WEBVTT 00:08.840 --> 00:10.020 All set? 00:12.940 --> 00:14.640 Okay, good morning. 00:14.640 --> 00:15.820 Welcome, everybody. 00:15.820 --> 00:19.040 Welcome back to day two of the Aerospace Village Theater. 00:19.040 --> 00:21.760 The crew has a lot of exciting content for you today. 00:21.760 --> 00:26.400 We are happy to kick off day two with all HackASAT updates. 00:26.400 --> 00:40.220 I am very, very proud to tell this entire room that we have successfully completed and accomplished a space challenge using our on-orbit satellite, quite literally making us the world's first CTF in space. 00:40.340 --> 00:41.820 So, thank you. 00:46.120 --> 00:51.340 Big props to our team out there, the Game Ops, the Satellite Ops, and of course all of our competitors. 00:51.440 --> 00:53.540 And thank you all for being here with us today. 00:53.700 --> 00:56.280 So, we do have a lot of very exciting content. 00:56.280 --> 00:57.920 Jordan is going to fill you in. 00:57.920 --> 01:00.220 All day yesterday, it was very productive. 01:00.220 --> 01:07.220 And even overnight, our teams were continuing to downlink data from the satellite to parse through all the information that came through. 01:07.280 --> 01:10.280 So, there's a lot of really exciting information to share with you all today. 01:10.540 --> 01:22.660 Before we do so, just in case anybody wasn't around or hasn't had the background of HackASAT, we do want to get started with just a quick video, a good overview of where we are, who we are. 01:22.660 --> 01:25.080 So, let me get that going for you now. 01:34.930 --> 01:44.670 To point B, the United States Air Force and Space Force had an idea to host a space-based CTF to advance space cybersecurity. 01:44.910 --> 01:54.390 While many were sure it couldn't or shouldn't be done, in 2020, they launched HackASAT, an educational effort and capture-the-flag style hacking competition. 01:54.390 --> 02:05.250 HackASAT is designed to inspire the global security researcher community to develop the interest and skills necessary to reduce vulnerabilities and build more secure space systems. 02:05.250 --> 02:22.790 Education has been central, from testing the public with an open hacking challenge, to a tough qualification round introducing space-relevant topics and skills, to a set of hands-on workshops in the virtual aerospace village at DEFCON Safe Mode, to a whole library of resources on space and hacking. 02:22.790 --> 02:31.770 We developed FlatSAT hardware and challenges to give security researchers access and experience to space technologies they wouldn't have otherwise. 02:31.770 --> 02:43.350 It all led to a fierce final CTF competition for the top eight teams from QUALS, and the source code for all QUALS and final challenges are available on GitHub for the community to keep learning. 02:43.350 --> 02:46.930 As HackASAT 1 ended, planning started for HackASAT 2. 02:46.930 --> 02:53.650 We enhanced the HackASAT FlatSAT and assembled a new digital twin to support even more realistic space challenges. 02:53.650 --> 02:59.990 The qualification round took place in June 2021, with the top eight teams making it to the final event. 02:59.990 --> 03:09.990 HackASAT brought a full slate of talks and workshops about space security to DEFCON 29, and the virtual final CTF took place in December 2021. 03:10.010 --> 03:16.190 Challenges were still based on the FlatSAT, but now teams could test their commands within the digital twin simulation. 03:16.190 --> 03:22.890 And again, the source code from QUALS and finals challenges are available on GitHub through our player's corner page. 03:23.450 --> 03:34.670 As HackASAT 2 ended, planning started for HackASAT 3, and development was already well underway for Moonlighter, a 3U CubeSat dedicated to furthering cybersecurity. 03:34.670 --> 03:37.870 Its first mission would be to host HackASAT 4. 03:37.870 --> 03:44.910 We developed the digital twin-based final event to mirror the actual Moonlighter satellite, and with help from astrophysicist Dr. 03:44.910 --> 03:54.710 Hakeem Oluseyi, we built an online educational experience for the public to plan, build, and test their very own 3U CubeSat, just like Moonlighter. 03:54.710 --> 03:58.410 HackASAT 3 QUALS took place virtually in May 2022. 03:58.410 --> 04:03.850 In August, the HackASAT team brought space-relevant talks to Aerospace Village at DEFCON 30. 04:03.850 --> 04:13.550 The finals took place in October of 2022, with eight teams working through 12 challenges over 23 hours in this attack-defense style CTF. 04:13.550 --> 04:17.930 And again, source code from QUALS and final challenges are available on GitHub. 04:18.250 --> 04:23.350 As Moonlighter moved from design to the build stage, the team went deep into HackASAT 4 planning. 04:23.350 --> 04:25.910 A space-focused CTF is hard to build and play. 04:25.910 --> 04:29.970 An on-orbit CTF is even harder, and it's never been done before. 04:29.970 --> 04:33.170 Our qualification round took place April 2023. 04:33.170 --> 04:42.430 Moonlighter launched on June 5th and deployed from the International Space Station on July 6th, and is now in low Earth orbit. 04:42.450 --> 04:44.610 This is its first mission. 04:44.790 --> 04:46.210 Practice is over. 04:46.210 --> 04:49.430 The HackASAT 4 final event has begun. 04:50.770 --> 04:53.270 A huge congratulations to the Moonlighter team. 04:53.770 --> 04:55.550 Best of luck with operations. 04:58.510 --> 04:59.310 Awesome. 05:00.370 --> 05:01.430 Thank you. 05:04.350 --> 05:07.870 So now that you know, definitely, we're HackASAT. 05:07.870 --> 05:08.990 We're excited to be here. 05:08.990 --> 05:12.490 But more importantly, DEFCON's no stranger to CTFs, right? 05:12.490 --> 05:14.370 But a space CTF, this is new. 05:14.370 --> 05:15.330 This is exciting. 05:15.330 --> 05:25.890 So we do want to provide to you, before we get into all the details of how yesterday unfolded, here's a quick game explainer, and then we'll get Jordan up here to get all the details for you. 05:38.070 --> 05:38.630 To 06:37.500 --> 07:55.250 meet the great challenges of our age, here on Earth, and beyond the Earth, in space. 07:57.030 --> 07:58.290 All right, everybody. 08:02.590 --> 08:03.530 All right, everybody. 08:03.530 --> 08:04.110 Good morning. 08:04.110 --> 08:04.990 Can you hear me? 08:05.290 --> 08:05.810 Hold on. 08:05.810 --> 08:06.930 We'll get this mic going. 08:07.070 --> 08:08.830 I can yell, but I don't want to lose my voice. 08:08.830 --> 08:11.010 So let's try again. 08:11.010 --> 08:11.290 Is this... 08:13.750 --> 08:15.070 We'll use this one. 08:17.030 --> 08:18.930 We'll use this one if it comes on. 08:18.930 --> 08:19.750 There we go. 08:20.170 --> 08:22.850 Which will be tricky as I have to type one-handed later, but we'll figure that out. 08:22.850 --> 08:31.650 So good morning, everybody, and I'm excited here to talk about the details of the capture flag, kind of what's been happening, give you an update here. 08:31.650 --> 08:32.870 I'm Jordan. 08:32.870 --> 08:34.790 I'm the sort of CTF sideline reporter. 08:34.790 --> 08:38.910 So my job is to dig into what's been going on, talk about the challenges. 08:39.010 --> 08:40.470 It's a nerve-wracking update, right? 08:40.470 --> 08:42.950 Because the beginning, we sort of know what we're going to talk about. 08:42.950 --> 08:43.830 We can't talk about the challenge. 08:43.830 --> 08:45.470 We're going to talk about the beginning of the game. 08:45.530 --> 08:52.530 This middle update, we can only talk about things that are already all solved, or we can talk about scoring events, and at the end, we can talk about all the details. 08:52.530 --> 08:55.450 So we can go into the behind the scenes of all the challenges and whatnot. 08:55.590 --> 08:59.670 So this update is the scariest, because you don't know if you're going to have things to talk about. 08:59.670 --> 09:00.890 Are the teams going to score? 09:00.890 --> 09:02.450 Will there be things you can talk about? 09:02.450 --> 09:03.550 What will have happened? 09:03.650 --> 09:08.210 Thankfully, we've got a whole bunch of stuff to talk about, so that's a relief. 09:08.210 --> 09:09.610 I was excited to have that happen. 09:10.070 --> 09:14.250 Just as a reminder, this is kind of the overall structure of what the teams have been doing, right? 09:14.250 --> 09:16.230 So in the lower left, we have the teams. 09:16.230 --> 09:19.190 How many people saw our update yesterday, by the way? 09:19.210 --> 09:21.210 If you were here yesterday morning, good. 09:21.210 --> 09:25.770 If it's a mostly new audience, I'll make sure we're all up to speed at the same time. 09:26.750 --> 09:28.330 The lower left are all the teams. 09:28.330 --> 09:30.170 They're here in the other room through that wall. 09:30.170 --> 09:33.270 You can see five teams that have made it here into the finals. 09:33.370 --> 09:36.490 They're talking to the satellite through this tasking API. 09:36.490 --> 09:50.310 They have this web server interface that all of their code gets uploaded to, all their downloads come through, but then those go to this validation system that actually will check all of their submissions, make sure they're well formed, and then it goes into the command scheduler, 09:50.310 --> 09:58.950 and that's all kind of done through the infrastructure from the game team here, but then the command scheduler goes into the KSAT ground link network. 09:58.950 --> 10:10.950 And so there's actually a commercial provider of satellite ground link stations, and we've got four locations throughout the globe, and then the next time the satellite is over top of one of those, there's a whole set of commands that are uploaded and data that's downloaded, 10:10.950 --> 10:11.430 right? 10:11.430 --> 10:17.390 And you'll notice, though, that the ground network that goes up is different than the ground network that goes down. 10:17.390 --> 10:19.150 Now, they're the same thing, right? 10:19.150 --> 10:20.710 It's the same four locations. 10:21.110 --> 10:23.850 The difference, though ‑‑ oh, sorry. 10:23.850 --> 10:24.030 All right. 10:24.030 --> 10:24.670 Is that better? 10:25.190 --> 10:25.570 All right. 10:25.570 --> 10:27.250 Let me know in the back if I'm getting too quiet. 10:27.430 --> 10:28.810 I hear my echo. 10:30.070 --> 10:39.110 The ground network, the same four ground stations that uplink also downlink, but the point here is that they don't do it at the same time, right? 10:39.110 --> 10:44.990 So if I upload something to happen, it happens sort of over the gap between the communication windows. 10:44.990 --> 10:52.230 So the code all gets queued up, it's on the satellite, and then it gets run while that satellite is going until the next communication window, then it downloads all the results. 10:52.270 --> 10:53.910 So there's a lot of lag. 10:53.910 --> 11:07.090 And even beyond that, and because some of these windows can be quite long, even beyond that, when you have an especially long window between the communication, you can't even download all of the telemetry, all of the things that have happened that have run on the satellite, 11:07.090 --> 11:14.670 and so it's this very, like, fluid environment where it may take multiple contacts to download what happened two windows ago, for example. 11:14.790 --> 11:29.210 And so there's a whole lot of things that you've got to kind of juggle and deal with, and you've got noise, we've had contacts that were interrupted by just bad RF where the communication link couldn't happen because it was just too noisy of a signal between our ground station for whatever reason. 11:29.430 --> 11:31.850 You know, there's a lot of things that are out of our control. 11:31.970 --> 11:34.050 And so that can really make a lot of this challenging. 11:34.090 --> 11:45.650 So the data comes back down on the next pass for whatever attempt you made, whatever challenge you tried to solve, goes through the ground network into the telemetry data that goes back into the teams, and they get to evaluate kind of what they did. 11:48.870 --> 11:57.770 So this is the sort of, like, overall look where you can see the windows that teams have are not fixed, right? 11:57.770 --> 12:00.470 And these are determined by the physics of the orbit. 12:00.470 --> 12:06.730 We didn't even know, in fact, the exact details of when we would have access to the satellite until this week. 12:06.730 --> 12:12.730 It's really been rather, you know, sort of sudden in terms of trying to figure out now how does this impact the challenges? 12:12.730 --> 12:15.370 How many times can the teams talk to the satellite? 12:15.370 --> 12:18.890 So you'll see even, for example, today, there's very few contact windows. 12:18.890 --> 12:27.030 We really only have two contact windows that teams can queue up their commands to the satellite. 12:27.250 --> 12:31.110 And so it means that you better get things right, right? 12:31.110 --> 12:32.890 There's not a lot of room for mistakes. 12:33.050 --> 12:35.530 And then a lot of these contacts do happen after hours, though. 12:35.530 --> 12:43.790 So the good news slash bad news is that, as I said, in these long windows, it takes a while to download all the data, but we've got more windows. 12:43.790 --> 12:53.010 And that's also why we're not really announcing the winners, because we don't know the winners until much later tomorrow morning when we've pulled all the data, we've combed through all the results, and we can really see what actually happens. 12:53.010 --> 13:02.170 So even the scoreboard that we're going to show is not actually real, right, in the sense that there's probably things that have happened since then that just haven't been downloaded or haven't been processed. 13:02.170 --> 13:04.130 There's multiple stages that are happening in this. 13:04.130 --> 13:09.410 So it's a kind of long, like, tail before you find out about some of these things happening. 13:10.510 --> 13:17.930 Specifically, though, you'll notice that teams can interact with these windows in sort of three primary ways. 13:17.930 --> 13:19.950 The first is they can upload a script. 13:19.950 --> 13:21.050 They can run a script. 13:21.090 --> 13:24.970 The second is that they can use the scripts to take a picture. 13:24.970 --> 13:27.230 There's an imager, there's a camera on Moonlighter. 13:27.230 --> 13:29.090 And the third thing is they can download some of that data. 13:29.090 --> 13:31.410 They can download results back out. 13:31.830 --> 13:37.530 In fact, it's up to them then to figure out what they're going to do throughout all of these windows. 13:37.790 --> 13:40.150 You'll notice, so yesterday, again, was the start of the game. 13:40.150 --> 13:48.370 Teams had the beginning of their access then, and there's these two windows, those little kind of white blocks of the communication windows, very, very quickly. 13:48.690 --> 13:51.150 And so the teams wouldn't have been able to get a whole lot done then. 13:51.150 --> 13:53.850 Turns out, they couldn't even communicate with the satellite at all. 13:53.850 --> 13:59.050 We actually had, unfortunately, had two errors that resulted in these windows kind of being unavailable. 13:59.230 --> 14:09.190 One was due to some testing infrastructure, because unlike a server where you can have two servers and one's prod and one's testing and they can be identical, well, that's a satellite in space, so nothing is identical. 14:09.290 --> 14:17.730 And so some of the testing infrastructure that was in place sort of blocked the upload to the satellite during that first window, and so unfortunately we lost that opportunity. 14:17.730 --> 14:24.110 And then the second window, again, we're at the sort of mercy of our ground network operator. 14:24.350 --> 14:25.810 They just dropped our connection, essentially. 14:25.810 --> 14:26.770 We don't really know. 14:27.150 --> 14:28.130 Sometimes it happens. 14:28.130 --> 14:29.590 You lose access to these windows. 14:29.590 --> 14:32.010 So those two windows didn't actually even happen. 14:32.010 --> 14:33.230 Teams had queued up commands. 14:33.230 --> 14:35.610 The good news was we looked through the results. 14:35.730 --> 14:37.030 None of the teams lost scoring. 14:37.030 --> 14:42.470 Nobody had anything that was going to be a solution that would have actually scored on any of the challenges. 14:43.210 --> 14:43.650 Awesome. 14:43.650 --> 14:44.870 Let's see if this one works. 14:46.810 --> 14:47.910 Let's try this one. 14:47.910 --> 14:48.950 Can you guys hear me now? 14:49.350 --> 14:50.290 Still a little quiet. 14:50.290 --> 14:50.610 There we go. 14:50.610 --> 14:51.230 They're going to bring me up. 14:51.230 --> 14:51.970 Perfect. 14:52.110 --> 14:52.430 All right. 14:52.430 --> 14:53.110 Thank you. 14:53.570 --> 14:59.510 So the teams here, they missed a couple of little sort of learning opportunities, right? 14:59.510 --> 15:03.490 These could have been good chances for them to be able to find out how things worked. 15:03.590 --> 15:12.230 And so, for example, one change or one thing that happens is that all the telemetry and the log data that comes back is shared with all teams. 15:12.510 --> 15:14.650 So this is kind of an interesting twist, right? 15:14.650 --> 15:19.890 You as a team, if you run a script and there's some output, everyone can potentially see that. 15:19.950 --> 15:21.350 So teams had to account for that. 15:21.350 --> 15:27.350 And we wanted them to learn that in the sort of first two windows as they were sort of testing the earlier tests. 15:27.530 --> 15:42.490 But because they didn't have that opportunity, what we did was we essentially on the third window, when any data came ‑‑ or the next window that came back to teams when they first had data back, we said, we're separating your logs for this run once, just because you didn't know. 15:42.490 --> 15:44.330 So everyone got their own logs separately. 15:44.430 --> 15:49.010 But just so you know, from now on, your logs are coming back with everybody's, right? 15:49.010 --> 15:52.870 So they have to kind of account for that as they're participating in the game. 15:52.930 --> 15:57.110 This is a concept called consensus logging or consensus evaluation. 15:57.310 --> 16:11.230 It was actually kind of popularized in Capture the Flag a few years ago at DARPA's Cyber Grand Challenge where it was one of the first major Capture the Flags where everything you did, every change you made to your environment, every team got to see. 16:11.230 --> 16:13.170 And it really changes the playing field. 16:13.170 --> 16:19.550 It's a very different game when I submit a change to a binary, I try to patch or make a fix, if other teams can see what I'm doing. 16:19.550 --> 16:23.230 You have to account for that in terms of how you play the game. 16:23.590 --> 16:26.690 And this is kind of a really interesting trade‑off that exists in the real world, too. 16:26.690 --> 16:29.450 Because sometimes you can keep things secret from attackers. 16:29.450 --> 16:32.870 Sometimes the attackers don't know what kind of infrastructure you're running. 16:32.870 --> 16:33.790 Sometimes they do. 16:33.790 --> 16:35.550 Like they can download Windows. 16:35.550 --> 16:38.870 They can download the antivirus software you're using and they can analyze it. 16:38.870 --> 16:43.730 They get full visibility into some of the things on your network or some of the software you're running. 16:43.830 --> 16:50.070 And so it is this interesting trade‑off that you see in Capture the Flag events where they try to balance between, like, is it realistic, is it not? 16:50.070 --> 16:55.890 And in consensus evaluation is one of those things that absolutely exists in kind of the real world, too. 16:56.310 --> 17:02.790 So after those Windows, we have a couple more kind of Windows later on where teams really start getting into it. 17:02.790 --> 17:05.750 They start uploading their attempts and we start seeing what they're doing. 17:05.750 --> 17:10.170 Let me go to this actual score chart and let's talk about this, too. 17:10.170 --> 17:17.710 So our scoreboard here has all five teams and we had to update this right before the talk because, again, we had some scoring events that came through. 17:18.050 --> 17:22.630 And, again, this is itself even delayed, right? 17:22.630 --> 17:29.570 So we got this update, the data was coming through, but we don't actually know if this is the current sort of state of reality. 17:29.570 --> 17:32.710 We have to let everything kind of settle out and we'll find out later. 17:32.910 --> 17:40.030 The five teams, you see the last minute, pulling can into space has jumped into first place. 17:40.450 --> 17:54.310 And then tied for second place, we have jump FS and space bits are us and we've got in fourth place crowd set and then macaroni or M macaroni and in the fifth place spot now. 17:54.310 --> 18:05.410 But, again, there's a lot of room for teams to jump it down because you can see, like, one update could bring you several spots up pretty easily because there are a number of challenges that are left. 18:05.650 --> 18:08.090 Let's go ahead and talk about the overall score chart. 18:08.090 --> 18:11.210 I like this one for looking at what's happening in the game. 18:11.550 --> 18:14.510 If you go to our website, again, you can pull up this data. 18:14.510 --> 18:24.810 You have to click the plus signs on the left to bring up the little ‑‑ the key, the legend that shows you who is ‑‑ which color is which if you don't remember off the top of your head. 18:25.010 --> 18:28.790 But you can see the total points for each one of these challenges. 18:28.790 --> 18:30.810 These are the ones that have been solved so far. 18:31.070 --> 18:37.710 So this is, as I said, this is nerve wracking when you're a competition organizer just seeing those first solves come in is fantastic and exciting. 18:37.930 --> 18:47.510 The top two challenges, password manager and flight software freebies, these are challenges that existed in our ground network. 18:47.610 --> 18:53.330 So they were solved by all the teams because they probably had more time to work on it and they had software they could work with and analyze. 18:53.330 --> 18:55.850 But these are not necessarily, like, give me challenges. 18:55.850 --> 18:58.090 I'll show you in much more detail we can talk about that. 18:58.090 --> 19:03.050 So the good news is because everyone solved it, we can analyze and we can look and we can see what they did. 19:03.050 --> 19:10.570 And those are going to be kind of more traditional software security vulnerabilities, binary analysis, decompilation, exploitation that the teams had to do. 19:10.630 --> 19:13.710 Because, again, that's very much a part of the ground station network. 19:13.710 --> 19:18.950 And the satellite ecosystem includes not only the satellite itself, but the ground stations that it's talking to. 19:18.990 --> 19:25.430 And so making sure that they're secure is equally as important because if the controllers are hijacked, well, then so can the satellites. 19:25.790 --> 19:28.910 And so you'll see thankfully all teams have solved that. 19:29.050 --> 19:33.850 I'm going to go give them a high five on the way out because that makes my life easier because we can talk about those. 19:33.930 --> 19:38.170 These other challenges we can't go into full detail on because not every team has solved them. 19:38.170 --> 19:42.230 So tomorrow if you come back at the awards ceremony, we can talk in a little bit more detail about how they happened. 19:42.230 --> 19:48.710 But we can at least talk about the sort of general shape of the challenges, what the teams know about what they had to do. 19:48.850 --> 19:51.670 So this third challenge you see here is called script kitty. 19:52.150 --> 19:55.390 And the idea here is you just have to run a script. 19:55.390 --> 20:00.110 Remember I said earlier that there's this command interface that lets the teams upload their code. 20:00.110 --> 20:01.670 Their code is running on the satellites. 20:01.670 --> 20:05.270 They're not like sending a packet to the satellite and getting a response back. 20:05.270 --> 20:07.630 Everything that they run has to run on the satellite. 20:07.630 --> 20:11.330 It's a Lua scripting engine that they're running with. 20:11.330 --> 20:16.450 And it's got a whole bunch of access to the imager, to the GPS module, to all these different things. 20:16.490 --> 20:20.510 They're writing their code as these payloads and then they upload it. 20:20.570 --> 20:27.310 That's also where I said that log data that comes back from the scripts comes into that log and that telemetry that gets distributed to all of the teams. 20:27.450 --> 20:32.830 So we saw three teams in the same scoring window were able to score on that script kitty challenge. 20:33.270 --> 20:38.730 We had PFS, PFS RCX or jump PFS or jump as they get called. 20:39.290 --> 20:45.490 We had Poland can and we had CrowdStat all score in the 19th scoring round. 20:45.490 --> 20:47.290 So let's talk a little bit, too, about those scoring rounds. 20:47.290 --> 20:51.710 Because if you look up top, you'll see there's 1, 2, 3, 4, 5, 6, 7, 18, 19, 20, 21. 20:52.110 --> 20:58.090 The fact that they're not contiguous is just sort of an artifact of some kind of internal, some testing that was happening. 20:58.390 --> 21:03.070 But the whole point is, this is the rounds as they happen with scoring windows. 21:03.330 --> 21:04.590 So this is not linear. 21:04.810 --> 21:09.650 This looks nice and linear and you look here like it happened all, like it kind of chunked at a time. 21:09.650 --> 21:20.670 But the scoring windows, as we saw earlier, if I can get back to them, the scoring windows, as we saw earlier, don't always happen at the same time. 21:20.710 --> 21:22.210 The time stamps are a little small. 21:22.210 --> 21:24.590 The website has the details and you can pull them up. 21:24.850 --> 21:26.410 But they're not like every hour. 21:26.470 --> 21:27.790 They can be very random. 21:28.010 --> 21:29.150 Actually, this one has the better one. 21:29.150 --> 21:32.130 You can see the gaps between each one of those windows. 21:32.870 --> 21:41.010 And so when we talk about these rounds, some of these rounds are rounds that happened last night, but the teams had uploaded the data before they left and it finally made it up to the satellite. 21:41.010 --> 21:41.770 The results happened. 21:41.770 --> 21:43.510 We got the data back in a later round. 21:43.790 --> 21:48.970 And so that's why you see it's sort of like this nice, pretty regular chart here and here. 21:49.090 --> 21:50.190 It's not so clean. 21:50.190 --> 21:53.070 It's not so easy in terms of how it actually has happened. 21:53.070 --> 21:57.130 So again, script kitty is your code execution, like running a code. 21:57.130 --> 21:58.710 This is part of a normal API. 21:58.710 --> 22:00.010 You're allowed to task. 22:00.330 --> 22:01.370 You get a time slice. 22:01.370 --> 22:02.570 You get to run your script. 22:02.930 --> 22:05.430 But then can you violate certain properties? 22:05.430 --> 22:07.870 Can you do certain things or some of these later challenges? 22:07.870 --> 22:11.030 So this is sort of, yes, hello, world, you can run code. 22:11.030 --> 22:13.350 Now go on and actually do something with it. 22:13.350 --> 22:16.510 And that's what we're going to see with these next two challenges. 22:16.510 --> 22:21.470 Silver medal is a challenge of just take a picture. 22:21.570 --> 22:22.770 You had to take a picture. 22:23.810 --> 22:30.510 And teams didn't have access earlier in the day yesterday to controlling the attitude of the satellite. 22:30.590 --> 22:37.530 So there was only a window of time overnight that they were actually able to adjust the orientation for pointing. 22:37.810 --> 22:42.450 And so if they want to take a picture of a specific place, you have to be able to point the satellite. 22:42.450 --> 22:46.570 And so that data is still coming in and we'll see what they did and hopefully see some of those images. 22:46.570 --> 22:52.630 I'm really looking forward to seeing the first captured flag picture from space that live happened. 22:52.750 --> 22:54.550 We did actually have one a few years ago. 22:54.550 --> 22:58.930 So we called it a moonshot on a previous version of Hackassat. 22:58.930 --> 23:01.030 But it wasn't the CTF happening on the satellite. 23:01.030 --> 23:08.190 It was like a separate challenge that they could run a little bit of code that was tested and then their pointing map was uploaded to a satellite and a picture was taken. 23:08.310 --> 23:09.890 So that actually let them take a picture. 23:09.890 --> 23:11.410 But this is like no kidding really. 23:11.410 --> 23:12.750 They're writing all the code. 23:12.750 --> 23:14.770 They're doing all the orientation on the satellite. 23:14.770 --> 23:16.750 Their code is running it and triggering it. 23:17.350 --> 23:20.790 So cross your fingers that tomorrow we're going to have some of those coming back. 23:20.790 --> 23:22.410 Like I said, from about 1 a.m. 23:22.410 --> 23:27.630 last night until just before we started speaking now was the period of time where the satellite was moving. 23:27.630 --> 23:32.830 Partly because the control system is a physical artifact. 23:32.830 --> 23:37.470 So there's actually, it's not like a digital on off exact pointing mechanism. 23:37.670 --> 23:43.350 And the fly wheels, the systems that actually do the orientation require a lot of maintenance and tuning and tweaking. 23:43.590 --> 23:46.890 So there's only kind of a narrow window of time that they can actually do that. 23:46.890 --> 23:48.750 Of course there's also power concerns too. 23:48.970 --> 23:56.550 But they've got to like, they've got to kind of reset and adjust the system so it doesn't kind of like become usable again. 23:56.650 --> 24:02.410 Go talk to all the people that do the real space stuff for the details on how that system works and why they need to kind of reorient it. 24:02.690 --> 24:07.530 Because that's, like I said, I'm just the hacker commentator here to talk about the security stuff. 24:07.530 --> 24:09.290 So at 11 a.m. 24:09.290 --> 24:11.670 is when they had that window to orient. 24:11.670 --> 24:13.610 So we'll see what images come down later. 24:13.630 --> 24:22.230 This one, as the satellite is spinning, so again, outside of that window I just mentioned where it's under control and it's actually, they can orient it, the satellite is actually kind of free floating. 24:22.230 --> 24:24.190 Like its orbit is fixed and they know where it is. 24:24.190 --> 24:26.470 But it actually is aiming in all different directions. 24:26.710 --> 24:28.570 And the teams didn't actually control that. 24:28.570 --> 24:29.990 But they could still take a picture. 24:29.990 --> 24:36.690 So that's what we're seeing here in the silver medal challenge that we have both JumpFS and Poland can solving. 24:37.090 --> 24:38.470 They were able to take a picture. 24:39.310 --> 24:40.830 So we will at some point be able to get that picture. 24:40.830 --> 24:43.330 It will probably just be black or looking at space. 24:43.430 --> 24:46.330 So there may not be much to it because they didn't control where it was aimed. 24:46.510 --> 24:51.430 In fact, one of the teams got bit by a little bit of bad luck. 24:51.470 --> 24:53.170 They triggered take a picture. 24:53.350 --> 24:58.550 But they were in a region that is what we call, we've got band regions. 24:58.550 --> 25:00.590 And this is not actual band regions. 25:00.590 --> 25:03.270 They literally did bands around the globe. 25:03.270 --> 25:07.010 So there's a bunch of longitudes that you can't take a picture of the earth for. 25:07.010 --> 25:10.550 And the idea is that this is, again, one of those exercises they have to solve. 25:10.610 --> 25:12.830 So this is one we're not seeing on this view. 25:13.090 --> 25:16.870 But this is called unintended bug. 25:18.190 --> 25:23.790 And that challenge means you have to take a picture of one of these locations where you're not supposed to be able to take a picture. 25:23.790 --> 25:29.090 There's code that prevents them from actually taking a picture out of a big chunk of the globe. 25:29.390 --> 25:32.770 We'll talk more about that tomorrow, how they had to solve it and how they could do that. 25:33.530 --> 25:35.890 But hopefully somebody actually gets that one kind of figured out. 25:35.890 --> 25:38.850 And I think they will from something we're going to talk about later. 25:39.510 --> 25:48.310 But one of the teams, which is randomly snapping a picture during one of their code windows, they happened to be over a band region and they happened to be aimed at the earth. 25:48.490 --> 25:52.470 And so the thing said, no, I'm sorry, I can't take that picture because I'm in a band region. 25:52.470 --> 25:54.150 So it prevented them from actually solving this. 25:54.150 --> 25:57.650 So it's unfortunately a little bit of bad luck, but that's going to happen. 25:57.650 --> 26:07.970 And they could have maybe controlled it, for example, if they would have calculated where in the window the flat sat would be above one of those band regions and where it wouldn't, they could have intentionally chosen that. 26:07.970 --> 26:13.270 So we'll see if that is something that they can solve or not. 26:13.590 --> 26:17.010 They're going to know, though, when they get back the results and they're told, no, your picture didn't get taken. 26:17.150 --> 26:18.530 They already know that's a problem. 26:18.530 --> 26:19.470 They figured that out. 26:19.470 --> 26:23.050 We'll see if they can actually solve it, though, already. 26:23.490 --> 26:30.030 So the last one that we've seen solves for, again, this is the one that happened just before we came into this event, is called Christmas in August. 26:30.370 --> 26:32.870 It's so called because you have to visit the North Pole. 26:33.370 --> 26:37.910 What you're supposed to do is have the satellite show up over the North Pole. 26:37.910 --> 26:42.710 However, I mentioned yesterday, there's no boosters on this satellite. 26:42.710 --> 26:43.710 There's no propulsion. 26:43.710 --> 26:45.070 There's no ability to move it. 26:45.390 --> 26:50.490 The budget wasn't there for, like, a fully autonomous vehicle in space that can move around. 26:50.910 --> 26:52.650 So how are teams supposed to do this? 26:52.650 --> 26:58.810 And the competition organizers did communicate to them, you have to basically get the GPS to be wrong, right? 26:58.810 --> 27:00.790 Because there's a GPS receiver on the satellite. 27:00.790 --> 27:05.650 So they have to do something to basically get the satellite to think it's somewhere else. 27:05.910 --> 27:10.590 And so that is going to let them, you know, lie and say that they're at a particular location. 27:10.590 --> 27:12.430 So two of the teams have figured that out. 27:12.430 --> 27:20.150 They were able to use a cool trick that we'll talk about tomorrow to be able to get the satellite to be somewhere else. 27:20.150 --> 27:26.530 And they were able to go visit Santa, pick up some cookies, have their Christmas in August, which is that particular challenge. 27:26.530 --> 27:30.270 So those are the points that the teams have been able to score. 27:30.650 --> 27:31.670 It's a great start. 27:31.670 --> 27:36.630 And again, we've got, while we only have these two more kind of windows today, the good news is, again, there's still data coming down. 27:36.630 --> 27:46.290 There's still a lot of things that we're getting from both that happened kind of overnight, that are happening today, and they're going to happen even over tonight as we continue to process and pull everything out. 27:46.290 --> 27:48.750 And so we'll see everything else that's going to happen. 27:49.110 --> 27:52.010 I'm going to go through some challenge walkthroughs, though, right? 27:52.010 --> 27:57.970 So for those of you that want kind of a little more detail of, like, well, what does it mean when you say that they're doing an exploit or they're solving a challenge? 27:57.990 --> 28:02.570 Because all five teams have solved these two ground station challenges, we can take a look at it. 28:02.570 --> 28:06.510 We can actually pull them up and show you all the details and talk about what exactly they're doing. 28:06.510 --> 28:11.990 And you can see, like, kind of what goes into their solving one of these. 28:12.410 --> 28:15.090 So the first one is a tool called Password Manager. 28:15.530 --> 28:25.370 And this is a ‑‑ it's actually ‑‑ the actual binary name is Final Pass, which I think is kind of a play on words from Last Pass, which is a password manager you might be familiar with. 28:25.550 --> 28:38.510 And the idea, the original idea, actually, for this challenge was it was going to be a challenge you had to solve at the very, very beginning before you would unlock a ‑‑ use that to unlock a separate server, and then that would unlock to give you all the binaries for the rest of the challenges, 28:38.510 --> 28:40.610 and you would kind of have to solve these kind of sequentially. 28:40.910 --> 28:54.970 However, when the organizers looked at the communication windows and they saw how few sort of communication slots there were, they actually changed the challenge up a little bit, made this one a little bit easier, and made it so you can just solve it and it doesn't block your access to any of their challenges. 28:54.970 --> 29:02.390 And, again, this just comes down to you have to be flexible because the environment you get in space may not be the one that you think you're going to get when you're in planning. 29:02.390 --> 29:05.170 And so they actually changed this before the competition started. 29:05.170 --> 29:07.410 To be clear, all this is done before anything has happened, and so it's fair. 29:07.410 --> 29:09.370 All teams got the same binary. 29:09.370 --> 29:14.550 Because that's also another really big concept in Capture the Flag, is that anything you tell the teams, you have to stick with it. 29:14.550 --> 29:16.550 Anything you communicate has to be even to everyone. 29:16.550 --> 29:19.110 Everyone has to have the same kind of scoring opportunities. 29:19.270 --> 29:21.750 So let's take a look at the password manager here. 29:22.350 --> 29:24.890 And we're going to use a tool called Binary Ninja. 29:25.010 --> 29:25.810 Shameless plug. 29:25.810 --> 29:27.450 My company builds this product. 29:27.910 --> 29:30.050 But it's basically a decompiler, right? 29:30.050 --> 29:39.530 So this takes apart and analyzes binary code, turns it back into source code or something like it that you can try to analyze to find out, like, what the code actually does. 29:39.530 --> 29:41.810 And so the font is going to be really small. 29:41.810 --> 29:43.430 I apologize in advance. 29:43.430 --> 29:49.250 Actually, maybe I can ‑‑ we'll bring up the font size a little bit and see if we can make this a little bit more readable. 29:50.070 --> 29:57.390 But the idea is, again, the code that runs on the satellite or runs on your computer or your phone is just binary, right? 29:57.390 --> 29:59.270 And the CPU is going to execute that directly. 29:59.770 --> 30:04.270 But what you want to know as a human is, what is this actually doing? 30:04.270 --> 30:06.190 Like, can you tell me something meaningful about that? 30:06.190 --> 30:18.110 So tools like Binary Ninja turn that binary back into something ‑‑ something understandable by humans. 30:18.530 --> 30:20.770 So that's a little bit ‑‑ all right, let's go back to the right one. 30:20.830 --> 30:21.950 A little bit more readable, hopefully. 30:21.950 --> 30:28.350 Like I said, we'll put the videos online so you can pull it up full screen later as well, too, so you can see it there. 30:28.670 --> 30:32.090 But the idea here is, you can just see a bunch of yellow on the screen. 30:32.090 --> 30:33.330 So let me talk about that for a second. 30:33.330 --> 30:38.030 When you give a binary to teams, you have a couple of choices as an organizer. 30:38.130 --> 30:41.990 You can give them something with what we call full symbols or with debug information. 30:42.250 --> 30:45.050 And that basically gives them a lot more data about what's actually happening. 30:45.050 --> 30:47.690 You're sort of including some of the stuff from your source code. 30:47.690 --> 30:48.750 So we can actually see that here. 30:48.750 --> 30:52.350 We see a whole bunch of C++ namespace symbols. 30:52.610 --> 30:55.590 So we have a lot of that included in this particular binary. 30:55.590 --> 30:57.130 We see some that are compiled in the binary. 30:57.130 --> 31:00.690 We see some that are imports from libraries, like standard IO stream libraries. 31:01.390 --> 31:03.750 And so we can start, like, this is the code as it runs. 31:03.750 --> 31:09.270 But thankfully, the teams had a lot more hints on what this binary is doing because they can actually kind of read some of the code. 31:09.270 --> 31:12.210 We can see here, this is, we know it's called a password manager. 31:12.210 --> 31:15.310 We can see it creates this manager object here. 31:15.310 --> 31:18.230 And it's got this process choice menu, for example. 31:18.290 --> 31:25.110 So we can look at the process choice and you can scroll through here and you can see, view a password, add a password, delete a password. 31:25.110 --> 31:27.410 So, yeah, it's a password manager. 31:27.550 --> 31:28.850 It's what you would expect. 31:29.250 --> 31:33.850 But there's this interesting thing you can do with a password manager, which is that you can load a database. 31:33.870 --> 31:38.870 You can actually give it a preformed database, like you could, like you have created your own. 31:39.130 --> 31:45.390 And so if you got this binary and you can analyze it, you can figure out what does a valid password database look like for this custom service. 31:45.630 --> 31:48.230 And so you would go into there, you would look at what it's doing. 31:48.330 --> 31:51.130 And even before you get there, you might see this is a little interesting. 31:51.670 --> 31:53.070 Start DB thread. 31:53.430 --> 31:56.230 Like, oh, no, this is sort of a dreaded thing. 31:56.230 --> 32:02.850 If you've ever done any multi‑threaded programming, how many people have written multi‑threaded code where it's like you've got to deal with different threads. 32:02.850 --> 32:08.370 This is actually really, it can be a lot of work, multi‑process, multi‑thread stuff, because now you have to worry about race conditions. 32:08.370 --> 32:13.190 Now you have to worry about, like, well, you have to have mutexes or locks, things that control access. 32:13.210 --> 32:17.770 So multiple threads are just like running sort of two processes that then talk to each other, right? 32:17.770 --> 32:26.350 So they can run at the same time because your computer has lots of CPUs that can run at the same time, so you can run these separate processes, but they increase the complexity of the code a lot. 32:26.430 --> 32:30.370 So in this particular challenge, trying to reverse engineer it was pretty easy. 32:30.370 --> 32:44.090 Like, you can look at this, all the symbols are there, it tells me what it's doing, I know what libraries it's importing, I can read the start DB thread, it's got a get database from the user, so it's actually going to open a data connection, it's going to parse some database. 32:44.150 --> 32:48.290 I have not seen this binary until literally a few hours ago this morning. 32:48.290 --> 32:52.270 They showed me this, like, on the spot when they made it, and this was pretty straightforward. 32:52.270 --> 32:55.930 You can just kind of read through it to understand what it's doing. 32:55.930 --> 33:01.770 It's got pretty error messages that you can see right here, so it's, oh, could not create a user, so there's a problem with user creation. 33:02.230 --> 33:14.790 What the teams had to figure out, though, was that this ‑‑ every time they opened up, whenever they uploaded a file, a new port was opened, a new socket was opened, and then they would upload the file to that socket. 33:14.830 --> 33:18.530 This is a little bit like how FTP works, if you're familiar with the file transfer protocol. 33:18.530 --> 33:24.630 When you upload a file, you say, I have a file , I'd like to upload it, and it's like, no problem, send it over here, and it gives you a new port. 33:24.890 --> 33:32.590 Most of the time nowadays, we have websites where we upload files, it all just uses the same kind of web connection, and we make a bunch of requests over and over to the same connection. 33:32.830 --> 33:39.810 So this is sort of a different way of transferring files, a little more old school , but in this case, it hints to teams, like, something weird is going on. 33:39.810 --> 33:42.330 You wouldn't normally build something like this without a good reason. 33:42.610 --> 33:55.250 And in this particular case, if you're able to open a separate connection, and then you can change some information on the server at the same time, you can trigger this sort of like a race condition. 33:55.250 --> 34:00.610 So what you're uploading, instead of overwriting your database or your information, you can overwrite something else. 34:00.770 --> 34:04.950 And what you would essentially do is you would use this to change your name and become, now I'm an admin. 34:05.190 --> 34:08.310 So you would essentially use this trick to become an administrator. 34:08.550 --> 34:14.990 What I think is especially interesting about this is a lot of these exploitation challenges, you're looking for memory corruption. 34:14.990 --> 34:27.810 If you've heard of a buffer overflow, where you have a specific size of data and you write too much into it and you overwrite some pointers or a return address and you're trying to basically get the computer to execute your code instead of the code it's supposed to run, 34:27.810 --> 34:31.910 treat your data as if it were code or you're trying to hijack the control of where it goes. 34:31.910 --> 34:36.370 Control flow hijacking or remote code execution. 34:36.410 --> 34:41.390 So this is what we often think of when we think of the most hardcore capture the flag kind of challenges. 34:41.710 --> 34:44.170 And this one, you never get code execution. 34:44.170 --> 34:45.290 You don't need to. 34:45.290 --> 35:01.190 You just need the password that's in the admin's password database and you can do that by using sort of this race condition, which is a memory corruption, you're changing bytes you're not supposed to be able to change because it's sort of confused about what you should have access to by having these two different processes running at the same time. 35:01.410 --> 35:07.950 And when you do that, all of a sudden you're just an admin and you can now read a password that you shouldn't have had access to, right? 35:07.950 --> 35:12.010 So I think this challenge is really interesting. 35:12.490 --> 35:13.750 Every team solved this, right? 35:13.890 --> 35:17.210 I kind of blew through the explanation, but there's a lot of code here. 35:17.210 --> 35:18.210 It's a lot to look through. 35:18.210 --> 35:28.650 And so these are all very good teams that they would have put this together and essentially done it midway through the day yesterday to be able to, like, solve this as well as the next one with the resources that they had. 35:28.650 --> 35:31.610 So like I said, this one, the exploitation is a little bit tricky. 35:31.610 --> 35:38.170 Figuring out how you have to kind of win the race is the phrase that we use in exploitation when there's a race condition. 35:38.330 --> 35:39.730 But they did have a lot of symbols. 35:40.310 --> 35:44.130 Now, the next challenge that they had was a little bit different. 35:44.910 --> 35:50.530 I'll just leave it up here in this mode instead of the full screen mode. 35:50.530 --> 35:53.230 Because the next one is called flight software freebies. 35:53.390 --> 35:57.890 So again, you saw on the score board, you can see the names, the password manager and flight software freebies. 35:57.930 --> 36:00.770 Flight software freebies is just a web server, right? 36:00.770 --> 36:04.910 So you can access the web server and they've actually been using this to send things to teams. 36:04.910 --> 36:06.310 They make files available. 36:06.310 --> 36:08.090 There's things on the web server. 36:08.350 --> 36:12.330 You can see here there's like documentation, there's tasking API information. 36:12.350 --> 36:15.610 So this is actually kind of a part of like how to access the game. 36:15.690 --> 36:17.750 All that information comes from this web server. 36:17.750 --> 36:25.130 But it's a custom written web server that the teams could actually use a couple different vulnerabilities on to achieve different things. 36:25.130 --> 36:40.750 Now, again, originally these two challenges, first you were going to have to hack the password manager, get the password, then you were going to have to hack the web server and that would give you all of the challenges, binaries, the documentation information that you would then use to access the remainder of the challenges. 36:40.970 --> 36:46.830 But when they took a look at the Windows and how difficult it was going to be, they said, you know what, we're not going to let this block things. 36:46.850 --> 36:50.150 So at the beginning of the game, all of these downloads were available. 36:50.150 --> 36:53.490 So all the teams could get all the files and kind of work in parallel. 36:53.650 --> 36:56.930 But they still had to solve this because there's still points behind this challenge. 36:57.070 --> 36:59.630 So there were a couple different ways that teams could do this. 37:00.110 --> 37:06.730 The teams were not given, unlike the last one where they just kind of had the binary and they were just given it and told it, here you go, analyze it, here's your password manager. 37:06.970 --> 37:12.930 And this particular one, they had to actually figure out how to even get the binary in the first place. 37:13.030 --> 37:20.290 And so it turned out that there is a, there's a couple ways they could do this, but the web server itself had sort of like a web security vulnerability. 37:20.290 --> 37:23.570 There was an API that you could access. 37:23.570 --> 37:30.310 So if we look on this screen shot of it, you can see there's like a server status page, which just includes some random information. 37:30.870 --> 37:32.650 One of which, let's see here. 37:34.470 --> 37:35.930 Oh, no, I went all the way back to the beginning. 37:35.930 --> 37:36.550 I hit the wrong one. 37:36.550 --> 37:37.490 That's all right, we'll scroll. 37:41.520 --> 37:44.740 Sorry, if I turn my head sideways, I think I make a, make noise. 37:45.820 --> 37:53.760 So if we look at the server status page, does anybody see anything slightly unusual on this page? 37:53.760 --> 37:55.400 Actually, audience participation. 37:56.440 --> 37:57.300 I like to do it that way. 37:57.300 --> 38:01.260 Let's see, does anybody, so there's just a bunch of like, like headers and text. 38:01.260 --> 38:06.760 One of the things on the right column has something that's like a little not like the rest of it. 38:06.940 --> 38:08.180 Does anybody see it? 38:09.640 --> 38:11.660 That's how I know everyone's still awake. 38:11.740 --> 38:13.380 It's early, I know, on Saturday. 38:14.660 --> 38:15.480 Anybody see anything? 38:15.480 --> 38:22.820 So we've got like has for HTTP, there's a server name, there's a document root, there's a bunch of values and true, false, boolean things. 38:22.820 --> 38:29.200 There's this host OS that includes Linux, AWS, it's running Ubuntu, timestamp. 38:29.400 --> 38:31.080 And what's that there at the very end? 38:31.080 --> 38:32.780 There's like this long number. 38:33.320 --> 38:35.400 And this was sort of like a little bit of a gimme. 38:35.660 --> 38:37.940 There's actually a value. 38:37.940 --> 38:39.400 That's actually a running pointer. 38:39.400 --> 38:43.100 It's a pointer that got accidentally leaked in the server. 38:43.320 --> 38:49.460 And so if you're able to download the copy of the server using a separate vulnerability, you can use that to figure out where it's running in memory. 38:49.460 --> 38:56.420 One of the techniques that's used in computers nowadays to make your software harder to hack is that the programs are randomized where they run. 38:56.420 --> 39:01.940 You have memory, you talk about 8 gigs of RAM in your phone or 16 gigs of RAM or 64 gigs of RAM in your computer. 39:02.080 --> 39:08.560 Well, that memory is like a big chunk of memory and when you load a program into it, it used to be your programs were always loaded at the same place. 39:08.560 --> 39:13.540 So when I wrote an exploit, I could just go to the same place if I kind of hijacked control and know what was going to be there. 39:13.540 --> 39:14.860 You don't have that nowadays. 39:14.860 --> 39:16.180 We have what's called ASLR. 39:16.180 --> 39:17.600 We move things around. 39:17.840 --> 39:18.800 This lets you beat that. 39:18.800 --> 39:25.420 This was sort of leaking information and telling the person visiting the website where this process was running in memory. 39:25.640 --> 39:46.120 So by combining that with the separate vulnerability that let them include a local file, pull something out of a proc self, if you really want to go into the geeky details, you could proc self and pull out the memory of the current process and that gets you the bytes of the binary so they could get the binary and they could get where it was loaded and that gave them a lot more information to access another vulnerability. 39:46.200 --> 39:51.380 So we're not going to go into like the full details of exactly how to exploit that vulnerability. 39:51.780 --> 39:55.240 We'll save that for maybe a wrap up later. 39:55.280 --> 40:06.400 But I do want to show you kind of a difference because I think it's instructive to just see, as I said earlier, you can see on this binary we have symbol names, we know that we see a bunch of information, we knew what it was doing. 40:06.540 --> 40:10.920 If we pull up the web server, I don't see anything readable here. 40:11.120 --> 40:17.540 I see, okay, there's a string, web server starting up, but all of these functions just are a random address. 40:17.560 --> 40:18.420 There's no name on them. 40:18.420 --> 40:20.240 This is what's called a stripped binary. 40:20.360 --> 40:23.420 Because, again, the computer doesn't need to know the human readable names. 40:23.480 --> 40:31.380 And most binaries don't have any human readable information in them except for the strings that are going to be sent to users or if there's things that are part of the program. 40:31.380 --> 40:33.760 But the actual code doesn't need that. 40:33.760 --> 40:36.900 The code just runs on all the addresses. 40:37.120 --> 40:40.320 So here you can see this is a very different, much harder to analyze binary. 40:40.320 --> 40:47.680 Not only is there no symbol information, there's no details about what these functions are doing, this is what's called a statically compiled binary. 40:47.860 --> 40:54.880 Which means that normally when you call other libraries, you want to include some other standard pieces of code that every C program might want to access. 40:55.020 --> 41:02.240 Like when you do a hello world, you would print to a screen, you'd say print F or puts or something, you'd write to the screen. 41:02.420 --> 41:07.560 You're not writing all the code to tell it how to write to the screen every time, you just tell it what text to put on the screen. 41:07.580 --> 41:10.120 The library that does that code is like a standard library. 41:10.300 --> 41:13.440 And here it's all compiled into one giant binary. 41:13.820 --> 41:15.360 None of which has names. 41:15.420 --> 41:19.260 So that actually makes the reverse engineering of this binary a very different process. 41:19.260 --> 41:22.960 So when I looked at this this morning, I was like, I don't know, how would I reverse engineer this? 41:23.020 --> 41:25.960 Well, the answer here would be something like you might look in all the strings. 41:25.960 --> 41:28.140 You might search the strings and you know it's a web server. 41:28.440 --> 41:32.260 So you might look for post, for example. 41:32.260 --> 41:32.640 Right? 41:32.740 --> 41:35.500 Post is an HTTP verb a web server would use. 41:35.500 --> 41:37.860 So I could find that string, okay, let's go look for post. 41:37.860 --> 41:40.020 All right, well that gets referenced from this piece of code. 41:40.120 --> 41:42.500 So now you'd start from that and you'd work kind of backwards. 41:42.500 --> 41:45.800 Whereas the other binary, I could just start from the top and just read what it was doing. 41:45.800 --> 41:47.720 I could look at the source code, look at the names. 41:47.720 --> 41:49.160 It was almost like reading source code. 41:49.360 --> 41:52.120 This is much harder to read and it's much more work. 41:52.120 --> 42:03.180 So I really think it's interesting to look at the difference between these two processes, like how you would solve these two challenges are kind of very different, even though they're both just sort of binary challenges. 42:03.180 --> 42:06.640 So as a web server, you had this local file inclusion vulnerability. 42:06.640 --> 42:16.600 You could read yourself, you could read other files and the teams could use that to get the flag or they could access another, there was actually a buffer overflow in the binary with a whole bunch of other stuff beyond that. 42:16.620 --> 42:19.480 So again, those are the two easy challenges. 42:19.480 --> 42:20.740 Those are the easiest ones. 42:20.740 --> 42:22.000 The teams did the quickest. 42:22.620 --> 42:28.320 So we're looking forward to seeing what else they can do throughout the rest of the competition. 42:28.620 --> 42:32.060 Really quickly, I'm just going to summarize some of the remaining tasks. 42:32.140 --> 42:33.420 The teams all know that they've been told this. 42:33.420 --> 42:39.960 They've got to point the satellite and take a picture at a particular location, which requires them to figure out the aiming and we'll see if they've done that overnight. 42:40.060 --> 42:51.000 They've got to take a picture of one of those blacklisted, those banned locations, which requires them to combine the fact that they need to figure out how to lie about where they are or where they're aiming and then be able to take a picture. 42:51.500 --> 43:01.600 And then there's another one as well, there's another challenge called the Iron Bank that involves some cryptography breaking that they have to do on the satellite. 43:01.600 --> 43:07.120 They have to break some crypto properties and exploit the service on the actual satellite itself, too. 43:07.120 --> 43:09.160 So lots more, we'll see if they do. 43:09.160 --> 43:13.300 And with that, I'll turn it over to Kevin. 43:16.840 --> 43:20.380 If I can push the right button, it's not F5, what's the other one from current slide? 43:20.380 --> 43:21.140 There we go. 43:22.740 --> 43:23.720 All right. 43:23.720 --> 43:24.740 Check, check. 43:24.760 --> 43:25.020 All right. 43:25.020 --> 43:25.940 Thank you, Jordan. 43:26.240 --> 43:29.060 So in case you had missed it... Hello. 43:29.080 --> 43:29.740 Whoa. 43:29.740 --> 43:30.120 Hello. 43:30.120 --> 43:30.980 Sorry, check. 43:31.440 --> 43:40.400 So you're probably wondering what is on this table right here and this is actually an engineering model of Moonlighter, the satellite that's over in low Earth orbit right now. 43:40.400 --> 43:43.000 And so we started this talk about 45 minutes ago. 43:43.000 --> 43:48.140 So it's gone halfway around the entire Earth since we all sat down and started talking. 43:48.140 --> 43:50.500 So it's about 17,000 miles per hour. 43:50.500 --> 43:52.000 So it's going really quickly. 43:52.000 --> 43:58.220 And Jordan had explained really well how some of the issues and challenges actually that are faced with the satellite moving that fast. 43:58.220 --> 44:02.720 You have to plan way ahead of when you have that limited contact window with Moonlighter. 44:02.720 --> 44:06.380 And so that makes it all the more challenging as the first CTF in space. 44:06.380 --> 44:10.220 So again, this is a digital, or sorry, engineering model of it. 44:10.220 --> 44:12.740 And I have some more breakout of it. 44:12.740 --> 44:16.300 So here is a chart that shows Moonlighter a little bit up close. 44:16.300 --> 44:18.500 Again, we launched and deployed this summer. 44:18.500 --> 44:23.300 We have good footage of that launch and deployment on our website, hackasat.com. 44:23.300 --> 44:30.900 And we also have a lot of other tons of good content that describes previous year's challenges and a lot of educational material as well. 44:31.280 --> 44:42.800 Hackasat here at DEF CON is the first use case of Moonlighter, but we're certainly finding different possibilities of using it in a similar way to help us become better and more cybersecure. 44:43.900 --> 44:44.880 So here's a chart. 44:44.880 --> 44:51.300 It's a little bit difficult to read, but we have the poster of this over in the contest area where we're mainly located. 44:51.300 --> 44:56.340 So you can look a little bit closer at where each of the, all the different components of Moonlighter. 44:56.340 --> 44:59.860 It has everything that's in a real satellite, because that's what it is. 44:59.860 --> 45:03.660 Its primary payload is a camera that's located on the top of it. 45:03.660 --> 45:05.040 You can see it right here. 45:05.400 --> 45:10.520 And like Jordan had mentioned, one of the challenges will be taking a photo of Earth. 45:10.700 --> 45:14.120 One of the ways you do that is by finding out where you're oriented. 45:14.120 --> 45:18.620 So in space, it's really hard for a satellite to do that just on gravity, because there is no gravity. 45:18.620 --> 45:23.560 So it uses sun sensor, star trackers to sort of look and orient where it's at. 45:23.560 --> 45:30.900 And then it sends commands to the reaction wheels within it to sort of go and face and point it with good accuracy. 45:30.940 --> 45:36.840 So check out the poster right next door and just talk and ask us a little bit more about it. 45:36.840 --> 45:42.480 Essentially, it's a flying computer that's going 17,000 miles an hour away from you. 45:42.480 --> 45:45.220 So it's really difficult to operate and work with. 45:45.300 --> 45:48.320 But it still makes it all the more challenging. 45:48.500 --> 45:51.200 And here's another, more photos of it. 45:51.200 --> 45:54.820 Again, this is, that was the actual Moonlighter itself that we took photos of. 45:54.820 --> 45:57.440 That middle photo is the stowed position. 45:57.440 --> 46:01.560 That's how it looked before the solar array panels came out. 46:01.740 --> 46:09.340 And it's important to make sure that these solar array panels are facing towards the sun, obviously, to do resource management with your battery. 46:10.520 --> 46:16.320 Next slide shows... so this is what the competitors see, but it's also what all of you can see, too. 46:16.320 --> 46:21.560 If you go to hackasat.com, we have live tracking of the Moonlighter space vehicle. 46:21.560 --> 46:24.900 We're showing who scored points when, live updates. 46:24.900 --> 46:30.220 It also shows the next contact windows of when people are going to be able to talk to the different ground stations. 46:30.280 --> 46:34.180 So we have four dedicated ground stations specifically for this competition. 46:34.220 --> 46:40.280 And you can see there's one just on the very, very end or bottom of Chile in Punta Arenas. 46:40.720 --> 46:42.580 And that's just one of them. 46:42.580 --> 46:44.540 So most of them are in the lower hemisphere. 46:44.660 --> 46:49.040 It also shows the different areas where they can take photos and where they can't take photos. 46:49.040 --> 46:55.700 So definitely recommend checking out the website throughout the competition to find out a little bit more about where Moonlighter's at. 46:55.700 --> 47:03.360 Again, it has a lifetime of about a year and a half before gravity eventually brings it down and it fizzles up in the atmosphere like a shooting star. 47:03.800 --> 47:07.240 But for now, if you want to keep tracking it, just go to our website. 47:07.500 --> 47:10.940 And to close things off, I'll invite Steve up here. 47:10.940 --> 47:11.720 Thank you. 47:15.510 --> 47:16.310 All right. 47:16.310 --> 47:18.170 So quickly wrapping things up. 47:18.850 --> 47:24.230 A lot of good content, still a lot of competition to be had, still a lot of things we're getting back from the satellite. 47:24.670 --> 47:27.050 So we're going to have some more things to expose pretty soon. 47:27.150 --> 47:31.110 But I just wanted to give you the schedule for tomorrow that's going to be really important. 47:31.750 --> 47:32.790 Whoops, not that. 47:33.730 --> 47:34.290 All right. 47:34.290 --> 47:36.650 So tomorrow at noon we're going to announce the winners. 47:36.650 --> 47:40.390 So we already talked about why we're going to announce the winners tomorrow and we can't do it earlier. 47:40.450 --> 47:44.570 But also we're going to have the game designers, we're going to have Jordan, and all the teams are going to be here. 47:44.570 --> 47:49.710 But mostly the game designers are going to talk about some of the, in more detail, what Jordan couldn't expose today. 47:49.710 --> 47:52.190 So it's going to be a really, really deep dive technically. 47:52.310 --> 47:53.990 So if you're into that, please join us. 47:54.330 --> 47:57.790 And our announcement, or the special guest will be announcing the winners. 47:57.790 --> 47:59.090 So that will be kind of cool also. 47:59.290 --> 48:02.050 So much appreciated for your time and we look forward to seeing you next door.