start	end	text
6100	10040	Greetings, and thank you all for attending today.
10040	15860	My tickles on the back of my neck are making this radio wave go really, really far.
16300	23920	My name is Hank Kashyap, and as you know, I work here at DEF CON, as well as the Aerospace Village.
23920	31320	I'm very much honored to be here today, and this is going to be a fabulous talk, and again, thank you all for showing up.
31380	44100	I do want to do one quick thank you to Patrick Flynn and Keith Abney, Bruce Cabrule, and Brian Jenkins for their tireless work and efforts on space and cybersecurity.
44640	49400	Pat facilitated Cal Poly's first ever grant on space cybersecurity from the U.S.
49400	51340	National Science Foundation.
51340	58780	Ethics professor Pat joins the National Space Council's user advisory group with Vice President Harris.
58780	62140	He is on their national security subcommittee with others.
62140	68220	I am honored to have worked with this amazing group, and I'm super, super stoked to be there with them.
68240	69400	Please stand up, Pat.
69400	73660	I want to give you a quick honor and give him a shout-out, and then we're going to start.
73660	75000	This is Patrick Flynn.
77300	78940	Please follow me next to him.
78940	82480	Give it a little shout-out one more time.
82600	84060	Keith, you're up next.
84060	84940	That's Keith.
84940	85540	Okay.
85700	93200	So, right before I start, I wanted to let you know that we do have today a Cal Poly CubeSat that I brought.
93200	96420	His name is iPax, and I'm really, really stoked.
96420	101860	Next door, we will have it, and it's a selfie with a machine and a CubeSat.
101860	105900	So please stop by at some point in the village and hang out with me.
106020	112620	I'm, again, just jittery with excitement, and you all are out of this world.
112620	116900	This is Sage's time, so everybody, one more quick round of applause for Sage.
116900	118140	Give it up for Sage.
122330	123370	Okay.
124810	131010	So, this is my presentation called Space Pirates on the Loose, and I thank you, everyone, for being here.
132910	138490	So, as you know, I'm a Cal Poly student, and this is my senior research project.
138490	145590	So, for the last two quarters, I've been working as a student research assistant under some professors at Cal Poly.
146110	150750	And as you can see in this photo, space technology is growing at a rapid pace.
150890	156790	57,000 satellites are planned through 2029, and that is only satellites, as you can see in that picture.
156910	163010	And although space technology is booming, space law and cyber security is still extremely underdeveloped.
163050	179430	So, our research proposes a broad set of scenarios and taxonomy on various cyber threats to space technologies, and it also provides an analysis of ethical, legal, and policy issues and gaps that arrive from multiple risk scenarios.
179490	187030	And our hope is for this research to be shown to the National Space Council, which Patrick wins on.
187190	193310	And just as a note, everything is still very work in progress, so any input and ideas are greatly appreciated.
193310	197490	So, if you run into me around the con, feel free to talk.
199070	204410	So, today, I'll be kind of presenting what I contributed to the research effort.
204410	215530	So, I'm mainly focused on brainstorming via threat modeling, and for those of you who don't know what that is, it's essentially a method in which threats are identified, enumerated, and prioritized.
216130	222930	And I also used attack trees and persona non grata to assist in this, which I'll get into later in this presentation.
223910	232050	So, while threat modeling, I also kept note of mitigations to prevent possible cyber attacks on space assets.
232510	240270	So, as you'll see later in this talk, I kind of found out that humans are the number one security vulnerability.
241990	245990	And also, this research provides a very abstracted view.
246010	254510	So, all attack scenarios were compiled based on just public papers, talks, and no technology was directly attacked for this research.
254510	259210	So, you won't see, like, too, too, too technical stuff.
260690	263270	So, first, attack trees.
263830	274430	So, if you don't know what an attack tree is, it's essentially a tree diagram that outlines, like, a multitude of ways that a potential asset or goal can be achieved by a threat actor.
275150	279810	So, attack trees were a big help in threat modeling and brainstorming.
280450	288890	Okay, so this one here is a zoomed out view of one of my attack trees.
288890	292570	And this one was specifically for compromising a dark mission.
292570	299890	And if you don't know what that is, it's NASA's program intended to protect Earth from asteroids by crashing satellites into them.
300050	301030	So, that's really cool.
301030	305130	And due to time, I'll only be going over a few of these attack trees listed.
307470	309810	So, how did I create these attack trees?
309810	317750	So, I mainly stuck to Visio due to its collaborative features, but I quickly learned that it was really stupid.
317750	323530	And every time I tried to, like, format stuff, it always crashed, and it was just really annoying.
323650	330430	So, due to this, I found a web app online called Deciduous created by these wonderful people on the screen.
330430	337750	And this is essentially a graph visualization tool that handles all the annoying grunt work of building an attack tree.
337830	350870	And as you can see in this screenshot, you have just, like, the language on that side, and then as you type, it just automatically formats everything into the attack tree, so you don't need to worry about all that annoying work.
351190	355190	And you can go check out that app if you want to use it yourself at those links.
357820	363800	So, many of my attack trees were inspired by the Lockheed Martin Cyber Kill Chain.
364080	369680	So, the Kill Chain models what threat actors must complete in order to achieve their objective.
369800	371520	So, it has seven phases.
371520	384860	However, my attack trees kind of use a modified version of this because I learned that every single cyber attack is unique and different, and some may use more phases than this, and some may use only some.
385900	396980	So, just to go over the original Cyber Kill Chain very quickly and simply for those of you who don't know it, the first phase is reconnaissance, and this just deals with getting information on the target system.
397200	403960	And then there's weaponization, which is just preparing stuff for the cyber attack, like phishing emails and whatnot.
404680	410140	And then delivery deals with how you go about getting malicious code on the target system.
410160	414260	Exploitation covers executing malicious code on the target system.
414260	418640	And then installation deals with installing malware on the target asset.
418680	425640	And I don't really include this phase in my attack tree since I kind of like couple that with the exploitation phase.
425640	433520	And then there's command and control, which just ensures a continuous remote channel between the target system and hacker if that is needed.
433800	443820	And then there's actions on objectives, and this essentially covers what the hacker does to cause chaos and damage once in position of the target system.
446980	450600	So, now on to persona non-gratas.
453760	466100	If you don't know what persona non-gratas are, they're essentially models to help analyze motivation skills and resources of malicious threat actors.
466940	471040	And listed here are some of the threat actors I came up with.
471120	482840	And just as a note, all of my persona non-gratas, I got their names from just common names, and all photos I used for them are generated by AI from thispersondoesnotexist.com.
483340	492060	And my persona non-gratas were heavily inspired by this paper called A Hybrid Threat Modeling Method, and that covered a really good paper.
492060	495420	I highly recommend checking it out if you want to learn more about threat modeling.
496260	497280	And yeah.
497680	506820	So, for the rest of this presentation, I'm going to be walking through some of the attack trees for some of my most interesting persona non-gratas due to the sake of time.
507500	509440	So, yeah, let's start.
509440	511880	So, this is Bob.
512120	520560	He is 55, and he's retired from his computer engineering job five years ago, and now he's living his lifelong dream, being an alien investigator.
521460	528300	He committed full-time when he bought an RV so he could visit all the alien hotspots, particularly Nevada.
529280	536260	Sadly for Bob, he has had no luck, even with his expensive equipment, so he's very angry, disappointed, and sad.
536260	541680	He is filled with emotion and anger, and his family and others think he's crazy.
541680	548200	So, due to this, he would do anything to prove the existence of aliens, even if it means falsifying evidence.
548360	552940	He also just wants to impress his radical conspiracy theorist group.
553100	554780	Now, y'all shouldn't underestimate Bob.
554780	558460	He's super passionate about aliens and poses a huge threat to U.S.
558460	559800	space assets.
560320	568120	So, in the next slides, we'll be walking Bob through one of my attack trees so he can go about proving the existence of aliens.
568220	576600	And this is just to show how threat modeling, such as attack trees and persona nogratas, are very useful for just brainstorming different cyber attacks.
579710	583930	Okay, so first, we're going to go start with one of my more simple attack trees.
583950	589250	So, this is my attack tree to prove the existence of aliens via tampering space data.
590350	595390	So, Bob will use this attack tree to kind of lay out his plan.
595650	600830	So, let's just assume the company Bob wants to hack into has very, very, very bad security.
601190	603770	So, that's the assumption we're going to make here.
604190	610990	So, he thinks by tampering SETI space data at the ground station level, he can prove to scientists and the public that aliens exist.
611010	622370	And if you don't know what SETI is, it's the search of extraterrestrial intelligence, and they essentially look at technosignatures which provide scientific data to prove the existence of aliens.
622670	627630	So, by tricking scientists, Bob hopes to prove his belief that aliens do indeed exist.
627830	633410	So, as you can see, this attack tree uses a modified version of the Lockheed Martin cyber kill chain.
633570	638470	So, those pink nodes there are each phases of the cyber kill chain.
638530	643250	As you can see, I don't have the installation phase, but I included a new phase called mask.
643270	654570	And this mask phase essentially just addresses plans and ideas a threat actor may have to better hide their footprints or the attack altogether, or delay response time.
656050	661030	So, for the sake of time, we're only going to cover Bob's plan for the circle phases.
661030	667430	So, let's just assume Bob already gathered information about the target system via reconnaissance.
669790	677270	So, again, Bob wants to tamper setting space data to trick scientists into believing that they discovered alien life.
678110	683910	So, his plan is essentially to gain access to where that data is stored and tamper it from there.
683910	686530	So, we're just going to walk through one of the attack trees.
686850	697250	So, let's again assume this company has very bad security, and let's assume Bob created malware to allow him remote access to some employee computer.
697250	699750	So, he has malware now, as you can see in that picture.
700030	702510	So, he's very determined and wants results quickly.
702510	712230	So, he decides he's just going to walk in the company himself and pretend to be an employee or inspection person because he feels confident he knows all the technical lingo.
715030	722370	So, anyways, going through this attack tree, all the green lines I have there are the paths you take.
722370	728350	The Xs are paths you wouldn't take just based on the background of the threat actor.
729170	732990	So, let's just assume he was successful and he's now inside.
732990	739330	So, he installs the USB himself, gains remote access to the system, and keeps track of anything interesting.
740190	749170	And he prepares things such as the USB in the weaponization phase, and he delivers it through social engineering and the delivery phase.
751580	755740	Okay, now on to exploitation and actions on objectives.
755800	764020	So, in the exploitation phase, he essentially goes to find where this data is located, and let's just assume it's in a database somewhere.
765080	774840	So, let's just assume he's lucky and the work laptop he has remote access to is owned by an employee with very, very bad password habits.
774840	782500	So, let's just assume he brute forces that in less than 30 seconds, and now he has access to the database and he can do whatever he wants.
784240	796060	Anyways, once he has access, he sends commands to alter the data, and let's just say he adds anonymalies and stuff like that to match up with scientists, to try and trick scientists.
796460	814860	Now, let's just make the assumption scientists found out, but they don't want to release that information to the public, and Bob didn't really think this through, so to convince the general public, he just decides to commit espionage and just leak all the falsified information he came up with.
815780	821380	Okay, so now let's move on to a more sophisticated threat actor and more complicated attack.
822080	824260	So, this is Eugene.
824460	829620	Eugene is a 19-year-old student who recently became obsessed in cyber security.
829640	832170	He is a physics major and teenage prodigy.
832500	849140	However, although passionate, Eugene is very immature and really only made scripts by others online to boot people off video games, and he recently joined a Discord group with other script kiddies who just tried to one-up each other in eliteness.
849820	861050	He kind of uses this server to feed his ego and stuff, so he thinks, desperate to impress his group, he just thinks it would be really, really a great idea to attack space assets, even though highly illegal.
861150	868990	So, he essentially only has one goal, cause as much chaos and destruction as possible to show how elite of a hacker he is.
869550	874170	He is also genuinely curious if he just has the skill to succeed in such an attack.
875010	882530	So, through being part of such a big hack, he believes he will for sure impress his group and others in the hacker community.
884310	893050	So, Eugene thinks it would be a great idea to target a satellite, especially those really cool ones that have lasers nowadays, cause Eugene loves lasers.
893050	897250	So, this is just a zoomed out view of the attack tree.
898290	903530	And due to time, we will just be jumping straight to the actions on objections phase.
906440	913760	So, let's say Eugene wants to target quantum key distribution, because he's a physics enthusiast.
914160	921720	So, let's just assume he just got past all the other phases, and somehow got access to a laser through social engineering.
921760	924280	So, now he's in possession of a deadly laser.
924280	926860	And we'll walk through this attack tree.
926860	940220	As you can see, some of those other sub -trees are X'd out, because I'm just assuming Eugene doesn't have that much expertise in quantum, so he just wants to shoot lasers at things, so he just goes the jamming route.
942830	947310	So, you may be wondering, what is quantum key distribution?
947310	956110	So, what quantum key distribution is, it essentially enables two parties to share a random bit stream used for encryption and decryption.
956170	976450	So, it follows the BB84 QKD security protocol, and essentially in quantum key distribution, keys are transmitted as photons, which are essentially light particles, and those are encoded with a random polarization basis, and they also hold quantum bits of information.
976450	983730	And if you don't know what polarization basis is, essentially, if you didn't know, photons are not only particles, but waves, so they oscillate.
983730	993150	So, when photons oscillate in one direction, they are polarized, and as you can see in this image, those vectors represent the direction in which those photons are going.
995470	999870	And essentially, let's just say Alice wants to talk to Bob.
1000030	1012510	So, Alice would send photons to Bob in a chosen polarization basis, and then Bob would use his detector and one of the two bases at random to kind of guess what Alice is sending.
1012550	1029350	So, some of them he's going to get wrong, some he's going to get right, and then through a process called sifting, they find, without revealing their results, where they use the same bases, and where they ended up using the same bases, that is used in the quantum key.
1029470	1036450	Now, the cool thing about quantum key distribution is that if there's an eavesdropper, you could detect that.
1036450	1042490	So, let's just assume Eugene's in the middle, and he wants to sneak and see their information.
1042570	1053950	So, in this situation, Eugene would get stuff from Alice, but he would have to kind of do the same thing as Bob, and kind of make guesses, just like Bob.
1054290	1064090	And since he has to send that information to Bob when he intercepts, he's going to make a lot of errors, because he has to make these guesses.
1064110	1071470	And it can only be measured once, the photons, so it's just going to increase the error rate.
1071470	1081350	So, also, quantum to error rate, which you see down there, that's error rate to key rate, and the higher the error rate is, the less likely you are to get your quantum key.
1082750	1085710	So, that's the cool thing about quantum key distribution.
1086050	1089530	So, back to Eugene's attack.
1089550	1097350	So, Eugene decides to shoot the laser at his target satellite, and he doesn't know too much about the quantum stuff behind it, he just thinks shooting lasers are cool.
1098010	1118470	So, just to go over what would happen, when he shoots this laser beam, the photons from the laser beam would scatter off the satellite and introduce extra optical noise in the transmission, and these photons interfere with the quantum signal and increase the quantum bit error rate significantly.
1119270	1130730	So, when this is very high, the quantum bit error rate, if it reaches a certain threshold, no secret key can be produced, which deems the transmission ineffective.
1132510	1134790	So, on to mitigation.
1134790	1147870	So, what I found out from all my research and attack trees, including the ones I wasn't able to show in the time period today, the number one security is gullible humans.
1147870	1160610	So, the best way to mitigate a lot of these attacks are to teach the gullible humans through stuff like employee training, enforcing two-factor authentication and password policies, for example.
1162150	1170510	Air-gapping critical systems is also important, and if you don't know what air-gapping is, it's just isolating a system from external networks.
1172110	1178670	So, each attack plan I kind of discussed were dependent on devices not being air-gapped.
1178670	1185870	So, if those devices were air-gapped, a lot of the attacks in my attack tree wouldn't be able to happen as easily.
1188670	1195270	So, anyway, to just end off and close up my presentation, I learned a lot.
1195270	1201730	I learned that space technology is rapidly being developed, and there's not enough research on the security of the newer technologies.
1201850	1215550	And as I was researching and finding sources, I found it really hard to find research papers, especially on really, really new technologies, such as DART and laser beam satellites.
1215590	1220210	There was stuff out there, but not all that much.
1221050	1236910	And then I also found that threat modeling, such as attack trees and persona non-guardas, are an excellent way to brainstorm, and they're especially useful for just, like, since there wasn't that much papers I came across for some of the technologies I looked into,
1236910	1245770	just using attack trees and threat modeling and just taking things from other attacks not related to space, it just really helps the brainstorming process.
1246070	1255610	So, anyways, I wanted to thank you all for listening, and I'll be around at the conference, so if you see me around and bump into me, feel free to ask questions in chat, and thank you.