1
00:00:06,100 --> 00:00:10,040
Greetings, and thank you all for attending today.

2
00:00:10,040 --> 00:00:15,860
My tickles on the back of my neck are making this radio wave go really, really far.

3
00:00:16,300 --> 00:00:23,920
My name is Hank Kashyap, and as you know, I work here at DEF CON, as well as the Aerospace Village.

4
00:00:23,920 --> 00:00:31,320
I'm very much honored to be here today, and this is going to be a fabulous talk, and again, thank you all for showing up.

5
00:00:31,380 --> 00:00:44,100
I do want to do one quick thank you to Patrick Flynn and Keith Abney, Bruce Cabrule, and Brian Jenkins for their tireless work and efforts on space and cybersecurity.

6
00:00:44,640 --> 00:00:49,400
Pat facilitated Cal Poly's first ever grant on space cybersecurity from the U.S.

7
00:00:49,400 --> 00:00:51,340
National Science Foundation.

8
00:00:51,340 --> 00:00:58,780
Ethics professor Pat joins the National Space Council's user advisory group with Vice President Harris.

9
00:00:58,780 --> 00:01:02,140
He is on their national security subcommittee with others.

10
00:01:02,140 --> 00:01:08,220
I am honored to have worked with this amazing group, and I'm super, super stoked to be there with them.

11
00:01:08,240 --> 00:01:09,400
Please stand up, Pat.

12
00:01:09,400 --> 00:01:13,660
I want to give you a quick honor and give him a shout-out, and then we're going to start.

13
00:01:13,660 --> 00:01:15,000
This is Patrick Flynn.

14
00:01:17,300 --> 00:01:18,940
Please follow me next to him.

15
00:01:18,940 --> 00:01:22,480
Give it a little shout-out one more time.

16
00:01:22,600 --> 00:01:24,060
Keith, you're up next.

17
00:01:24,060 --> 00:01:24,940
That's Keith.

18
00:01:24,940 --> 00:01:25,540
Okay.

19
00:01:25,700 --> 00:01:33,200
So, right before I start, I wanted to let you know that we do have today a Cal Poly CubeSat that I brought.

20
00:01:33,200 --> 00:01:36,420
His name is iPax, and I'm really, really stoked.

21
00:01:36,420 --> 00:01:41,860
Next door, we will have it, and it's a selfie with a machine and a CubeSat.

22
00:01:41,860 --> 00:01:45,900
So please stop by at some point in the village and hang out with me.

23
00:01:46,020 --> 00:01:52,620
I'm, again, just jittery with excitement, and you all are out of this world.

24
00:01:52,620 --> 00:01:56,900
This is Sage's time, so everybody, one more quick round of applause for Sage.

25
00:01:56,900 --> 00:01:58,140
Give it up for Sage.

26
00:02:02,330 --> 00:02:03,370
Okay.

27
00:02:04,810 --> 00:02:11,010
So, this is my presentation called Space Pirates on the Loose, and I thank you, everyone, for being here.

28
00:02:12,910 --> 00:02:18,490
So, as you know, I'm a Cal Poly student, and this is my senior research project.

29
00:02:18,490 --> 00:02:25,590
So, for the last two quarters, I've been working as a student research assistant under some professors at Cal Poly.

30
00:02:26,110 --> 00:02:30,750
And as you can see in this photo, space technology is growing at a rapid pace.

31
00:02:30,890 --> 00:02:36,790
57,000 satellites are planned through 2029, and that is only satellites, as you can see in that picture.

32
00:02:36,910 --> 00:02:43,010
And although space technology is booming, space law and cyber security is still extremely underdeveloped.

33
00:02:43,050 --> 00:02:59,430
So, our research proposes a broad set of scenarios and taxonomy on various cyber threats to space technologies, and it also provides an analysis of ethical, legal, and policy issues and gaps that arrive from multiple risk scenarios.

34
00:02:59,490 --> 00:03:07,030
And our hope is for this research to be shown to the National Space Council, which Patrick wins on.

35
00:03:07,190 --> 00:03:13,310
And just as a note, everything is still very work in progress, so any input and ideas are greatly appreciated.

36
00:03:13,310 --> 00:03:17,490
So, if you run into me around the con, feel free to talk.

37
00:03:19,070 --> 00:03:24,410
So, today, I'll be kind of presenting what I contributed to the research effort.

38
00:03:24,410 --> 00:03:35,530
So, I'm mainly focused on brainstorming via threat modeling, and for those of you who don't know what that is, it's essentially a method in which threats are identified, enumerated, and prioritized.

39
00:03:36,130 --> 00:03:42,930
And I also used attack trees and persona non grata to assist in this, which I'll get into later in this presentation.

40
00:03:43,910 --> 00:03:52,050
So, while threat modeling, I also kept note of mitigations to prevent possible cyber attacks on space assets.

41
00:03:52,510 --> 00:04:00,270
So, as you'll see later in this talk, I kind of found out that humans are the number one security vulnerability.

42
00:04:01,990 --> 00:04:05,990
And also, this research provides a very abstracted view.

43
00:04:06,010 --> 00:04:14,510
So, all attack scenarios were compiled based on just public papers, talks, and no technology was directly attacked for this research.

44
00:04:14,510 --> 00:04:19,210
So, you won't see, like, too, too, too technical stuff.

45
00:04:20,690 --> 00:04:23,270
So, first, attack trees.

46
00:04:23,830 --> 00:04:34,430
So, if you don't know what an attack tree is, it's essentially a tree diagram that outlines, like, a multitude of ways that a potential asset or goal can be achieved by a threat actor.

47
00:04:35,150 --> 00:04:39,810
So, attack trees were a big help in threat modeling and brainstorming.

48
00:04:40,450 --> 00:04:48,890
Okay, so this one here is a zoomed out view of one of my attack trees.

49
00:04:48,890 --> 00:04:52,570
And this one was specifically for compromising a dark mission.

50
00:04:52,570 --> 00:04:59,890
And if you don't know what that is, it's NASA's program intended to protect Earth from asteroids by crashing satellites into them.

51
00:05:00,050 --> 00:05:01,030
So, that's really cool.

52
00:05:01,030 --> 00:05:05,130
And due to time, I'll only be going over a few of these attack trees listed.

53
00:05:07,470 --> 00:05:09,810
So, how did I create these attack trees?

54
00:05:09,810 --> 00:05:17,750
So, I mainly stuck to Visio due to its collaborative features, but I quickly learned that it was really stupid.

55
00:05:17,750 --> 00:05:23,530
And every time I tried to, like, format stuff, it always crashed, and it was just really annoying.

56
00:05:23,650 --> 00:05:30,430
So, due to this, I found a web app online called Deciduous created by these wonderful people on the screen.

57
00:05:30,430 --> 00:05:37,750
And this is essentially a graph visualization tool that handles all the annoying grunt work of building an attack tree.

58
00:05:37,830 --> 00:05:50,870
And as you can see in this screenshot, you have just, like, the language on that side, and then as you type, it just automatically formats everything into the attack tree, so you don't need to worry about all that annoying work.

59
00:05:51,190 --> 00:05:55,190
And you can go check out that app if you want to use it yourself at those links.

60
00:05:57,820 --> 00:06:03,800
So, many of my attack trees were inspired by the Lockheed Martin Cyber Kill Chain.

61
00:06:04,080 --> 00:06:09,680
So, the Kill Chain models what threat actors must complete in order to achieve their objective.

62
00:06:09,800 --> 00:06:11,520
So, it has seven phases.

63
00:06:11,520 --> 00:06:24,860
However, my attack trees kind of use a modified version of this because I learned that every single cyber attack is unique and different, and some may use more phases than this, and some may use only some.

64
00:06:25,900 --> 00:06:36,980
So, just to go over the original Cyber Kill Chain very quickly and simply for those of you who don't know it, the first phase is reconnaissance, and this just deals with getting information on the target system.

65
00:06:37,200 --> 00:06:43,960
And then there's weaponization, which is just preparing stuff for the cyber attack, like phishing emails and whatnot.

66
00:06:44,680 --> 00:06:50,140
And then delivery deals with how you go about getting malicious code on the target system.

67
00:06:50,160 --> 00:06:54,260
Exploitation covers executing malicious code on the target system.

68
00:06:54,260 --> 00:06:58,640
And then installation deals with installing malware on the target asset.

69
00:06:58,680 --> 00:07:05,640
And I don't really include this phase in my attack tree since I kind of like couple that with the exploitation phase.

70
00:07:05,640 --> 00:07:13,520
And then there's command and control, which just ensures a continuous remote channel between the target system and hacker if that is needed.

71
00:07:13,800 --> 00:07:23,820
And then there's actions on objectives, and this essentially covers what the hacker does to cause chaos and damage once in position of the target system.

72
00:07:26,980 --> 00:07:30,600
So, now on to persona non-gratas.

73
00:07:33,760 --> 00:07:46,100
If you don't know what persona non-gratas are, they're essentially models to help analyze motivation skills and resources of malicious threat actors.

74
00:07:46,940 --> 00:07:51,040
And listed here are some of the threat actors I came up with.

75
00:07:51,120 --> 00:08:02,840
And just as a note, all of my persona non-gratas, I got their names from just common names, and all photos I used for them are generated by AI from thispersondoesnotexist.com.

76
00:08:03,340 --> 00:08:12,060
And my persona non-gratas were heavily inspired by this paper called A Hybrid Threat Modeling Method, and that covered a really good paper.

77
00:08:12,060 --> 00:08:15,420
I highly recommend checking it out if you want to learn more about threat modeling.

78
00:08:16,260 --> 00:08:17,280
And yeah.

79
00:08:17,680 --> 00:08:26,820
So, for the rest of this presentation, I'm going to be walking through some of the attack trees for some of my most interesting persona non-gratas due to the sake of time.

80
00:08:27,500 --> 00:08:29,440
So, yeah, let's start.

81
00:08:29,440 --> 00:08:31,880
So, this is Bob.

82
00:08:32,120 --> 00:08:40,560
He is 55, and he's retired from his computer engineering job five years ago, and now he's living his lifelong dream, being an alien investigator.

83
00:08:41,460 --> 00:08:48,300
He committed full-time when he bought an RV so he could visit all the alien hotspots, particularly Nevada.

84
00:08:49,280 --> 00:08:56,260
Sadly for Bob, he has had no luck, even with his expensive equipment, so he's very angry, disappointed, and sad.

85
00:08:56,260 --> 00:09:01,680
He is filled with emotion and anger, and his family and others think he's crazy.

86
00:09:01,680 --> 00:09:08,200
So, due to this, he would do anything to prove the existence of aliens, even if it means falsifying evidence.

87
00:09:08,360 --> 00:09:12,940
He also just wants to impress his radical conspiracy theorist group.

88
00:09:13,100 --> 00:09:14,780
Now, y'all shouldn't underestimate Bob.

89
00:09:14,780 --> 00:09:18,460
He's super passionate about aliens and poses a huge threat to U.S.

90
00:09:18,460 --> 00:09:19,800
space assets.

91
00:09:20,320 --> 00:09:28,120
So, in the next slides, we'll be walking Bob through one of my attack trees so he can go about proving the existence of aliens.

92
00:09:28,220 --> 00:09:36,600
And this is just to show how threat modeling, such as attack trees and persona nogratas, are very useful for just brainstorming different cyber attacks.

93
00:09:39,710 --> 00:09:43,930
Okay, so first, we're going to go start with one of my more simple attack trees.

94
00:09:43,950 --> 00:09:49,250
So, this is my attack tree to prove the existence of aliens via tampering space data.

95
00:09:50,350 --> 00:09:55,390
So, Bob will use this attack tree to kind of lay out his plan.

96
00:09:55,650 --> 00:10:00,830
So, let's just assume the company Bob wants to hack into has very, very, very bad security.

97
00:10:01,190 --> 00:10:03,770
So, that's the assumption we're going to make here.

98
00:10:04,190 --> 00:10:10,990
So, he thinks by tampering SETI space data at the ground station level, he can prove to scientists and the public that aliens exist.

99
00:10:11,010 --> 00:10:22,370
And if you don't know what SETI is, it's the search of extraterrestrial intelligence, and they essentially look at technosignatures which provide scientific data to prove the existence of aliens.

100
00:10:22,670 --> 00:10:27,630
So, by tricking scientists, Bob hopes to prove his belief that aliens do indeed exist.

101
00:10:27,830 --> 00:10:33,410
So, as you can see, this attack tree uses a modified version of the Lockheed Martin cyber kill chain.

102
00:10:33,570 --> 00:10:38,470
So, those pink nodes there are each phases of the cyber kill chain.

103
00:10:38,530 --> 00:10:43,250
As you can see, I don't have the installation phase, but I included a new phase called mask.

104
00:10:43,270 --> 00:10:54,570
And this mask phase essentially just addresses plans and ideas a threat actor may have to better hide their footprints or the attack altogether, or delay response time.

105
00:10:56,050 --> 00:11:01,030
So, for the sake of time, we're only going to cover Bob's plan for the circle phases.

106
00:11:01,030 --> 00:11:07,430
So, let's just assume Bob already gathered information about the target system via reconnaissance.

107
00:11:09,790 --> 00:11:17,270
So, again, Bob wants to tamper setting space data to trick scientists into believing that they discovered alien life.

108
00:11:18,110 --> 00:11:23,910
So, his plan is essentially to gain access to where that data is stored and tamper it from there.

109
00:11:23,910 --> 00:11:26,530
So, we're just going to walk through one of the attack trees.

110
00:11:26,850 --> 00:11:37,250
So, let's again assume this company has very bad security, and let's assume Bob created malware to allow him remote access to some employee computer.

111
00:11:37,250 --> 00:11:39,750
So, he has malware now, as you can see in that picture.

112
00:11:40,030 --> 00:11:42,510
So, he's very determined and wants results quickly.

113
00:11:42,510 --> 00:11:52,230
So, he decides he's just going to walk in the company himself and pretend to be an employee or inspection person because he feels confident he knows all the technical lingo.

114
00:11:55,030 --> 00:12:02,370
So, anyways, going through this attack tree, all the green lines I have there are the paths you take.

115
00:12:02,370 --> 00:12:08,350
The Xs are paths you wouldn't take just based on the background of the threat actor.

116
00:12:09,170 --> 00:12:12,990
So, let's just assume he was successful and he's now inside.

117
00:12:12,990 --> 00:12:19,330
So, he installs the USB himself, gains remote access to the system, and keeps track of anything interesting.

118
00:12:20,190 --> 00:12:29,170
And he prepares things such as the USB in the weaponization phase, and he delivers it through social engineering and the delivery phase.

119
00:12:31,580 --> 00:12:35,740
Okay, now on to exploitation and actions on objectives.

120
00:12:35,800 --> 00:12:44,020
So, in the exploitation phase, he essentially goes to find where this data is located, and let's just assume it's in a database somewhere.

121
00:12:45,080 --> 00:12:54,840
So, let's just assume he's lucky and the work laptop he has remote access to is owned by an employee with very, very bad password habits.

122
00:12:54,840 --> 00:13:02,500
So, let's just assume he brute forces that in less than 30 seconds, and now he has access to the database and he can do whatever he wants.

123
00:13:04,240 --> 00:13:16,060
Anyways, once he has access, he sends commands to alter the data, and let's just say he adds anonymalies and stuff like that to match up with scientists, to try and trick scientists.

124
00:13:16,460 --> 00:13:34,860
Now, let's just make the assumption scientists found out, but they don't want to release that information to the public, and Bob didn't really think this through, so to convince the general public, he just decides to commit espionage and just leak all the falsified information he came up with.

125
00:13:35,780 --> 00:13:41,380
Okay, so now let's move on to a more sophisticated threat actor and more complicated attack.

126
00:13:42,080 --> 00:13:44,260
So, this is Eugene.

127
00:13:44,460 --> 00:13:49,620
Eugene is a 19-year-old student who recently became obsessed in cyber security.

128
00:13:49,640 --> 00:13:52,170
He is a physics major and teenage prodigy.

129
00:13:52,500 --> 00:14:09,140
However, although passionate, Eugene is very immature and really only made scripts by others online to boot people off video games, and he recently joined a Discord group with other script kiddies who just tried to one-up each other in eliteness.

130
00:14:09,820 --> 00:14:21,050
He kind of uses this server to feed his ego and stuff, so he thinks, desperate to impress his group, he just thinks it would be really, really a great idea to attack space assets, even though highly illegal.

131
00:14:21,150 --> 00:14:28,990
So, he essentially only has one goal, cause as much chaos and destruction as possible to show how elite of a hacker he is.

132
00:14:29,550 --> 00:14:34,170
He is also genuinely curious if he just has the skill to succeed in such an attack.

133
00:14:35,010 --> 00:14:42,530
So, through being part of such a big hack, he believes he will for sure impress his group and others in the hacker community.

134
00:14:44,310 --> 00:14:53,050
So, Eugene thinks it would be a great idea to target a satellite, especially those really cool ones that have lasers nowadays, cause Eugene loves lasers.

135
00:14:53,050 --> 00:14:57,250
So, this is just a zoomed out view of the attack tree.

136
00:14:58,290 --> 00:15:03,530
And due to time, we will just be jumping straight to the actions on objections phase.

137
00:15:06,440 --> 00:15:13,760
So, let's say Eugene wants to target quantum key distribution, because he's a physics enthusiast.

138
00:15:14,160 --> 00:15:21,720
So, let's just assume he just got past all the other phases, and somehow got access to a laser through social engineering.

139
00:15:21,760 --> 00:15:24,280
So, now he's in possession of a deadly laser.

140
00:15:24,280 --> 00:15:26,860
And we'll walk through this attack tree.

141
00:15:26,860 --> 00:15:40,220
As you can see, some of those other sub -trees are X'd out, because I'm just assuming Eugene doesn't have that much expertise in quantum, so he just wants to shoot lasers at things, so he just goes the jamming route.

142
00:15:42,830 --> 00:15:47,310
So, you may be wondering, what is quantum key distribution?

143
00:15:47,310 --> 00:15:56,110
So, what quantum key distribution is, it essentially enables two parties to share a random bit stream used for encryption and decryption.

144
00:15:56,170 --> 00:16:16,450
So, it follows the BB84 QKD security protocol, and essentially in quantum key distribution, keys are transmitted as photons, which are essentially light particles, and those are encoded with a random polarization basis, and they also hold quantum bits of information.

145
00:16:16,450 --> 00:16:23,730
And if you don't know what polarization basis is, essentially, if you didn't know, photons are not only particles, but waves, so they oscillate.

146
00:16:23,730 --> 00:16:33,150
So, when photons oscillate in one direction, they are polarized, and as you can see in this image, those vectors represent the direction in which those photons are going.

147
00:16:35,470 --> 00:16:39,870
And essentially, let's just say Alice wants to talk to Bob.

148
00:16:40,030 --> 00:16:52,510
So, Alice would send photons to Bob in a chosen polarization basis, and then Bob would use his detector and one of the two bases at random to kind of guess what Alice is sending.

149
00:16:52,550 --> 00:17:09,350
So, some of them he's going to get wrong, some he's going to get right, and then through a process called sifting, they find, without revealing their results, where they use the same bases, and where they ended up using the same bases, that is used in the quantum key.

150
00:17:09,470 --> 00:17:16,450
Now, the cool thing about quantum key distribution is that if there's an eavesdropper, you could detect that.

151
00:17:16,450 --> 00:17:22,490
So, let's just assume Eugene's in the middle, and he wants to sneak and see their information.

152
00:17:22,570 --> 00:17:33,950
So, in this situation, Eugene would get stuff from Alice, but he would have to kind of do the same thing as Bob, and kind of make guesses, just like Bob.

153
00:17:34,290 --> 00:17:44,090
And since he has to send that information to Bob when he intercepts, he's going to make a lot of errors, because he has to make these guesses.

154
00:17:44,110 --> 00:17:51,470
And it can only be measured once, the photons, so it's just going to increase the error rate.

155
00:17:51,470 --> 00:18:01,350
So, also, quantum to error rate, which you see down there, that's error rate to key rate, and the higher the error rate is, the less likely you are to get your quantum key.

156
00:18:02,750 --> 00:18:05,710
So, that's the cool thing about quantum key distribution.

157
00:18:06,050 --> 00:18:09,530
So, back to Eugene's attack.

158
00:18:09,550 --> 00:18:17,350
So, Eugene decides to shoot the laser at his target satellite, and he doesn't know too much about the quantum stuff behind it, he just thinks shooting lasers are cool.

159
00:18:18,010 --> 00:18:38,470
So, just to go over what would happen, when he shoots this laser beam, the photons from the laser beam would scatter off the satellite and introduce extra optical noise in the transmission, and these photons interfere with the quantum signal and increase the quantum bit error rate significantly.

160
00:18:39,270 --> 00:18:50,730
So, when this is very high, the quantum bit error rate, if it reaches a certain threshold, no secret key can be produced, which deems the transmission ineffective.

161
00:18:52,510 --> 00:18:54,790
So, on to mitigation.

162
00:18:54,790 --> 00:19:07,870
So, what I found out from all my research and attack trees, including the ones I wasn't able to show in the time period today, the number one security is gullible humans.

163
00:19:07,870 --> 00:19:20,610
So, the best way to mitigate a lot of these attacks are to teach the gullible humans through stuff like employee training, enforcing two-factor authentication and password policies, for example.

164
00:19:22,150 --> 00:19:30,510
Air-gapping critical systems is also important, and if you don't know what air-gapping is, it's just isolating a system from external networks.

165
00:19:32,110 --> 00:19:38,670
So, each attack plan I kind of discussed were dependent on devices not being air-gapped.

166
00:19:38,670 --> 00:19:45,870
So, if those devices were air-gapped, a lot of the attacks in my attack tree wouldn't be able to happen as easily.

167
00:19:48,670 --> 00:19:55,270
So, anyway, to just end off and close up my presentation, I learned a lot.

168
00:19:55,270 --> 00:20:01,730
I learned that space technology is rapidly being developed, and there's not enough research on the security of the newer technologies.

169
00:20:01,850 --> 00:20:15,550
And as I was researching and finding sources, I found it really hard to find research papers, especially on really, really new technologies, such as DART and laser beam satellites.

170
00:20:15,590 --> 00:20:20,210
There was stuff out there, but not all that much.

171
00:20:21,050 --> 00:20:36,910
And then I also found that threat modeling, such as attack trees and persona non-guardas, are an excellent way to brainstorm, and they're especially useful for just, like, since there wasn't that much papers I came across for some of the technologies I looked into,

172
00:20:36,910 --> 00:20:45,770
just using attack trees and threat modeling and just taking things from other attacks not related to space, it just really helps the brainstorming process.

173
00:20:46,070 --> 00:20:55,610
So, anyways, I wanted to thank you all for listening, and I'll be around at the conference, so if you see me around and bump into me, feel free to ask questions in chat, and thank you.