start	end	text
0	6400	Brandon Bailey is a Senior Project Leader in the Cyber Assessments and Research Department at the Aerospace Corporation.
6420	13200	He performs cybersecurity research on ground systems and spacecraft systems to better protect our critical space infrastructure.
13760	21160	He will be speaking about developing a tactic against space misuse using Space Attack Research and Tactic Analysis, or SPARTA.
21160	26660	And with that, please welcome once again Brandon to the Aerospace Builders stage.
33080	34780	Thanks a lot.
35060	36640	Appreciate you guys coming in here.
36640	43460	So , just by a show of hands real quick, who has not heard of the SPARTA work that we've been doing yet?
43920	45120	Has not.
45180	45760	Good.
45760	51420	Alright, so we're going to spend a few minutes introing what it is and what it isn't.
51420	57080	Just to, because I know I'll get this question, these slides are already available on the SPARTA website.
57080	64360	So, on the bottom here, if you go to sparta.aerospace.org slash resources, there will be a PDF version of the slides there.
64560	70740	As well as, there's links throughout the presentation for lots of resources, papers, things that we've been doing.
71180	86680	So, I'm not going to touch too much on my background, but basically I've spent the last 10 years either trying to hack into ground systems, of operational systems, or hacking into like digital twins, like last year at DEF CON, as well as attacking kind of real spacecraft.
86680	92760	So, I've got a background in this area, and it kind of fostered the work that I'm going to talk about today.
94260	100140	So, what's the problem we're dealing with when we think about cyber and space and things?
100140	104000	And we just saw the weather balloon discussion a minute ago.
104640	107600	He was talking a little bit about authentication and encryption at the end.
107640	116760	And one of the things you'll notice in the space domain, which is probably similar to what you just saw, is encryption authentication are kind of sometimes mainstays of the security approach.
117380	122760	And unfortunately, that is sometimes the only security that's implemented on these systems.
122760	135200	And what we're seeing with the difference in different attacks, you know, with supply chain, or very other attack vectors, insider threat, and things like that, we need to think outside the box.
135200	141620	So , if encryption is like your only defense on a satellite, you're more vulnerable than you realize.
141620	145200	And you need to think about how do we actually, you know, get above that.
145340	149460	So , aerospace is a federally funded research and development center.
149600	154400	We are basically a non-profit research institute for the government.
154720	158220	And we're trying to, you know, lead advancement in this area.
158320	159940	There's a lot of great things that are going on.
159940	162460	You know, the Hackasat has been going on for a few years.
162460	166180	And there's other entities and national labs in this space as well.
166400	177660	So, one of the things we noticed a few years ago when we really got into this problem was there was a lot of articles, papers written that talked about cyber as a problem in space, or cyber as a threat to space.
177680	179140	But it was a black box.
179140	182980	It was basically a cyber boogeyman that would just get you and attack your space system.
182980	185940	But no one ever decomposed the problem into something manageable.
185940	188880	You can't solve a problem unless you kind of understand the problem.
188880	191560	And just saying cyber will get you is not really helpful.
191640	200880	So, what we've been doing is really have a concerted effort on our end is to push out information in the public domain, as well as in the government sector, to get the information out there.
200880	216000	So, what we're seeing with the commercialization in space and the boom that's happening in all the startups, we can't necessarily keep all this security information and the way you need to protect the space system kind of behind lock and key.
216000	217020	It needs to be shared.
217020	224920	We need to benefit with what we've seen in other industries, from the industrial control system to just DEF CON in general.
224920	228900	Getting the word out, getting people educated on the problem is a big thing.
228940	235080	So, we've been working on identifying what we call the requirements, the countermeasures and things like that.
235080	242020	And the way we view this is we want to use threats and or TTPs to help push the corrections.
242180	244360	So, what we have in the federal space...
244360	246480	You were here yesterday and saw the White House talk, right?
246480	250620	We have a lot of compliance and legislation and various things.
250620	255920	But sometimes we don't have the low-level details that we need to really mitigate the threat.
256060	259220	So, that's just kind of what we're trying to do with this product and we'll talk all about it.
259220	269700	So, we feel like if we can help define what those right requirements are, help define what are the critical controls and critical defenses you need to build into a space system, up front, we're going to be way better off.
270040	275900	And one of the reasons we need to do that is, it's pretty apparent if you're not aware, but this is just an example.
276420	283660	This slide kind of cut off at 2018, but you're seeing a kind of an increase in security incidents for space systems.
283700	290580	So, you see the red line indicates the operational satellites and the blue bars are kind of the incidents that we're seeing.
290580	296000	So, you're seeing a little bit of that correlation between the more we deploy out there and the more incidents.
296000	305620	Now, this graph will probably get a little different looking when Starlink launches because there's thousands of satellites and you don't have that proportionality yet on the attack side.
305620	310020	But this does show that correlation over from the 60s until now.
310020	313440	We continue to get incidents as it relates.
314200	321300	So, when we were looking at this problem, we were saying, okay, how do we decompose this to something manageable?
321500	324240	And what we're trying to figure out is mission impact.
324240	329180	What is the potential impact to a space system from a cyber perspective?
329180	340140	And we back this up with Space Policy Directive 5, which basically says that you need to identify existing and anticipated threats and mitigate those.
340660	346140	And it talks about it at the space system level, and the space system is ground, link, and vehicle.
346320	353240	So, what we were really concerned about was, okay, let's look at the TTP, the threat action.
353240	362540	So , yeah, there's actors out there, there's nation states, there's varying levels of people that are doing the things, but it doesn't help you that much of knowing who's doing it.
362540	365840	It's what are they doing and how are they doing it is the important thing.
365960	371940	And if we can really decompose that problem down, help people get educated on it, we're going to be in a much better situation.
372320	380160	So, we said, all right, how would we document TTPs from a space cyber perspective?
380160	387180	And we said, well, hmm, I think there's a framework out there that exists that does decomposition of TTPs.
387320	388740	It's called the MITRE ATT&CK Framework.
389080	394980	10 years from 2013 to 2023, 10 years running, it's kind of industry standard.
394980	400060	So, we said, okay, call our friends at MITRE and say, hey, are you guys working on something similar?
400260	401720	They said, no, not really.
401780	403800	We said, all right, cool, let's do that.
403800	411020	We're going to basically use your open source framework like ATT&CK, but we're going to kind of put our space spin on it.
411020	412960	And then we're going to integrate a bunch of other information.
413360	421020	So, we felt like cybersecurity matrices have been kind of the industry standard in the last 10 years as it relates to communicating this type of information.
421100	425300	And we wanted to help fill that kind of critical knowledge gap on adversary behaviors.
425460	426520	And that's what we did.
427040	435500	And if you think about the way the MITRE ATT&CK Framework is currently built, and from a TTP perspective, it's really focused solely on the stuff that's on the ground.
435500	439500	It doesn't really talk about how you would actually attack something like a space system.
439800	445460	So, from that perspective, you want to make sure you kind of understand both, because the ground is an attack vector, obviously.
445460	450220	So, from a TTP mitigation perspective, the MITRE ATT&CK Framework is where you want to go.
450220	461860	But once you get to the point where you're no longer attacking a Windows or a Linux system, and you're trying to pivot and have some sort of impact on a space platform, that's when you kind of, what's called pivot, which is a concept published on MITRE as well,
461860	463860	that pivot into something called Sparta.
464840	472380	So, what we found out, you know, after doing this, talking to a lot of people, putting this together, it really is kind of the first of its kind of body of knowledge.
472380	480760	Because one of the things we're really focused on is, some people get really squirrelly about saying, oh, well, why are you documenting all these TTPs for space?
481020	486420	Well, that's just the why of why you need to implement the security that we think you need to implement.
486420	489200	So, some people would say, well, why do I need to do X?
489200	494940	Why do I need to put some sort of AI, machine learning, intrusion detection on a spacecraft?
495400	501020	Well, if you can't articulate the threat, then they're not going to implement the countermeasure.
501060	506000	So, for us, the means to implement the countermeasure is using the threat and TTP.
506000	507600	And that's what we've really been focused on.
507600	513200	So, every individual technique that we have has some sort of countermeasure tied to it.
513200	518040	And that's really the benefit of what we're trying to publish with this work.
518480	521120	And it's not just us.
521120	524500	So, we've had some international collaboration as well.
524520	528940	When we first launched Sparta, we got contributions from the European Space Agency.
529120	536980	We got contributions from John Hopkins, some individuals at NASA here and there, and other agencies.
536980	542100	So , this isn't just, hey, go listen to these few people at aerospace.
542100	544720	It's been an international collaboration, and we want to continue that.
544720	550840	Most recently, we started working with Cyber Inflight, and he's down here in the front.
550840	559400	He's basically, they maintain a database of attacks against space systems, and we've integrated that information into Sparta.
559620	566080	And we continue to extend invitations for anyone who wants to collaborate on this information.
566080	568500	So , go to our contribute page.
568500	570860	The list keeps growing as we go.
570860	574140	So, if you're into this type of thing, please jump in.
574140	576640	So , what would we actually do with Sparta?
576640	579960	And this will kind of wrap up the introduction before we jump into the attack chain stuff.
580120	586560	So, first and foremost, what we feel like Sparta is really meant for is the space system developers.
586980	595440	So , I think it was Chad Luck, who was here yesterday, who worked for SpaceX, said a really good question to the White House OECD folks.
595440	598640	It was like, well, how do we know what are the right controls to implement?
598640	614340	And so, what we wanted to do is basically say, hey, we want to educate developers, engineers, people who build these systems, on what is the actual threat, TTP, that could impact their system, so they can implement the countermeasure.
614340	618480	Because if they don't know how someone can impact their system, how are they going to know how to fix it?
618760	630660	And so, what we've seen in the past with security in general, with like NIST, Cybersecurity Framework, or Risk Manager Framework, those are general guidance and abstracted levels of information.
630980	640880	So, what we're trying to do is help bridge the gap between threat, TTP, to countermeasure, to even NIST controls, and some level of requirements, and we'll show you how that works.
640880	644420	But basically, educate the developers, get the countermeasures implemented.
644900	648980	Another one is people who are actually doing monitoring on the ground.
648980	658600	So, some people actually, from a defensive cyber operation perspective, some people monitor their network for security impact.
658880	659960	That's a novel concept, right?
659960	662860	Monitor the network, look for, do the detect, and defend.
663820	680020	So, if you're thinking about monitoring the ground infrastructure, and you have Splunk, or you have Elk Stack or something, those type of things can really understand TTPs from the MITRE perspective, because that's how they've been programmed.
680200	687440	But now you have something that can educate you on what to look for, how to build dashboards from a TTNC perspective on space.
687440	700300	So, that's something we feel like it can help with as well, because you see something go across the wire, if you don't have the context of how that can be bad, which Sparta helps you with, then you have a gap.
700680	717900	Another thing we're seeing, and we've gotten some really good adoptions, if you're not familiar with the Space ISAC, the Space ISAC has a watch center that they just set up in March, and essentially what they're going to be doing is tagging all their threat intelligence reports with the appropriate Sparta TTPs as well as MITRE ATT&CK TTPs and things like that.
717960	727380	So, we feel like from a threat intelligence, threat reporting, attack chain building, education of actual things out there, this can be used for that purpose.
728320	734180	That's mostly a lot of the examples that we're going to talk through, is kind of this threat intelligence, attack chain reporting aspect of it.
734180	751900	Assessments and tabletops, so if you're in the federal space, or I guess technically even the commercial space now, and you're responsible for some level of compliance audit through NIST 853, or now even ISO 27001, Sparta has basically all of our information counter-correlated to all those frameworks.
751900	760140	So basically you can go in and say, if I don't implement ISO control 5.6, what space context does that have?
760140	763680	What kind of gaps do I have?
763680	769480	If I'm not implementing NIST control AC4, for instance, what does that mean in the space context?
769480	773400	That's all information that's now in a tool and is publicly available.
774320	777140	And one big thing, education and training.
777140	789120	So we heard this yesterday during the ONCD discussion, was we have kind of a shortage of skilled people in this area, space cyber area.
789120	792980	That's a problem in cyber in general, but it's even more so a problem in the space context.
793300	805380	So what we did was, let's take virtually all the knowledge that we have in our collective heads, and let's put it in a repository, in a database, so that we can all kind of start from the same sheet of music.
805640	813020	Instead of gatekeeping information and saying, oh well, I know how to attack a space system with cyber, so pay me a lot of money.
813020	814520	That's not going to help the nation, right?
814520	820360	So we want to get all the information out there as much as possible and raise that bar of what we call common knowledge.
821200	824600	And like I said before, we continuously outsource this information.
827940	831280	Crowdsource the information so we can get input from everyone.
831280	841500	So you can always email sparta.arrow.org and we'll take new TTPs, new defenses, whatever it is that you can come up with, corrections or whatever.
842260	848220	Okay, so we'll start talking about the meat of this, the attack chain development.
848220	854580	So if you think about attacking a space system, it can be an attack chain, right?
854580	865400	If you're thinking about, I'm going to do some sort of RF injection, RFI injection, or I'm going to basically attack the ground system and not only move through the network and whatever.
867320	869980	Basically, Sparta can help you kind of do all those things.
870240	880640	And one of the things to think about is attack chains and attack flows, different terminology for different people, but basically you can document kind of every step of the way.
880640	895540	And that's important to break these things down is because, for instance, if you were to go look at the Viasat thing that happened in February, there were multiple stages through that attack chain where if certain countermeasures were implemented, it would have actually stopped it.
895540	902520	So it's really important to understand not just, hey, this was the vulnerability at the end that got us, but how did they get from point A to point B?
902520	907720	And having frameworks like ATT&CK, Sparta, and these other things like this really help understand that thing.
907720	911300	And this is not to be confused with the cyber kill chain because these are different things.
911780	915940	The cyber kill chain is a little more, you know, it's just phases.
915940	919000	It's not really, and it's a sequential order of things.
919840	923360	ATT&CK chains and Sparta and these other frameworks are a little bit different.
924420	928420	It's more than just a sequence because it breaks things down differently.
928500	931640	It gives you, talks about, all right, how do they achieve initial access?
931640	932700	How do they escalate?
932700	934420	How do they laterally move?
934460	935680	Whatever it is.
935680	943500	So one of the benefits of using something like Sparta to do this, so, you know, we've seen other frameworks that are out there.
943500	953000	They basically, sometimes you have to go in one framework to see the TTPs and go to the next framework to see how you defend against those things.
953060	956620	So what we're trying to do is actually aggregate all that together on one spot.
956760	968540	So if you start using Sparta to build ATT&CK chains, we have tools that I'll show you that can help you get educated on what are the countermeasures and show you exactly how, what you need to do to kind of mitigate those all in one place.
968660	973240	That way you don't have to go to like, you don't have to go read this 700 page NIST document.
973240	976480	You don't have to go read, you know, a thousand controls from REV5.
976480	984880	Or you don't have to go read the ISO standard to understand how all this interrelates together and helps you mitigate the cyber issues on your space system.
985200	989700	So if we have time at the end, we'll show a little demonstration of those tools that can help.
989780	992860	All right, so let's jump into a couple of ATT&CK chains just for the fun of it.
992860	1001780	So if you've seen the talks that I've done in previous aerospace villages, I did a replay ATT&CK, which is a very basic ATT&CK in the space context.
1001780	1007140	Basically replaying the RF signal to call some sort of execution on a spacecraft.
1007360	1015860	Last year, did a memory injection ATT&CK on a PowerPC 750, where you could corrupt the memory space and basically render the embedded processor useless.
1016100	1019160	And then we'll do a couple of new things, just for the sake of doing new ones.
1019160	1023800	And then I'll break down something from SISAT 2023.
1023800	1036820	So if you are not aware, back in April of 2023, Thales Group, which is a European contractor, basically carried out a controlled cyber experiment on an operational asset at ESA.
1036820	1039820	And we have documented kind of how that works.
1040920	1047480	So if you think about building ATT&CK chains and what you need to know, I put some resources here for people to help you understand.
1048580	1051800	I'm all about using what information is valuable.
1052180	1060620	And it doesn't matter if SISA produced it, it doesn't matter if MITRE produced it, it doesn't matter if some European agency produced it.
1060620	1063800	If it's valuable information, we're going to use it.
1063800	1072020	So we're going to talk about... I have some screenshots from a DHS paper that talks about how to use the MITRE ATT&CK framework to kind of document ATT&CK chains.
1072020	1076140	But that exact same concept applies to Sparta, because it's built the same way.
1076140	1082940	So these are all the resources that you kind of have here at your disposal to kind of build ATT&CK chains and what that looks like.
1082940	1089700	So the next one is... so this is a paper from SISA, and it's a good paper.
1089700	1099580	So if you don't really understand, all right, this ATT&CK happened, or this ATT&CK chain, how do I build some sort of ATT&CK chain whenever there's an incident?
1099660	1103560	So SISA wrote this really good paper that says, this is kind of how you do it.
1103560	1108280	And they wrote it in the context of ATT&CK, but it applies to any of these frameworks that are built like this.
1108500	1114560	So basically, you find the behavior, and then you can potentially put it into...
1116040	1117800	ATT&CK has a thing called Navigator.
1117800	1119220	Sparta has a thing called Navigator.
1119420	1124160	And what you're trying to do is find the behavior, find the why, find the tactic.
1124160	1125660	Are they trying to get initial access?
1125660	1126660	Are they trying to execute?
1126660	1127860	Are they trying to escalate?
1128060	1131200	And then identify what's the technique or sub-technique underneath that.
1131200	1134900	So it's pretty basic, but this is a good document to kind of help break that down.
1134900	1142180	Because it helps you understand, all right, step one of any ATT&CK is initial access, right?
1142180	1143380	So what's the behavior?
1143380	1144780	How do they get initial access?
1145360	1148980	And then it's, all right, once they got initial access, what did they actually do?
1148980	1151060	How did they gain initial access?
1151220	1152600	And then so forth and so on.
1152600	1158700	And there's a lot of resources you can use within these tools to help you do that.
1158700	1165440	So just wanted to throw this paper up there for people who aren't familiar with it and want to kind of dive into ATT&CK development.
1165640	1167360	This is a good resource.
1167960	1173820	And then once you have the technique identified, you can identify the sub-techniques and then you can kind of map all this stuff out.
1173960	1174820	And it's all written here.
1174820	1176200	I'm not going to kind of belabor the issue.
1176200	1185280	But the takeaway here was it's a good 15, 20-page paper, 30-minute read to kind of really get accustomed to using these frameworks to kind of do ATT&CK development.
1185280	1189020	So let's move in to one simple ATT&CK chain.
1189020	1197840	So this ATT&CK chain was basically done in 2020 at DEF CON, Aerospace Village, and it's on YouTube.
1197840	1201700	But this happened prior to Sparta, right?
1201700	1205400	Sparta was something that we built and deployed in 2022 in October.
1205820	1217320	So the reason I'm bringing this up is basically think about how beneficial it would be if we retrospectively went through and looked at all the past incidents that we had, right?
1217320	1224400	And then we started rewriting them, these reports, or redoing the analysis with these frameworks in mind from an ATT&CK chain perspective.
1224520	1226820	Because what does that allow you to do, right?
1226820	1228280	Over time, you're going to trend.
1228280	1230580	You're going to see what's the most prevalent TTPs that are out there.
1230580	1234040	So what is the most highest risk area that we're at?
1234040	1243880	And this is why working with CyberInFlight was such a good thing for us because they've already done all this analysis of a hundred and some different attacks that have happened.
1243960	1248940	And then we work together and basically come up with a translation mapping of what they had versus Sparta.
1248940	1257200	So now we actually do have some level of trend over the last 15 years of what are the most prevalent TTPs from a space perspective that are out there.
1257420	1259120	So this is just very simple.
1259640	1261840	I'm not going to dive into too much.
1261840	1270580	But basically, from an ATT&CK chain perspective for a replay, you record the RF, you replay it, and then it causes some sort of impact.
1270780	1275940	So this is what it would look like, and this is just some screenshots from that demonstration in 2020.
1276000	1283440	Basically, we've done eavesdropping, the TTP of eavesdropping, as the RF signal was being transmitted, or in our case, a simulated RF signal.
1284380	1290700	And once it went up there, you could see the command counters in the top right corner.
1290700	1291540	They're at 1.
1291800	1294180	We replay the traffic, they go to 2.
1294180	1295740	Not that impressive, right?
1295920	1299500	A counter went from 1 to 2, so it's not that big of a deal.
1299820	1309240	So then, in that demonstration, what we did was, all right, let's basically leverage the fact that this replay works, and let's modify the bits that get sent and cause a different action.
1309320	1321540	So we recorded the actual action of a command, just a basic ping no-op command, but then we manipulated the data packets and then re-sent it again, and then caused some sort of reset failure on the vehicle.
1321540	1324560	And this is what the thing would look like.
1324620	1337240	And this is why I'm advocating for doing things like this, because this is a very basic attack, so people generally know how to prevent replay attacks, encryption authentication, basic principles.
1337400	1350800	But the concept is, if you throw these things in Sparta from a TTP perspective, you immediately get feedback in the tool that says, oh, these things in the green, these are the countermeasures you should consider implementing to mitigate that thing.
1352300	1360140	And then you can kind of pick from there, like it'll give you a list of ones that you want, and then you pick the ones that are most applicable for your attack chain, or what you're trying to do.
1360620	1362060	This is the one from last year.
1362580	1363880	This is a memory injection.
1364240	1381620	So basically, similar thing, you do a bunch of reconnaissance, you've got to figure out the memory layout and a bunch of things like that, and then you've got to actually get your initial access, which in this case was through the ground system, to send the packet to the simulator to cause the effect.
1381980	1396580	So from this attack chain, the way this works is basically, this specific one requires a lot of reconnaissance, because you basically have to do some sort of inspection of the memory layout and the memory contents and how that works.
1397160	1403920	But in this case, all we really did was review the documentation and the fault management.
1403920	1420060	So if you're into the space world, and you're wanting to learn how to really attack a spacecraft, just go read the ICDs and the fault management documents, because it is just full of juicy data that says, don't do this, it'll crash.
1420120	1421480	So as a hacker, what are you going to do?
1421480	1422700	You're going to do that, right?
1424640	1434300	So I bring that up because some people don't really understand or realize, from a space perspective, how critical what I would say that reconnaissance step is in the design information.
1434460	1445420	So if you've seen any reports over the past 20 years, their adversaries are basically eating their lunch from an exfiltration perspective.
1445740	1452520	It is a huge issue to get your design artifacts, especially your fault management and your software, exfiled.
1452520	1457920	Because that can be the first, that's the pre-attack, that's the first step to generate things.
1457920	1461600	You're not just going to be able to send a signal and have an impact, right?
1461600	1464140	You have to know what kind of signal you need to do.
1464140	1465780	All that's in the design docs.
1465780	1467740	So the reconnaissance is extremely important.
1468000	1470300	And make sure you keep that stuff under close hold.
1470300	1471960	It's very important to do that.
1471980	1476980	So this was just some screenshots of showing, you know, of the attack chain.
1477040	1497600	It's nothing crazy, but basically what we did, and you can watch that video from last year on YouTube, but basically we figured out a way to construct a packet, a CCSDS ring, and send that CCSDS ring through the front-end processor to the vehicle to basically cause the denial of disruption.
1497600	1507860	So what we did was come up with the right contents of the frame, shoot it across, and then you see the segfault, basically, in the PowerPC, which killed the system.
1508020	1509420	So why does that matter?
1509420	1511140	Why is it important to break that down?
1511140	1522580	Very similarly, you break down those TTPs, Sparta tells you which countermeasures you need to implement to mitigate it, and then you can pick out which ones you want and then go from there.
1522980	1524340	And you kind of see that on the right.
1524340	1525940	Those are NIST controls.
1525980	1530660	It's an eye chart from here, but when you get these charts, you'll see how that works and how we type.
1531220	1532380	Here's another thing.
1532380	1535880	So this is another example of, like, design artifacts.
1535880	1540880	So this is a very basic attack on NASA's core flight system, which is open source.
1541120	1549560	So if you go on GitHub and you look at their individual design artifacts and how that system works, it tells you this is how the system works.
1549560	1558220	And the way it does is, like, in this example, it's like, oh, every time our flight software starts, we run this basic thing called a relative time sequence.
1558440	1559920	Relative time sequence one.
1560100	1570020	So if you're a bad guy, you're like, oh, well, every time the thing runs, it's just going to run this, basically this script, you know, while I'll just inject in there and see what happens.
1570160	1573160	So that's what we did in this specific attack, right?
1573160	1583540	So we were simulating a supply chain attack in this example just to kind of show, hey, this can be, you know, some people think of, like, a supply chain attack as being, like, something super sophisticated.
1584000	1585400	This is one example.
1585400	1590800	This is just one line in a C file that's buried down into the flight software.
1590860	1596380	And static code analysis isn't going to find it because it's basically, it's a legitimate command.
1596480	1604480	So if you think about space, to me, some of our biggest vulnerabilities in space is more so using the system against itself.
1604480	1610600	So it's not, in my opinion, it's not, oh, a buffer overflow on the satellite.
1610820	1613000	Those do exist, and those could be impactful.
1613000	1616180	But it's more so of actually just using the system against itself.
1616180	1620180	It's a cyber-physical system, and there's a lot of trust between the ground and the spacecraft.
1620180	1622780	So you tell it to do something, it's just going to do it.
1622780	1628340	And it's not really built from the perspective that says, oh, I'm going to attack myself against some sort of intrusion.
1628520	1632560	Yet, that's why the countermeasures that we have in our system are important.
1633200	1637100	So all I did in this demonstration in attack chain was something pretty basic.
1637160	1647900	Was basically injected through the supply chain in this example, and said, all right, look, I want to basically tell this thing to reboot after like 60 seconds.
1648420	1657540	So basically, if this was real, right, you would put this one line of code in, and then every time the system boots, 60 seconds later, it reboots.
1657640	1659520	And then it just reboots, and then it just reboots.
1659520	1664640	So you never actually can kind of get going until you figure out kind of what happened.
1666180	1670080	Similarly, put the attack chain, countermeasures, go from there.
1670240	1672640	So here's another one.
1672640	1675700	So there's some CubeSats, obviously, that are out here.
1675700	1678160	There's the Moonlighter thing that's going on out there.
1678340	1684020	And I hear this sometimes, and I heard this in Europe, in that SciSat.
1684020	1697140	I was kind of surprised, because they were talking about how, well, even to this day, a lot of the CubeSats, these smaller academic things, aren't implementing, some of them aren't doing any encryption, and some are maybe barely doing authentication.
1697420	1700820	And it's like, well, some of these CubeSats actually have maneuverability.
1700820	1702280	They have reaction wheels, right?
1702280	1710760	So if you don't have basic protections on these things, like authentication and encryption, it's very easy to do bad things.
1710760	1715180	So this is just an example of kind of showing an attack chain and how that would work, right?
1715180	1717460	You do some recon, right?
1717460	1720400	You got to get the design information to kind of know what it looks like.
1720500	1726960	But once you kind of get that command database, so this is another thing that people talk about in the context of space, right?
1726960	1731060	There's the design artifacts, but there's these command dictionaries.
1731220	1739840	So one of the things that some people don't realize is a lot of times they use the same command dictionaries in the lab environments that they use in operations.
1739840	1741680	They don't make changes, right?
1741680	1747960	So people think, oh yeah, well, my command database is under lock and key in this operational system.
1747960	1753940	But for the two years you were developing it, it was just on some guy's laptop that anybody could get access to.
1753940	1755820	So it's not really that hard to get this information.
1755820	1757180	People need to realize that.
1757500	1767480	So this example basically just analyzed what the command structure looked like in the CCSDS frame, and then pushed this value to it.
1767780	1771260	And then what you get is...
1772240	1773120	Let's see.
1773120	1774300	It might just play.
1775620	1776200	Oh.
1781100	1781940	Yeah.
1781940	1796620	So this is pretty basic, but basically all it is, it's, you know, the kubectl and then all of a sudden you shoot the wrong type of command because the encryption is not working right and it just starts in a freefall tumble because you...
1796620	1803640	Actually, it wasn't like, oh look, we sent a buffer overflow to this thing and it corrupted the memory and did something crazy.
1803660	1804000	No.
1804000	1811520	You just told it, hey, increase your factor of your momentum on your reaction wheel by a hundred times and it'll do it.
1811520	1813700	Because this is like, not set up to not do that.
1814080	1829680	So that's some of the important stuff that people need to understand and realize that these systems need to be built with less trust and, you know, I don't like to use the term zero trust necessarily, but the tenets of zero trust make sense in the context of space,
1829680	1830120	right?
1830120	1835820	Segmentation, least privilege, don't just do anything the ground says because the ground says to do it.
1835820	1837580	It's very important to do that.
1837760	1845680	And if you were to model out these attack chains in something like Sparta and you get the countermeasures, you'll be able to figure out what you need to do.
1845760	1849620	So what I did was basically took these four attack chains that we built.
1849620	1855540	So you think about, if you're building a system and your people say, you should do threat modeling against your system.
1855580	1858580	Well, this is kind of a macro level of threat modeling to an extent.
1858580	1868420	So I took these four attack chains that, you know, let's all make believe that this is one system and not like four different simulators.
1868840	1878180	So I modeled out these attack chains in Sparta and then I basically said, all right, these are the things that I care about or that I think is most likely to happen on my system.
1878300	1882080	Sparta will shoot out the countermeasures and then you can pick out the ones you want.
1882220	1894040	So something you can do in Sparta is export everything in Excel because if you're an engineer in this room who doesn't love Excel and so we've made everything in Excel exportable so people can do all their data transforms they want in Excel.
1894400	1905520	So basically, map out the attack chain, dump it to Excel, you can start pulling out all the countermeasures, miscontrols, you can even get down to the shell statement requirements if you want.
1905880	1910640	So we have a couple hundred shell statement requirements that are implemented in Sparta as well.
1910640	1913620	We're going to increase that number over the next year.
1913620	1915760	So keep in tune for that.
1915760	1917300	And we're continuously pushing out releases.
1917300	1918380	We pushed out one this week.
1918380	1921680	And I'll show you a few features if I have time of what that looks like.
1923180	1929560	So if you were to put those four things in there, the countermeasures would light up, you can pull out the information in Excel.
1930340	1937400	It'll show you the countermeasure name, it'll show you what miscontrol, it'll show you sample shell statements, all that stuff.
1938820	1943840	This is kind of the importance is trying to answer that question that was asked yesterday.
1943840	1947440	It was like, what are those important controls and why?
1947660	1956340	And if you do attack chain development or you do threat modeling, you can in using these type of tools, you can get to that control list.
1956340	1965560	It's not, hey listen, because some compliance exercise told me that I'm a moderate level impact, so let's go from there.
1965880	1970700	This allows you to do threat modeling to an extent and generate those critical controls.
1972440	1979080	The last thing here to kind of go through is this thing, the operational hacking thing that happened.
1979200	1985880	So basically, this took place in April, sponsored by ESA, and it was performed by Thales Group.
1986000	1990000	And it mimics a little bit what we're seeing with HackASet 4 over there to an extent.
1990000	1993020	It's a controlled cyber experiment basically is what it is.
1993240	2002080	So what we did was we said, okay, even though this is a contrived cyber exercise, let's analyze it like it was a real attack.
2002180	2022140	So we said, alright, let's look at what this Thales did and let's break it down in the context of Sparta because what we had, when this first went in the news in April, we had customers coming to us and saying, well, what do we need to do to protect ourselves against what just happened there?
2022540	2031240	And so I was like, well, one easy way to do that is actually just, alright, let's do the analysis, throw it in Sparta, spit out the countermeasures and say, does this make sense?
2031240	2033820	And it actually worked out the way we thought it would.
2033920	2039900	So we wrote a long article on Medium already and the link's in the charts, you can go read it, but we'll do just a little snippet of it.
2040200	2049200	So one of the things that's interesting about Opsat when they did this event is Opsat's designed as an experimentation platform.
2049260	2057600	So what that means is its mission is for the user community to upload software to it to do science.
2057980	2062800	So if you think from a cyber perspective, initial access is basically granted at that point, right?
2062800	2069080	Because the whole point of the experiment is you write code to put on this vehicle and they actually run it for you.
2069180	2080600	So that provides an interesting attack vector because you don't have to do all the getting into the ground or get up through the RF leak or whatever, like, hey, here, put your software on here.
2080660	2087440	But they have security things that they look through to see if the software is malicious.
2087620	2094660	So the whole point of this attack was, you know, after initial access was granted, what next?
2094940	2102340	So researchers were given the access to the payload to execute software, which is the design, but they get, like, low privilege access, right?
2102340	2106400	So what would a user do if you're a malicious user?
2106400	2111060	You're trying to escape the sandbox you're in, escalate, move, and do whatever.
2111060	2112740	So that's exactly what they did.
2113440	2124980	And what I did when I did the analysis is basically say, hey, listen, hey, if they weren't granted initial access, these are some of the TTPs that they would have to use to actually make that, you know, happen in real life.
2124980	2127040	But in this case, initial access was granted.
2127460	2132160	So what they did was the inject was a kind of a simulated supply chain injection.
2132320	2141260	So what they did was, all right, they're permitted to actually upload software to the vehicle and their security check's done.
2142880	2148040	So they'll basically, you know, I don't know exactly what they do, but I think they just run some static code analysis against it, right?
2148200	2149140	Or whatever.
2150680	2153520	Or analyze it for malware or something.
2153560	2156820	What they did was basically they just injected their own vulnerability into the software.
2156820	2163960	So they wrote unsecured code on purpose so that then they could just exploit their own code to get the escalation they needed to get.
2163960	2164900	So that's what they did.
2164900	2169420	So they injected a vulnerability into the software that they knew about and knew how to do it.
2169420	2171840	And it was just a basic Java deserialization vulnerability.
2171840	2174200	So it wasn't like super anything crazy in advance.
2174440	2179140	And what that allowed them to do was execute basically shellcode on the system.
2179840	2184300	And this specific offset has CAN bus.
2184480	2192460	So if you know anything about 1553 or CAN bus, no segmentation, no security, really.
2192460	2200040	So what they were able to do was execute, just send data across the CAN bus to laterally move across the thing.
2200220	2206220	And you'll see links and these are all links to TTPs that are in Sparta as we did the mapping.
2206220	2210960	And then they were able to get some sort of persistence through injection in the Java library.
2211040	2213820	And then they basically modified the imagery coming down.
2214020	2217900	So it's pretty interesting to kind of watch.
2218360	2223060	So we wrote this article and we did this analysis so we could answer this next question.
2223680	2224940	There's the link.
2225220	2228720	Like I said, all these charts are on Sparta's website already so you can grab them.
2228780	2232640	So this was the attack chain that they came up with, or attack flow, right?
2232640	2236580	They evaded the detection by injecting their own vulnerability.
2236840	2244520	They used the CAN bus to laterally move and they established a backdoor through Java library injections and they modified the imagery coming down.
2245260	2253360	So what we said was, you know, Thales when they demonstrated this event, you know, this was the slide that they put up.
2253360	2255460	Well, here's how you mitigate this risk.
2255460	2265200	And it was like I looked at that and I was like, okay that's, I mean, that's none of it's wrong, but it's not super, super helpful from a detailed granularity perspective.
2265200	2269120	And we wanted, our customers wanted to know, what exactly do I do?
2269220	2272780	It would be like oh yeah, just do supply chain risk management.
2272780	2273800	That'll solve your problem.
2273860	2276300	It's like, well, I need to know, like, what can we do?
2276300	2279320	So we threw all this stuff in the navigator tool.
2279540	2286800	We dumped all the countermeasures in there and then basically said, oh look, this actually works.
2286960	2293600	If you would have done proper analysis on the ground using these methods, you'd have probably caught that before it went up.
2293880	2301680	If they got past that security using the fits and depth, if you actually had some level of segmentation on the canvas they wouldn't have been able to move.
2301740	2306240	If you weren't running everything as root, they wouldn't have been able to escalate.
2306240	2312380	If you actually were looking for some sort of onboard malicious activity using intrusion detection, you probably would have found it.
2312440	2321720	So it was a good validation of that whole concept of like, alright, take an attack chain, throw it in a tool, dump out the countermeasures and go from there.
2321720	2327060	So basically what we did in the article was show look, these are the TTPs they used.
2327060	2328920	These are the countermeasures at the steps.
2328920	2336000	If you were implementing using the fits and depth as a concept, you can see where you can mitigate this attack from that perspective.
2336900	2340020	So what are some takeaways from this presentation I hope you got?
2340020	2345940	So countermeasures can be deployed anywhere to disrupt and degrade steps on the attack chain.
2346820	2353140	You really need to understand the importance of reconnaissance and resource development because it's usually a precursor to any attack.
2353240	2363000	Basically using that cyber and flight data, 60% of the things that they had analyzed had all been basically reconnaissance, early stages of attacks.
2363260	2365900	Or, conversely, maybe that was the attack.
2365900	2367400	It was exfiltration.
2367520	2374380	So you never know because there maybe hasn't been a carry on, a second phase of that attack chain, but it's just something to consider.
2375900	2385420	For you think about attacks that are focused on the space segment, initial access can be difficult and probably the most difficult if you're using proper authentication and encryption.
2385600	2398920	But I feel like with the prevalence of supply chain, the history we've seen with insider threat, getting access to a ground system, now a lot of our ground systems are going cloud, it's more interconnected, so getting access to the ground is a lot easier than it used to be.
2399060	2402420	I think the likelihood is increasing that these are going to happen.
2403940	2415520	And once initial access is granted, it's really I personally feel like our space vehicles aren't really resilient against basic execution, escalation, lateral movement types of things.
2415520	2431880	Because we're not doing proper segmentation, we don't have least privilege, everything runs root, there's no monitoring, a lot of times there's not secure boot, digital signatures aren't a thing, so it's like all this basic stuff that we know is actually good in an embedded systems world,
2431880	2433140	we're not doing it.
2433200	2436040	And we would be a lot better off if we did that.
2437480	2451340	And something that I don't want people to take away from some of these attack chains in this presentation, or what's going on with Moonlighter across the wall here, or what happened in SySat, yes, these are contrived experiments.
2451340	2453920	But that's how we advance.
2453920	2456380	We actually need to test these theories out.
2457040	2463000	What we've seen with the Sparta work as far as, all the things that we've seen, we went back to HackAsset 3.
2463260	2474480	We've actually analyzed all three HackAssets at this point, SySat, our own research, and basically we've covered every TTP that's been used already.
2474480	2478880	My biggest thing is we've got to be able to protect against the no-knowns.
2478880	2482140	We've got to know how to protect ourselves against things that we know can happen.
2483400	2488820	Everybody wants to say, well, there's a big zero-day crazy vulnerability, and gets all excited about it.
2488820	2491220	But it's like, we aren't even doing some of the basics.
2491220	2493460	So let's get the basics done.
2493460	2494800	Let's take care of the no-knowns.
2494800	2500060	Things like Sparta, things like ATT&CK, can really help tell us what the no-knowns are so that we can actually mitigate those.
2500060	2504120	Then we can maybe pivot and focus to some of the more harder things to solve.
2507120	2508000	Let's see...
2508000	2511440	I've already said this, but space vehicles must be able to protect itself.
2512400	2515180	Some people say zero-trust in space.
2515220	2519220	So if I was to say, what does zero-trust mean in space?
2519220	2526700	Well, in the context of one space vehicle, these are the countermeasures that you can easily pull out of Sparta that kind of support the zero-trust concept.
2527800	2536400	I think I've already shown a little bit of this type of slide, but basically if you throw in ATT&CK chains, you can dump out data on countermeasures.
2536680	2539160	You've seen several of those demonstrations at this point.
2540420	2542780	This is a chart that will be in here.
2542780	2551340	There's all sorts of articles, blogs, some coverage from CyberScoop and Dark Reading and CyberWire.
2552760	2555640	There's a lot of good information that's already out there.
2556540	2560340	Congressional testimony, that link might be on there too, I don't know.
2560340	2564740	I linked a lot of papers in here and resources.
2565780	2570860	This top link is actually Indiana University is putting together a space cybersecurity digital badge program.
2570860	2573880	If you want to go check that out, you can go to that URL.
2573960	2577640	All the past presentations, all these papers are all listed here.
2577660	2579080	Like I said, it's on the website.
2579500	2580580	You can go from there.
2581040	2583560	The one thing I wanted to do is
2590400	2598020	hopefully real quick I think I should have some time.
2598300	2602880	In preparation for DEF CON, we basically Oh, I'm not showing that screen.
2603360	2605200	How do I show this screen there?
2605380	2606140	Can you do that?
2606140	2606640	No?
2606700	2607280	Okay.
2609200	2613440	One of the things that you I sent out a notice to a lot of people on the list.
2613500	2618940	If you go to Sparta today, we launched a new release yesterday, two days ago.
2619400	2624040	One of the big things that we did is ISO 27,000.
2624040	2630580	So we had a lot of European customers asking for how do the countermeasures, how does Sparta actually interrelate with the ISO standard?
2630660	2631760	So that's now out there.
2631760	2636000	But I think the biggest thing we did, we kept having this question come up.
2636000	2640180	We said, hey, you have 150 TTPs in here.
2640180	2643120	How do I know which ones are the ones that I need to worry about the most?
2643680	2645620	Which ones will impact me the most?
2645700	2650340	So what we did was we used the threat model that we published two or three years ago.
2650340	2654120	And we went through and did a risk analysis of every single TTP that we had.
2654120	2656540	And we rated it on a 5 by 5 risk matrix.
2656760	2667740	So now you can go into Sparta and you can see if you're basically which ones are high in the red of the top right quadrant of a risk cube and on down the list.
2668020	2672380	And we based that on the threat model and a bunch of analysis that we did.
2672380	2676460	So you can go in there, just precursor some of the things.
2677200	2683480	Jamming, high on the list, supply chain, software, firmware corruption, high on the list, things like that.
2684140	2690600	If you go there, there's a blog on Medium that talks all about it, so go out there and give that a read if you can.
2691060	2695320	But with that, I think I'll take a question or two if there's a minute or two.
2695320	2697740	It looks like there's probably five minutes.
2697740	2699900	So any questions at this point?
2701240	2701860	No.
2708860	2712180	So the question was, are we getting logs or correlations?
2712180	2713480	No, we're not.
2713480	2716820	Just like MITRE ATT&CK and stuff like that, we don't get logs or anything.
2716820	2725720	What we do get is we continually work with partners across the world now that give us references of things.
2725720	2732760	Like if there's a new experiment that's happened or when Hack Sat 4 is over, we'll analyze all those TTPs and that'll get filled in.
2732760	2738640	So what you will notice, in every TTP that we have in there, at the bottom there's a thing called references.
2738860	2750360	So if there's some article, blog, tweet, something that has some level of assurance that's accurate, there'll be a reference in there that says this is kind of where we pulled it from.
2750620	2753340	So it's not like a real-time log perspective.
2753340	2754020	Sir?
2754240	2758750	Do you analyze the data yourself
2763190	2763750	?
2763970	2764810	Oh , okay.
2764810	2772150	Yeah, so the question is, do we counteranalyze the countermeasures with mission objectives?
2772150	2781250	So SPARTA and things like that are mostly, it's agnostic of the mission because it's a generic tool, not with context of the mission.
2781330	2790990	So what you would need to do, which is basically throw your TTPs or get your countermeasure list and then you as the user have to counteract that.
2790990	2796910	So for instance, something that might be on our list that says you should put onboard intrusion detection on your spacecraft.
2797030	2798250	Not a lot of people may do that.
2798250	2802270	They may not have the size, weight, power, compute to do it or the tech to do it.
2802270	2804170	So you're saying, well, I don't have that tech.
2804170	2804690	Can't do that.
2804690	2805970	What's something else I could do?
2805970	2815550	So what we're trying to do is give you a laundry list of potential countermeasures that could make sense for you and then you have to kind of down select based on your mission profile.
2815550	2824010	So what we did do though, in that published, the RISC-Q publication, we basically created a three-tier system in there.
2824010	2825590	It's basically high, medium, low.
2825590	2836330	So we said if you're a high criticality system, you know, military, intelligence, whatever, or national critical infrastructure, you're in that high category.
2836330	2840630	Medium category, you're doing weather, civil space, maybe commercial.
2840830	2846470	Low category is basically academic research, that type of thing.
2846470	2862250	So what that did was basically create a different bucket structure for like, as an academic researcher, you know, this TTV RISC is at this level for me, but it's going to be different for a critical infrastructure item.
2862250	2871670	So that's kind of how we're approaching it, and this is our first go at publishing that type of information , and we're going to hopefully get feedback from the community .
2871950	2872770	Is there another question?
2872770	2874770	I think there's time for one more maybe.
2879000	2880500	Screw me, I'll repeat it.
2887050	2887630	Yeah .
2891170	2896070	So yeah, the question is any noticeable differences with ISO 27000.
2896370	2898990	And we put this on the website.
2898990	2905390	So one of the things we did was, because ISO is a paid standard, there's very limited things you can publish about it, right?
2905390	2915710	So what we did do, late July , and NIST published an updated translation of NIST 853 -05 to ISO 27000 -2022.
2915790	2923810	So what we did was use that correlation between NIST and ISO and publish, because we don't want to publish things that we don't own, right?
2923810	2929370	So what I would say in a generic sense, ISO is a higher level of abstraction than NIST, right?
2929370	2943190	So there are let's say a thousand NIST controls that are in the 853 database, and I don't know the number, I'm making this up, 200 of those have some sort of translation to ISO.
2943190	2949710	So that immediately tells you right off the bat, it's like, NIST is a much more thorough analysis of that.
2949710	2954590	And I said 27000 really meant more so for organizational information security stuff.
2954730	2963850	I don't think it's really, it's not really meant for space systems, but I think on a European side, I think a lot of their laws or regulation all ties to ISO.
2963890	2976950	So it was kind of trying to bridge that gap to show, alright, well, how can we use we want to advance the state of practice on the space vehicle, but we only, the only hammer we have is ISO, so let's help them get to that point, was kind of there.
2977750	2978350	One more.
2978350	2978910	We're good?
2978930	2979590	One more.
2979870	2980410	Okay.
2980410	2980770	We're good.
2980770	2981070	Thanks.
2981070	2983350	I'll be around until Monday.
2983510	2984410	Come find me.
2984530	2986210	All my contact info is on the slides.
2986210	2987290	Go to the Sparta website.
2987530	2988050	Thanks for coming.
2988050	2988850	I appreciate it.