WEBVTT 00:17.420 --> 00:18.460 Hey, everybody. 00:18.460 --> 00:19.240 Welcome. 00:19.340 --> 00:20.860 We're going to get started. 00:20.860 --> 00:22.480 If you would take your seats. 00:27.500 --> 00:28.280 Awesome. 00:28.280 --> 00:37.420 So, before the actual event you came here to hear about and learn more about and watch happen, I'm going to do a brief introduction. 00:37.420 --> 00:38.840 My name is Steve Leszczynski. 00:38.840 --> 00:40.420 Spanky also works. 00:40.420 --> 00:42.820 And I am part of the Aerospace Village. 00:42.880 --> 00:51.120 So, we are so happy, proud, you name it, the fact that we have this village. 00:51.120 --> 00:52.420 You all are here. 00:52.420 --> 00:55.520 You all are also here because you want to see HackASAT. 00:55.520 --> 01:04.220 It's our fifth year, but we've been partnered with them from the very first DEF CON in 2019 where we came together as the Aviation Village. 01:04.500 --> 01:12.540 The idea grew and now we're the fourth year and being able to team up with them and, again, having you all come in and see what's happening. 01:12.540 --> 01:14.360 So, please take time. 01:14.360 --> 01:16.280 Obviously, take a look at HackASAT. 01:16.280 --> 01:17.200 Come by the village. 01:17.200 --> 01:18.220 You got questions? 01:18.220 --> 01:19.980 The blue shirts can help you out. 01:20.240 --> 01:24.540 But, man, really glad to see this happening and excited for you all and all the hard work. 01:24.540 --> 01:28.140 So, I will pass it off to a fellow, Steve, and you're in good hands. 01:35.520 --> 01:36.700 What's up, everybody? 01:36.700 --> 01:37.840 How are we doing today? 01:38.840 --> 01:39.640 Awesome. 01:41.900 --> 01:43.320 So, Steve, thank you for that. 01:43.320 --> 01:43.900 Appreciate it. 01:43.900 --> 01:46.940 We certainly appreciate our partnership here with the Aerospace Village. 01:47.760 --> 01:53.000 Already, since our 9 o'clock start time, we've had two scores on the board in HackASAT 4. 01:53.000 --> 01:56.620 Jordan Wines, our CTF expert, is going to talk to you more about it in a few minutes. 01:56.620 --> 02:03.520 But we were a little bit on pins and needles with a real satellite in the air because this is the first ever CTF in outer space. 02:03.620 --> 02:10.020 But we've made it through that uncertainty and, hopefully, we keep progressing positively throughout the next two days. 02:10.620 --> 02:13.140 So, again, I'm Steve from the Air Force. 02:13.520 --> 02:19.760 And a lot of people have asked me, like, why is the Department of the Air Force, which includes the U.S. 02:19.760 --> 02:22.540 Space Force, doing something like hacking a satellite? 02:23.020 --> 02:27.120 And, I mean, it seems like a simple answer to me because we've been on this journey for four years. 02:27.120 --> 02:40.320 But at the end of the day, we wanted to raise the public's awareness, the security researchers' awareness, and the space experts' awareness to the fact that we care about the security of our space systems. 02:40.380 --> 02:45.260 Certainly, we do as a government, just like every other government, but also for our everyday life. 02:45.260 --> 02:52.960 I mean, what we're doing here today, how a lot of us got here today, all integral to space, working 100% and flawlessly. 02:52.960 --> 02:54.260 And it's super hard. 02:54.260 --> 02:57.100 This is why our slogan this year is, practice is over. 02:57.100 --> 03:00.200 We have, space is hard, labeled all of our videos. 03:00.200 --> 03:02.960 And the reason for that is because it truly is hard. 03:02.960 --> 03:05.980 And a lot of things go wrong, and we're not impacted. 03:05.980 --> 03:15.420 But if they go really wrong because of not enough foresight or not enough forethought into the designs of these systems, we all sort of are going to be impacted in a negative manner. 03:15.460 --> 03:19.300 So that's what we really wanted to do, is raise awareness with respect to that. 03:19.300 --> 03:22.320 But we also knew that there was some fun to be had. 03:22.480 --> 03:27.480 Everyone was asking, like, when's the Air Force going to do something that's fun instead of just being boring? 03:27.560 --> 03:30.720 So we just said, all right, well, can we do some something in outer space? 03:30.720 --> 03:35.340 Super hard at first, because no one wanted to let us use their satellites, as you probably can imagine. 03:35.340 --> 03:50.260 So what we did is we slowly, we called it the design-build-break sort of methodology of how we eventually developed our Moonlighter satelliter and launched it, which we'll have one of our Space Force representatives come up and discuss a little bit of the intricacies about it. 03:50.260 --> 03:54.420 We have a real-life replica of it, so the thing flying in outer space right now is that. 03:54.620 --> 03:55.960 It's just a replica. 03:56.480 --> 04:03.800 And we're also going to talk about some game explainers, as well as sort of recap some of our quals and how that went down. 04:03.800 --> 04:05.860 And then what you can see here today. 04:05.860 --> 04:07.780 So there's the history wall over here. 04:07.780 --> 04:08.920 We have what we call a museum. 04:08.920 --> 04:09.840 We have posters. 04:10.000 --> 04:11.540 So please come check it out. 04:11.540 --> 04:22.960 I hope that we've done our job, which is raising the public's awareness of how space systems need to be resilient for the globe to rise, just like the old saying is, a rising tide raises all boats. 04:22.960 --> 04:24.120 So we want to do that. 04:24.120 --> 04:26.800 We want to just come up together, because we all need space. 04:27.180 --> 04:29.980 So with that said, I'm going to show you a history video. 04:30.160 --> 04:32.360 And then some of our other team members are going to come up. 04:32.360 --> 04:41.000 Like I said, Jordan, we have our whole cast of characters that are going to come up and give you some details, along with what you can see around the corner here for the rest of the day and tomorrow. 04:41.260 --> 04:47.840 And also, noon on Sunday, the schedule is all out on the Aerospace Village website, as well as hackasad.com. 04:47.840 --> 04:50.200 We're going to announce the winners. 04:50.520 --> 04:55.080 So there's some intricacies, which Jordan's going to get into, of why we can't score everything right away. 04:55.080 --> 04:57.540 So Sunday, we're going to unveil everything right here. 04:57.540 --> 04:58.900 So it's going to be pretty exciting. 04:58.900 --> 05:02.380 And we might have a special guest potentially do the announcements. 05:02.380 --> 05:07.160 So with that, I'm going to hit the video, and then Rachel's going to come up. 05:13.420 --> 05:16.500 The problem is really quite simple. 05:16.500 --> 05:22.200 Find the best path to get from point A to point B. 05:22.200 --> 05:29.940 The United States Air Force and Space Force had an idea to host a space-based CTF to advance space cybersecurity. 05:29.940 --> 05:39.680 While many were sure it couldn't or shouldn't be done, in 2020, they launched HackASAT, an educational effort and capture-the-flag style hacking competition. 05:39.680 --> 05:50.540 HackASAT is designed to inspire the global security researcher community to develop the interest and skills necessary to reduce vulnerabilities and build more secure space systems. 05:50.540 --> 05:52.480 Education has been central. 05:52.480 --> 06:08.120 From testing the public with an open hacking challenge, to a tough qualification round introducing space-relevant topics and skills, to a set of hands-on workshops in the virtual aerospace village at DEFCON SafeMode, to a whole library of resources on space and hacking, 06:08.120 --> 06:17.000 we developed FlatSAT hardware and challenges to give security researchers access and experience to space technologies they wouldn't have otherwise. 06:17.000 --> 06:28.480 It all led to a fierce final CTF competition for the top eight teams from QWALS, and the source code for all QWALS and final challenges are available on GitHub for the community to keep learning. 06:28.480 --> 06:32.240 As HackASAT 1 ended, planning started for HackASAT 2. 06:32.240 --> 06:38.980 We enhanced the HackASAT FlatSAT and assembled a new digital twin to support even more realistic space challenges. 06:38.980 --> 06:45.240 The qualification round took place in June 2021, with the top eight teams making it to the final event. 06:45.240 --> 06:55.260 HackASAT brought a full slate of talks and workshops about space security to DEFCON 29, and the virtual final CTF took place in December 2021. 06:55.260 --> 07:01.480 Challenges were still based on the FlatSAT, but now teams could test their commands within the digital twin simulation. 07:01.480 --> 07:08.200 And again, the source code from QWALS and finals challenges are available on GitHub through our Players Corner page. 07:08.460 --> 07:19.760 As HackASAT 2 ended, planning started for HackASAT 3, and development was already well underway for Moonlighter, a 3U CubeSat dedicated to furthering space cybersecurity. 07:19.900 --> 07:22.780 Its first mission would be to host HackASAT 4. 07:22.780 --> 07:28.260 We developed the digital twin-based final event to mirror the actual Moonlighter satellite. 07:28.260 --> 07:30.180 And with help from astrophysicist Dr. 07:30.180 --> 07:40.000 Hakim Oluseyi, we built an online educational experience for the public to plan, build, and test their very own 3U CubeSat, just like Moonlighter. 07:40.000 --> 07:43.720 HackASAT 3 QWALS took place virtually in May 2022. 07:43.720 --> 07:49.100 In August, the HackASAT team brought space-relevant talks to Aerospace Village at DEFCON 30. 07:49.100 --> 07:58.860 The finals took place in October of 2022, with 8 teams working through 12 challenges over 23 hours in this attack-defense style CTF. 07:58.860 --> 08:03.220 And again, source code from QWALS and final challenges are available on GitHub. 08:03.660 --> 08:08.640 As Moonlighter moved from design to the build stage, the team went deep into HackASAT 4 planning. 08:08.640 --> 08:11.200 A space-focused CTF is hard to build and play. 08:11.200 --> 08:15.240 An on-orbit CTF is even harder, and it's never been done before. 08:15.240 --> 08:18.500 Our qualification round took place April 2023. 08:18.500 --> 08:27.660 Moonlighter launched on June 5th and deployed from the International Space Station on July 6th and is now in low Earth orbit. 08:27.740 --> 08:29.880 This is its first mission. 08:30.080 --> 08:31.500 Practice is over. 08:31.500 --> 08:34.720 The HackASAT 4 final event has begun. 08:36.080 --> 08:38.540 A huge congratulations to the Moonlighter team. 08:38.540 --> 08:40.980 Stay in touch and best of luck with operations. 08:48.070 --> 08:49.310 Okay, great. 08:49.310 --> 08:49.990 Hi, everybody. 08:49.990 --> 08:52.330 I'm Rachel Mann from the Air Force Research Lab. 08:52.330 --> 08:59.110 So just a little bit more background as far as how we got where we are today to have a live event with you all. 08:59.130 --> 09:02.170 So a qualification was held over April Fool's weekend. 09:02.170 --> 09:05.030 That was not intentional, but it was April Fool's weekend. 09:05.330 --> 09:08.770 Thank you to anybody that's in here that did compete in that. 09:08.770 --> 09:16.250 We, of course, cannot have a great final event with all the participants that we have here today without a really successful qualification event. 09:16.250 --> 09:21.950 And so this year, over the two-day, 30-hour period, we did a Jeopardy-style competition. 09:21.950 --> 09:24.190 We did have over 700 teams. 09:24.190 --> 09:27.390 Over 58 countries are represented across those teams. 09:27.410 --> 09:33.050 We did have 28 challenges with one left unsolved, which I think is kudos to our challenge development team. 09:33.050 --> 09:37.450 We keep things interesting and make it fun but challenging. 09:37.450 --> 09:42.130 So the top eight teams this year were able to get $10,000 in cash prizes. 09:42.130 --> 09:48.510 You will notice a change from this year to last year is that we only brought five teams to finals today. 09:48.550 --> 09:52.790 Of course, why did we have to make that change after doing it that way for three years? 09:52.790 --> 09:55.770 It is, of course, because of the satellite that's in orbit. 09:55.770 --> 10:12.910 To keep this game interesting, to keep it fun, challenging, but still fair, we felt that bringing five teams to finals was the best way to encourage the use of the satellite without any unfairness, any issues with the satellite, and teams not being able to use it. 10:12.910 --> 10:17.150 Five was kind of our prime number versus the eight that we've done in years past. 10:17.150 --> 10:18.290 So that was intentional. 10:18.290 --> 10:20.290 It did take a lot of thinking on our part. 10:20.330 --> 10:26.310 The decision, of course, was not made quickly, but I think we're happy with the way that we are going forward. 10:26.310 --> 10:28.270 And so far, so good. 10:30.570 --> 10:31.370 Kevin. 10:31.370 --> 10:31.530 All 10:36.450 --> 10:38.070 right. 10:38.070 --> 10:38.830 Good morning, everyone. 10:38.830 --> 10:40.670 I'm Captain Kevin Burnett from the U.S. 10:40.670 --> 10:41.370 Space Force. 10:41.370 --> 10:44.730 I'm one of the Space System Command sponsors for this program. 10:44.790 --> 10:52.130 Like Steve had mentioned, when this program was originally starting out, we wanted to see if we can get someone to let us use their satellite and let y'all hack it. 10:52.130 --> 10:54.070 We were met with a resounding no. 10:54.070 --> 10:58.410 So we decided to start building up our very own satellite, never say never. 10:58.410 --> 11:04.830 So it took us a little under two years from start to finish, which is really fast for satellite development. 11:04.830 --> 11:12.950 But earlier this year, in April, we delivered the Moonlighter space vehicle after it was all finished up to the integrator. 11:12.950 --> 11:20.910 So space integrators are the ones in charge of making sure that your vehicle or your space vehicle will fit onto the launch vehicle itself. 11:20.910 --> 11:29.710 And so in June of this year, it was attached to the SpaceX 28 rocket, which was a commercial resupply mission to the ISS. 11:29.710 --> 11:34.370 So it was taking food, water, resources, science missions, upgrades to the ISS. 11:34.950 --> 11:37.430 And it didn't really take long to get there. 11:37.430 --> 11:44.590 But it hung out on the ISS for about a month before an astronaut went and loaded it onto the airlock system. 11:44.590 --> 11:50.170 And then a robotic arm went and grabbed the satellite and essentially just pointed it out and shot it off into orbit. 11:50.170 --> 11:52.610 And we have some cool footage of that as well. 11:52.910 --> 11:57.970 So like I said, Moonlighter, this is a full-scale model of it, a one-for-one model. 11:57.970 --> 11:59.050 So it's pretty small. 11:59.050 --> 12:03.330 It's what's called a 3U CubeSat, which is how they measure smaller satellites. 12:03.330 --> 12:06.090 So it's about 30 centimeters by 10 by 10. 12:06.370 --> 12:11.750 But as our computers and everything gets smaller but still more powerful, this does as well. 12:11.750 --> 12:19.290 So it has all the stuff that's on a satellite, because it is a satellite, and it has its solar panels right now unfolded. 12:19.290 --> 12:22.150 But I think we have some cool footage to show you as well. 12:22.150 --> 12:23.630 These are some different angles. 12:23.630 --> 12:29.830 That middle one is just a picture of the solar panels in a stowed position. 12:29.830 --> 12:37.850 So once you get it released from the ISS, after a while you're able to get those opened up just to make sure your battery life lasts a little bit longer. 12:38.290 --> 12:48.050 And also we have amazing displays over in the next room as well in our contest area, and a lot more people to answer more in-depth questions. 12:48.940 --> 12:56.490 So again, for liftoff, we launched June 5th aboard the SpaceX Commercial Resupply Mission bound for the ISS. 13:01.260 --> 13:02.940 Thank you, NASA. 13:08.940 --> 13:13.110 So there it is in Florida at the Kennedy Space Center. 13:20.920 --> 13:21.970 Liftoff. 13:23.880 --> 13:27.880 And liftoff of CRS-28, go Falcon, go Dragon. 13:42.510 --> 13:45.590 About two minutes, 40 seconds after you have separation. 13:49.160 --> 13:53.040 And then it goes and docks onto the International Space Station. 13:53.040 --> 13:56.380 So space is hard, as Steve Colenso had mentioned. 13:56.700 --> 14:01.680 One of the main reasons is coordinating, working with your launch provider and getting it in space. 14:01.680 --> 14:06.480 I'm sure you've all heard of space launches getting scrubbed due to weather or technical difficulties. 14:06.480 --> 14:07.600 Well, the same thing happened to us. 14:07.600 --> 14:12.660 We had a lot of our team there at the beginning waiting for a launch, only for it to be aborted very shortly after. 14:12.800 --> 14:16.380 And so we came back the next day, but some people had to go home, and it got scrubbed again. 14:16.380 --> 14:18.480 And we waited the next day, but then we had success. 14:18.480 --> 14:23.120 So we were able to have some boots on the ground and get some good footage of that as well. 14:23.120 --> 14:38.260 But just the coordination with space vehicles, although space is much more proliferated than it was even a year ago, you still obviously run into those issues, because the price is too high for you to take any risks that are not negotiable by waiting just one other day. 14:38.260 --> 14:44.640 But we also have some cool footage of when the Moonlighter vehicle was deployed from the International Space Station. 14:44.640 --> 14:52.620 Because a lot of the times your rocket will take you directly into your orbit, but like I said, this is a unique opportunity to get Moonlighter into the orbit that we needed it to be. 14:52.620 --> 14:55.660 So again, it was about a month later that we deployed from the ISS. 14:59.160 --> 15:01.200 Follow along closely, because it's about to shoot. 15:01.200 --> 15:04.540 3, 2, 1, mark. 15:06.020 --> 15:06.960 There it goes. 15:09.940 --> 15:11.400 And it tracks it a little bit. 15:11.400 --> 15:13.220 You'll be able to see it, I think, in the top left corner. 15:13.220 --> 15:14.320 Yep, there it is. 15:16.420 --> 15:17.740 There's real footage. 15:18.100 --> 15:19.500 The Earth is round. 15:19.560 --> 15:20.940 There it is, the curvature. 15:21.820 --> 15:22.860 There's the ISS. 15:22.860 --> 15:26.100 So it took a selfie, so you can tell that it also came off the ISS. 15:27.700 --> 15:31.240 It also shows you how fast Moonlighter really is going around Earth. 15:31.240 --> 15:37.760 So things in LEO at that specific orbit rotate around the entire Earth in only an hour and a half. 15:37.760 --> 15:45.560 So it's moving at 17,000 plus or minus 100 miles per hour, about 5 miles per second. 15:47.660 --> 15:56.460 And later on, we'll get into more details about why that makes it challenging, but also more fun for our ground stations to contact Moonlighter. 15:56.460 --> 15:58.460 Congratulations to the Moonlighter team. 15:58.460 --> 16:00.780 Stay in touch and good luck with the operations. 16:01.080 --> 16:02.160 But it's real. 16:02.160 --> 16:06.100 We're up there now, on orbit, as we speak, it's still going over. 16:06.360 --> 16:14.120 Moonlighter has a shelf life of about a year and a half before gravity eventually pulls it down and it fizzles off into a shooting star. 16:15.740 --> 16:23.840 So you're probably wondering, though, how we're able to even do a CTF, not just on the ground, but on space, on a space vehicle that's going so fast. 16:23.840 --> 16:26.880 And so here's a video that will help shed some light on that. 16:44.980 --> 16:45.460 To 18:50.000 --> 18:56.800 meet the great challenges of our age, here on Earth and beyond the Earth, in space. 18:56.800 --> 18:57.660 Good morning, everyone. 18:57.660 --> 19:03.260 I'm Jordan Wines, or Cyphertex, and I'm the sort of CTF sideline reporter for HackASAT. 19:03.260 --> 19:15.180 By day, I work on a reverse engineering tool called Binary Ninja, and then at night, I play Capture the Flags, or commentate them, talk about them, and I've been lucky to be part of HackASAT now for about four years. 19:15.400 --> 19:18.380 I kind of want to talk a little bit, first, how many people here know what a Capture the Flag is? 19:18.380 --> 19:31.380 I assume most people do, you're here in the room, but just, you know, the idea is that you're hacking systems in a legal manner, and the flags are usually just kind of code, or proof, or triggers, or something that you've shown you've violated some security kind of principle. 19:31.380 --> 19:35.020 So in the Capture the Flag community, we have a couple of different styles of events. 19:35.020 --> 19:44.660 We have ones that are called attack defense, which is what's happening over at DEFCON CTF right now, just over the way, where there are 12 teams there attacking each other while they're defending against their same system. 19:44.660 --> 19:53.240 And we've done that, for example, last year at HackASAT, there have been teams, each with their own infrastructure, that everyone else was attacking and defending at the same time. 19:53.320 --> 20:00.440 We tried to get the Space Force and Air Force to let us launch five satellites, and unfortunately, there wasn't budget, apparently, for that. 20:00.440 --> 20:05.840 So we've got one flat sat that's up in space with Moonlighter right now. 20:05.920 --> 20:11.880 And so this year, in the fourth year, the final event is not going to be this attack defense kind of competition. 20:11.880 --> 20:19.760 It has more of what we call either a Jeopardy style, or a red team CTF, where it's pure attack. 20:19.760 --> 20:26.340 So each team is just trying to attack, and solve, and score, and they're working their way through the different challenges to get their points. 20:26.340 --> 20:32.860 As mentioned in the game explainer, there's no SLA, so obviously in a commercial environment, SLA is service level agreement. 20:32.860 --> 20:34.600 It's just, did you keep your servers up? 20:34.640 --> 20:38.380 Because it's pretty boring when you play a CTF and you just turn the server off. 20:38.560 --> 20:49.740 You're secure, ta-da, and so most CTFs will require you to maintain the services that you're running for other people to attack, but again, since we're not doing attack defense, that's less of a concern this year. 20:49.780 --> 20:54.640 In years past, for example, teams had to worry about battery life, and actually maintain their satellite themselves. 20:54.960 --> 20:58.180 We didn't want to let them mess that up this year on a real satellite, right? 20:58.180 --> 21:07.200 So there's one satellite, it's being maintained, the operations, the battery level, all that's being maintained by the game, the satellite operations teams, and so they're kind of managing that part of it. 21:07.200 --> 21:10.580 But the cool part is, this is the first capture the flag in space. 21:10.580 --> 21:16.140 There is code that is running on that satellite from our teams that's going to be solving these challenges. 21:16.140 --> 21:18.940 So let's talk a little bit about what the game infrastructure kind of looks like. 21:19.520 --> 21:32.060 We've got this kind of overall picture here of, it's a little bit small there, but on the bottom left, though, you can see there's our five teams that are starting here on the ground floor in Vegas. 21:32.100 --> 21:33.380 It's also really nice, by the way. 21:33.380 --> 21:35.860 We've been playing this now for, this is the fourth year we've had this event. 21:35.860 --> 21:38.220 This is the first time we could see the teams face-to-face. 21:38.240 --> 21:39.280 So that's actually really cool. 21:39.280 --> 21:41.840 We're really excited to finally be able to meet people. 21:42.060 --> 21:48.920 It was the beginning of the pandemic when it first hit, and we switched from planning to come to DEF CON, planning to do this event in person, to having to do it all virtually. 21:48.920 --> 21:51.000 So it's great to kind of finally be here. 21:51.000 --> 22:02.680 So we've got those five teams, and again, as Rachel mentioned, you can't have like eight teams competing for a very small number of kind of like satellite communication windows, so we've pared down the final set of teams to these teams. 22:02.680 --> 22:10.560 It also meant that if they qualified for DEF CON CTF, they didn't have to decide if they were going to split their team or if they were going to do both at the same time, if there were fewer teams in the finals. 22:11.100 --> 22:13.260 They're talking to this tasking API. 22:13.260 --> 22:18.240 This tasking interface API is just an HTTP interface that they can now submit their code to, right? 22:18.240 --> 22:27.900 So every operation that they send, they package up, they send to this API, and that can include commands, it can include requests for telemetry, include a scripting interface. 22:27.900 --> 22:32.200 There's all these operations that they can do using that API. 22:32.200 --> 22:33.880 That goes into a validation step. 22:33.880 --> 22:40.620 So the game infrastructure people do some amount of validation to make sure this stuff is well-formed, it's not going to cause anything super crazy to happen. 22:40.620 --> 22:45.540 Like, there is hacking, and that's intentional, but there's also things that could maybe be a bad idea to do. 22:45.540 --> 22:49.780 And so there's some, like, does it pass sort of, like, is it well-formed data? 22:49.780 --> 22:54.260 Is it going to actually do something like construct, or is it actually going to do the task that they're trying to do? 22:54.380 --> 22:59.600 Well, we don't tell them for sure if they're going to solve it or not, but we at least can validate the structure of the requests. 22:59.740 --> 23:01.220 That goes to the command scheduler. 23:01.220 --> 23:10.420 And between the command scheduler there, then, and the ground network, that's actually, it goes off to a commercial satellite operations company that has ground stations throughout the world. 23:10.420 --> 23:12.660 And so there's four different ground stations in use. 23:12.740 --> 23:20.040 You'll see that this ground network kind of has that little L-shaped bend because there's these two phases that the ground station's going to be activated in, right? 23:20.040 --> 23:29.360 On the uplink request, when the code gets, when the requests get uploaded to the server, see, I'm so used to playing with the CTF, to the satellite, right? 23:29.360 --> 23:32.620 When the code gets uploaded to it, that's going to happen during that uplink. 23:32.780 --> 23:39.400 And then it's going to have the next, between the next windows of communication, the code's going to be running, right? 23:39.400 --> 23:45.340 So the payloads are all going to be running on the satellite as the teams each try to solve their challenges. 23:45.340 --> 23:52.120 You can see then on the bottom right there, Moonletter itself has a lot of components that are typical of a satellite, right? 23:52.120 --> 24:01.780 It's got an imager, it's got GPS, it's got ADCS, it's attitude, oh, I always forget, attitude determination control system. 24:01.780 --> 24:02.200 See? 24:02.200 --> 24:03.900 This is why we had the space people around. 24:03.900 --> 24:05.820 I'm just the CTF guy. 24:06.220 --> 24:08.480 And that's essentially the orienting, right? 24:08.480 --> 24:15.800 It's the ability to, like, move and locate where are you and position, well, sorry, move is the thing I have to be careful of saying, right? 24:15.800 --> 24:18.000 Because there is no propulsion on this. 24:18.000 --> 24:26.060 These little flatsats are just floating around, they have the solar panels for, like, maintaining their onboard systems, and they have some gyroscopic orientation. 24:26.120 --> 24:36.380 So they have these, like, I guess they're similar to flywheels, at least as I understand, they can kind of, like, use to, like, orient and move it in 3D space so they can change the axes, but they're just pointing, right? 24:36.380 --> 24:41.520 Which makes sense if you've got that imager and you want to be able to take a picture of something, well, you have to aim at what you're pointing at. 24:41.520 --> 24:44.080 So that's how they do that with that ADCS system. 24:44.080 --> 24:50.340 So these are, again, all kind of typical components of many satellites, commercial and otherwise. 24:50.700 --> 24:59.820 And so it executes the commands, it's going to run through each team's requests, and then that data is going to come back down through the ground station network. 24:59.820 --> 25:03.700 And you notice that we showed that as a different satellite dish because these are different windows, right? 25:03.700 --> 25:09.240 You don't, like, you upload your request and then you have to wait until the next window before you get the results as they come back down. 25:09.240 --> 25:16.900 And that telemetry data, the results that come back, if there's code that they ran, and the teams are going to get all that information, and the data comes back over there. 25:18.960 --> 25:28.800 There are nine challenges, two of which happened on the ground station, and seven of which happened in space, right? 25:28.800 --> 25:33.500 So the majority of the game is actually happening on code that runs on Moonlighter. 25:33.500 --> 25:36.720 So they've got to, like, run their payloads, they've got to get that up in space. 25:36.720 --> 25:38.400 This is what this is actually going to look like. 25:38.400 --> 25:44.960 These communication windows that teams are actually sending their request to throughout these two weekends. 25:45.060 --> 25:54.740 And this is really important to point out that we didn't even know, as the sort of organizers in putting this on, exactly what these communication windows were going to look like until just about the week before the event, right? 25:54.740 --> 25:58.560 So it's really the last minute because you're waiting for the... 25:58.560 --> 26:07.960 Again, I don't understand the space physics or how it exactly works, but you actually don't necessarily know exactly where your orbit's going to be at exactly what time at a far enough out period. 26:07.960 --> 26:11.780 And so we had to kind of figure out where we could talk to it, even. 26:11.780 --> 26:13.840 And it impacted how you design challenges. 26:13.840 --> 26:17.360 Do you have, for example, one challenge that gates another challenge or not? 26:17.360 --> 26:19.880 Is something you would normally design and do a capture-the-flag? 26:19.900 --> 26:21.260 But we had to build that in with... 26:21.260 --> 26:25.300 Again, you'll notice there's very few contact windows on the next day, for example. 26:25.300 --> 26:29.200 So tomorrow, there's just very few opportunities to talk to the FlatSat. 26:29.200 --> 26:38.360 And so they've got a lot of opportunities today, they've got overnight, and then we've got tomorrow Each one of these windows, if you look, there's sort of like door frame or window is the window, right? 26:38.360 --> 26:39.700 The little white arch. 26:40.060 --> 26:45.060 And that's just showing, that's the period of time where we're able to uplink and downlink data from the satellite. 26:45.120 --> 26:53.920 Well, triangle is indicating that the teams have to have all of their requests queued in to be validated to go to the command queue before that window itself, right? 26:53.920 --> 26:56.220 So there's like a hard cutoff, the teams have to have everything in. 26:56.300 --> 26:57.600 Then we have the communication window. 26:57.600 --> 27:01.660 Then it goes off and executes the payloads and we get the results back in the next window. 27:01.660 --> 27:03.020 If all goes to plan. 27:03.020 --> 27:04.580 There's a lot of things that can happen. 27:04.580 --> 27:11.940 Actually, overnight last night, when the game competition team was running tests, they actually had some windows that were corrupted because of RF interference. 27:11.940 --> 27:19.800 It just happens that you don't get a good command window because of who knows what interrupted the communication link. 27:19.800 --> 27:30.360 And so this is, again, we're talking about space is hard, there's just all these real world concerns that can come in and impact how the communications happen and how much availability you have. 27:30.360 --> 27:37.040 So this is really, you know, it's a lot to kind of fit into this weekend competition, capture the flag style event. 27:37.240 --> 27:45.860 You'll see that the red line there on the bottom that shows up tomorrow and kind of overnight, that's actually where they're going to be doing the pointing and imaging missions, right? 27:47.900 --> 27:53.300 Because the flat set isn't always sort of engaged in terms of moving, actually the default state is kind of a tumble. 27:53.360 --> 28:01.000 It's only when you need to activate it and use it and point it and use the orientation mechanisms that it's kind of under control. 28:01.100 --> 28:12.420 And so there's this window that occurs kind of overnight where those imaging tasks, again, there's some of these challenges that they're going to have to do involve pointing the flat set and taking pictures of particular locations. 28:12.880 --> 28:19.960 There's even a fun one where they're required to take a picture at a location that's actually off limits, which I think is super cool. 28:20.280 --> 28:22.480 Off limits being just arbitrary locations. 28:22.480 --> 28:32.740 I mean, we'll see if they try to take pictures of some secret things, but the resolution of the camera is not particularly good, so I don't think we have to worry too much about that. 28:32.820 --> 28:39.440 So again, the game ends from the player's perspective in terms of the commands they're sending tomorrow at about 6pm, right, and there's that last window. 28:39.700 --> 28:44.140 But then there are several more there and even overnight where we're waiting for more data to come back. 28:44.140 --> 29:02.560 It's possible, again, that some of the windows we don't get the full downloads or maybe there's a lot of data backed up and we're waiting for it to all download, and so it's going to take a little bit, and this is why we say come back on Sunday and we'll get the full kind of update of what's happened as we've been able to kind of tally up and see how teams did. 29:03.400 --> 29:05.120 And speaking of the teams... 29:05.120 --> 29:05.480 Oh, wait. 29:05.480 --> 29:05.880 Oh, that's right. 29:05.880 --> 29:06.380 I forgot. 29:06.380 --> 29:07.160 This is the good one. 29:07.160 --> 29:17.420 So this is the actual breakdown where you can see each team has a sort of time slice of the window where their code's going to be run, and there's several different actions they can do. 29:18.440 --> 29:26.640 There's a scripting, there's a downlinking, and then there's an imaging kind of like section, actions that they can take. 29:27.140 --> 29:28.900 There's several different things they can do with that. 29:28.900 --> 29:38.880 It's like an actual scripting language and it's actually a Lua interface that's running on the flat site and so they're uploading this code that's actually going to be executed there. 29:39.440 --> 29:41.580 And you'll see each team changes though. 29:41.580 --> 29:47.360 So the colors of the team is unique to each of our five finalist teams, but it's different per pass. 29:47.360 --> 29:49.540 We randomize it up so that it's sort of fair. 29:49.540 --> 29:53.820 So if you went first in one pass, you'll go in a different spot in a later pass. 29:53.820 --> 29:56.280 And not all teams may take all actions every window, right? 29:56.280 --> 30:07.380 If they're not ready or if they don't have a thing that they want to attempt or they haven't solved a particular challenge and figured out what they need to do yet, maybe we have a couple go by where nothing is happening or maybe only a few teams do. 30:07.980 --> 30:12.620 Alright, so now speaking of the teams, let's talk about the teams themselves that are here. 30:12.760 --> 30:21.240 It's really cool to me that these have been five teams that have all got a long history now with the last four years that we've been running HackASat. 30:22.640 --> 30:26.080 Tremendous amount of placements and qualifiers and finalists. 30:26.920 --> 30:31.680 And so it's really cool that, again, the goal of this event as a whole was to increase interest, education. 30:31.720 --> 30:38.800 It's to help the Capture the Flag, the cybersecurity, the information security community engage with these new systems, right? 30:38.800 --> 30:43.220 There's a lot of unique constraints and unique things with the platform that they're running on. 30:43.400 --> 30:45.460 And we're going to go in order of their qualifications. 30:45.460 --> 30:48.360 So again, the qualifiers that was held on April 1st weekend. 30:48.460 --> 30:50.620 This was the first place team, which was CroutSat. 30:50.620 --> 30:52.600 They're actually a mostly German team. 30:52.600 --> 30:54.520 They've got a couple of Europeans as well. 30:54.640 --> 30:58.360 They've actually been participating in all four years of HackASat. 30:58.480 --> 31:02.140 And they've actually been in the finals now twice. 31:02.380 --> 31:06.700 They were first in Quals this year, which is like a good sign so they're kind of like on an upward trend. 31:06.940 --> 31:16.260 I think it's interesting to talk about them in particular because CroutSat and SourCloud, which is actually playing over in DEF CON CTF right now, are kind of like paired teams. 31:16.260 --> 31:18.780 They're part of the same CTF ecosystem. 31:18.780 --> 31:32.840 And this is sort of one of a couple of different CTF megateams, where there are several Capture the Flag teams that form up, oftentimes along national boundaries or other friend groups or colleges, and they'll have several different smaller teams that come together to form one team. 31:32.840 --> 31:37.820 And so you'll see this is our sort of German representatives of a CTF megateam. 31:37.820 --> 31:43.000 The second place team at the qualifiers was mHackeroni, an Italian sort of megateam. 31:43.000 --> 31:49.480 So they've got a number of folks on their team come from a number of different backgrounds. 31:49.480 --> 31:58.720 They've got a lot of academics, a lot of students, professors, researchers, as well as a lot of commercial engineers like tech companies, security people. 31:58.720 --> 32:07.180 And then they pulled in for in particular for Hackasat, they pulled in some folks that knew the space stuff, right? 32:07.180 --> 32:10.820 To learn how to do satellite operations, to learn some of those details. 32:11.680 --> 32:20.900 They claim that they do have one weakness, so don't tell the other teams, but if you deliver them pizza with pineapple on it, it's apparently their kryptonite. 32:21.240 --> 32:25.260 It's mHackeroni, so pepperoni only apparently, I guess is how that goes. 32:26.000 --> 32:27.620 But we'll see how they do. 32:27.620 --> 32:38.840 And again, they're one of the other teams along with Crowdsat that are kind of jointly playing on the CTF finals over in DefCon CTF and Hackasat at the same time. 32:38.840 --> 32:47.640 So these are large teams, they have large groups of people to even be able to split up and work sort of both of these events at the same time because they take a lot of energy and a lot of focus. 32:49.000 --> 32:54.940 SpaceBitsRUs is unlike the sort of CTF mega teams we saw from the last two, is actually one organization. 32:54.940 --> 32:59.860 So this is Northrop Grumman, they're primarily from the US and the UK, it's a defense contractor. 33:00.060 --> 33:06.380 What's interesting though is that they still have this sort of mixture of like backgrounds and experiences just in a very large company, right? 33:06.380 --> 33:18.540 So they could go find somebody who has satellite ops experience, they could find people with security, with reverse engineering, with data science, whatever skill sets that they needed, you know, physicists, and they could pull all those people into like one team. 33:18.720 --> 33:19.920 And they've formed that. 33:19.920 --> 33:22.620 They've actually been playing again for all four years. 33:22.620 --> 33:30.600 What I think is cool though is that they've like, they did much worse the first couple of years, they were very low in the rankings and they've really improved and increased and done super, super well. 33:30.600 --> 33:32.600 In fact, they were second place in the finals last year. 33:32.600 --> 33:39.760 So they've really come along, you can tell that they've built up the team, they've been learning in this space and done super well. 33:41.440 --> 33:43.880 The next team is the one to watch for though. 33:43.880 --> 33:52.940 They were only fourth in the qualifiers this year but Poland Can Into Space which is a play on words from the Country Balls comic. 33:52.940 --> 33:59.840 If you go look on the, like a webcomic Country Balls, there's a joke about Poland can't , like Poland can't get into space . 33:59.860 --> 34:00.600 And they're like, yes we can. 34:00.600 --> 34:05.500 And their code is indeed going to be running in space this year, so I would say that they certainly can. 34:05.500 --> 34:12.220 They're primarily made up of two Polish, primarily Polish CTF teams, Dragon Sector and P4. 34:12.260 --> 34:19.280 They're very, very strong capsule, like traditional kind of capsule flag teams and they've been dominant in Hackasat over the years. 34:19.280 --> 34:24.040 This fourth place qualifying that they had this year is actually their lowest result they've had. 34:24.040 --> 34:28.920 They've been first or second in every quals and every finals we've had in the past three years. 34:28.920 --> 34:31.680 Last year was the first time they got a final, the first place in the finals. 34:31.740 --> 34:34.560 But again, they've just consistently done extremely well. 34:34.820 --> 34:38.160 And so it's not a surprise that we're seeing them here at finals. 34:38.160 --> 34:42.480 If I had to pick, put some Vegas odds on it, they would be a hard one to beat. 34:42.480 --> 34:46.820 So definitely keep an eye on them as we see how they score throughout the weekend. 34:48.660 --> 34:53.240 Finally, our last qualifying team is JumpFS RCX. 34:53.280 --> 34:56.160 I actually decoded the opcode at first when I first saw the team name. 34:56.160 --> 35:03.420 I'm like, okay it's 0xFF64 64FF21 and I was trying to decode the bits, like what does it mean? 35:03.420 --> 35:07.040 And then I was like, oh no, it's PFS and RCX. 35:07.040 --> 35:08.080 The logo makes it obvious. 35:08.080 --> 35:14.980 So they found an actual x64 CPU instruction that has their two team names combined into it. 35:14.980 --> 35:19.600 So PFS was a capture the flag team that actually won the first year of HackASAT. 35:19.980 --> 35:23.780 And then RCX is from Raytheon Technologies, another defense contractor. 35:23.940 --> 35:25.680 RCX is their CTF team. 35:25.780 --> 35:33.380 And so I was pretty impressed that they could actually find an x86 instruction with both of their mnemonics together, which is kind of cool. 35:33.380 --> 35:41.260 They claim that they can trigger random cosmic ray space rays and trigger bit flips. 35:41.260 --> 35:47.000 I think that's probably not true, but they did list that as their superpower on their team bio. 35:47.000 --> 35:52.600 If they can, Moonlighter will actually be much more susceptible to it than us on Earth with the ozone. 35:52.600 --> 35:57.500 If you're not familiar, there are actual cosmic rays that will literally hit electronics and flip bits randomly. 35:57.500 --> 36:05.240 So sometimes when your computer blue screens, it's not because of a software bug, it's actually because a space ray hit your memory and flipped a bit. 36:05.240 --> 36:07.920 This is actually a thing that happens, which is kind of crazy to think about. 36:08.300 --> 36:12.860 I don't think they can do it, but we'll see if it helps them in the final event. 36:13.880 --> 36:15.480 Alright, so that's it for the teams. 36:15.480 --> 36:20.880 Let's go ahead and talk a little bit more about the schedule and what you can expect the rest of the weekend. 36:22.480 --> 36:23.620 Thanks, Jordan. 36:23.760 --> 36:26.100 Okay, so let's just fill everybody in. 36:26.100 --> 36:30.520 If you haven't visited us, right on the other side of this wall, meander back out of the village. 36:30.520 --> 36:31.500 Please come see us. 36:31.500 --> 36:32.660 We do have stickers. 36:32.660 --> 36:34.440 If there's none out, ask one of us. 36:34.440 --> 36:36.500 We will hook you up with some cool stickers. 36:36.800 --> 36:41.540 We are, of course, running the CTF the rest of today and all day tomorrow. 36:41.620 --> 36:45.100 Let's just remember, this is quite literally the first CTF in space. 36:45.100 --> 36:51.460 So please digest our information, really get lost in the posters, ask questions. 36:51.460 --> 36:57.460 The only thing we do ask is that you give the privacy to the competitors and the main game ops table. 36:57.480 --> 37:02.480 They're kind of off limits, but we will help you and get you all the information you need in the meantime. 37:02.980 --> 37:07.460 Being our fourth year in the village, we still wanted to provide an educational aspect. 37:07.520 --> 37:10.460 Provide folks with kind of a trip down memory lane. 37:10.460 --> 37:13.120 So we have a really fun and cool technology museum. 37:13.180 --> 37:15.060 I personally think it looks awesome. 37:15.060 --> 37:18.380 In the cases, you'll find flatsats from years one and two. 37:18.420 --> 37:21.160 You'll also see a 3D print of Moonlighter. 37:21.160 --> 37:22.700 That's in the third case. 37:22.760 --> 37:31.440 The screen above those has a lot of information as far as the different boards and parts and pieces that it took to put those flatsats and make those work for us. 37:31.440 --> 37:34.460 We've got posters on Moonlighter on the game. 37:34.460 --> 37:38.160 We have a history poster, which is very informative as well. 37:38.160 --> 37:41.740 On our main screen, we're actually going to get some audio running out there. 37:41.740 --> 37:44.140 Live scoreboard, we're always tracking Moonlighter. 37:44.140 --> 37:47.780 It's very important to us and we want to be able to share that with you all as well. 37:49.160 --> 37:55.200 Other than that, we hope to see you again tomorrow, right back here in the same stage, same room at 11. 37:55.200 --> 38:00.180 Jordan is going to give a full deep dive of everything that occurs today. 38:00.180 --> 38:04.300 Anything else that he can talk about that's been scored and all the teams know. 38:04.300 --> 38:08.900 There will be no secrets or insider information given in this room. 38:08.900 --> 38:20.120 We're not anticipating any teams to come in and listen to these talks, so this is really for you guys to just get that piece of the competition that you don't otherwise get sitting at those chairs out there. 38:20.160 --> 38:33.480 So, like I said, tomorrow at 11, and then Sunday the awards ceremony is at noon and that will be the first time that anybody knows where the scoreboard is at and hears our first, second, and third place winners. 38:33.480 --> 38:39.360 The scoreboard is getting pulled off from our public website tomorrow at 6pm. 38:39.380 --> 38:50.080 Not necessarily to provide a blackout, but because we have many more contacts that we're going to be downlinking information and getting the final scores computated. 38:55.780 --> 38:56.860 Are you running through? 38:57.080 --> 38:59.540 Okay, Jordan, one more time for you all. 39:00.340 --> 39:06.380 Alright, so we're going to do a quick game update because, again, the competition actually started at 9am this morning. 39:06.380 --> 39:09.440 The teams have been actively communicating with things. 39:09.440 --> 39:17.200 And we do have a couple of scoring events, so we're going to pull up the scoreboard, but as a reminder, you can get to all this on Hackasat.com. 39:17.200 --> 39:21.720 I'm doing two different events this weekend, so it's a little crazy. 39:21.880 --> 39:26.620 If you go to Hackasat.com, you can see all of the data of, like, when the next contact window is. 39:26.620 --> 39:29.520 You can see how teams are scoring. 39:29.520 --> 39:31.340 And we do already have two teams who have scored. 39:31.340 --> 39:35.320 So remember earlier I mentioned there are two challenges that are just here on the ground station. 39:35.320 --> 39:38.640 So there's some services that the teams can interact with. 39:38.820 --> 39:42.900 And this is important because, you know, somebody's like, I thought this was a space hacking challenge. 39:42.900 --> 39:48.020 Why are they hacking just regular stuff that are normal servers sitting on the ground? 39:48.020 --> 39:52.640 It's like, well, because in actual satellite operations, the ground station is very much a part of the ecosystem. 39:52.660 --> 39:58.140 So that is very much part of securing it, is to secure the communication systems that they're working with. 39:58.140 --> 40:04.660 And those are oftentimes just running on standard servers, standard desktops and the operating systems they're running. 40:05.540 --> 40:11.220 Sometimes there's some slight differences, but some of those are actually surprisingly familiar to people who play regular CTFs. 40:11.220 --> 40:13.560 So it's not a surprise that teams are doing better with that. 40:13.600 --> 40:17.760 We've already got two scores on those ground station challenges. 40:17.860 --> 40:26.020 And so both PolinCAN and JumpFSRCX have scored on the flight software freebies challenge. 40:26.120 --> 40:29.440 So you'll see the scoreboard out on the wall and on the website. 40:29.440 --> 40:32.340 You'll see that they were able to get that in. 40:32.340 --> 40:35.860 We expect a couple more and then again hopefully we'll see some come through. 40:35.860 --> 40:39.220 They have their more communication windows throughout the day. 40:39.440 --> 40:42.180 So like I said, I think we'll just let you all check it out on the website. 40:42.180 --> 40:42.840 Unless it's here? 40:42.840 --> 40:43.480 Oh, it's here. 40:43.480 --> 40:44.240 There we go. 40:44.280 --> 40:45.660 Alright, so we can see the website. 40:48.060 --> 40:48.740 That's alright. 40:49.900 --> 40:51.300 It'll even work on mobile. 40:51.420 --> 40:55.380 It can be a little bit slow because there's a lot of stuff that loads on it. 40:55.380 --> 40:56.340 There's a whole bunch of different things. 40:56.340 --> 40:57.740 You'll see the score over time. 40:57.860 --> 41:01.100 The best one I think is probably the challenge dashboard. 41:01.240 --> 41:05.060 The challenge dashboard will show you by challenge who has solved things. 41:05.060 --> 41:09.220 So you get a pretty good idea of where people are throughout the competition, if that makes sense. 41:10.160 --> 41:11.560 Alright, I think that's it. 41:11.560 --> 41:15.920 We look forward to seeing everybody at our update tomorrow as well as Sunday. 41:16.060 --> 41:17.800 We'll tell you more details about how teams are doing.