WEBVTT 00:00.000 --> 00:06.280 Well, I'm sad to say it, but we've arrived at our last talk at the Aerospace Village for DEFCON 31. 00:06.280 --> 00:09.100 Our ultimate presenter is Jacob Oakley. 00:09.100 --> 00:17.700 Jacob is a cybersecurity professional and author with close to two decades of experience on offensive cyber operations and security for space systems. 00:17.700 --> 00:24.740 He advises on strategic mitigation of risks and threats to globally distributed multi-domain network architectures. 00:24.740 --> 00:32.200 Jacob's presentation is on the complexities emerging from the intersection of space and cyber domains to professionals in both areas. 00:32.380 --> 00:41.880 He covers an introduction to satellites and space operations, the attacks that space assets face, and the vectors used to facilitate malicious activity. 00:41.940 --> 00:45.480 For the last time this year, please welcome Jacob to the stage. 00:52.680 --> 01:04.280 Alright, so that was a really long intro, but just to give a little more context, you know, I hope this talk can kind of flesh out what you've seen here with HackASAT and give you a sense of what, you know, APTs and the people that are targeting these systems, 01:04.280 --> 01:08.880 how they look at them, how these systems actually are, and the challenges that we're going to have trying to protect them. 01:14.400 --> 01:15.800 So, space. 01:16.420 --> 01:17.480 Obligatory meme. 01:17.520 --> 01:29.520 Alright, so, like the intro said, I did offensive cybersecurity for a really long time, and then more recently have gotten involved in the space industry, and I found out that, you know, I used to think this is kind of what a space system was, right? 01:29.520 --> 01:33.440 There's something floating in space, and then there's some dishes on the ground that point and talk to it. 01:33.560 --> 01:41.640 What I learned terrifyingly is that it is a lot like normal things that hackers gain access to, and typically things that have really weak security. 01:41.640 --> 01:52.900 So, I learned that space systems actually have things like software-defined radios and data handlers and flight control computers and payloads and sensors, and all of those things are also computers. 01:53.100 --> 01:59.540 In fact, they often talk IP to each other, and they look like things that people compromise on a daily basis, but they're not protected in the same way. 01:59.940 --> 02:05.380 And I learned that on the ground, you have those same kind of components, and more of a traditional attack surface kind of layout. 02:06.360 --> 02:12.560 Also, in satellites, you have two different portions of the satellite, and I'll use these words a lot through the presentation. 02:12.560 --> 02:15.480 You have the bus, that's the part that's actually flying the satellite. 02:15.480 --> 02:21.580 It has propulsion, it generates power, it's responsible for maintaining position, navigation, timing, that sort of thing. 02:21.580 --> 02:24.620 And then you have your payload, which is the reason the satellite's in space. 02:24.800 --> 02:31.080 It might be a camera if it's taking imagery, it might be antennas if it's doing something like SiriusXM radio, and so on and so forth. 02:33.080 --> 02:44.620 So, to break it down a little bit more, and show you just how much like a normal network it can be, you know, you have crypto, hopefully, and you have software-defined radios or regular radios that are modulating that encrypted signal. 02:44.620 --> 02:48.620 But at the end of the day, you really just have two computers talking TCP IP to each other. 02:48.620 --> 02:56.240 And if you were to compromise the ground station, there's potential that you could send traffic without even having to do complex altering of the way that communication protocol works. 02:56.240 --> 03:00.840 That's not to say that's how all satellites are, but that's certainly the case for some of them, which was a little terrifying to me. 03:02.180 --> 03:07.480 One more thing to talk about, and so primarily this talk is going to focus on low-Earth orbit satellites. 03:07.480 --> 03:13.140 That's where I have the most experience, but I tried to expand where I could to cover any kind of attack surface that you have in space. 03:13.140 --> 03:22.060 But it's important to note, you know, from a security person's perspective, you don't want to think about the fact that that thing you're trying to secure, that thing you're trying to hack if you're the enemy, is not there all the time, right? 03:22.060 --> 03:29.460 You might only talk to it for 15 minutes at a time, and then you might not see it again for two and a half hours or days, depending on the way the orbit's traversing across Earth. 03:30.960 --> 03:32.220 So what do ground stations do? 03:32.220 --> 03:34.200 That thing on the ground with the antenna? 03:34.200 --> 03:36.140 Well, of course, it's responsible for antenna movement. 03:36.140 --> 03:39.620 It's responsible for closing the link with the satellite and establishing communications. 03:39.620 --> 03:46.500 And that's where you're going to have, you know, you're tasking for flight, and the payload are going to channel through that ground station, even if they're distributed on the ground. 03:46.760 --> 03:50.440 And it's also responsible for disseminating the things that it gets from the satellite, right? 03:52.160 --> 03:55.820 The space vehicle has, you know, the bus like we talked about. 03:55.820 --> 03:58.340 It's doing power generation, storage, moderation. 03:58.520 --> 04:01.220 It's got P&T, that's position, navigation, and timing. 04:01.300 --> 04:13.280 And that's accomplished with things like GPS, which you're probably familiar with, or star trackers, which are things that just keep a map of the star, and if they lose GPS, they can try to find a constellation they recognize and triangulate their location off of that. 04:13.420 --> 04:16.500 And then you have a sun sensor, which is a star tracker for just the sun, right? 04:16.500 --> 04:19.060 It tries to find the sun and recalibrate its orientation. 04:20.000 --> 04:21.060 You've got flight. 04:21.260 --> 04:31.380 Now, flight is, traditionally you would think of something like propulsion, but they also have like flywheels, reaction wheels, which are really just these things that generate inertia, and that's actually how they move, you know, they can adjust their orbit, 04:31.380 --> 04:32.660 they can move it out of the way of things. 04:32.880 --> 04:35.080 All stuff I learned about as a cyber security person. 04:35.080 --> 04:39.400 And lastly, on the space vehicle, you've got the payload-specific tasking of data storage. 04:40.400 --> 04:48.420 So, a computer's life in space is difficult, and there are a lot of environmental challenges, and these computers have to be hardened to deal with all these things. 04:48.420 --> 04:49.780 So you have radiation, right? 04:49.780 --> 04:51.160 Computers don't like radiation. 04:51.460 --> 04:55.520 You have accumulation from being above the Earth's atmosphere, but you also have like single events. 04:55.520 --> 05:00.140 Something like a solar flare is going to be a lot more impactful on a satellite that doesn't have the Earth's atmosphere to protect it. 05:00.640 --> 05:02.580 You have temperature extremes, right? 05:02.580 --> 05:05.420 You're going from complete sun and then complete darkness. 05:05.800 --> 05:07.620 Again, something computers don't necessarily like. 05:07.620 --> 05:09.020 You have a vacuum, right? 05:09.020 --> 05:11.560 And so connections and stuff like that can suffer from that. 05:11.760 --> 05:13.040 And then you have other space objects. 05:13.040 --> 05:16.740 These satellites have to, you have to worry about, you're flying it, is there other stuff headed your way? 05:16.740 --> 05:17.520 Is it man-made? 05:17.520 --> 05:18.260 Can they move? 05:18.260 --> 05:19.020 Do you have to move? 05:19.020 --> 05:19.840 So on and so forth. 05:19.840 --> 05:27.200 So, this is just to give you an idea that the risks these things face aren't just cyber security related, but they actually all compound cyber security, and we're going to get into that as well. 05:27.520 --> 05:31.620 So operationally, there's a whole lot that goes into space systems, right? 05:31.620 --> 05:37.920 And things you don't think about as a normal cyber security professional, but all those things we just said, they have to test the spacecraft to see if it can survive all those extremes, right? 05:37.920 --> 05:43.640 You have to send it to a table and shake it to make sure that when it gets launched on the rocket, the whole satellite doesn't fall apart, right? 05:43.640 --> 05:46.140 You have to send it in a vacuum to make sure it still functions. 05:46.140 --> 05:47.100 You put it in an oven, right? 05:47.100 --> 05:48.080 So on and so forth. 05:48.960 --> 05:52.100 Then you have to survive, you have to get a launch, which is very difficult. 05:52.220 --> 05:59.480 Then you have to deploy from your launch vehicle, stabilize, stop tumbling from getting ejected, and then finally start talking to the ground, right? 05:59.480 --> 06:03.240 And then once you're doing that, you still have to maintain and generate power. 06:03.540 --> 06:06.640 You have to worry about emanations interrupting your ability to communicate to the ground. 06:06.640 --> 06:11.620 And you, in some cases, have to worry about de-orbiting as a requirement for being put in different orbits. 06:11.780 --> 06:23.960 So last thing, before we get into the attacking these things, I gave a talk similar to this at a flight software workshop for NASA where they have the people that create the software for these systems, and a lot of people were arguing with me saying, well, 06:23.960 --> 06:25.620 satellites have things like backups. 06:25.620 --> 06:29.360 They have gold images so they can revert to it if they can't talk to the ground after so long. 06:29.360 --> 06:39.440 They have these scripts they call watchdog scripts that if power usage goes over a certain level or certain things happen, there are predetermined actions in the satellite that will protect it. 06:39.440 --> 06:43.320 But the important thing to consider is these are all redundancy things, right? 06:43.320 --> 06:48.480 Like space, overtime, organizations like NASA and the newer people playing in space, they're really good at redundancy. 06:48.480 --> 06:55.060 They're really good at, I need a third fail-safe to make sure I can still have my 10, 20-million-billion-dollar asset talk to me. 06:55.060 --> 06:56.620 But none of those are security-focused, right? 06:56.620 --> 07:04.040 And if you have code execution on a component of the satellite, you're likely able to turn off these things or maybe set the watchdog to zero, right? 07:04.040 --> 07:07.560 If it uses any power, shut it off to preserve it and then your satellite stops functioning, right? 07:08.920 --> 07:13.440 So targeting these systems is kind of a two-step process, right, as it is in anything. 07:13.440 --> 07:15.920 But we're going to walk through the specificity to space. 07:15.920 --> 07:20.380 So what is that thing that I want to attack and how is it chosen? 07:20.480 --> 07:24.260 And what's the desired effect I want to achieve on that asset in space? 07:27.100 --> 07:34.400 So as a hacker, as a malicious APT, you're going to pick targets for one of a couple different reasons and methods. 07:34.480 --> 07:42.840 You're either going to pick it because it's a target of opportunity and you know you can hack it because you found it vulnerable and you don't really have any other reason to go after it other than you found a vulnerable thing. 07:43.140 --> 07:45.780 You may be targeting it based on who owns that asset. 07:46.160 --> 07:52.520 You may be targeting it specifically, that one comm satellite that does this one thing and that's just that one satellite I'm going after. 07:52.760 --> 07:55.020 Or you might be targeting it based on what the satellite does, right? 07:55.020 --> 07:57.860 So you're targeting all navigation satellites, for instance. 07:59.500 --> 08:12.860 Importantly, regardless of the method that you're going to have for target selection on one of these space vehicles, it's actually the mission or missions that that space vehicle performs is what's going to heavily impact the way an APT is going to go after them as a target. 08:14.020 --> 08:21.920 So you could basically break down all different missions a satellite or space vehicle, for that matter, could perform into three high-level categories. 08:21.940 --> 08:27.340 There's missions that are sensing, there's missions that are emitting, and there's missions that are transiting something, right? 08:27.340 --> 08:33.560 You can sense radio frequencies, you can have a camera that's sensing infrared, and so on and so forth. 08:33.560 --> 08:40.660 You can have emitters like GPS, you can have emitters like satellite radio, lasers, and that sort of thing. 08:40.660 --> 08:50.220 And then transit is, you know, the space shuttle carrying cargo or a communications satellite transiting comms, right, where it's just responsible for moving something from point A to point B. 08:54.130 --> 09:00.010 So now that we know what those targets look like, what are the motivations, what are the reasons somebody would want to hack a satellite, right? 09:00.010 --> 09:04.170 We just walked through the finals of a competition where they were doing that, but why would those things happen, right? 09:04.170 --> 09:05.670 Why would I want to target that? 09:05.990 --> 09:08.610 It should pretty much be broken down into these five categories. 09:08.610 --> 09:21.430 You either want to collect something off of it, you want to use that satellite to redirect malicious activity to something else, you want to subvert the mission of the satellite, you want to potentially ransom it, that might be that target of opportunity, 09:21.430 --> 09:21.610 right? 09:21.610 --> 09:28.570 If somebody happened to find a satellite vulnerable and they tried to ransom it, these things are very expensive and the optics of losing it would be pretty bad for whatever organization owned it. 09:28.570 --> 09:30.210 Or you simply want to disable it. 09:31.490 --> 09:42.710 So, regardless of what you want to do to the satellite and why you chose it as a target, I broke down the vectors that are going to enable that malicious activity to get to a satellite and to pre-operational and to operational. 09:43.530 --> 09:50.030 So by pre-operational, we mean things like design, development, testing, transportation, storage, and launch, right? 09:50.030 --> 09:54.010 So uniquely to space systems, you might finish designing a new... 09:54.010 --> 10:02.490 you have a $5 million satellite, you finish designing it and developing it, you then have to go put it in a warehouse at a launch facility and wait for it to get its ride into space. 10:02.510 --> 10:05.130 And that all presents, you know, unique challenges to these things. 10:06.510 --> 10:17.250 So, then you have the operational vector, which is, you know, once it's developed and launched into space and it's operating, what are the things that you can attack while it's doing its mission and still in space? 10:17.250 --> 10:22.130 So obviously you can go from the ground to the space vehicle and from the space vehicle to the ground. 10:22.330 --> 10:26.790 And then you have inter-vehicle, where, you know, we talked about earlier that whole bus payload thing. 10:26.850 --> 10:32.910 If I get malicious code execution on one of those computers on the satellite, I'm probably going to want to pivot to other things. 10:33.350 --> 10:39.170 And it's important to think about the fact that a lot of satellites up there, for instance Starlink, right, they're hosted payloads. 10:39.170 --> 10:48.150 So you have one company who owns it and flies it and you have another company or organization who has the payloads on that system and one of them could get compromised and spread to the other, right? 10:48.630 --> 10:53.970 And then you have space vehicle to space vehicle if you think about the constellations and mesh networks they have in space. 10:53.970 --> 11:01.330 If you're able to compromise one you could potentially traverse across optical links and other things to other satellites in that same network, and then space to ground. 11:02.810 --> 11:14.690 So exploitation on these space systems, right, is often going to be tied to the mission and it's also going to be impacted by the motivation for why you're going up there to go up and hack the satellite. 11:15.010 --> 11:21.750 If you wanted to ransom it, well, you're probably not going to attack the payload, you want to ransom the whole satellite, right? 11:21.750 --> 11:25.750 If you wanted to take it out of orbit, you probably want to go after the bus and not a payload. 11:26.690 --> 11:36.050 And then the other can be true of something like if you're trying to collect intelligence or you're trying to subvert a mission specifically, maybe it's easier for you to go after just the payload so that you have less likelihood of being caught. 11:38.210 --> 11:44.110 But certainly many of those things can be accomplished by going after both and anything that impacts the space vehicle is going to impact the mission. 11:44.950 --> 11:52.250 So what are those subsystems that we would want to exploit on a satellite to deliver the effect, the whole reason we have motivated to go hack it? 11:52.410 --> 12:06.630 There's the bus and payload subsystems, right, so I can go after tasking, I can impact your ability to receive tasking from the ground, I can mess with that, I can impact your ability to know where you are in space, what way you're facing and what time it is, 12:06.630 --> 12:13.910 and if you can mess with that, then the satellite might not be able to point to the ground, close the link, you might not be able to do encryption handshakes, and so on and so forth. 12:14.170 --> 12:22.330 And go after communications that way by messing with crypto keys, right, if I get code execution on your satellite and I change the crypto key, well, you can't talk to it anymore. 12:22.330 --> 12:26.130 Well, and I can because I know where it's at in space and I can point a dish at it and maybe close the loop. 12:26.130 --> 12:29.530 There's a lot more to it than that, but that's simply certainly part of the attack surface. 12:30.650 --> 12:44.390 And like I mentioned earlier, all those redundancy protocols that people have programmed into these flight computers can also be attacked because if I can get privilege escalation on a satellite's operating system and I can tell the watchdog, hey, anytime somebody uses 0.1% of the CPU, 12:44.390 --> 12:48.270 shut the whole satellite down as a protective measure, right, and it will just keep doing that over and over and over again. 12:49.430 --> 13:03.730 And then the bus has, you know, the one thing that's bus-specific, whereas all those other things that could be a payload or the bus, right, you can impact PNT, you want to make sure the satellite can't talk to the ground, but I could also mess with the GPS of a payload so that it doesn't know where it's taking pictures of, 13:03.730 --> 13:09.110 for instance, right, but bus-specific, you would want to go after things like power generation, distribution and storage. 13:09.110 --> 13:15.510 That's probably the one thing I would say attack surface-wise is particular to the bus and you're unlikely to have a payload doing that itself. 13:16.910 --> 13:22.810 So, to kind of wrap all that together, the way that I go after these vehicles, I came up with something called the Trex Framework. 13:22.810 --> 13:28.050 It's not anything like the Sparta or any of these other highly intuitive and interactive things. 13:28.050 --> 13:41.310 This is kind of just a way I gathered my thoughts, but I thought it was a really useful way to frame, you know, the way a malicious actor would look at these systems, how they would target them, and the way they would think through attempting to compromise that space system's mission and get a desired effect. 13:41.310 --> 13:45.170 So, I'm not going to read everything on here, but it's essentially what the previous slides were about. 13:46.890 --> 13:51.290 So , what does it look like when somebody hacks a single satellite? 13:51.290 --> 13:56.030 And I've walked a lot of engineers through this because they don't believe me that their air gap system could be compromised. 13:56.030 --> 13:58.250 And I tell them okay , well, you have a personal computer, right? 13:58.250 --> 13:59.190 And they say yes . 13:59.370 --> 14:10.010 Oh, okay, and you charge your cell phone on there maybe, you know, listen to music on it, and then you take your cell phone to work and you charge it on the server that hosts the ground station VM in your lab in your college or university. 14:10.410 --> 14:11.590 And I say, oh yeah, maybe. 14:11.590 --> 14:21.670 Okay, well, I walk them through the malware and different tools that are developed to, you know, for instance, hop across a cell phone, compromise your laptop, break into VMs that are hosted on there. 14:21.670 --> 14:29.430 And I tell them, if I can get into your ground station VM, I can probably get into your payload computer because there's an inherent trust between those two devices. 14:29.770 --> 14:34.270 And if I can get into the payload computer, maybe I can pivot into the thing doing the data handling for the whole bus. 14:34.490 --> 14:39.010 And if I can do that, then maybe I compromise your software to find radio, and you can't talk to the ground anymore. 14:39.010 --> 14:43.250 Or maybe you talk to me now and not your original organization of the satellite. 14:45.610 --> 14:58.970 Also more importantly as we get into the world of, you know, mesh communications and these big distributed systems is the fact that, you know, let's use let's say the people who have satellite radio, they don't actually own the satellite, they just have a payload on it that sends down the radio, 14:58.970 --> 14:59.190 right? 14:59.190 --> 15:04.670 But the satellite radio company gets hacked, and one of their satellites payload gets compromised. 15:04.810 --> 15:16.530 And with privilege escalation and moving across the computing devices on one satellite, I can actually, every time I talk to a new ground station via my payload, I can try to send malicious traffic down to the ground. 15:16.530 --> 15:20.570 Because again, why would my ground station think that it's getting malicious traffic from a satellite? 15:20.570 --> 15:25.070 There's a lot of inherent trust in these architectures and not a lot of validation of what's coming down. 15:26.130 --> 15:39.310 If I can do that, maybe I pivot into the flight computer, even though it was the satellite radio company that got hacked and it's payload and I spread into their ground stations, I can now pivot into the flight computer and when it talks to the next ground station of the company that owns the satellite, 15:39.310 --> 15:41.370 I can compromise their ground station too. 15:41.750 --> 15:50.010 And like I said, with the whole mesh thing, if I compromise your optical link or just the communications you're using to talk to all the other satellites in your mesh, I can now proliferate across that as well. 15:52.150 --> 16:02.390 So, most importantly, I think the thing I'm trying to get across here is I've learned more about space and cyber security or what are these foundational problems that we're going to have to worry about and solve to prevent these sorts of things from happening. 16:03.350 --> 16:04.550 So, there's a cost problem. 16:04.550 --> 16:06.210 There's always a cost problem in cyber security. 16:06.210 --> 16:07.230 It's seen as a tax. 16:07.230 --> 16:08.510 People don't want to pay for it. 16:08.770 --> 16:22.170 It's even more of a nuanced and difficult conversation in space because you're not only saying, hey, I need you to spend money to fix something, but you're saying, hey, I need you to use the next week's worth of contacts with your satellite to upload a patch or something like that. 16:22.170 --> 16:24.010 So, now it becomes even more difficult. 16:24.670 --> 16:31.850 I can tell you the space community is obsessed with flight heritage, and so if you can't answer this question, has that been done in space before? 16:31.850 --> 16:33.530 Has your tool been done in space before? 16:33.530 --> 16:36.650 And you say no, and they say, well, I'm not going to be your guinea pig to get into space. 16:36.730 --> 16:39.150 I'll just eat the risk and hope that I don't get compromised. 16:39.550 --> 16:42.190 So, that's one really difficult problem that'll have to be overcome. 16:43.010 --> 16:44.910 There's also a cyber warfare problem. 16:45.570 --> 16:50.170 Normally, cyber warfare is not a great tactical choice for impacting something, right? 16:50.170 --> 17:00.450 If you told me that you cybered the anti-aircraft missiles and I have to fly my plane over them, and I see perfectly intact missiles pointing up at the plane, and I'm just really hoping nobody goes over there and reboots it so I don't get shot out of the sky, 17:00.450 --> 17:04.430 that's not a really strong tactical methodology for going after something. 17:04.430 --> 17:10.070 But in space, it's actually the only place where I want to kill something and have it just go silent and keep floating there. 17:10.270 --> 17:22.810 There's been examples in recent history where countries have shot satellites with missiles to prove they can do it, and they've actually polluted orbital fields with shrapnel going over 10,000 miles an hour, and now people can't put satellites where those things were shot at. 17:22.810 --> 17:29.690 So , not only are there a lot of challenges to securing satellites, but they're actually the most suitable target to cyber warfare. 17:30.950 --> 17:33.170 There's a big test and evaluation problem. 17:33.310 --> 17:38.650 So , all other tests that we talked about that are operational constraints for space systems, right? 17:38.650 --> 17:41.310 There's a vacuum in space, so I put the space vehicle in a vacuum. 17:41.310 --> 17:43.470 Space is hot and cold, so I put it in an oven. 17:43.690 --> 17:47.130 The rocket's going to shake it, so I shake it on a table to make sure it doesn't fall apart. 17:47.270 --> 17:51.750 There isn't an exercising of the security apparatus for these assets, right? 17:51.750 --> 18:07.930 There's things like the risk management framework, there's validation of compliance checks, but that's about as far as it goes, and it's kind of confusing to see an industry so obsessed with, you have to prove to me that this can survive in space, not have cyber security treated the same way. 18:08.690 --> 18:22.130 It's kind of like, if you had a torque bolt that's going to hold something so tight, and you just said, well, I measured how hard I twisted it, so it should survive being launched on a Falcon 9 rocket, instead of going and putting it on a table that's going to shake it that hard for as long as it's going to take it to get into space. 18:24.310 --> 18:25.670 There's also an adaptation problem. 18:25.670 --> 18:30.350 All those things we just talked about, like temperature extremes and vacuums, those are solved problems in the space industry, right? 18:30.350 --> 18:32.070 I know how to shield something from radiation. 18:32.070 --> 18:35.090 If I know how long it's going to be up there, I can protect it, so on and so forth. 18:35.250 --> 18:41.210 Whereas, as we come up with cyber security solutions that are going to protect satellites, the enemy is obviously going to try to counter them. 18:41.210 --> 18:49.230 And so, you know, the thing that we're only doing compliance checks on is also the only problem to the space industry that's constantly going to adapt to defeat them. 18:50.210 --> 18:52.190 There's a really big defense in depth problem. 18:52.190 --> 19:01.870 I hinted at it a couple times that, architecturally speaking, space systems, when you talk about the ground segment, space vehicles, other space vehicles, the components within them, they inherently trust everything they talk to. 19:01.890 --> 19:09.330 If you get to a ground station of a space system, you can probably do whatever you want, because the satellites have no reason to not trust the ground. 19:09.330 --> 19:17.950 And the people that operate and own those systems are very nervous about putting anything in there that's going to potentially, you know, quarantine something on the satellite and make it so they can't talk to it anymore. 19:17.950 --> 19:19.810 They're going to view that as a risk not worth taking. 19:21.510 --> 19:23.930 So, modernization is also a problem for space. 19:23.930 --> 19:29.750 You know, I think 15, 20 years ago, if you had people trying to hack satellites in something like HackASat, they'd find it very difficult. 19:29.750 --> 19:39.490 The skill set needed to have the aerospace engineering, electrical engineering, RF engineering, to actually maybe compromise these things that didn't have a lot of software definition would make it a hard target. 19:39.490 --> 19:44.270 Whereas now, you have things having more real-time operating systems that are open operating systems. 19:44.270 --> 19:49.190 They have, you know, Linux basically just stripped down Linux on them and they look more like a traditional target. 19:49.330 --> 19:55.310 And that's been done to make development easier but that also means that this attack surface now looks like something that a lot more people could compromise. 19:56.850 --> 20:00.550 So, another one is that there's a failure analysis problem in space. 20:00.550 --> 20:12.730 There's a lot of rigor given to something goes wrong, if a satellite gets lost, they will convene a board of PhDs and all the different specialties, metallurgy, radio frequency people, electrical engineers, and they'll try to figure out for days and days and days, 20:12.730 --> 20:15.690 if not months, what went wrong so they can learn from it. 20:15.830 --> 20:28.610 But, rarely in those conversations, if ever, does cyber security come up and I've tried to communicate to people that cyber security could actually be, somebody could hack a satellite and do any kind of change to make it look like it was a vacuum problem or a radiation problem or any of these other things, 20:28.610 --> 20:28.870 right? 20:28.870 --> 20:32.150 But that's been given kind of last seat if it's even brought up at all. 20:33.630 --> 20:36.870 Most importantly, I think, is there's a huge disclosure problem. 20:36.870 --> 20:44.890 So, almost everything in space is owned by a government or a military or a very large corporation that contracts with those types of people. 20:45.150 --> 21:00.770 And that means that unlike on the ground, something like, we're never going to get a hammer like Stuxnet or the SolarWinds Compromise to go beat people over the head with and say, we need to fix data, we need to fix software supply chains because we're never going to hear about these things when they get compromised, 21:00.770 --> 21:01.690 for the most part, right? 21:01.690 --> 21:07.070 And that's why it's very hard to kind of build momentum and say, well, no, you do need to fix this because it could be really bad for you. 21:07.070 --> 21:09.750 And they're going to say, well, it hasn't happened to anybody yet, right? 21:11.970 --> 21:18.210 So, lastly, for cyber and space tomorrow, we really need to catch up as a cyber security industry. 21:18.210 --> 21:21.510 I think space and cyber, and it's growing, but they need to do a lot of interchange. 21:21.510 --> 21:26.710 There's a lot of different technologies and a lot of attack surface and things that cyber security people are not used to securing. 21:26.810 --> 21:34.230 And so, by the time that's the highest risk that space systems view is cyber, we need to be prepared to address their problems. 21:35.290 --> 21:35.990 And that's it. 21:35.990 --> 21:39.010 I have a shameless plug up there, and I'm happy to answer questions.