1
00:00:00,540 --> 00:00:04,923
- James Pavur is here to
talk about satellite hacking.

2
00:00:06,420 --> 00:00:07,353
Thanks for coming.

3
00:00:09,690 --> 00:00:11,070
- Hi, everyone.

4
00:00:11,070 --> 00:00:12,180
I'm James Pavur.

5
00:00:12,180 --> 00:00:15,360
I work with the Directorate
for Digital Services,

6
00:00:15,360 --> 00:00:18,030
which is part of the
Pentagon's new Chief Digital

7
00:00:18,030 --> 00:00:19,950
and AI Office.

8
00:00:19,950 --> 00:00:21,720
I do all kinds of weird things there

9
00:00:21,720 --> 00:00:24,300
from like rapid-response
software engineering,

10
00:00:24,300 --> 00:00:26,610
to cybersecurity stuff, to policy stuff,

11
00:00:26,610 --> 00:00:30,000
depending on what matters to
the country on any given day.

12
00:00:30,000 --> 00:00:32,820
But today, what I want
to talk about has been

13
00:00:32,820 --> 00:00:34,620
an interest of mine for a long time,

14
00:00:34,620 --> 00:00:37,920
and that is satellite cybersecurity.

15
00:00:37,920 --> 00:00:38,880
And in particular,

16
00:00:38,880 --> 00:00:42,690
how we protect the radio links
we use to talk to satellites.

17
00:00:42,690 --> 00:00:44,790
In this talk, we'll kind of go over

18
00:00:44,790 --> 00:00:47,640
why satellite cybersecurity
is becoming so important.

19
00:00:47,640 --> 00:00:50,250
We'll look at the history of
satellite radio exploitation,

20
00:00:50,250 --> 00:00:52,350
which has been going on for decades.

21
00:00:52,350 --> 00:00:54,270
We'll develop two new threat models,

22
00:00:54,270 --> 00:00:56,100
one that looks at using radio attacks

23
00:00:56,100 --> 00:00:57,240
against rocket launches,

24
00:00:57,240 --> 00:00:59,280
and one that looks at using radio attacks

25
00:00:59,280 --> 00:01:00,840
to hijack other people's satellites

26
00:01:00,840 --> 00:01:02,520
and transmit your own messages.

27
00:01:02,520 --> 00:01:03,353
And then we'll conclude

28
00:01:03,353 --> 00:01:05,550
by talking about how people
like you in the audience

29
00:01:05,550 --> 00:01:08,613
might contribute to future
research in this area.

30
00:01:09,630 --> 00:01:14,610
So satellite cybersecurity has
been in the limelight lately.

31
00:01:14,610 --> 00:01:16,740
Many of you have probably heard of KA-SAT,

32
00:01:16,740 --> 00:01:18,810
which is a satellite over Europe

33
00:01:18,810 --> 00:01:21,000
operated by the company Viasat.

34
00:01:21,000 --> 00:01:23,070
And in February,

35
00:01:23,070 --> 00:01:26,280
more or less concurrent with
Russia's invasion of Ukraine,

36
00:01:26,280 --> 00:01:29,910
there was a cyber attack
on Viasat's network.

37
00:01:29,910 --> 00:01:31,470
It caused a disruption first

38
00:01:31,470 --> 00:01:33,900
in modems located within Ukraine,

39
00:01:33,900 --> 00:01:36,510
but it quickly spread
to thousands of modems

40
00:01:36,510 --> 00:01:38,580
across the continent of Europe,

41
00:01:38,580 --> 00:01:40,230
and affected not just those modems,

42
00:01:40,230 --> 00:01:43,680
but the systems which
rely on those modems.

43
00:01:43,680 --> 00:01:47,280
Most notably, about 5,000
wind turbines in Germany

44
00:01:47,280 --> 00:01:49,890
were disrupted and lost
access to critical weather

45
00:01:49,890 --> 00:01:52,770
and operational data
for a pretty long time.

46
00:01:52,770 --> 00:01:55,740
Now, the Viasat attack was
not a radio jamming attack,

47
00:01:55,740 --> 00:01:57,570
like we'll be talking about today,

48
00:01:57,570 --> 00:01:59,340
but it does tell us some interesting stuff

49
00:01:59,340 --> 00:02:01,170
for kind of positioning this talk

50
00:02:01,170 --> 00:02:03,750
and why space security is important.

51
00:02:03,750 --> 00:02:06,270
Viasat is a commercial space company.

52
00:02:06,270 --> 00:02:08,850
They sell internet
services to governments,

53
00:02:08,850 --> 00:02:11,580
but also to many civilians,
many wind turbines,

54
00:02:11,580 --> 00:02:13,500
many people who just need
to browse the internet.

55
00:02:13,500 --> 00:02:14,880
And we see how satellites

56
00:02:14,880 --> 00:02:16,500
with this inherently dual-use nature

57
00:02:16,500 --> 00:02:20,760
are becoming increasingly
popular targets for adversaries,

58
00:02:20,760 --> 00:02:22,650
both at wartime and in peace.

59
00:02:22,650 --> 00:02:24,180
And we see why that can be bad.

60
00:02:24,180 --> 00:02:27,270
It can affect people who
are unrelated to a conflict

61
00:02:27,270 --> 00:02:29,820
as kind of spillover collateral damage.

62
00:02:29,820 --> 00:02:32,160
And space security is a domain

63
00:02:32,160 --> 00:02:34,770
where that spillover
risk is very, very high.

64
00:02:34,770 --> 00:02:37,590
And so securing these
systems is very important.

65
00:02:37,590 --> 00:02:40,140
When you're in geostationary Earth orbit,

66
00:02:40,140 --> 00:02:43,560
you can't see the silly lines
that people draw on maps.

67
00:02:43,560 --> 00:02:46,740
You see a third of the Earth's
surface at any given time.

68
00:02:46,740 --> 00:02:49,230
And so when we think about
how we protect satellites,

69
00:02:49,230 --> 00:02:51,300
simply passing a law in your country

70
00:02:51,300 --> 00:02:53,430
that is like, "you're not
allowed to hack satellites,"

71
00:02:53,430 --> 00:02:55,980
is meaningless because
that satellite radio signal

72
00:02:55,980 --> 00:02:58,500
is accessible from just across the border.

73
00:02:58,500 --> 00:02:59,880
A satellite in the Earth orbit

74
00:02:59,880 --> 00:03:03,510
will cross over dozens of
countries every single day.

75
00:03:03,510 --> 00:03:05,610
And so technical controls
to make it harder

76
00:03:05,610 --> 00:03:08,823
to attack these systems are
really important to develop.

77
00:03:10,050 --> 00:03:11,910
One way to think about
how to protect the future

78
00:03:11,910 --> 00:03:14,640
of space missions is to
take a look at the past.

79
00:03:14,640 --> 00:03:16,650
It turns out satellite
hacking has been going on

80
00:03:16,650 --> 00:03:19,080
for a very long time.

81
00:03:19,080 --> 00:03:20,970
I recently published a paper that looks at

82
00:03:20,970 --> 00:03:23,790
about a hundred different
satellite cybersecurity incidents.

83
00:03:23,790 --> 00:03:26,460
And everyone from big nation-state players

84
00:03:26,460 --> 00:03:28,560
like the Soviet Union
and the United States

85
00:03:28,560 --> 00:03:31,770
to individuals who just
wanted fame and notoriety

86
00:03:31,770 --> 00:03:34,110
have played the satellite hacking game.

87
00:03:34,110 --> 00:03:37,800
And one trend I picked out
is that overwhelmingly,

88
00:03:37,800 --> 00:03:40,980
people target the radio
link for satellites.

89
00:03:40,980 --> 00:03:43,230
This makes a lot of
intuitive sense, right?

90
00:03:43,230 --> 00:03:46,020
Because satellites are often very custom,

91
00:03:46,020 --> 00:03:47,790
very bespoke pieces of hardware.

92
00:03:47,790 --> 00:03:49,830
They work in kind of weird ways.

93
00:03:49,830 --> 00:03:50,663
And as an attacker,

94
00:03:50,663 --> 00:03:53,280
you may not know how the
space platform works,

95
00:03:53,280 --> 00:03:56,280
but radio waves follow some
very basic physical principles.

96
00:03:56,280 --> 00:03:58,680
There are only so many
communications protocols used

97
00:03:58,680 --> 00:04:00,150
to transmit radio signals.

98
00:04:00,150 --> 00:04:01,740
And so it's a very common target

99
00:04:01,740 --> 00:04:04,230
for attackers to hit satellites.

100
00:04:04,230 --> 00:04:06,390
In recent years, we've seen
an increase in attacks,

101
00:04:06,390 --> 00:04:07,470
like the one with Viasat,

102
00:04:07,470 --> 00:04:09,540
targeting satellite ground stations.

103
00:04:09,540 --> 00:04:10,590
Also makes a lot of sense.

104
00:04:10,590 --> 00:04:11,580
Satellite ground stations

105
00:04:11,580 --> 00:04:13,590
are becoming more like
commercial IT systems

106
00:04:13,590 --> 00:04:16,320
that are just plugged into
antennas that talk to satellites.

107
00:04:16,320 --> 00:04:17,970
And so they're more exploitable.

108
00:04:17,970 --> 00:04:20,370
My guess is that middle
line, the satellite payload,

109
00:04:20,370 --> 00:04:21,630
so the thing in orbit,

110
00:04:21,630 --> 00:04:23,970
will end up getting many
more attacks this decade

111
00:04:23,970 --> 00:04:25,110
than in previous decades,

112
00:04:25,110 --> 00:04:27,303
as those also become more commodity IT.

113
00:04:28,170 --> 00:04:30,810
But regardless, the bread
and butter of space hacking

114
00:04:30,810 --> 00:04:32,880
has been, and I think will continue to be,

115
00:04:32,880 --> 00:04:34,860
radio-based attacks.

116
00:04:34,860 --> 00:04:38,520
The first radio-based attack
I found was in the 1970s.

117
00:04:38,520 --> 00:04:39,353
There was a dispute

118
00:04:39,353 --> 00:04:41,853
between the Soviet Union
and the United States.

119
00:04:42,840 --> 00:04:43,920
The Soviet Union asserted

120
00:04:43,920 --> 00:04:46,920
that the US was transmitting
what's basically propaganda

121
00:04:46,920 --> 00:04:49,140
into Soviet territory from US satellites.

122
00:04:49,140 --> 00:04:51,360
And they said that they
had a sovereign right

123
00:04:51,360 --> 00:04:53,550
to jam these illegal radio signals

124
00:04:53,550 --> 00:04:55,410
on someone else's satellite.

125
00:04:55,410 --> 00:04:57,150
They weren't the first country to assert

126
00:04:57,150 --> 00:04:58,230
or execute this right.

127
00:04:58,230 --> 00:05:00,390
There are many countries
who view satellite jamming

128
00:05:00,390 --> 00:05:02,790
as an acceptable form
of information control.

129
00:05:02,790 --> 00:05:05,520
And it's a big policy debate
that's still happening today

130
00:05:05,520 --> 00:05:07,530
in terms of like, when is it appropriate

131
00:05:07,530 --> 00:05:09,990
to interfere with radio
signals from satellites?

132
00:05:09,990 --> 00:05:11,580
Because they are those inherently

133
00:05:11,580 --> 00:05:13,743
internationally-visible objects.

134
00:05:14,760 --> 00:05:17,250
I think one of the biggest
space security developments

135
00:05:17,250 --> 00:05:19,740
though wasn't in the sphere
of big nation states.

136
00:05:19,740 --> 00:05:21,240
It was actually an individual,

137
00:05:21,240 --> 00:05:24,000
a guy going by the
pseudonym Captain Midnight

138
00:05:24,000 --> 00:05:26,910
transmitted this image
to thousands of viewers

139
00:05:26,910 --> 00:05:29,610
of HBO satellite television one night.

140
00:05:29,610 --> 00:05:34,080
He was protesting recent changes
in HBO's subscriber model.

141
00:05:34,080 --> 00:05:35,880
And what's interesting about this attack

142
00:05:35,880 --> 00:05:37,500
is that it was just a guy.

143
00:05:37,500 --> 00:05:39,660
He was a satellite radio enthusiast,

144
00:05:39,660 --> 00:05:42,000
but he certainly wasn't a nation state.

145
00:05:42,000 --> 00:05:44,160
And he didn't just jam the radio signal.

146
00:05:44,160 --> 00:05:47,520
He actually hijacked it and
transmitted his own message.

147
00:05:47,520 --> 00:05:49,230
Within a matter of months,

148
00:05:49,230 --> 00:05:52,020
Congress had passed specific legislation

149
00:05:52,020 --> 00:05:53,250
making this activity,

150
00:05:53,250 --> 00:05:55,530
interfering with satellite radio signals,

151
00:05:55,530 --> 00:05:58,350
a felony punishable by
up to 25 years in prison.

152
00:05:58,350 --> 00:06:00,630
So one, don't try this at home, kids.

153
00:06:00,630 --> 00:06:02,640
But two, I think it's really important

154
00:06:02,640 --> 00:06:04,950
to see how big of a move this was

155
00:06:04,950 --> 00:06:06,870
in terms of threat modeling.

156
00:06:06,870 --> 00:06:08,160
From Captain Midnight to today,

157
00:06:08,160 --> 00:06:09,840
there are too many incidents to list,

158
00:06:09,840 --> 00:06:11,100
but there are a couple ones

159
00:06:11,100 --> 00:06:12,660
that I think are worth highlighting.

160
00:06:12,660 --> 00:06:15,270
We see increased activity
from non-state actor groups.

161
00:06:15,270 --> 00:06:17,280
So for example, Falun Gong,

162
00:06:17,280 --> 00:06:20,160
which is kind of a religious
and protest movement in China,

163
00:06:20,160 --> 00:06:23,190
heavily persecuted by the
Chinese Communist Party,

164
00:06:23,190 --> 00:06:26,460
hijacked a satellite TV signal
to broadcast a message out

165
00:06:26,460 --> 00:06:28,890
during prime viewing hours
about their movement.

166
00:06:28,890 --> 00:06:30,960
This is something that lots
of non-state actor groups do,

167
00:06:30,960 --> 00:06:32,970
whether they be terrorists sending threats

168
00:06:32,970 --> 00:06:35,280
or activist movements
trying to get a message out

169
00:06:35,280 --> 00:06:37,200
to an audience they otherwise can't reach.

170
00:06:37,200 --> 00:06:38,880
We're seeing more non-state activity

171
00:06:38,880 --> 00:06:41,223
in the space, radio interference game.

172
00:06:42,240 --> 00:06:43,980
On a kind of the smaller scale of things,

173
00:06:43,980 --> 00:06:47,280
there was also a really
interesting incident in 2009,

174
00:06:47,280 --> 00:06:50,940
where a number of Brazilian
truckers were arrested

175
00:06:50,940 --> 00:06:53,820
for hijacking a US military
satellite transponder

176
00:06:53,820 --> 00:06:56,820
and using it as basically
a long-range cell service.

177
00:06:56,820 --> 00:06:59,700
So FLTSAT-8 was a
military-operated satellite,

178
00:06:59,700 --> 00:07:02,460
and these ham radio enthusiasts
were basically using it

179
00:07:02,460 --> 00:07:06,060
to transmit messages to each
other across the Amazon.

180
00:07:06,060 --> 00:07:08,430
What's interesting here
is that these individuals

181
00:07:08,430 --> 00:07:11,190
were not like incredibly
well-resourced hackers.

182
00:07:11,190 --> 00:07:12,750
They weren't like space people.

183
00:07:12,750 --> 00:07:14,910
Their primary job was trucker.

184
00:07:14,910 --> 00:07:17,880
Their secondary enthusiasm
was for ham radio

185
00:07:17,880 --> 00:07:20,760
and they were still able
to engage in these attacks.

186
00:07:20,760 --> 00:07:24,300
One final incident I think is
worth mentioning is in 2018,

187
00:07:24,300 --> 00:07:26,970
Norway and Finland accused Russia

188
00:07:26,970 --> 00:07:29,280
of interfering with GPS signals

189
00:07:29,280 --> 00:07:33,420
during some NATO war exercises
from a base in the Arctic.

190
00:07:33,420 --> 00:07:35,310
And we'll talk about
GPS interference today.

191
00:07:35,310 --> 00:07:37,950
It's actually not that
technically hard of an attack

192
00:07:37,950 --> 00:07:38,820
to pull off.

193
00:07:38,820 --> 00:07:39,750
But I think what's interesting

194
00:07:39,750 --> 00:07:41,130
is that this was not a precursor

195
00:07:41,130 --> 00:07:42,960
to an invasion of Norway by Russia.

196
00:07:42,960 --> 00:07:45,780
This was something done
during a time of unpeace

197
00:07:45,780 --> 00:07:48,510
or relative peace just
as a form of harassment.

198
00:07:48,510 --> 00:07:51,000
And as we think about
securing space assets,

199
00:07:51,000 --> 00:07:52,920
this idea that countries may mess

200
00:07:52,920 --> 00:07:55,050
with each other's space
assets during times of peace,

201
00:07:55,050 --> 00:07:58,320
I think is particularly
concerning and a good motivator

202
00:07:58,320 --> 00:08:00,783
for why we need space cybersecurity now.

203
00:08:02,100 --> 00:08:04,740
So how do these kinds of
jamming attacks happen?

204
00:08:04,740 --> 00:08:06,210
What's the basic principle

205
00:08:06,210 --> 00:08:09,120
of interfering with
satellite radio signals?

206
00:08:09,120 --> 00:08:11,910
We start with an antenna.
This is a piece of metal.

207
00:08:11,910 --> 00:08:14,520
It's of a certain size
and a certain shape.

208
00:08:14,520 --> 00:08:17,610
And you apply electrical
pulses to the antenna

209
00:08:17,610 --> 00:08:19,860
and it generates an electromagnetic wave,

210
00:08:19,860 --> 00:08:22,380
which is basically a thing in the universe

211
00:08:22,380 --> 00:08:24,180
that emanates out from the antenna.

212
00:08:24,180 --> 00:08:25,830
And that wave has a particular shape,

213
00:08:25,830 --> 00:08:29,010
a particular pattern
in which it modulates.

214
00:08:29,010 --> 00:08:30,720
And that pattern is dictated

215
00:08:30,720 --> 00:08:32,490
by how you apply those electrical pulses

216
00:08:32,490 --> 00:08:34,800
to the stick of metal
that is your antenna.

217
00:08:34,800 --> 00:08:37,590
Now, when you look at
this electromagnetic wave

218
00:08:37,590 --> 00:08:38,910
on a receiving antenna,

219
00:08:38,910 --> 00:08:41,430
you can apply some math to this shape

220
00:08:41,430 --> 00:08:44,130
and you can basically
convert the information

221
00:08:44,130 --> 00:08:45,750
that's encoded in the stream back

222
00:08:45,750 --> 00:08:48,330
to the pulses that were
used to generate it.

223
00:08:48,330 --> 00:08:50,250
And you can say, all of the pulses

224
00:08:50,250 --> 00:08:52,620
that fall into this quadrant of the graph

225
00:08:52,620 --> 00:08:53,670
are the number one.

226
00:08:53,670 --> 00:08:55,860
All the ones that fall into
this quadrant of the graph

227
00:08:55,860 --> 00:08:57,930
are the number zero.

228
00:08:57,930 --> 00:09:00,540
And that's the core idea of
digital-signal processing.

229
00:09:00,540 --> 00:09:02,670
It's taking something
physical in the world

230
00:09:02,670 --> 00:09:05,340
and converting it into
kind of a symbol space

231
00:09:05,340 --> 00:09:07,050
that can be used to
communicate information

232
00:09:07,050 --> 00:09:08,223
between computers.

233
00:09:09,060 --> 00:09:10,890
Now, when a jammer gets involved,

234
00:09:10,890 --> 00:09:12,690
what ends up happening is this math

235
00:09:12,690 --> 00:09:16,200
operates not just on the
legitimate wave that's being sent,

236
00:09:16,200 --> 00:09:18,780
but kind of a summation of
both the legitimate wave

237
00:09:18,780 --> 00:09:22,350
plus an illegitimate wave
on a very similar frequency.

238
00:09:22,350 --> 00:09:24,780
And so when you sum these waves together

239
00:09:24,780 --> 00:09:26,730
and they're carrying different messages,

240
00:09:26,730 --> 00:09:29,670
you no longer have that nice,
neat constellation of symbols

241
00:09:29,670 --> 00:09:31,590
that map to specific sections on a graph.

242
00:09:31,590 --> 00:09:34,200
So now you don't know what's
a zero and what's a one.

243
00:09:34,200 --> 00:09:35,340
Your information is corrupted

244
00:09:35,340 --> 00:09:36,480
and it can no longer be received.

245
00:09:36,480 --> 00:09:39,570
And this is just a physical
fact of the way radios work.

246
00:09:39,570 --> 00:09:41,193
So it's very hard to get around.

247
00:09:42,300 --> 00:09:45,120
Even more interestingly, if our
attacker has a lot of power,

248
00:09:45,120 --> 00:09:47,820
if their jammer is really, really strong,

249
00:09:47,820 --> 00:09:49,560
they can actually engage
in a hijacking attack.

250
00:09:49,560 --> 00:09:51,870
When you add their malicious signal

251
00:09:51,870 --> 00:09:54,000
to the very weak, legitimate signal,

252
00:09:54,000 --> 00:09:56,400
the legitimate signal is
basically background noise,

253
00:09:56,400 --> 00:09:58,740
and you end up with a nice,
neat constellation again,

254
00:09:58,740 --> 00:10:00,300
but with the wrong information.

255
00:10:00,300 --> 00:10:03,210
So this is how something like
the Captain Midnight attack

256
00:10:03,210 --> 00:10:04,413
is possible.

257
00:10:05,490 --> 00:10:07,170
So what's special about satellites

258
00:10:07,170 --> 00:10:08,490
in the context of radio jamming?

259
00:10:08,490 --> 00:10:10,440
What makes it a particularly
interesting area

260
00:10:10,440 --> 00:10:12,713
to think about jamming attacks?

261
00:10:12,713 --> 00:10:15,180
I think one of the most important numbers

262
00:10:15,180 --> 00:10:17,190
in satellite radio communications

263
00:10:17,190 --> 00:10:20,280
is something called free space path loss.

264
00:10:20,280 --> 00:10:21,870
And it's expressed by this formula here.

265
00:10:21,870 --> 00:10:24,750
It's basically how much
weaker a radio signal gets

266
00:10:24,750 --> 00:10:27,300
the further away from
a transmitter you are.

267
00:10:27,300 --> 00:10:29,400
And you don't have to
worry about the numbers,

268
00:10:29,400 --> 00:10:32,040
but it's a square of the
distance is the important thing.

269
00:10:32,040 --> 00:10:35,070
So every step further
from the antenna you go,

270
00:10:35,070 --> 00:10:37,590
the signal gets much, much weaker.

271
00:10:37,590 --> 00:10:40,290
This makes sense if you kind
of think of a radio wave

272
00:10:40,290 --> 00:10:42,570
as a sphere that emanates
out from an antenna

273
00:10:42,570 --> 00:10:45,000
and the surface area of that sphere

274
00:10:45,000 --> 00:10:46,830
will have the same amount of energy on it.

275
00:10:46,830 --> 00:10:49,320
But as the sphere gets
further and further away,

276
00:10:49,320 --> 00:10:50,640
it inflates like a balloon

277
00:10:50,640 --> 00:10:53,010
and eventually dissipates
into the universe.

278
00:10:53,010 --> 00:10:54,840
And so as the balloon inflates,

279
00:10:54,840 --> 00:10:57,030
you get less and less
energy hitting your antenna

280
00:10:57,030 --> 00:10:59,940
and that drops off really dramatically.

281
00:10:59,940 --> 00:11:02,580
So this concept of free space path loss

282
00:11:02,580 --> 00:11:04,590
is why attacks like this are possible.

283
00:11:04,590 --> 00:11:07,170
So this is a news article from 2016

284
00:11:07,170 --> 00:11:09,120
when Pokemon GO was really popular

285
00:11:09,120 --> 00:11:12,270
about people who were using
software-defined radios

286
00:11:12,270 --> 00:11:15,390
to spoof their GPS signals
and cheat at the game

287
00:11:15,390 --> 00:11:17,850
and basically appear in
different continents and stuff.

288
00:11:17,850 --> 00:11:20,550
And if you aren't super
familiar with radio jamming,

289
00:11:20,550 --> 00:11:23,250
this might not make any
sense to you, right?

290
00:11:23,250 --> 00:11:26,610
A GPS satellite is a
billion-dollar government project.

291
00:11:26,610 --> 00:11:27,443
It's got to have

292
00:11:27,443 --> 00:11:29,490
a great, powerful, really
high-end transmitter.

293
00:11:29,490 --> 00:11:32,280
Software-defined radio is
like 200 bucks off the shelf.

294
00:11:32,280 --> 00:11:34,200
So how can you win out?

295
00:11:34,200 --> 00:11:35,820
And if we plug in the numbers

296
00:11:35,820 --> 00:11:38,100
to that free space path loss equation,

297
00:11:38,100 --> 00:11:39,420
we can start to see why.

298
00:11:39,420 --> 00:11:42,360
So the signal that comes
from a GPS satellite

299
00:11:42,360 --> 00:11:45,780
is really weak by the time it
travels all 20,000 kilometers

300
00:11:45,780 --> 00:11:48,870
from a MEO to the Earth's surface

301
00:11:48,870 --> 00:11:50,880
to the antenna on your cell phone.

302
00:11:50,880 --> 00:11:51,720
Meanwhile,

303
00:11:51,720 --> 00:11:54,300
the signal that comes from a
relatively weak transmitter

304
00:11:54,300 --> 00:11:56,850
on your lab bench is still much stronger

305
00:11:56,850 --> 00:11:59,340
because it doesn't have
that massive amount of time

306
00:11:59,340 --> 00:12:03,660
to be losing power to
free space path loss.

307
00:12:03,660 --> 00:12:05,520
And that's the crux of a
GPS-interference attack.

308
00:12:05,520 --> 00:12:07,620
You take advantage of physical proximity

309
00:12:07,620 --> 00:12:09,930
in order to be able to
override GPS signals.

310
00:12:09,930 --> 00:12:12,780
If you have the right protocols,
you can even spoof them.

311
00:12:12,780 --> 00:12:15,690
But fundamentally, it's just
about shouting the loudest.

312
00:12:15,690 --> 00:12:18,300
So we've talked a little
bit about GPS interference,

313
00:12:18,300 --> 00:12:19,800
but let's spice it up a little

314
00:12:19,800 --> 00:12:21,990
and think about GPS-interference attacks

315
00:12:21,990 --> 00:12:22,830
in a different domain.

316
00:12:22,830 --> 00:12:26,820
So specifically, GPS-interference
attacks in space,

317
00:12:26,820 --> 00:12:31,650
and looking at kind of
specifically rocket launches

318
00:12:31,650 --> 00:12:34,680
and what happens if a rocket
doesn't know where it is

319
00:12:34,680 --> 00:12:36,810
because of GPS interference.

320
00:12:36,810 --> 00:12:38,310
So this image here

321
00:12:38,310 --> 00:12:41,460
is from the European Space
Agency's Vega mission,

322
00:12:41,460 --> 00:12:44,310
which is a fairly typical rocket launch,

323
00:12:44,310 --> 00:12:45,780
but it does have one interesting thing,

324
00:12:45,780 --> 00:12:48,360
which is that it's not
launching just one satellite.

325
00:12:48,360 --> 00:12:50,070
There are dozens of satellites

326
00:12:50,070 --> 00:12:52,560
that are sharing the cost
of this ride to space.

327
00:12:52,560 --> 00:12:53,940
And they come from entities

328
00:12:53,940 --> 00:12:56,670
who don't necessarily know
each other or trust each other,

329
00:12:56,670 --> 00:12:58,590
have any relationship prior to the launch.

330
00:12:58,590 --> 00:12:59,730
This particular mission

331
00:12:59,730 --> 00:13:02,040
carried everything from an asset belonging

332
00:13:02,040 --> 00:13:04,350
to a Russian nuclear physics institute,

333
00:13:04,350 --> 00:13:07,680
to Israeli tech startup, to
the Air Force of Thailand

334
00:13:07,680 --> 00:13:10,380
on a shared journey towards the stars.

335
00:13:10,380 --> 00:13:11,850
And in our threat model today,

336
00:13:11,850 --> 00:13:14,190
we're going to imagine
that one of these entities

337
00:13:14,190 --> 00:13:15,240
is malicious.

338
00:13:15,240 --> 00:13:19,080
They put a CubeSat, a small
satellite, onto this rocket

339
00:13:19,080 --> 00:13:21,900
that is designed to try
to disrupt the mission

340
00:13:21,900 --> 00:13:23,820
by causing GPS interference

341
00:13:23,820 --> 00:13:26,100
that makes the rocket
not know where it is.

342
00:13:26,100 --> 00:13:28,650
Now, turns out you can't just like walk up

343
00:13:28,650 --> 00:13:30,780
to Elon Musk with a block of C4

344
00:13:30,780 --> 00:13:32,550
and say, please attach
this to your rocket.

345
00:13:32,550 --> 00:13:34,560
I promise I won't blow it up.

346
00:13:34,560 --> 00:13:37,650
There are safety controls
on rocket launches

347
00:13:37,650 --> 00:13:39,660
that try to make CubeSats

348
00:13:39,660 --> 00:13:42,930
and secondary payloads not
threaten the overall mission.

349
00:13:42,930 --> 00:13:45,990
In the US, the dominating
documents for this

350
00:13:45,990 --> 00:13:48,810
are something called the
CubeSat Design Specification,

351
00:13:48,810 --> 00:13:50,520
which dictates how CubeSats

352
00:13:50,520 --> 00:13:52,380
and small satellites
should look and behave.

353
00:13:52,380 --> 00:13:53,880
And the Air Force Space Manual,

354
00:13:53,880 --> 00:13:56,160
which dictates kind of how
rocket launches should behave

355
00:13:56,160 --> 00:13:59,310
and how secondary payload
should keep them safe.

356
00:13:59,310 --> 00:14:01,260
And if we dig into these documents,

357
00:14:01,260 --> 00:14:04,380
the situation looks quite
grim for our attacker,

358
00:14:04,380 --> 00:14:06,120
our radio jammer.

359
00:14:06,120 --> 00:14:07,860
They're all kinds of very sensible rules

360
00:14:07,860 --> 00:14:09,210
that get in the way of radio jamming,

361
00:14:09,210 --> 00:14:11,640
stuff like CubeSats
aren't allowed to turn on

362
00:14:11,640 --> 00:14:13,380
while they're attached
to the launch vehicle.

363
00:14:13,380 --> 00:14:14,490
They have to have these little switches

364
00:14:14,490 --> 00:14:16,050
that are pressed down
and keep them turned off.

365
00:14:16,050 --> 00:14:18,270
Or when you separate
from the launch vehicle,

366
00:14:18,270 --> 00:14:21,210
you have to wait 45
minutes in low Earth orbit

367
00:14:21,210 --> 00:14:24,060
before you can start
transmitting radio signals.

368
00:14:24,060 --> 00:14:26,130
But what's interesting about these rules,

369
00:14:26,130 --> 00:14:27,900
if we delve into them,

370
00:14:27,900 --> 00:14:29,280
is that the way they're enforced

371
00:14:29,280 --> 00:14:31,500
is often just a matter of paperwork.

372
00:14:31,500 --> 00:14:33,690
Nobody's checking each other's CubeSats

373
00:14:33,690 --> 00:14:35,160
to be sure they comply.

374
00:14:35,160 --> 00:14:37,680
The person who built the
CubeSat either contracts out

375
00:14:37,680 --> 00:14:40,080
or conducts themselves
a day-in-the-life test,

376
00:14:40,080 --> 00:14:42,060
where they kind of pretend
the launch is happening

377
00:14:42,060 --> 00:14:43,080
and record what occurred,

378
00:14:43,080 --> 00:14:45,480
and they sign a form
saying that the CubeSat

379
00:14:45,480 --> 00:14:47,250
behaves like it's supposed to.

380
00:14:47,250 --> 00:14:50,100
This works great when
everyone shares the same goals

381
00:14:50,100 --> 00:14:51,900
of having a safe rocket launch,

382
00:14:51,900 --> 00:14:54,360
but it doesn't necessarily
hold up quite so well

383
00:14:54,360 --> 00:14:56,370
when someone is either deceptive

384
00:14:56,370 --> 00:14:58,560
or deceived in how their CubeSat behaves,

385
00:14:58,560 --> 00:15:01,260
if it behaves like differently on orbit.

386
00:15:01,260 --> 00:15:03,060
So what we're gonna do today

387
00:15:03,060 --> 00:15:05,040
is try to break some of these rules

388
00:15:05,040 --> 00:15:07,770
and then see how far a notional CubeSat,

389
00:15:07,770 --> 00:15:09,960
a very small inexpensive satellite,

390
00:15:09,960 --> 00:15:13,110
can get in terms of GPS
interference in low Earth orbit.

391
00:15:13,110 --> 00:15:14,823
So after the rocket has launched.

392
00:15:15,990 --> 00:15:17,040
During the launch period,

393
00:15:17,040 --> 00:15:19,890
our CubeSat is gonna behave
just like it's supposed to.

394
00:15:19,890 --> 00:15:20,940
It's gonna be turned off.

395
00:15:20,940 --> 00:15:23,880
It's gonna look like a
fairly regular CubeSat.

396
00:15:23,880 --> 00:15:24,960
It's not gonna do anything

397
00:15:24,960 --> 00:15:26,760
while we're attached to the rocket.

398
00:15:26,760 --> 00:15:29,130
But the moment we separate
from the launch vehicle,

399
00:15:29,130 --> 00:15:31,410
so when we're in orbit, we're
gonna start misbehaving.

400
00:15:31,410 --> 00:15:34,650
We're gonna start to transmit
radio signals 45 minutes

401
00:15:34,650 --> 00:15:36,210
before we're supposed to.

402
00:15:36,210 --> 00:15:38,730
And these radio signals
are going to be designed

403
00:15:38,730 --> 00:15:40,530
to overlap with GPS signals.

404
00:15:40,530 --> 00:15:42,150
So they're gonna target
with a specific frequency

405
00:15:42,150 --> 00:15:44,610
that comes from GPS satellites.

406
00:15:44,610 --> 00:15:48,123
Now, why would someone want
to do this sort of thing?

407
00:15:49,260 --> 00:15:51,990
It turns out rockets are super dangerous.

408
00:15:51,990 --> 00:15:53,790
And if they stray from their flight path,

409
00:15:53,790 --> 00:15:55,590
you can either hurt a lot
of people on the ground

410
00:15:55,590 --> 00:15:57,480
or accidentally start World War III.

411
00:15:57,480 --> 00:15:59,970
And so there are very low tolerances

412
00:15:59,970 --> 00:16:01,710
for rockets that misbehave.

413
00:16:01,710 --> 00:16:03,780
Traditionally, there's
actually a guy on the ground

414
00:16:03,780 --> 00:16:06,900
called a range safety officer
who has a big red button.

415
00:16:06,900 --> 00:16:08,670
And if the rocket's telemetry says

416
00:16:08,670 --> 00:16:10,110
that it's going off of its path,

417
00:16:10,110 --> 00:16:11,250
they can press that button

418
00:16:11,250 --> 00:16:14,190
and trigger what's called a
flight-termination sequence.

419
00:16:14,190 --> 00:16:15,660
The rocket will self-destruct,

420
00:16:15,660 --> 00:16:19,440
the goal being to burn up
before it hits the ground.

421
00:16:19,440 --> 00:16:22,650
Now, what's changing these
days is we're starting to move

422
00:16:22,650 --> 00:16:24,840
towards these devices called AFTSs,

423
00:16:24,840 --> 00:16:27,300
autonomous flight termination systems.

424
00:16:27,300 --> 00:16:29,460
And they use sensor data
from the launch vehicle,

425
00:16:29,460 --> 00:16:33,390
specifically GPS inputs
and accelerometer data,

426
00:16:33,390 --> 00:16:36,810
in order to make that fly,
no-fly decision in real time.

427
00:16:36,810 --> 00:16:38,400
And they can trigger a flight termination

428
00:16:38,400 --> 00:16:40,290
without a human in the loop.

429
00:16:40,290 --> 00:16:41,550
This is really, really great

430
00:16:41,550 --> 00:16:43,170
if you lose communications
with your rocket

431
00:16:43,170 --> 00:16:45,030
and still need to terminate the mission.

432
00:16:45,030 --> 00:16:47,400
But it means that if you
can't trust the sensor data

433
00:16:47,400 --> 00:16:48,540
coming into your AFTS,

434
00:16:48,540 --> 00:16:50,760
because it might be
vulnerable to an attack,

435
00:16:50,760 --> 00:16:51,960
then there are all kinds of risks

436
00:16:51,960 --> 00:16:54,003
to the overall safety of the mission.

437
00:16:54,990 --> 00:16:56,160
So in order to understand

438
00:16:56,160 --> 00:16:58,710
if a CubeSat could mess
with this sensor data,

439
00:16:58,710 --> 00:17:00,720
we have to model a couple of things.

440
00:17:00,720 --> 00:17:02,970
First, we have to model
the motion of the CubeSat.

441
00:17:02,970 --> 00:17:07,380
So I did this using a astrodynamics
tool called FreeFlyer.

442
00:17:07,380 --> 00:17:09,690
And it turns out it's a
very low-tech process.

443
00:17:09,690 --> 00:17:12,060
You basically have these
tubes called P-PODs,

444
00:17:12,060 --> 00:17:13,950
which are attached to the launch vehicle.

445
00:17:13,950 --> 00:17:16,410
They have a spring on one
end and a door on the other.

446
00:17:16,410 --> 00:17:18,210
And at some point in the
mission, the door opens

447
00:17:18,210 --> 00:17:20,340
and the spring just kind
of gently yeeds the CubeSat

448
00:17:20,340 --> 00:17:21,420
out into space.

449
00:17:21,420 --> 00:17:22,590
And it just drifts away

450
00:17:22,590 --> 00:17:25,053
from the rocket at a fairly low speed,

451
00:17:25,890 --> 00:17:28,680
which means that you've got
this really long window of time

452
00:17:28,680 --> 00:17:30,450
when you've got a proximity advantage,

453
00:17:30,450 --> 00:17:32,490
you've got that free
space path loss advantage,

454
00:17:32,490 --> 00:17:35,040
and you're kind of hanging
out close to the rocket.

455
00:17:35,910 --> 00:17:37,020
If we take those numbers

456
00:17:37,020 --> 00:17:39,600
and then plug them into some basic models

457
00:17:39,600 --> 00:17:40,770
like free space path loss,

458
00:17:40,770 --> 00:17:42,840
how strong we'd expect
a radio signal to be

459
00:17:42,840 --> 00:17:44,520
from an antenna on the CubeSat,

460
00:17:44,520 --> 00:17:46,320
we can get a sense of what a jammer

461
00:17:46,320 --> 00:17:49,320
might theoretically be
able to get into an antenna

462
00:17:49,320 --> 00:17:52,590
on the rocket that it separated from.

463
00:17:52,590 --> 00:17:54,210
And so that's what I did here.

464
00:17:54,210 --> 00:17:55,740
You've got this dotted line at the top,

465
00:17:55,740 --> 00:17:57,570
which is what the GPS signal would be

466
00:17:57,570 --> 00:17:59,880
if there was no interference going on.

467
00:17:59,880 --> 00:18:01,200
And then the curved lines,

468
00:18:01,200 --> 00:18:02,670
the further down the graph they are,

469
00:18:02,670 --> 00:18:06,840
the more disruption there
is to GPS communications.

470
00:18:06,840 --> 00:18:08,850
If we map these models from the simulation

471
00:18:08,850 --> 00:18:12,540
to the characteristics of
high-end GPS receivers today,

472
00:18:12,540 --> 00:18:14,130
we can get a sense of what this means.

473
00:18:14,130 --> 00:18:19,130
So the green zone is
where the GPS reception

474
00:18:19,470 --> 00:18:20,670
would be basically perfect.

475
00:18:20,670 --> 00:18:22,320
You wouldn't have any
dilution of precision

476
00:18:22,320 --> 00:18:23,910
that you'd know where the rocket was.

477
00:18:23,910 --> 00:18:25,890
The yellow zone is where
you start to have issues.

478
00:18:25,890 --> 00:18:26,723
And then the red zone

479
00:18:26,723 --> 00:18:29,220
is where you have serious
degradation in GPS performance

480
00:18:29,220 --> 00:18:32,580
and may not be able to determine
the location of the rocket.

481
00:18:32,580 --> 00:18:33,780
Now, this isn't to say

482
00:18:33,780 --> 00:18:35,640
that like it's easy to launch a CubeSat

483
00:18:35,640 --> 00:18:36,540
and blow up a rocket.

484
00:18:36,540 --> 00:18:38,880
I think there's a lot of
operational challenges

485
00:18:38,880 --> 00:18:40,470
in actually doing that.

486
00:18:40,470 --> 00:18:41,700
But I think it is worth highlighting

487
00:18:41,700 --> 00:18:43,110
that the radio environment,

488
00:18:43,110 --> 00:18:46,080
even when you're thinking
about assets that are in space,

489
00:18:46,080 --> 00:18:49,230
is not necessarily a safe
or a trusted environment.

490
00:18:49,230 --> 00:18:53,220
Radio waves are inherently
public physical phenomenon.

491
00:18:53,220 --> 00:18:55,320
And so when you design
your space missions,

492
00:18:55,320 --> 00:18:58,050
or when you think about space
hardware or rocket design,

493
00:18:58,050 --> 00:18:59,220
you need to keep in mind

494
00:18:59,220 --> 00:19:03,150
that you can't necessarily
trust radio data at face value

495
00:19:03,150 --> 00:19:05,950
or trust that it will be there
for you when you need it.

496
00:19:06,870 --> 00:19:08,460
So this is an example of an attack

497
00:19:08,460 --> 00:19:11,310
where we mess with a signal
that is coming from space

498
00:19:11,310 --> 00:19:13,140
to something close to the ground.

499
00:19:13,140 --> 00:19:15,060
But there's a different way
to look at space jamming,

500
00:19:15,060 --> 00:19:17,670
which is to flip things around

501
00:19:17,670 --> 00:19:19,470
and look at signal hijacking attacks.

502
00:19:19,470 --> 00:19:22,770
So attacks like the
Captain Midnight incident.

503
00:19:22,770 --> 00:19:24,330
These are scenarios where you want to get

504
00:19:24,330 --> 00:19:27,750
a broadcast satellite in orbit
to transmit your message,

505
00:19:27,750 --> 00:19:28,710
instead of the message

506
00:19:28,710 --> 00:19:31,310
that it's supposed to be
transmitting for its owner.

507
00:19:32,340 --> 00:19:35,310
To understand these kinds
of signal hijacking attacks,

508
00:19:35,310 --> 00:19:36,630
it's good to have a basic understanding

509
00:19:36,630 --> 00:19:38,670
of how broadcast satellites work.

510
00:19:38,670 --> 00:19:41,400
And this applies to most
broadcast satellites.

511
00:19:41,400 --> 00:19:43,980
There's a bit of a shift towards
more complicated devices,

512
00:19:43,980 --> 00:19:46,320
but most of them work like this still.

513
00:19:46,320 --> 00:19:48,000
You've got a ground station,

514
00:19:48,000 --> 00:19:50,610
which could be something
that's physically constructed,

515
00:19:50,610 --> 00:19:53,160
a big antenna on a rooftop,
or it could be like a van,

516
00:19:53,160 --> 00:19:55,650
like the sort of van you
see following a news crew.

517
00:19:55,650 --> 00:19:58,080
And you point the dish
on that ground station

518
00:19:58,080 --> 00:20:00,810
up at a satellite in orbit

519
00:20:00,810 --> 00:20:04,260
and transmit a message on
a specific radio frequency

520
00:20:04,260 --> 00:20:05,700
towards a device on the satellite

521
00:20:05,700 --> 00:20:07,500
which is called a transponder.

522
00:20:07,500 --> 00:20:12,500
And transponders are basically
these analog antenna setups.

523
00:20:12,720 --> 00:20:15,270
And they'll receive a
frequency on one signal.

524
00:20:15,270 --> 00:20:17,430
Or they'll receive a signal
on a specific frequency

525
00:20:17,430 --> 00:20:18,660
and then they'll take that signal

526
00:20:18,660 --> 00:20:19,800
and they'll send it out again

527
00:20:19,800 --> 00:20:22,200
on a different frequency
down to the customers,

528
00:20:22,200 --> 00:20:24,030
so it'll be over a really wide area

529
00:20:24,030 --> 00:20:25,170
underneath that satellite

530
00:20:25,170 --> 00:20:28,140
and picking up the
message that's being sent.

531
00:20:28,140 --> 00:20:31,320
Now, the important thing to
know about these transponders

532
00:20:31,320 --> 00:20:34,410
is that they are very, very dumb.

533
00:20:34,410 --> 00:20:36,870
Satellites are expensive.
You don't want them to break.

534
00:20:36,870 --> 00:20:40,080
And many of these are
basically analog devices.

535
00:20:40,080 --> 00:20:43,140
If you send a message
on the right frequency

536
00:20:43,140 --> 00:20:45,870
to a transponder in the
right spot in orbit,

537
00:20:45,870 --> 00:20:48,900
it will dutifully relay
that like a bent pipe.

538
00:20:48,900 --> 00:20:50,400
It just takes whatever comes in

539
00:20:50,400 --> 00:20:52,710
and sends whatever comes out.

540
00:20:52,710 --> 00:20:54,990
Now, many of you have probably figured out

541
00:20:54,990 --> 00:20:56,430
where this is going, right?

542
00:20:56,430 --> 00:20:57,690
If you are an attacker

543
00:20:57,690 --> 00:21:00,300
and you can send a
sufficiently strong signal

544
00:21:00,300 --> 00:21:01,680
into that pipe,

545
00:21:01,680 --> 00:21:03,090
what comes out the other side

546
00:21:03,090 --> 00:21:06,510
will be a combination of
your very, very strong signal

547
00:21:06,510 --> 00:21:10,080
and the legitimate transmitter's
relatively weak signal.

548
00:21:10,080 --> 00:21:12,660
And you will be able to
take over the message

549
00:21:12,660 --> 00:21:15,330
and send the broadcast that you want.

550
00:21:15,330 --> 00:21:18,270
So what does enough power look like

551
00:21:18,270 --> 00:21:19,833
in this kind of situation?

552
00:21:21,000 --> 00:21:23,280
I've gone ahead and put
together a little web tool

553
00:21:23,280 --> 00:21:25,770
that you all can actually play
with after the conference,

554
00:21:25,770 --> 00:21:27,420
there'll be a link at
the end of the slides,

555
00:21:27,420 --> 00:21:29,160
to model these sorts of scenarios

556
00:21:29,160 --> 00:21:33,030
and see kind of how power
interacts with geography in space.

557
00:21:33,030 --> 00:21:34,620
So we've gotten our model here.

558
00:21:34,620 --> 00:21:38,340
We have an attacker antenna
and a defender antenna.

559
00:21:38,340 --> 00:21:39,780
We can control the power levels

560
00:21:39,780 --> 00:21:41,880
of both antennas and their position.

561
00:21:41,880 --> 00:21:43,440
And then we can set up our simulation.

562
00:21:43,440 --> 00:21:44,910
So we can pick a specific satellite

563
00:21:44,910 --> 00:21:46,530
and see how much power the two antennas

564
00:21:46,530 --> 00:21:48,120
could get up to that device.

565
00:21:48,120 --> 00:21:50,190
So I'm gonna look at VIASAT-2 first.

566
00:21:50,190 --> 00:21:52,470
This is a satellite in
geostationary Earth orbit.

567
00:21:52,470 --> 00:21:54,630
So it's 30,000 kilometers away

568
00:21:54,630 --> 00:21:57,990
and doesn't move relative
to the Earth's surface.

569
00:21:57,990 --> 00:22:00,870
From way up here, the attacker
and defender ground station

570
00:22:00,870 --> 00:22:03,990
are basically the same distance
away from the satellite.

571
00:22:03,990 --> 00:22:05,640
So the attacker will need a jammer

572
00:22:05,640 --> 00:22:09,120
that is basically as strong
as the legitimate transmitter

573
00:22:09,120 --> 00:22:11,970
in order to overwhelm
that signal and take over.

574
00:22:11,970 --> 00:22:12,900
And that makes sense, right?

575
00:22:12,900 --> 00:22:13,890
When you're really far away,

576
00:22:13,890 --> 00:22:15,210
the distances on the Earth's surface

577
00:22:15,210 --> 00:22:16,380
don't matter quite as much

578
00:22:16,380 --> 00:22:19,080
as just the raw power that
you can pump into a signal.

579
00:22:20,010 --> 00:22:22,140
If we take a look at
closer satellites, though,

580
00:22:22,140 --> 00:22:23,430
those in low Earth orbit,

581
00:22:23,430 --> 00:22:26,010
things start to get a
little bit more interesting.

582
00:22:26,010 --> 00:22:28,830
So I'm gonna pull up a
low-Earth-orbiting satellite here

583
00:22:28,830 --> 00:22:30,120
called AQUA.

584
00:22:30,120 --> 00:22:32,520
This is an Earth-observation satellite.

585
00:22:32,520 --> 00:22:33,840
So it loops around the Earth every day,

586
00:22:33,840 --> 00:22:36,900
taking pictures for
scientific research and stuff.

587
00:22:36,900 --> 00:22:37,980
And we'll go ahead

588
00:22:37,980 --> 00:22:40,980
and look at how geography
can affect jamming potential

589
00:22:40,980 --> 00:22:42,750
in the context of low Earth orbit.

590
00:22:42,750 --> 00:22:45,630
So I've set AQUA to kind of
crest over the horizon here

591
00:22:45,630 --> 00:22:47,730
into the northern hemisphere.

592
00:22:47,730 --> 00:22:49,260
We're gonna take our attacker

593
00:22:49,260 --> 00:22:52,650
and we'll go ahead and
move them up to Michigan.

594
00:22:52,650 --> 00:22:55,200
So they're in a very different
spot from the defender.

595
00:22:55,200 --> 00:22:56,820
And then we'll wait a few seconds

596
00:22:56,820 --> 00:22:59,550
as AQUA starts to kind
of go over the horizon

597
00:22:59,550 --> 00:23:03,030
and make contact with the
defender ground station.

598
00:23:03,030 --> 00:23:05,820
And at some point, it'll
come in range of the defender

599
00:23:05,820 --> 00:23:07,290
and the defender will be able to start

600
00:23:07,290 --> 00:23:11,070
transmitting legitimate
radio signals to AQUA.

601
00:23:11,070 --> 00:23:13,980
So I've got the attacker
jammers very low now.

602
00:23:13,980 --> 00:23:15,810
We've got regular
communications right now.

603
00:23:15,810 --> 00:23:17,730
And then as we turn up the jammer,

604
00:23:17,730 --> 00:23:21,090
we can see that at a relatively
low level of jamming power,

605
00:23:21,090 --> 00:23:22,890
the attacker is able to take advantage

606
00:23:22,890 --> 00:23:24,750
of this geographic positioning

607
00:23:24,750 --> 00:23:26,910
to overwhelm the legitimate signal.

608
00:23:26,910 --> 00:23:30,060
This is true for every
satellite in low Earth orbit.

609
00:23:30,060 --> 00:23:31,800
The very nature of low Earth orbit

610
00:23:31,800 --> 00:23:33,840
means there will always be a point in time

611
00:23:33,840 --> 00:23:35,760
and a point in space where an attacker

612
00:23:35,760 --> 00:23:38,430
can have a very fundamental
geographic advantage

613
00:23:38,430 --> 00:23:39,263
for jamming.

614
00:23:39,263 --> 00:23:41,850
The attacker can always
build a cheaper jammer

615
00:23:41,850 --> 00:23:43,350
than the defender.

616
00:23:43,350 --> 00:23:45,330
Now, as the satellite crests the horizon,

617
00:23:45,330 --> 00:23:47,550
and moves away from the
attacker's line of sight,

618
00:23:47,550 --> 00:23:48,780
they will get weaker and weaker,

619
00:23:48,780 --> 00:23:51,900
and the defender will regain
their communications advantage.

620
00:23:51,900 --> 00:23:53,310
But I think it's at
least interesting to note

621
00:23:53,310 --> 00:23:55,740
how the geography of low
Earth orbit, in particular,

622
00:23:55,740 --> 00:23:58,920
creates these interesting
opportunities for jamming attacks.

623
00:23:58,920 --> 00:24:01,890
This tool is open source. You
all can play around with it.

624
00:24:01,890 --> 00:24:04,050
It's built on some really
neat JavaScript libraries.

625
00:24:04,050 --> 00:24:06,480
You can model all kinds
of different satellites

626
00:24:06,480 --> 00:24:07,440
and time periods.

627
00:24:07,440 --> 00:24:09,300
You can look at orbits
over multiple weeks.

628
00:24:09,300 --> 00:24:10,980
Or you can pick other objects

629
00:24:10,980 --> 00:24:13,200
like the Space Station for example,

630
00:24:13,200 --> 00:24:15,870
or the Starlink satellite,

631
00:24:15,870 --> 00:24:19,410
and just get an intuitive feel
for how geography interacts

632
00:24:19,410 --> 00:24:21,810
with when jammers can talk to satellites

633
00:24:21,810 --> 00:24:23,550
and how strong they need to be.

634
00:24:23,550 --> 00:24:25,680
And that's part of the
equation is the power side,

635
00:24:25,680 --> 00:24:27,210
but there's also the protocol side, right?

636
00:24:27,210 --> 00:24:28,740
You need to be sure the message

637
00:24:28,740 --> 00:24:30,540
that you're sending over this bent pipe

638
00:24:30,540 --> 00:24:34,230
is meaningful to the
receivers on the other side.

639
00:24:34,230 --> 00:24:37,680
So I've also put together
a model in GNU Radio

640
00:24:37,680 --> 00:24:40,380
using flowgraphs that can
actually let you walk through

641
00:24:40,380 --> 00:24:42,180
the process of generating these signals.

642
00:24:42,180 --> 00:24:44,430
And this is in the same Git repository

643
00:24:44,430 --> 00:24:46,530
that'll be at the end of the slide deck.

644
00:24:46,530 --> 00:24:47,910
And these are two flowgraphs here.

645
00:24:47,910 --> 00:24:51,570
They're using an awesome
out-of-tree module for DVB-S2,

646
00:24:51,570 --> 00:24:53,370
digital video broadcasting for satellite,

647
00:24:53,370 --> 00:24:54,840
which is a common protocol

648
00:24:54,840 --> 00:24:56,910
for satellite radio communications.

649
00:24:56,910 --> 00:24:59,610
The top flowgraph is the
legitimate transmitter.

650
00:24:59,610 --> 00:25:01,980
The bottom flowgraph is
the illegitimate one.

651
00:25:01,980 --> 00:25:03,720
They're both basically the same,

652
00:25:03,720 --> 00:25:05,610
except the message inside is different.

653
00:25:05,610 --> 00:25:08,220
They're transmitting different content.

654
00:25:08,220 --> 00:25:10,290
And then I've got this
receiver model here.

655
00:25:10,290 --> 00:25:11,850
So we basically combine the signal

656
00:25:11,850 --> 00:25:14,010
from the two transmitters.

657
00:25:14,010 --> 00:25:15,060
We add them together

658
00:25:15,060 --> 00:25:17,430
in order to simulate that
interference environment.

659
00:25:17,430 --> 00:25:21,390
And then we pass it to a
DVB-S2 demodulator and receiver

660
00:25:21,390 --> 00:25:24,210
and convert that back into a video feed.

661
00:25:24,210 --> 00:25:25,410
You could take these flowgraphs

662
00:25:25,410 --> 00:25:28,200
and apply them to real-world hardware.

663
00:25:28,200 --> 00:25:29,160
But for simulations,

664
00:25:29,160 --> 00:25:32,100
it's really nice to just be
able to do it all on a computer.

665
00:25:32,100 --> 00:25:35,400
So in that model here, we can
have the jammer at no jamming.

666
00:25:35,400 --> 00:25:36,233
And then we can look

667
00:25:36,233 --> 00:25:38,460
at the constellation
diagram that we've got,

668
00:25:38,460 --> 00:25:40,350
and we'll see those four nice neat dots

669
00:25:40,350 --> 00:25:43,050
that we would expect from this
particular encoding scheme.

670
00:25:43,050 --> 00:25:45,570
So this means there's no
jamming. There's no disruption.

671
00:25:45,570 --> 00:25:47,820
The signal's coming
through as we want it to.

672
00:25:48,660 --> 00:25:50,370
If we turn on the jammer
just a little bit,

673
00:25:50,370 --> 00:25:53,550
make it like roughly equal
to the legitimate signal,

674
00:25:53,550 --> 00:25:55,260
we'll see that constellation has degraded.

675
00:25:55,260 --> 00:25:57,120
We no longer have those four symbols.

676
00:25:57,120 --> 00:25:59,070
We can't tell what's a one, what's a zero,

677
00:25:59,070 --> 00:26:00,660
and the information we're transmitting

678
00:26:00,660 --> 00:26:02,910
has been broken at a physical level.

679
00:26:02,910 --> 00:26:04,860
If we ramp the jammer all the way up,

680
00:26:04,860 --> 00:26:07,530
and then we look again at
the constellation diagram,

681
00:26:07,530 --> 00:26:09,630
we'll see those four nice neat dots again.

682
00:26:09,630 --> 00:26:11,100
But the idea here

683
00:26:11,100 --> 00:26:14,160
is that it's probably
transmitting the wrong content.

684
00:26:14,160 --> 00:26:16,860
It's transmitting the attacker's content.

685
00:26:16,860 --> 00:26:18,540
So we can actually take a look

686
00:26:18,540 --> 00:26:20,070
at what this looks like
on the receiver side,

687
00:26:20,070 --> 00:26:22,050
someone who has their
satellite dish pointed

688
00:26:22,050 --> 00:26:24,363
at this jammed environment.

689
00:26:25,380 --> 00:26:27,300
So I'm gonna run three simulations.

690
00:26:27,300 --> 00:26:31,110
The first one is with no
jamming. So we'll kick that off.

691
00:26:31,110 --> 00:26:32,580
We'll set the jammer to zero

692
00:26:32,580 --> 00:26:35,220
and we'll look at the constellation here,

693
00:26:35,220 --> 00:26:38,430
and it's gonna be that nice,
neat, orderly constellation

694
00:26:38,430 --> 00:26:42,210
that we would expect from an
undisturbed satellite signal.

695
00:26:42,210 --> 00:26:46,140
Next, we'll go ahead and kick
off a medium jamming scenario.

696
00:26:46,140 --> 00:26:48,360
So this is where the
jammer and the transmitter

697
00:26:48,360 --> 00:26:50,550
will have equal levels of power.

698
00:26:50,550 --> 00:26:52,050
And if we look at the constellation,

699
00:26:52,050 --> 00:26:54,810
it will be that degraded kind
of meaningless constellation.

700
00:26:54,810 --> 00:26:55,643
And we would assume

701
00:26:55,643 --> 00:26:58,770
that the receiver's going to
get no useful data out of it.

702
00:26:58,770 --> 00:27:01,800
And then finally, I'll kick
off a third scenario here

703
00:27:01,800 --> 00:27:03,030
with a hijacking attempt.

704
00:27:03,030 --> 00:27:05,430
So we're gonna transmit the
strongest signal we can.

705
00:27:05,430 --> 00:27:08,760
And all three of these
scenarios are saving the output

706
00:27:08,760 --> 00:27:11,520
to some files on my machine
that we'll be able to look at

707
00:27:11,520 --> 00:27:12,870
and actually parse out the signal

708
00:27:12,870 --> 00:27:14,670
that's coming through them.

709
00:27:14,670 --> 00:27:17,910
So this last one here, we're
gonna ramp that jammer way up

710
00:27:17,910 --> 00:27:20,280
and then take a look at the constellation

711
00:27:20,280 --> 00:27:21,780
and we'll see the constellation

712
00:27:21,780 --> 00:27:23,220
is nice and neat like we'd expect,

713
00:27:23,220 --> 00:27:25,890
but hopefully, it's
carrying the wrong message.

714
00:27:25,890 --> 00:27:29,850
So now I'm gonna pop open
a tool called TSDuck,

715
00:27:29,850 --> 00:27:31,950
which is a really awesome open-source tool

716
00:27:31,950 --> 00:27:34,500
for working with MPEG transport streams,

717
00:27:34,500 --> 00:27:38,250
which are commonly used by
satellite TV and data providers.

718
00:27:38,250 --> 00:27:39,930
And we'll go ahead and
look at these signals

719
00:27:39,930 --> 00:27:41,610
and we'll try to pipe
them to a video player

720
00:27:41,610 --> 00:27:43,020
and see what's going on.

721
00:27:43,020 --> 00:27:46,440
So I'll first take a look at
the scenario with no jamming

722
00:27:46,440 --> 00:27:49,140
and pipe the output of
that process to VLC,

723
00:27:49,140 --> 00:27:51,300
and we'll see the
legitimate video play here.

724
00:27:51,300 --> 00:27:53,460
So after a few seconds, we'll see,

725
00:27:53,460 --> 00:27:55,080
this is some public-domain footage

726
00:27:55,080 --> 00:27:56,670
from the International Space Station.

727
00:27:56,670 --> 00:27:57,720
It's undisturbed.

728
00:27:57,720 --> 00:28:01,083
This is the video that we
would expect to be sending,

729
00:28:02,070 --> 00:28:04,020
going through that whole
simulated radio pipeline

730
00:28:04,020 --> 00:28:05,640
and coming out like this.

731
00:28:05,640 --> 00:28:06,960
The next scenario we're gonna look at

732
00:28:06,960 --> 00:28:09,480
is where the jammer has equal
power to the transmitter.

733
00:28:09,480 --> 00:28:11,430
So I'm gonna go ahead and run that now.

734
00:28:11,430 --> 00:28:13,650
And what we'll see is,
before we turn on the jammer,

735
00:28:13,650 --> 00:28:16,320
we'll actually get a little
bit of our legitimate video.

736
00:28:16,320 --> 00:28:18,150
And then once the jammer comes on,

737
00:28:18,150 --> 00:28:19,710
we'll start to see a
bunch of error messages,

738
00:28:19,710 --> 00:28:21,780
as it's no longer able
to decode that video feed

739
00:28:21,780 --> 00:28:23,400
and eventually gives up.

740
00:28:23,400 --> 00:28:26,310
So this is where we've
canceled the signal.

741
00:28:26,310 --> 00:28:28,920
Finally, we'll look at
the hijacking scenario.

742
00:28:28,920 --> 00:28:31,920
And again, we should
expect to see a little bit

743
00:28:31,920 --> 00:28:34,173
of the legitimate feed when it comes up,

744
00:28:36,150 --> 00:28:38,310
but then pretty much instantaneously,

745
00:28:38,310 --> 00:28:40,080
the attacker signal is going to take over

746
00:28:40,080 --> 00:28:42,780
and it's gonna transmit
a malicious message.

747
00:28:42,780 --> 00:28:44,520
And the attacker has now hijacked it.

748
00:28:44,520 --> 00:28:46,830
And they're able to
transmit their own video

749
00:28:46,830 --> 00:28:49,470
to the people who are listening
to this satellite feed.

750
00:28:49,470 --> 00:28:51,900
And that's the crux of
satellite signal hijacking.

751
00:28:51,900 --> 00:28:54,360
If you shout loud enough
and in the right way,

752
00:28:54,360 --> 00:28:57,060
people will have no
choice but to hear you.

753
00:28:57,060 --> 00:29:00,000
And it's a very fundamental
attack that's based off

754
00:29:00,000 --> 00:29:02,490
of kind of the physical way
these satellites operate

755
00:29:02,490 --> 00:29:03,993
and the way radio waves work.

756
00:29:05,220 --> 00:29:07,740
So where do we go from here?

757
00:29:07,740 --> 00:29:10,560
What's kind of the next
thing to think about

758
00:29:10,560 --> 00:29:12,240
in terms of satellite jamming attacks?

759
00:29:12,240 --> 00:29:14,940
The attacks that we talked about today

760
00:29:14,940 --> 00:29:16,620
are very fundamental, right?

761
00:29:16,620 --> 00:29:19,020
They're just a matter of
screaming really, really loud.

762
00:29:19,020 --> 00:29:21,600
They're the most basic ideas of jamming

763
00:29:21,600 --> 00:29:24,630
applied amazingly to a
novel environment, space,

764
00:29:24,630 --> 00:29:27,570
but there's nothing too
weird going on here.

765
00:29:27,570 --> 00:29:29,970
That said, there's a lot
of research to be done

766
00:29:29,970 --> 00:29:33,060
in how you can effectively
mess with satellites

767
00:29:33,060 --> 00:29:35,100
or other radio signals with less power.

768
00:29:35,100 --> 00:29:37,680
So there are sophisticated
jamming techniques

769
00:29:37,680 --> 00:29:40,500
that involve sending like
pulses at specific intervals

770
00:29:40,500 --> 00:29:42,600
or using a weaker transmitter

771
00:29:42,600 --> 00:29:45,360
that sends very specifically
crafted messages

772
00:29:45,360 --> 00:29:47,190
in order to mess with the receiving end.

773
00:29:47,190 --> 00:29:49,470
And I think people here who
are like really interested

774
00:29:49,470 --> 00:29:50,850
in RF jamming attacks,

775
00:29:50,850 --> 00:29:52,320
spending some time thinking about

776
00:29:52,320 --> 00:29:54,810
what sort of sophisticated
attacks can be conducted

777
00:29:54,810 --> 00:29:57,870
against these DVB-S satellite broadcasts

778
00:29:57,870 --> 00:30:00,450
could be a really
fruitful area for research

779
00:30:00,450 --> 00:30:02,973
and finding exploits
against some space systems.

780
00:30:03,840 --> 00:30:05,010
On the defending side,

781
00:30:05,010 --> 00:30:06,900
on the side of protecting these assets,

782
00:30:06,900 --> 00:30:09,270
there are all kinds of unsolved questions.

783
00:30:09,270 --> 00:30:11,580
So there are ways we
can deal with jamming.

784
00:30:11,580 --> 00:30:12,720
One of the most common techniques

785
00:30:12,720 --> 00:30:14,250
is basically frequency hopping.

786
00:30:14,250 --> 00:30:17,550
You shift frequencies, according
to some pre-agreed pattern

787
00:30:17,550 --> 00:30:19,860
and the jammer doesn't know
which frequency to jam next.

788
00:30:19,860 --> 00:30:21,690
So they're always one step behind you

789
00:30:21,690 --> 00:30:23,700
and you can transmit your message.

790
00:30:23,700 --> 00:30:24,660
There are all kinds of problems

791
00:30:24,660 --> 00:30:26,670
with setting up that pre-agreed pattern

792
00:30:26,670 --> 00:30:28,080
that makes it difficult.

793
00:30:28,080 --> 00:30:31,140
And also, frequency
hopping maybe doesn't work

794
00:30:31,140 --> 00:30:33,390
in cases where the satellite
is already in orbit

795
00:30:33,390 --> 00:30:36,180
and doesn't support that kind of behavior.

796
00:30:36,180 --> 00:30:37,910
So there are some questions to think about

797
00:30:37,910 --> 00:30:40,140
of how we can upgrade
our existing satellites

798
00:30:40,140 --> 00:30:42,900
to maybe make those bent
pipes more reliable.

799
00:30:42,900 --> 00:30:46,230
Is there something we can
install on ground stations

800
00:30:46,230 --> 00:30:47,550
like the customer terminals

801
00:30:47,550 --> 00:30:50,490
to detect pirated broadcasts
using cryptography?

802
00:30:50,490 --> 00:30:53,070
Is there some way we can
upgrade our in-orbit satellites

803
00:30:53,070 --> 00:30:56,100
with these very dumb
mechanical transponders

804
00:30:56,100 --> 00:30:58,260
in order to make them
more capable of detecting

805
00:30:58,260 --> 00:30:59,400
and preventing these attacks?

806
00:30:59,400 --> 00:31:00,780
So if you're really interested

807
00:31:00,780 --> 00:31:03,180
in hardware-design type
stuff around radios,

808
00:31:03,180 --> 00:31:06,420
I think this is a fruitful
area to dive into.

809
00:31:06,420 --> 00:31:09,630
There's also the detection
and forensic side.

810
00:31:09,630 --> 00:31:11,310
And this matters quite a lot

811
00:31:11,310 --> 00:31:14,430
because satellite dishes
are super directional.

812
00:31:14,430 --> 00:31:15,900
When you point a dish at the sky,

813
00:31:15,900 --> 00:31:17,820
the beam doesn't spread very far.

814
00:31:17,820 --> 00:31:19,170
The side lobes from your antenna

815
00:31:19,170 --> 00:31:21,540
don't go very far from your transmitter.

816
00:31:21,540 --> 00:31:23,760
And so if a satellite is being jammed,

817
00:31:23,760 --> 00:31:25,260
it can be really hard to figure out

818
00:31:25,260 --> 00:31:26,820
who's jamming it and where they are

819
00:31:26,820 --> 00:31:29,580
so that you can arrest them
or disrupt the jamming.

820
00:31:29,580 --> 00:31:32,100
And so thinking about how we might

821
00:31:32,100 --> 00:31:35,370
forensically detect satellite
jammers and locate them

822
00:31:35,370 --> 00:31:37,410
and how we might increase the attribution

823
00:31:37,410 --> 00:31:38,850
to satellite jamming attacks.

824
00:31:38,850 --> 00:31:40,980
I think there's like a really high risk

825
00:31:40,980 --> 00:31:42,750
that people will think they can get away

826
00:31:42,750 --> 00:31:44,880
with satellite radio interference
without being detected.

827
00:31:44,880 --> 00:31:47,430
And I think there's a good
chance those people are right

828
00:31:47,430 --> 00:31:48,450
in the status quo.

829
00:31:48,450 --> 00:31:51,000
And coming up with ways
to make nation states

830
00:31:51,000 --> 00:31:54,270
face like diplomatic costs for
engaging in jamming attacks

831
00:31:54,270 --> 00:31:57,660
or make individuals face
criminal risk when they do it

832
00:31:57,660 --> 00:31:59,610
can be one way to really
protect these systems

833
00:31:59,610 --> 00:32:01,290
by just deterring attackers

834
00:32:01,290 --> 00:32:02,730
before they even get to the stage

835
00:32:02,730 --> 00:32:04,280
of messing with the satellites.

836
00:32:05,250 --> 00:32:07,380
And that kind of ties
into the last theme here,

837
00:32:07,380 --> 00:32:10,530
which is talking about
the policy and norms

838
00:32:10,530 --> 00:32:11,490
that we want to have

839
00:32:11,490 --> 00:32:14,760
for space cybersecurity and space jamming.

840
00:32:14,760 --> 00:32:17,220
I started this talk by talking about

841
00:32:17,220 --> 00:32:18,930
how the Soviet Union and the United States

842
00:32:18,930 --> 00:32:20,880
got into a fight in the United Nations

843
00:32:20,880 --> 00:32:24,300
about what kind of jamming
countries are allowed to do.

844
00:32:24,300 --> 00:32:26,970
And these discussions are
happening all the time.

845
00:32:26,970 --> 00:32:29,640
Questions about what
acceptable behavior looks like

846
00:32:29,640 --> 00:32:31,920
when we're talking about
treating the space environment

847
00:32:31,920 --> 00:32:33,690
and the radio environment.

848
00:32:33,690 --> 00:32:35,370
And what the red lines are,

849
00:32:35,370 --> 00:32:37,590
what countries and
individuals and businesses

850
00:32:37,590 --> 00:32:39,360
are allowed to do in this space.

851
00:32:39,360 --> 00:32:42,930
So if you have policy chops,
legal chops, lobbying chops,

852
00:32:42,930 --> 00:32:44,340
it's a place to apply that to

853
00:32:44,340 --> 00:32:46,290
and kind of think about
how we set the norms

854
00:32:46,290 --> 00:32:48,873
for the next generation of space missions.

855
00:32:50,310 --> 00:32:54,960
So if I were to pick three
key takeaways from this talk,

856
00:32:54,960 --> 00:32:58,500
I think the first is the
physicality of space.

857
00:32:58,500 --> 00:33:02,130
Satellites are dictated by
their environment in a way

858
00:33:02,130 --> 00:33:05,310
that very few other information
systems are designed.

859
00:33:05,310 --> 00:33:07,320
Satellites are constantly under attack

860
00:33:07,320 --> 00:33:10,710
from the sun, from
temperatures, from radiation.

861
00:33:10,710 --> 00:33:12,630
And so when you build satellites,

862
00:33:12,630 --> 00:33:14,400
you make adaptations to deal

863
00:33:14,400 --> 00:33:17,190
with this incredibly hostile
environment of outer space.

864
00:33:17,190 --> 00:33:18,630
And those adaptations,

865
00:33:18,630 --> 00:33:21,210
like having very, very dumb transponders

866
00:33:21,210 --> 00:33:23,850
that are super reliable in
that hostile environment,

867
00:33:23,850 --> 00:33:26,190
can lead to cybersecurity risks.

868
00:33:26,190 --> 00:33:28,620
And so as security
researchers who are trying

869
00:33:28,620 --> 00:33:32,040
to find new and weird
exploits in space assets,

870
00:33:32,040 --> 00:33:33,540
I think starting with the physics

871
00:33:33,540 --> 00:33:35,940
and the kind of the
physicality of space assets

872
00:33:35,940 --> 00:33:38,760
is a really great way to
mine out interesting ideas

873
00:33:38,760 --> 00:33:40,143
for space exploitation.

874
00:33:41,250 --> 00:33:43,740
It's also worth noting
that there's nothing new

875
00:33:43,740 --> 00:33:45,180
about space cybersecurity.

876
00:33:45,180 --> 00:33:47,040
People have been doing it for decades.

877
00:33:47,040 --> 00:33:49,980
And looking at some of these
hacker heroes of the past

878
00:33:49,980 --> 00:33:52,170
and learning from the
discoveries they made

879
00:33:52,170 --> 00:33:53,520
can be a really great way

880
00:33:53,520 --> 00:33:57,630
to think about how we can
protect systems in the future.

881
00:33:57,630 --> 00:34:01,110
The space world is
changing a lot right now.

882
00:34:01,110 --> 00:34:04,410
We are launching orders of
magnitude more satellites

883
00:34:04,410 --> 00:34:06,180
every year than we ever have before.

884
00:34:06,180 --> 00:34:09,060
Thousands of satellites will
go up in orbit this year

885
00:34:09,060 --> 00:34:11,250
and next year and the year after.

886
00:34:11,250 --> 00:34:13,500
And the design decisions we make

887
00:34:13,500 --> 00:34:15,810
in building these satellites today

888
00:34:15,810 --> 00:34:18,420
will end up shaping what
security looks like in space

889
00:34:18,420 --> 00:34:20,670
for decades to come.

890
00:34:20,670 --> 00:34:22,860
So people, like you all in the audience

891
00:34:22,860 --> 00:34:24,420
who care about cybersecurity,

892
00:34:24,420 --> 00:34:26,430
who already know that it's
something that matters

893
00:34:26,430 --> 00:34:27,720
for space assets,

894
00:34:27,720 --> 00:34:29,250
can have a really important voice

895
00:34:29,250 --> 00:34:31,980
in shaping this next
generation of space missions,

896
00:34:31,980 --> 00:34:34,320
whether that's coming to
conferences like DEF CON,

897
00:34:34,320 --> 00:34:36,210
going to things like
the Aerospace Village,

898
00:34:36,210 --> 00:34:37,710
or working in a space industry,

899
00:34:37,710 --> 00:34:39,300
or committing to open-source projects,

900
00:34:39,300 --> 00:34:41,220
or doing your own security research.

901
00:34:41,220 --> 00:34:43,680
The next five years are probably

902
00:34:43,680 --> 00:34:47,310
some of the most important
times for space cybersecurity,

903
00:34:47,310 --> 00:34:48,143
maybe ever.

904
00:34:48,143 --> 00:34:49,710
It's a really big moment

905
00:34:49,710 --> 00:34:51,720
for what space looks like for people.

906
00:34:51,720 --> 00:34:53,640
And being someone to jump on that now

907
00:34:53,640 --> 00:34:56,400
is, I think, a really
important thing to do.

908
00:34:56,400 --> 00:34:57,510
There's a need for people.

909
00:34:57,510 --> 00:34:58,470
There's someone in this audience

910
00:34:58,470 --> 00:34:59,850
who's better at radios than me,

911
00:34:59,850 --> 00:35:02,280
who's better at astrodynamics than me.

912
00:35:02,280 --> 00:35:04,800
And getting your voices in this discussion

913
00:35:04,800 --> 00:35:06,780
can go a long way towards making everyone

914
00:35:06,780 --> 00:35:09,810
who depends on space a bit safer.

915
00:35:09,810 --> 00:35:12,180
So that's basically it from me.

916
00:35:12,180 --> 00:35:14,040
There's a little bit of
time for questions I think.

917
00:35:14,040 --> 00:35:16,590
If you want to shoot
me an email afterwards,

918
00:35:16,590 --> 00:35:18,540
you can also do that.

919
00:35:18,540 --> 00:35:20,640
All of the resources from this talk,

920
00:35:20,640 --> 00:35:22,140
so like that little web demo,

921
00:35:22,140 --> 00:35:24,720
the GNU Radio flowgraphs, all of that,

922
00:35:24,720 --> 00:35:26,400
are available at this Git repository.

923
00:35:26,400 --> 00:35:27,570
So you can check that out.

924
00:35:27,570 --> 00:35:29,430
If you're interested in jobs,

925
00:35:29,430 --> 00:35:32,190
I can think of few places that
need an injection of DEF CON

926
00:35:32,190 --> 00:35:34,320
as badly as the Department of Defense.

927
00:35:34,320 --> 00:35:37,560
We work on really cool
and weird systems at DDS.

928
00:35:37,560 --> 00:35:39,330
Hit me up if that excites you.

929
00:35:39,330 --> 00:35:40,980
Be happy to connect you with people.

930
00:35:40,980 --> 00:35:42,510
And then check out the other space stuff.

931
00:35:42,510 --> 00:35:44,430
There's a really cool talk on Saturday

932
00:35:44,430 --> 00:35:46,893
on hijacking an old,
like retired satellite

933
00:35:46,893 --> 00:35:48,840
that will take some of these principles

934
00:35:48,840 --> 00:35:51,180
I've done through simulations
and actually make them real.

935
00:35:51,180 --> 00:35:52,830
And then there's tons of cool content

936
00:35:52,830 --> 00:35:57,360
at the Aerospace Village all
weekend on space exploitation.

937
00:35:57,360 --> 00:35:58,740
I'm gonna stop talking now.

938
00:35:58,740 --> 00:35:59,760
Happy to hear any questions,

939
00:35:59,760 --> 00:36:02,126
and hopefully you all enjoyed the brief.

940
00:36:02,126 --> 00:36:05,126
(audience applauds)