220	23038120	that at some point in the next few hours, the scoreboard might be going off. Depending on the
23038120	23042660	organizers, anyway, many in-person CTFs have a tradition of blanking the scoreboard toward the
23042660	23047920	end for a little bit of increased drama, and I'm told we might see that happen here, so teams could
23047920	23052360	slip in a surprise solution when that happens. With no point decay, you probably have no incentive
23052360	23057120	to hold back on an answer that you might otherwise do in a normal CTF. If you've been watching this
23057120	23062080	carousel webcams, you might have noticed the occasional astronaut heading into space around
23062080	23066660	our flatsats. Let's go ahead and take a look now. Oh, we've got some audio. Let's see if we can mute
23066660	23073670	that. I'm not sure if it's coming through on that. Yeah, unfortunately, we've got a little bit too
23073670	23078630	much audio on that video, so we're going to have to probably kill that one. The video that you're
23078630	23083610	not seeing actually has some of the CubeSats in slow motion. If you've been watching the webcams,
23083610	23092890	we've actually got different views showing each of the satellites, the flatsats, as they're spinning
23092890	23097450	around orienting themselves on top of the sun. If we can stop this video before we zoom, it's
23097450	23100990	going to be really good, or else you're going to hear some really, really interesting background
23100990	23107810	noise. So one of our explorers was able to get that video. It showed 1550 trees flatsat as it
23107810	23111290	actually orbited around the room. We'll make sure to get that up on the YouTube playlist afterwards
23111290	23115270	so you can catch it. It was able to keep itself oriented on the sun as it went around the room,
23115270	23119390	that of course being one of the previous challenges. All right, for more information
23119390	23123150	on the other things that have been going on behind the scenes, we're going to see if we can bring
23123150	23128210	Alex Taylor from CrimeAlerts into the feed as well. Alex, can you hear me first of all?
23128650	23129850	Yeah, I can hear you great.
23129850	23133730	And I hear you too. This is good. Awesome. All right, well, welcome to the stream. Thanks for
23133730	23134050	coming on.
23134050	23134770	Thank you.
23135290	23139330	Okay, so first, can you tell me a little bit about what's been happening behind the scenes? I talked
23139330	23143910	to Bryce, I talked to the Jasons, and they kind of gave me some updates on some of the design
23143910	23148770	things. But in terms of what's actually happening like today and yesterday, anything interesting
23148770	23149370	been going on?
23150110	23158590	Sure. So all of the flatsats in the room are connected to the ground stations that the teams
23158590	23166250	are on via radios. So one of the things that we have to do occasionally is move some of the radios
23166250	23170930	around the room. Sometimes there's some interference, either from other radios, or, you
23170930	23173750	know, just from things that they get moved around in the room.
23173750	23176450	Somebody starts to microwave a floor below or something, maybe?
23176450	23177630	Yeah, sure.
23178330	23183430	I mean, there's some bits of metal and stuff that might be in the way, too. So one of the
23183430	23188190	things that you might see people come into frame doing is moving some of those radios around just
23188190	23193150	to make sure that teams are not getting large amounts of packet loss when they're communicating
23193150	23194370	with the satellites.
23195230	23199010	Yeah, a little bit less deterministic than, I guess, a network challenge where the networks
23199010	23203330	are a little bit more reliable. When you're working with RF for every connection you make,
23203330	23205530	you've got to deal with a little bit of that. That makes sense.
23205530	23210070	Yeah, and something we had to communicate to teams earlier as well is that this isn't
23210190	23213650	a network service. So they have to be very careful with the amount of data that they're
23213650	23220070	sending. They don't want to trip over themselves and cause their messages to not get completely
23220070	23220790	sent.
23220790	23224310	I saw that message going on in the team chat. And I like that because you kind of, as an
23224310	23227910	organizer, you have to strike the balance between how much information you give. And,
23227910	23230390	you know, you don't want to give a hint on something that may help one team more than
23230390	23234570	others. But you want to also help everyone make productive progress. You don't want people
23234570	23238790	to be doing things that might hurt themselves. How else do you kind of have to deal with
23238790	23243070	fairness? Have any other kind of concerns that have come up throughout the game so far?
23243470	23249430	Sure, yeah. So actually, early on day one, we realized that we had left a couple of files
23249430	23255630	on certain teams' command and control systems from some earlier testing that we had done
23255630	23264550	to make sure the challenges were solvable. Fortunately, the files that were left behind,
23265110	23269550	you know, would have given teams an unfair advantage in the competition. But what we did
23269550	23276710	is we decided to put all those files together into a single archive and give those out to all
23276710	23281850	of the teams so that if we were wrong, and those files contained something that was useful,
23281850	23286650	at least every team had access to the same information before those challenges got released.
23286970	23289870	Yeah, no, that makes sense. And I think that's, you know, you always have to, as an organizer,
23289870	23295230	balance what decisions you make, and trying to be fair is certainly important. One thing I'm
23295230	23299930	asking everyone, what is your favorite challenge? And if it's not one we've seen yet, no spoilers,
23299930	23302910	but if it's one we've already seen about, you can, of course, talk in detail, or even just
23302910	23306850	which one you worked on that you thought was most interesting. Sure. Well, that's an interesting
23306850	23311990	question. So you might expect me to say challenge zero, since that was the one I worked on.
23311990	23317730	Yeah, yeah. Right. I would also say that challenge five, which is coming up, is pretty cool because
23317730	23322710	it's the culmination of everything that the teams have been doing. My personal favorite,
23322710	23326870	though, is probably challenge three, just because it's, it's the kind of challenge I would be
23326870	23331550	interested in solving. If I were playing this event, my background is very heavy on reverse
23331550	23336550	engineering and exploitation. And that's exactly what you have to do to solve the challenges,
23336550	23341250	have a heavy amount of reverse engineering, you wind up with an exploit. It's good stuff.
23341370	23345110	Yeah, I agree. That's why I highlighted that one as well. So Alex, thank you very much for taking
23345110	23349490	some time out from helping keep the game going. Let's get back to that and we'll continue wrapping
23349490	23357510	up this update. Thanks for having me. Finally, here's our last Space Talk episode of the event
23357510	23361670	from Just Coffee with a summary of how communications in space work, something our
23361670	23367110	teams have surely demonstrated competence with over these past few days. Why do we use satellites
23367110	23370910	like these for long distance communication?
23380950	23385290	Communicating with a satellite ranges from several buildings worth of highly specialized
23385290	23390430	equipment to a couple hundred dollars worth of handheld amateur radio hardware. LEOSATs,
23390430	23395910	only about 400 to 2000 kilometers up, are even close by terrestrial standards. That means simple
23395910	23399850	ham radios are often used to communicate with them. There's even one aboard the International
23399850	23404090	Space Station that you can use to talk to the astronauts if you catch them at the right time
23404090	23407990	and they're not too busy. The complexity with communicating with LEO satellites is actually
23407990	23413790	their orbital speed. LEOSATs are moving so quickly that we have to use antennas that track them as
23413790	23418430	they move rapidly across the sky. This tracking can be really difficult due to the uncertainty
23418430	23424250	of the satellite location and how fast they move in and out of view. A satellite coming in and out
23424250	23429210	of view from horizon to horizon is called a pass. Passes are the only times that we can actually
23429210	23434670	communicate with satellites. Management of LEO satellites especially revolves entirely around
23434670	23439550	this concept of passes and maximizing their effectiveness. For instance, it doesn't help
23439550	23444690	having an imaging satellite over the target location if you didn't have a pass before it
23444690	23449870	got to that location to tell it to take that photo. Similarly, you have to wait until the next pass
23449870	23455190	to be able to actually bring that data back down to ground. Passes are roughly about five to ten
23455190	23460610	minutes for LEO satellites. This duration changes drastically based on where the ground station is
23460610	23465210	located. Near the equator, the Earth's rotation actually causes the ground station and the
23465210	23470170	satellite to lose contact with each other faster. But near the poles, Earth's rotation is negligible
23470170	23475510	and the satellite is actually in view for almost twice as long, if not more. Essentially, the higher
23475510	23480230	the latitude of your ground station, the more useful your passes actually end up being. This
23480230	23484730	is the reason most ground stations are located in the higher latitudes, even in the very hard
23484730	23490390	to reach locations. One of the best examples of that is Svalbard, a Norwegian archipelago that's
23490390	23495830	extremely close to the North Pole. It has over a hundred commercial ground station antennas,
23495830	23498850	making it the largest commercial ground station in the world.
23508180	23512720	As always, thanks Jess for the content and thanks to the team at the different studios for that
23512720	23517980	awesome editing and animations that go into those Space Talk episodes. That's our last hourly update
23517980	23523320	of the competition. I look forward to seeing everyone at 4 p.m. Pacific, 7 p.m. Eastern, as we
23523320	23530780	will have our final daily recap where we will reveal which team's solution is being run on our satellite.
26519130	26520530	so
27530810	27836560	A little pause... and we are back.
27836560	27836660	A little pause... and we are back.
28369270	28371150	A little pause... and we are back.
28371150	28371330	A little pause... and we are back.
30697790	30841930	A little pause... and we are back.
30841930	30842010	A little pause... and we are back.
30842390	30848070	Welcome to Space Security Challenge 2020, HackASAT, the final event.
30848070	30852980	As the democratization of space opens up a new frontier for exploration and innovation,
30853270	30856600	we see new cybersecurity vulnerabilities emerging.
30857870	30862730	The Space Security Challenge is designed to inspire the world's top cybersecurity talent
30862730	30867800	to develop the skills necessary to secure this last frontier of cybersecurity,
30868310	30872370	space. And already we've made a ton of progress.
30872390	30878030	I'll catch you up. This spring we hosted over 2,000 teams who worked their way through a set
30878030	30884450	of foundational space cybersecurity challenges in our HackASAT qualification round. Now,
30884450	30890950	eight finalist teams are stepping up to the ultimate challenge. They are hacking a satellite.
30897840	30903880	Welcome to the Saturday Daily Recap of Space Security Challenge 2020, or HackASAT.
30903880	30908800	For the second to last time, I'm your host, Jordan Wines, and it's time to fill you in
30908800	30913520	on how our competitors did on day two of this first-of-its-kind satellite hacking competition.
30913600	30916980	Okay, let's get right to the moment everyone's been waiting for.
30917040	30921800	Here is our video to show which team was selected for the on-orbit challenge.
30923400	30930220	Oh, I'm sorry. Actually, it appears that we're experiencing some technical difficulties.
30930620	30933640	Yeah, I guess that means you're going to have to listen to the rest of this update.
30933640	30938220	And then we'll play the big reveal at the end instead. So let's take a look back at today's
30938220	30950410	action. In fact, let's go ahead and take a look at the scoreboard now in our live octagon feed.
30951150	30955850	And they definitely haven't slowed down. You'll notice that Solarwine actually scored first blood
30955850	30961110	on challenge three. Congratulations to them for the great work overnight. You can also see Flux
30961110	30966850	Repeat Rocket scoring just before this broadcast with only a 5% reduction in total points. That
30966850	30971670	means Solarwine and Flux Repeat Rocket are both moving on to challenge four. While the score
30971670	30976650	hasn't changed, we have had one important game milestone pass us by. We timed out unavailable
30976650	30981350	points for challenge three. That means those two teams, Solarwine and Flux Repeat Rocket,
30981350	30985050	they've obtained points for that challenge, and all other teams were given a solution script
30985050	30994520	so they can focus on the next challenge. If you've been following along at home,
30994520	30998580	you know that we sprung our on-orbit challenge on our teams yesterday. We had four teams submit
30998580	31004820	their solutions by 4 p.m. Pacific, our deadline for evaluation for on-orbit, but only one was
31004820	31009360	selected to have their code sent to the live satellite to capture a moonshot. We will learn
31009360	31016160	who that lucky team is later on in the broadcast. While today's action started strong with several
31016160	31020360	early scores, teams really struggled their way through challenge four today. While the organizers
31020360	31024900	knew it would be the hardest challenge, the hope was that it would be solved before this point.
31024900	31030140	In fact, in the last hour of the competitions, some team had run so low on power that the
31030140	31034900	organizers offered to take the flatsats offline so they could plug them into power. This would
31035640	31039520	mean teams would have challenges in solving challenge five, but hopefully it would give
31039520	31044900	them enough power and time to solve challenge four in the last few minutes. Given that,
31044900	31048920	here is our explanation for the challenge four solution.
31050020	31056100	Challenge four. Here's what we know. We've restored communication with the payload module,
31056100	31061380	but we still can't operate it. The challenge? Now teams must restore normal operations of the
31061380	31067000	payload module so we can access the imager. Here's how they do it. Teams discover that the payload
31067000	31071900	module bootloader has been corrupted, which is why the payload module is not operating normally.
31071900	31076260	The teams discover a system console to the payload module and the ability to access the
31076260	31081760	module system console by controlling an undocumented GPIO and multiplexer on the
31081760	31087300	CNDH board. The teams must write a custom flight software application that can control the GPIO
31087300	31092000	and enable access to the payload system console. After writing the application,
31092000	31097020	the teams must upload it to the CNDH and execute it. Once the teams have access to the system
31097020	31101780	console, they will identify that it has been corrupted. The teams will need to research
31101780	31106560	nominal kubos bootloader configuration and repair the payload module's bootloader to resume proper
31106560	31117040	operation of the payload module. As I mentioned during a previous update, there was always a
31117040	31121540	chance that the scoreboard was going to go dark. And sure enough, with 30 minutes left in the
31121540	31126120	competition, as teams were hopefully nearing it on a challenge 4 solution, the organizers decided
31126120	31131200	to keep us all in suspense. Here's a look at our final scoreboard that everyone saw before it went
31131200	31138420	dark. As we can tell, we had a couple of solves later on, but early was where most of the action
31138420	31144100	happened. However, with our accepted and rejected on orbit status, we knew that there was two teams
31144100	31149540	who would not be eligible for final prizes. We will make the final actual scores available tomorrow
31149540	31153900	during the closing ceremony. Before you make your predictions on our podium winners, let's
31153900	31159020	take a look at the final challenge 5 to see what it was teams would have had to solve after they
31159020	31167440	finished challenge 4. Challenge 5. Here's what we know. We've done our best work, and it seems that
31167440	31173500	we've regained control of the satellite. But how do we know for sure? The challenge? Teams must
31173500	31178280	prove that we are fully in control of the satellite system by successfully imaging the moon.
31188150	31191870	I thought I could have solved some of these challenges, and the answer was almost certainly
31191870	31196470	not. I've got a lot of respect for the teams out there who made progress at all through this event.
31196470	31200950	With a very difficult environment, very different to what many other CTFs have to do,
31200950	31204990	there's a lot of extra constraints you have to worry about. For more information on that, let's
31204990	31210730	do one last Q&A session with Jason Latimer to talk about how teams were approaching challenge 4.
31210830	31216150	Let's see if we can get him in here. Jason, do you hear me? Yeah, I got you. Excellent. I hear you as
31216150	31223610	well. Great. So, we're wrapped up. The game is over. I hopped into a couple of your calls,
31223610	31229350	and I was listening to you guys describe some of the approaches teams were taking on challenge 4.
31229350	31232070	I thought there's some really, really interesting things that came out. I'd love to hear a little
31232070	31237890	bit more from your perspective. Yeah, so the background on challenge 4 was that, you know,
31237890	31243050	the teams had gotten past the implant that the adversary had put on the satellite, and that they
31243050	31247650	were trying to use the payload, and quickly found that the payload wasn't functional.
31248830	31254670	So, what the adversary had done was corrupted the bootloader, and so they had to, you know,
31254670	31259750	uncorrupt the bootloader. There were a number of approaches. Teams seemed to be struggling in the
31259750	31264570	beginning. So, at one point, we gave a hint that said, hey, you need to write an application that's
31264570	31270410	capable of communicating with the system console and enabling that system console via GPIO.
31270910	31277530	Very quickly, teams started uploading their custom CFS applications. Some teams were just
31277530	31283190	trying to enable the GPIO to control the system console based on other GPIOs that were already on
31283190	31288570	the system, and they had done that successfully. And then we had some unique approaches where teams
31288570	31298710	were trying to upload applications that could do like TFTP transfers to the device. So, we had a
31299350	31303210	application that they're compiling. Was this like just a standard compiler they could use,
31303210	31307410	or what sort of information about that environment did they have to have to build
31307410	31312210	these custom applications? Yeah. So, it's actually a little bit more complicated than that, and we
31312210	31316530	didn't want that to be the challenge behind the whole, you know, restoring the bootloader. So,
31316530	31321250	we actually did provide to the teams ahead of time the RTEMs build environment they would need to
31321250	31327630	build an application. And then we provided also a set of example applications that they could use
31327630	31333530	as a template for creating this application that would restore the bootloader on the payload.
31333690	31337070	There was still quite a bit of challenges there because there were specific peripherals that
31337070	31345450	they'd have to be able to control. So, I'm talking to, you know, specific UART and GPIO drivers to
31345450	31350050	do that. So, it was non-trivial. Yeah. What did your solution look like? I mean, it just sort of
31350050	31355090	like did it rebuild it, or how did your intended solution work on that? Yeah. So, we had a custom
31355090	31362410	application that ran in CFS that could talk to the Raspberry Pi system console over the UART. So,
31362410	31367130	it was literally like talking to this, you know, system console. We would send a command and we
31367130	31373010	could, you know, do an LS on the shell or whatever it was. And through that, we could restore the
31373010	31378990	bootloader via just typical system console commands. But in order to actually enable that UART, we had
31379790	31386310	a GPIO that was hidden. So, one of the challenges for challenge four was actually looking through
31386310	31392310	the FPGA Verilog and VHDL code and finding that that actually existed. So, we had gotten some
31392310	31396490	feedback during quals that, you know, teams were really interested in doing that kind of
31397130	31402570	documentation reverse engineering. So, we went to a lot of effort to make sure that that existed. So,
31402570	31407790	to even identify that that was there, they were doing code inspections of the VHDL and the Verilog
31407790	31412950	for the FPGA. Now, I heard hints that, like, at least one team was doing something creative with,
31412950	31420210	like, direct memory writes. What do we know about that? All we know about that, well,
31421890	31426830	teams were doing uploads of applications, but it looked like some teams were using the direct
31426830	31432010	memory writes to actually interact with that shell, the Raspberry Pi shell. So,
31432150	31437510	a little different than our approach. But yeah, it was interesting. If it gets your code running,
31437510	31442510	it gets it working, right? There's no points for the jankiness or the cleverness. It's just,
31442510	31445870	does it solve the challenge, right? So, one of the things that I just mentioned to people,
31445870	31450550	of course, was the power constraints and how many of the satellites were running low on power at the
31450550	31455330	end from a lot of movement throughout the day and a lot of usage and the sort of option they had to
31455330	31459890	get connected to a ground power. Tell me how that changed the sort of Challenge 5 requirements. And
31459890	31464910	if a team was able to solve a Challenge 4 after the SCOVR went dark, would they have been able to
31464910	31469810	do it from the ground or was that completely impossible or what happened there? Yeah. So,
31469810	31473770	we talked with the organizers and based on the fact that we had these power constraints
31474670	31479190	and that the teams that had elected to be put on the ground wouldn't be able to get a picture of
31479190	31484750	the moon, we adjusted the criteria for Challenge 5 to just be get a picture. It was interesting to
31484750	31492190	see what the different... it was interesting to see what the different teams were doing as far
31492190	31497850	as power. Some teams had conserved their power throughout the day and other teams had not. So,
31497850	31503250	we had some teams that were in the running to solve Challenge 4 that said, hey, we don't want
31503250	31506830	to be put on the ground. We'll just stay on the carousel. We've been good with the batteries all
31506830	31511570	day. And we actually mentioned that in an earlier update here that power was potentially a concern
31511570	31514890	and it was nice that teams weren't entirely out of the running, right? There was sort of
31514990	31520050	a backup mechanism, but it cost them time while their flat set was taken down, was rewired in,
31520050	31523670	so that was sort of a penalty for exercising that option, although they weren't kind of out
31523670	31527550	of the running entirely. That works out great. All right, well, thank you very much for taking
31527550	31533110	time to talk to us and we'll continue on with the rest of our update. Thank you.
31534350	31539090	All right, now the moment that you hopefully have actually been waiting for. We're going
31539090	31543390	to answer the question as to which team had their code sent into space tonight.
31544330	31549070	So, the video that we're going to look at here is the same one that I previewed earlier. So,
31549070	31553730	we can see Poland Can is the very first team to get an acceptable payload. We knew that from
31553730	31558430	watching the scoreboard and got reasonably close. Next coming in are going to be several other
31558430	31563310	teams, ADD Vulcan number two, and then number three, Flux Repeat Rocket. So, we've got the
31563310	31567990	three quickest ones and then we're going to have right here a Samurai come in. So, these were the
31567990	31572510	four that came in before the timeline. So, if we stop right now, this is our launch cutoff, right?
31572510	31577970	So, these were the teams that came in and if we look at closest to the bullseye, you can see that
31577970	31583130	Poland Can did a space, just beat out Flux Repeat Rocket with the most accurate solution
31583130	31589030	during our window. And this is the payload that's being run on an actual satellite right now. So,
31589030	31594410	we're looking forward to getting the results back from that tonight as it runs. And then tomorrow
31594410	31598170	during the live event, we're going to show you, hopefully, the moonshot. We'll find out how
31598170	31602230	accurate it was. And of course, we're going to continue the run here because as I mentioned
31602230	31606930	earlier, we know there was that sort of like sudden death for the last two slots, right? And
31606930	31611630	we could see the teams that were two more slots that were available. And so, after that 7 p.m.
31611690	31616230	cutoff, we had a quick 1550 tree that was able to make it in. But we also noticed that Poland Can
31616690	31620850	really got in close. And so, they got a really, really nice solution. They kept iterating on it.
31620850	31625890	There was no points for it. There was no extra... it was not considered for the on-orbit. But it
31625890	31632650	was so good that the individuals we had evaluating all of the solutions, they had a lot of automation,
31632650	31635750	but there was also, I guess, a little bit of an art to it. They were explaining that they thought
31635750	31641910	that final Poland Can was so beautiful that it was like a piece of art. They loved that final
31641910	31648250	solution. And then, of course, we had our last solve here coming in that's going to be from
31648250	31653790	PFS, which we've already revealed. They were the last team to make it into the qualifying minimal
31653790	31660710	acceptable range, which unfortunately left our two other teams, which were SolarWind and 1064
31660710	31667650	Seabred, not in the running for that. So, first of all, congrats to Team Poland Can Into Space
31667650	31673130	for submitting not only the best solution overall throughout the whole evaluation period,
31673130	31677670	but the solution that is going to space. Let's see their team bio again.
31710120	31716160	And into space, I can confirm that your commands were uplinked in our comms window earlier today.
31716160	31720980	We expect the moonshot to happen in a couple of hours at 630 Pacific, and that picture will be
31720980	31725440	sent down to Earth at about 1 a.m. Pacific. We will reveal what is hopefully a clear moonshot
31725440	31730300	picture at tomorrow's closing ceremonies. It all depends on how accurate your command really was.
31730300	31734480	Fingers crossed. You'd think that just watching instead of playing would be less stressful,
31734480	31738060	and I'm sure it was worse for our competitors, but even in the production room, we were cheering
31738060	31741660	and sweating along with our teams as they worked their way through these challenges.
31741860	31747400	Thanks very much for joining us throughout this event. That's it for today's recap. Make sure you
31747400	31752500	tune in to Hackensack Closing Ceremonies tomorrow at 11 Pacific, where we will hopefully reveal the
31752500	31758080	world's first CTF moonshot taken by Poland Canada Space. We'll also show you the overall contest
31758080	31762800	results and award the prizes to our teams and reveal what happened after the scoreboard went
31762800	31767520	dark. We'll also hear closing remarks by Dr. Will Roper from the U.S. Space Force and Air Force
31767520	31771740	Acquisition Chief. Be sure to also check out all the great happenings going on at DEFCON
31771740	31776620	and in the Aerospace Village. See you tomorrow at 11 Pacific for the Closing Ceremonies.