[00:06.100 --> 00:10.040]  Greetings, and thank you all for attending today.
[00:10.040 --> 00:15.860]  My tickles on the back of my neck are making this radio wave go really, really far.
[00:16.300 --> 00:23.920]  My name is Hank Kashyap, and as you know, I work here at DEF CON, as well as the Aerospace Village.
[00:23.920 --> 00:31.320]  I'm very much honored to be here today, and this is going to be a fabulous talk, and again, thank you all for showing up.
[00:31.380 --> 00:44.100]  I do want to do one quick thank you to Patrick Flynn and Keith Abney, Bruce Cabrule, and Brian Jenkins for their tireless work and efforts on space and cybersecurity.
[00:44.640 --> 00:49.400]  Pat facilitated Cal Poly's first ever grant on space cybersecurity from the U.S.
[00:49.400 --> 00:51.340]  National Science Foundation.
[00:51.340 --> 00:58.780]  Ethics professor Pat joins the National Space Council's user advisory group with Vice President Harris.
[00:58.780 --> 01:02.140]  He is on their national security subcommittee with others.
[01:02.140 --> 01:08.220]  I am honored to have worked with this amazing group, and I'm super, super stoked to be there with them.
[01:08.240 --> 01:09.400]  Please stand up, Pat.
[01:09.400 --> 01:13.660]  I want to give you a quick honor and give him a shout-out, and then we're going to start.
[01:13.660 --> 01:15.000]  This is Patrick Flynn.
[01:17.300 --> 01:18.940]  Please follow me next to him.
[01:18.940 --> 01:22.480]  Give it a little shout-out one more time.
[01:22.600 --> 01:24.060]  Keith, you're up next.
[01:24.060 --> 01:24.940]  That's Keith.
[01:24.940 --> 01:25.540]  Okay.
[01:25.700 --> 01:33.200]  So, right before I start, I wanted to let you know that we do have today a Cal Poly CubeSat that I brought.
[01:33.200 --> 01:36.420]  His name is iPax, and I'm really, really stoked.
[01:36.420 --> 01:41.860]  Next door, we will have it, and it's a selfie with a machine and a CubeSat.
[01:41.860 --> 01:45.900]  So please stop by at some point in the village and hang out with me.
[01:46.020 --> 01:52.620]  I'm, again, just jittery with excitement, and you all are out of this world.
[01:52.620 --> 01:56.900]  This is Sage's time, so everybody, one more quick round of applause for Sage.
[01:56.900 --> 01:58.140]  Give it up for Sage.
[02:02.330 --> 02:03.370]  Okay.
[02:04.810 --> 02:11.010]  So, this is my presentation called Space Pirates on the Loose, and I thank you, everyone, for being here.
[02:12.910 --> 02:18.490]  So, as you know, I'm a Cal Poly student, and this is my senior research project.
[02:18.490 --> 02:25.590]  So, for the last two quarters, I've been working as a student research assistant under some professors at Cal Poly.
[02:26.110 --> 02:30.750]  And as you can see in this photo, space technology is growing at a rapid pace.
[02:30.890 --> 02:36.790]  57,000 satellites are planned through 2029, and that is only satellites, as you can see in that picture.
[02:36.910 --> 02:43.010]  And although space technology is booming, space law and cyber security is still extremely underdeveloped.
[02:43.050 --> 02:59.430]  So, our research proposes a broad set of scenarios and taxonomy on various cyber threats to space technologies, and it also provides an analysis of ethical, legal, and policy issues and gaps that arrive from multiple risk scenarios.
[02:59.490 --> 03:07.030]  And our hope is for this research to be shown to the National Space Council, which Patrick wins on.
[03:07.190 --> 03:13.310]  And just as a note, everything is still very work in progress, so any input and ideas are greatly appreciated.
[03:13.310 --> 03:17.490]  So, if you run into me around the con, feel free to talk.
[03:19.070 --> 03:24.410]  So, today, I'll be kind of presenting what I contributed to the research effort.
[03:24.410 --> 03:35.530]  So, I'm mainly focused on brainstorming via threat modeling, and for those of you who don't know what that is, it's essentially a method in which threats are identified, enumerated, and prioritized.
[03:36.130 --> 03:42.930]  And I also used attack trees and persona non grata to assist in this, which I'll get into later in this presentation.
[03:43.910 --> 03:52.050]  So, while threat modeling, I also kept note of mitigations to prevent possible cyber attacks on space assets.
[03:52.510 --> 04:00.270]  So, as you'll see later in this talk, I kind of found out that humans are the number one security vulnerability.
[04:01.990 --> 04:05.990]  And also, this research provides a very abstracted view.
[04:06.010 --> 04:14.510]  So, all attack scenarios were compiled based on just public papers, talks, and no technology was directly attacked for this research.
[04:14.510 --> 04:19.210]  So, you won't see, like, too, too, too technical stuff.
[04:20.690 --> 04:23.270]  So, first, attack trees.
[04:23.830 --> 04:34.430]  So, if you don't know what an attack tree is, it's essentially a tree diagram that outlines, like, a multitude of ways that a potential asset or goal can be achieved by a threat actor.
[04:35.150 --> 04:39.810]  So, attack trees were a big help in threat modeling and brainstorming.
[04:40.450 --> 04:48.890]  Okay, so this one here is a zoomed out view of one of my attack trees.
[04:48.890 --> 04:52.570]  And this one was specifically for compromising a dark mission.
[04:52.570 --> 04:59.890]  And if you don't know what that is, it's NASA's program intended to protect Earth from asteroids by crashing satellites into them.
[05:00.050 --> 05:01.030]  So, that's really cool.
[05:01.030 --> 05:05.130]  And due to time, I'll only be going over a few of these attack trees listed.
[05:07.470 --> 05:09.810]  So, how did I create these attack trees?
[05:09.810 --> 05:17.750]  So, I mainly stuck to Visio due to its collaborative features, but I quickly learned that it was really stupid.
[05:17.750 --> 05:23.530]  And every time I tried to, like, format stuff, it always crashed, and it was just really annoying.
[05:23.650 --> 05:30.430]  So, due to this, I found a web app online called Deciduous created by these wonderful people on the screen.
[05:30.430 --> 05:37.750]  And this is essentially a graph visualization tool that handles all the annoying grunt work of building an attack tree.
[05:37.830 --> 05:50.870]  And as you can see in this screenshot, you have just, like, the language on that side, and then as you type, it just automatically formats everything into the attack tree, so you don't need to worry about all that annoying work.
[05:51.190 --> 05:55.190]  And you can go check out that app if you want to use it yourself at those links.
[05:57.820 --> 06:03.800]  So, many of my attack trees were inspired by the Lockheed Martin Cyber Kill Chain.
[06:04.080 --> 06:09.680]  So, the Kill Chain models what threat actors must complete in order to achieve their objective.
[06:09.800 --> 06:11.520]  So, it has seven phases.
[06:11.520 --> 06:24.860]  However, my attack trees kind of use a modified version of this because I learned that every single cyber attack is unique and different, and some may use more phases than this, and some may use only some.
[06:25.900 --> 06:36.980]  So, just to go over the original Cyber Kill Chain very quickly and simply for those of you who don't know it, the first phase is reconnaissance, and this just deals with getting information on the target system.
[06:37.200 --> 06:43.960]  And then there's weaponization, which is just preparing stuff for the cyber attack, like phishing emails and whatnot.
[06:44.680 --> 06:50.140]  And then delivery deals with how you go about getting malicious code on the target system.
[06:50.160 --> 06:54.260]  Exploitation covers executing malicious code on the target system.
[06:54.260 --> 06:58.640]  And then installation deals with installing malware on the target asset.
[06:58.680 --> 07:05.640]  And I don't really include this phase in my attack tree since I kind of like couple that with the exploitation phase.
[07:05.640 --> 07:13.520]  And then there's command and control, which just ensures a continuous remote channel between the target system and hacker if that is needed.
[07:13.800 --> 07:23.820]  And then there's actions on objectives, and this essentially covers what the hacker does to cause chaos and damage once in position of the target system.
[07:26.980 --> 07:30.600]  So, now on to persona non-gratas.
[07:33.760 --> 07:46.100]  If you don't know what persona non-gratas are, they're essentially models to help analyze motivation skills and resources of malicious threat actors.
[07:46.940 --> 07:51.040]  And listed here are some of the threat actors I came up with.
[07:51.120 --> 08:02.840]  And just as a note, all of my persona non-gratas, I got their names from just common names, and all photos I used for them are generated by AI from thispersondoesnotexist.com.
[08:03.340 --> 08:12.060]  And my persona non-gratas were heavily inspired by this paper called A Hybrid Threat Modeling Method, and that covered a really good paper.
[08:12.060 --> 08:15.420]  I highly recommend checking it out if you want to learn more about threat modeling.
[08:16.260 --> 08:17.280]  And yeah.
[08:17.680 --> 08:26.820]  So, for the rest of this presentation, I'm going to be walking through some of the attack trees for some of my most interesting persona non-gratas due to the sake of time.
[08:27.500 --> 08:29.440]  So, yeah, let's start.
[08:29.440 --> 08:31.880]  So, this is Bob.
[08:32.120 --> 08:40.560]  He is 55, and he's retired from his computer engineering job five years ago, and now he's living his lifelong dream, being an alien investigator.
[08:41.460 --> 08:48.300]  He committed full-time when he bought an RV so he could visit all the alien hotspots, particularly Nevada.
[08:49.280 --> 08:56.260]  Sadly for Bob, he has had no luck, even with his expensive equipment, so he's very angry, disappointed, and sad.
[08:56.260 --> 09:01.680]  He is filled with emotion and anger, and his family and others think he's crazy.
[09:01.680 --> 09:08.200]  So, due to this, he would do anything to prove the existence of aliens, even if it means falsifying evidence.
[09:08.360 --> 09:12.940]  He also just wants to impress his radical conspiracy theorist group.
[09:13.100 --> 09:14.780]  Now, y'all shouldn't underestimate Bob.
[09:14.780 --> 09:18.460]  He's super passionate about aliens and poses a huge threat to U.S.
[09:18.460 --> 09:19.800]  space assets.
[09:20.320 --> 09:28.120]  So, in the next slides, we'll be walking Bob through one of my attack trees so he can go about proving the existence of aliens.
[09:28.220 --> 09:36.600]  And this is just to show how threat modeling, such as attack trees and persona nogratas, are very useful for just brainstorming different cyber attacks.
[09:39.710 --> 09:43.930]  Okay, so first, we're going to go start with one of my more simple attack trees.
[09:43.950 --> 09:49.250]  So, this is my attack tree to prove the existence of aliens via tampering space data.
[09:50.350 --> 09:55.390]  So, Bob will use this attack tree to kind of lay out his plan.
[09:55.650 --> 10:00.830]  So, let's just assume the company Bob wants to hack into has very, very, very bad security.
[10:01.190 --> 10:03.770]  So, that's the assumption we're going to make here.
[10:04.190 --> 10:10.990]  So, he thinks by tampering SETI space data at the ground station level, he can prove to scientists and the public that aliens exist.
[10:11.010 --> 10:22.370]  And if you don't know what SETI is, it's the search of extraterrestrial intelligence, and they essentially look at technosignatures which provide scientific data to prove the existence of aliens.
[10:22.670 --> 10:27.630]  So, by tricking scientists, Bob hopes to prove his belief that aliens do indeed exist.
[10:27.830 --> 10:33.410]  So, as you can see, this attack tree uses a modified version of the Lockheed Martin cyber kill chain.
[10:33.570 --> 10:38.470]  So, those pink nodes there are each phases of the cyber kill chain.
[10:38.530 --> 10:43.250]  As you can see, I don't have the installation phase, but I included a new phase called mask.
[10:43.270 --> 10:54.570]  And this mask phase essentially just addresses plans and ideas a threat actor may have to better hide their footprints or the attack altogether, or delay response time.
[10:56.050 --> 11:01.030]  So, for the sake of time, we're only going to cover Bob's plan for the circle phases.
[11:01.030 --> 11:07.430]  So, let's just assume Bob already gathered information about the target system via reconnaissance.
[11:09.790 --> 11:17.270]  So, again, Bob wants to tamper setting space data to trick scientists into believing that they discovered alien life.
[11:18.110 --> 11:23.910]  So, his plan is essentially to gain access to where that data is stored and tamper it from there.
[11:23.910 --> 11:26.530]  So, we're just going to walk through one of the attack trees.
[11:26.850 --> 11:37.250]  So, let's again assume this company has very bad security, and let's assume Bob created malware to allow him remote access to some employee computer.
[11:37.250 --> 11:39.750]  So, he has malware now, as you can see in that picture.
[11:40.030 --> 11:42.510]  So, he's very determined and wants results quickly.
[11:42.510 --> 11:52.230]  So, he decides he's just going to walk in the company himself and pretend to be an employee or inspection person because he feels confident he knows all the technical lingo.
[11:55.030 --> 12:02.370]  So, anyways, going through this attack tree, all the green lines I have there are the paths you take.
[12:02.370 --> 12:08.350]  The Xs are paths you wouldn't take just based on the background of the threat actor.
[12:09.170 --> 12:12.990]  So, let's just assume he was successful and he's now inside.
[12:12.990 --> 12:19.330]  So, he installs the USB himself, gains remote access to the system, and keeps track of anything interesting.
[12:20.190 --> 12:29.170]  And he prepares things such as the USB in the weaponization phase, and he delivers it through social engineering and the delivery phase.
[12:31.580 --> 12:35.740]  Okay, now on to exploitation and actions on objectives.
[12:35.800 --> 12:44.020]  So, in the exploitation phase, he essentially goes to find where this data is located, and let's just assume it's in a database somewhere.
[12:45.080 --> 12:54.840]  So, let's just assume he's lucky and the work laptop he has remote access to is owned by an employee with very, very bad password habits.
[12:54.840 --> 13:02.500]  So, let's just assume he brute forces that in less than 30 seconds, and now he has access to the database and he can do whatever he wants.
[13:04.240 --> 13:16.060]  Anyways, once he has access, he sends commands to alter the data, and let's just say he adds anonymalies and stuff like that to match up with scientists, to try and trick scientists.
[13:16.460 --> 13:34.860]  Now, let's just make the assumption scientists found out, but they don't want to release that information to the public, and Bob didn't really think this through, so to convince the general public, he just decides to commit espionage and just leak all the falsified information he came up with.
[13:35.780 --> 13:41.380]  Okay, so now let's move on to a more sophisticated threat actor and more complicated attack.
[13:42.080 --> 13:44.260]  So, this is Eugene.
[13:44.460 --> 13:49.620]  Eugene is a 19-year-old student who recently became obsessed in cyber security.
[13:49.640 --> 13:52.170]  He is a physics major and teenage prodigy.
[13:52.500 --> 14:09.140]  However, although passionate, Eugene is very immature and really only made scripts by others online to boot people off video games, and he recently joined a Discord group with other script kiddies who just tried to one-up each other in eliteness.
[14:09.820 --> 14:21.050]  He kind of uses this server to feed his ego and stuff, so he thinks, desperate to impress his group, he just thinks it would be really, really a great idea to attack space assets, even though highly illegal.
[14:21.150 --> 14:28.990]  So, he essentially only has one goal, cause as much chaos and destruction as possible to show how elite of a hacker he is.
[14:29.550 --> 14:34.170]  He is also genuinely curious if he just has the skill to succeed in such an attack.
[14:35.010 --> 14:42.530]  So, through being part of such a big hack, he believes he will for sure impress his group and others in the hacker community.
[14:44.310 --> 14:53.050]  So, Eugene thinks it would be a great idea to target a satellite, especially those really cool ones that have lasers nowadays, cause Eugene loves lasers.
[14:53.050 --> 14:57.250]  So, this is just a zoomed out view of the attack tree.
[14:58.290 --> 15:03.530]  And due to time, we will just be jumping straight to the actions on objections phase.
[15:06.440 --> 15:13.760]  So, let's say Eugene wants to target quantum key distribution, because he's a physics enthusiast.
[15:14.160 --> 15:21.720]  So, let's just assume he just got past all the other phases, and somehow got access to a laser through social engineering.
[15:21.760 --> 15:24.280]  So, now he's in possession of a deadly laser.
[15:24.280 --> 15:26.860]  And we'll walk through this attack tree.
[15:26.860 --> 15:40.220]  As you can see, some of those other sub -trees are X'd out, because I'm just assuming Eugene doesn't have that much expertise in quantum, so he just wants to shoot lasers at things, so he just goes the jamming route.
[15:42.830 --> 15:47.310]  So, you may be wondering, what is quantum key distribution?
[15:47.310 --> 15:56.110]  So, what quantum key distribution is, it essentially enables two parties to share a random bit stream used for encryption and decryption.
[15:56.170 --> 16:16.450]  So, it follows the BB84 QKD security protocol, and essentially in quantum key distribution, keys are transmitted as photons, which are essentially light particles, and those are encoded with a random polarization basis, and they also hold quantum bits of information.
[16:16.450 --> 16:23.730]  And if you don't know what polarization basis is, essentially, if you didn't know, photons are not only particles, but waves, so they oscillate.
[16:23.730 --> 16:33.150]  So, when photons oscillate in one direction, they are polarized, and as you can see in this image, those vectors represent the direction in which those photons are going.
[16:35.470 --> 16:39.870]  And essentially, let's just say Alice wants to talk to Bob.
[16:40.030 --> 16:52.510]  So, Alice would send photons to Bob in a chosen polarization basis, and then Bob would use his detector and one of the two bases at random to kind of guess what Alice is sending.
[16:52.550 --> 17:09.350]  So, some of them he's going to get wrong, some he's going to get right, and then through a process called sifting, they find, without revealing their results, where they use the same bases, and where they ended up using the same bases, that is used in the quantum key.
[17:09.470 --> 17:16.450]  Now, the cool thing about quantum key distribution is that if there's an eavesdropper, you could detect that.
[17:16.450 --> 17:22.490]  So, let's just assume Eugene's in the middle, and he wants to sneak and see their information.
[17:22.570 --> 17:33.950]  So, in this situation, Eugene would get stuff from Alice, but he would have to kind of do the same thing as Bob, and kind of make guesses, just like Bob.
[17:34.290 --> 17:44.090]  And since he has to send that information to Bob when he intercepts, he's going to make a lot of errors, because he has to make these guesses.
[17:44.110 --> 17:51.470]  And it can only be measured once, the photons, so it's just going to increase the error rate.
[17:51.470 --> 18:01.350]  So, also, quantum to error rate, which you see down there, that's error rate to key rate, and the higher the error rate is, the less likely you are to get your quantum key.
[18:02.750 --> 18:05.710]  So, that's the cool thing about quantum key distribution.
[18:06.050 --> 18:09.530]  So, back to Eugene's attack.
[18:09.550 --> 18:17.350]  So, Eugene decides to shoot the laser at his target satellite, and he doesn't know too much about the quantum stuff behind it, he just thinks shooting lasers are cool.
[18:18.010 --> 18:38.470]  So, just to go over what would happen, when he shoots this laser beam, the photons from the laser beam would scatter off the satellite and introduce extra optical noise in the transmission, and these photons interfere with the quantum signal and increase the quantum bit error rate significantly.
[18:39.270 --> 18:50.730]  So, when this is very high, the quantum bit error rate, if it reaches a certain threshold, no secret key can be produced, which deems the transmission ineffective.
[18:52.510 --> 18:54.790]  So, on to mitigation.
[18:54.790 --> 19:07.870]  So, what I found out from all my research and attack trees, including the ones I wasn't able to show in the time period today, the number one security is gullible humans.
[19:07.870 --> 19:20.610]  So, the best way to mitigate a lot of these attacks are to teach the gullible humans through stuff like employee training, enforcing two-factor authentication and password policies, for example.
[19:22.150 --> 19:30.510]  Air-gapping critical systems is also important, and if you don't know what air-gapping is, it's just isolating a system from external networks.
[19:32.110 --> 19:38.670]  So, each attack plan I kind of discussed were dependent on devices not being air-gapped.
[19:38.670 --> 19:45.870]  So, if those devices were air-gapped, a lot of the attacks in my attack tree wouldn't be able to happen as easily.
[19:48.670 --> 19:55.270]  So, anyway, to just end off and close up my presentation, I learned a lot.
[19:55.270 --> 20:01.730]  I learned that space technology is rapidly being developed, and there's not enough research on the security of the newer technologies.
[20:01.850 --> 20:15.550]  And as I was researching and finding sources, I found it really hard to find research papers, especially on really, really new technologies, such as DART and laser beam satellites.
[20:15.590 --> 20:20.210]  There was stuff out there, but not all that much.
[20:21.050 --> 20:36.910]  And then I also found that threat modeling, such as attack trees and persona non-guardas, are an excellent way to brainstorm, and they're especially useful for just, like, since there wasn't that much papers I came across for some of the technologies I looked into,
[20:36.910 --> 20:45.770]  just using attack trees and threat modeling and just taking things from other attacks not related to space, it just really helps the brainstorming process.
[20:46.070 --> 20:55.610]  So, anyways, I wanted to thank you all for listening, and I'll be around at the conference, so if you see me around and bump into me, feel free to ask questions in chat, and thank you.