[00:14.860 --> 00:20.420] Good afternoon, everybody. In case you haven't been following this weekend, we executed the [00:20.420 --> 00:35.060] world's first CTF in space. So here's what's going to go on today. We're obviously going [00:35.060 --> 00:41.540] to go over the award ceremony and who won by our resident CTF expert, Jordan Wines. [00:41.640 --> 00:46.920] I'm Captain Kevin Berner, again, from the Space Systems Command in the U.S. Space Force. [00:46.920 --> 00:52.340] Sorry about that. I think everyone probably heard about it, but late last night while [00:52.340 --> 00:56.640] we were still here, the organizers, we were still collecting data from the satellite to [00:56.640 --> 01:01.720] see how well the teams were scoring, but there was something suspicious in the hallway and [01:01.720 --> 01:05.440] we were still here, so they had to evacuate all of Caesar's Forum out of an abundance [01:05.440 --> 01:11.680] of caution. But we couldn't necessarily pause Moonlighter, just have it stop going, so we [01:11.680 --> 01:26.380] still had to connect. That's us in an emergency exit stairwell. The show must go on, so massive [01:26.380 --> 01:33.360] props to the game organizers there for continuing to execute it. We had to use our Wi-Fi pucks [01:33.360 --> 01:38.100] and hotspots to make sure we were still connected to the satellite itself. We just wanted to [01:38.100 --> 01:42.340] make sure the integrity of the game was still intact, so that's why. Here's another shot [01:42.340 --> 01:50.820] of us right outside the forum before we had to get ushered away. Thank you. We knew we [01:50.820 --> 01:54.200] would be out there for a while, though. Again, the satellite never stops going and we wanted [01:54.200 --> 01:59.820] to get all the data, so one of the teammates invited us to just go and continue uploading [01:59.820 --> 02:05.740] into his actual room itself, so we were there until the wee hours of the morning, but we [02:05.740 --> 02:11.160] are in a very good spot and we're very, very excited to tell you the results of the competition [02:11.160 --> 02:17.120] here. Unlike some of the other contests, though, we wanted to just front-load the awards, so [02:17.120 --> 02:20.400] not make you, you know, sit through everything. We have a lot of great content, though, to [02:20.400 --> 02:25.320] go through, but just to cut to it, I'm going to invite Jordan up on stage. Thanks. [02:27.360 --> 02:37.480] Thanks, Kevin. I sat through a lot of DEF CON CTF finals waiting to find out who won, [02:37.480 --> 02:41.140] so I was excited when they said they were going to do it first, because I know how stressful [02:41.140 --> 02:45.920] that can be, so we're going to get right into it. We're going to announce the winners, except [02:46.380 --> 02:56.100] first we have to explain something. We almost had an unfortunate situation where we couldn't [02:56.100 --> 03:01.360] differentiate, but we did. If teams remember, there was an update the first day, actually, [03:01.360 --> 03:06.820] so I guess it was two days ago or yesterday, where we clarified and said, just so you know, [03:06.820 --> 03:12.340] tiebreaker mode is where we can differentiate between final scores that are the same based [03:12.340 --> 03:17.700] on rounds. So within the same round, if two teams scored, it counts the same, no matter when their [03:17.700 --> 03:20.980] windows were, right? No matter where in the window they were. So we weren't going to differentiate [03:20.980 --> 03:25.820] between somebody who got an earlier time slot in a particular window, but for a previous round, [03:25.820 --> 03:30.160] if you were the first to get to that score, that's how we broke the ties, right? This is [03:30.160 --> 03:34.300] traditionally how it's done in most CTFs as well, so I think people weren't surprised, but it's a [03:34.300 --> 03:40.780] good thing that we clarified that because we did indeed need that. So we've got our second and [03:40.780 --> 03:46.800] third place were points-wise scored with fourth place, but because they were earlier to it, first [03:46.800 --> 03:54.620] to it, we're able to reveal that the third place team, round of applause for JumpFS RCX. [04:07.060 --> 04:10.040] We're gonna bring all you guys up. All right, so I thought we were just doing the first place. [04:10.040 --> 04:13.880] We're bringing every... so come on up stage or come up up front. We're gonna actually challenge [04:13.880 --> 04:19.500] going all of the the winners. So if the third place team, JumpFS, come on up in front. You're [04:19.500 --> 04:24.160] gonna have... you're gonna come and get your letters and all sorts of good stuff. Sorry, I [04:24.160 --> 04:30.320] thought we were... yeah, yeah. So you'll get more stuff later, but coming up real quick, we'll get the [04:30.320 --> 04:37.380] whole team up. This is a lot more than the eight we saw on the table, right? I expect this with a lot [04:37.380 --> 04:54.160] of the teams. So one last... one other round of applause for JumpFS RCX, everybody. Congratulations. [04:54.160 --> 04:58.400] Thanks, everybody. All right, and now in second place, go ahead and head back to your seats. It's [04:58.580 --> 05:05.460] a too small a stage to bring everybody up. In second place... and somebody remind me, I forget [05:05.460 --> 05:14.100] the prize amounts for third, second, and first. I should have remembered. So it's $20,000 prize [05:14.100 --> 05:22.260] for third place, $30,000 prize for second place, and a $50,000 prize for first place. And in second [05:22.260 --> 05:47.980] place, Poland Candidate Into Space. There's more stuff coming afterwards. I'm not going to hand [05:47.980 --> 05:52.260] everything out, but we've got some coins and some letters and much other stuff for all the teams. [05:53.920 --> 06:20.030] You all worked very hard. You deserve the recognition. All right, thanks, everybody. All right, go [06:20.030 --> 06:29.610] ahead, take your seats, and we'll bring up the winners of HackASAT 4, the first place scores for [06:29.610 --> 06:34.250] the first Capture the Flag in space. I'm going to wait until the hallways are cleared. We don't [06:34.250 --> 06:45.270] want to cause a fire hazard here. Congratulations to Team Macaroni. [06:54.180 --> 06:58.640] This is HackATheHack, the king of the hill. HackASAT 4, the hack for the thrill. Forget about [06:58.640 --> 07:02.360] breathing, let's get to the meal. I'm about to serve you beef, tougher than that. HavocHack is [07:02.360 --> 07:06.860] really bad as well. All you hackers, bring your baggage. Let me take you on a ride in my rocket [07:06.860 --> 07:11.500] ship. This is the future in Apollo 11. Welcome to space. Better strap in if you want to keep [07:11.500 --> 07:15.040] pace. Better come prepared if you want to save face. Boy, need I remind you this ain't a safe [07:15.040 --> 07:19.740] place. This is a race, this is a grind. Infinite space, but not infinite time. It's the same face, [07:19.740 --> 07:25.180] but it's different inside. HackASAT 4, can you hack at it now? That's it, calibrated. HackASAT, [07:25.180 --> 07:37.700] underrated, flatline. All you haters, game time. Is it time for a be real? Did you catch that in [07:37.700 --> 07:47.050] time? So congratulations to all of the participants. Everybody worked really hard. [07:47.050 --> 07:54.530] Congratulations to those that scored in the finals. Making it here at all really is impressive. Let's [07:54.530 --> 07:59.290] go ahead and look now a little bit more about how they got here, how the teams did it, the scores [07:59.290 --> 08:05.670] that kind of got them into this position. So again, as Kevin said, I'm Jordan, the BinaryNinjaGuy, [08:05.670 --> 08:13.110] or CTF sideline reporter, as has been the case. So this is the breakdown of the rounds that we saw [08:13.110 --> 08:19.290] scores on. So you can see who scored when, and again, this is where you can see how that tie [08:19.290 --> 08:26.390] breaker worked out. I can tell people really want to look at this, especially the teams who have not [08:26.390 --> 08:39.660] seen this data. So I'll give them a second to catch up on this. This will be on the website [08:39.660 --> 08:47.700] later too. So you'll have all this later. You don't have to catch it all quite now. So you may [08:47.700 --> 08:52.140] see some that you're surprised you did or didn't see. So let's go ahead and talk about these [08:52.140 --> 08:56.640] challenges. If you've been here with us throughout some of our other broadcasts, you saw we've [08:56.640 --> 09:01.640] already covered a password manager and Flay software freebies, because all of the teams had [09:01.640 --> 09:05.680] solved that by the time we presented on the second day yesterday. Those are the two [09:05.680 --> 09:11.300] ground station challenges. We talked a little bit about those in detail. ScriptKitty was just the [09:11.300 --> 09:15.940] ability to execute scripts. And you can actually see that all the teams have their colors, right? [09:15.940 --> 09:21.680] So you can see what team scored wins. So if you see five blocks of color in one of the rows, that [09:21.680 --> 09:26.600] means every team has solved that particular challenge. The ones that started to differentiate, [09:26.600 --> 09:32.880] where we started to get the final placements, came in SilverMetal, IronBank, and Christmas in [09:32.880 --> 09:40.080] August. And SilverMetal, we had discussed previously, SilverMetal is the ability to take a [09:40.080 --> 09:44.540] photo. And taking a photo could have been sort of a couple of different flavors. One of the photos [09:44.540 --> 09:48.780] is just take any photo and download it essentially from the imager on the satellite. And so if the [09:48.780 --> 09:52.780] teams were able to take any photo, even while they weren't pointing or aiming, they were able to get [09:52.780 --> 10:00.080] points in that particular challenge. IronBank is a cryptography challenge. Essentially there is a [10:00.080 --> 10:04.380] secure element we'll talk a little bit more about later. And Christmas in August is the challenge [10:04.380 --> 10:10.560] where they had to actually spoof the GPS, right? They had to be able to get the satellite to be in [10:10.560 --> 10:15.060] a different location. So here's what those scores look like when you map them out. Again, you can [10:15.060 --> 10:21.840] see Macaroni's fantastic jump to the lead overnight, just this last night. And again, as the [10:21.840 --> 10:25.560] data came in, when the team was out there on the steps, they're downloading all the results that [10:25.560 --> 10:30.680] let these scores get kind of calculated, right? So this is what happens as we were to pull in all the [10:30.680 --> 10:35.800] data. You can see everything that they're doing. And you can see they had a really, really good [10:35.800 --> 10:44.720] surge there with several solves. So here's what the contact windows look like. Again, due to physics [10:44.720 --> 10:48.980] and the fact that we don't control things absolutely, and there's a lot of noise in the system, [10:48.980 --> 10:52.600] and there's a lot of things that you just kind of have to play the hand you're dealt, we didn't [10:52.600 --> 10:56.660] know exactly what these contact windows were going to look like for the ground stations that we [10:56.660 --> 11:01.600] had for this event until this past week. And so you can see the first day we had a lot of contact [11:01.600 --> 11:07.320] windows, but then the second day we had very, very few. In fact, two of these windows on the [11:07.320 --> 11:11.400] second day, right there in the middle and at the end, they were so busy uploading things, very [11:11.400 --> 11:16.060] little data could even be downloaded because the communication links were just so busy. We wanted [11:16.060 --> 11:21.180] to give teams as many attempts as possible and to get as many of their windows run, and so it was [11:21.180 --> 11:27.820] just all uploads, right? And so you have to kind of balance that data. I'll bring the mic in a [11:27.820 --> 11:31.120] little bit closer. Is that loud enough? It's so loud to me up here, I feel like when I do this. [11:31.120 --> 11:35.900] You guys can hear me okay in the back? All right, we'll do it closer then. Yell at me if I get [11:35.900 --> 11:42.240] quiet again. All right, so let's go ahead and we're going to bring up the Cromulence Challenge [11:42.240 --> 11:45.720] team because they're the ones that built all of these challenges, and we're going to deep dive [11:45.720 --> 11:50.460] into some of like how they work, how the solutions are. The teams I know are probably get excited to [11:50.460 --> 11:55.180] like ask them questions too, so come on up Cromulence if you guys want to join me on stage. I'm [11:55.180 --> 11:58.780] going to go ahead and play some of the videos while they're kind of coming up and get getting [11:58.780 --> 12:05.280] situated here. We'll get them on stage. The first thing we're going to watch is the official kind [12:05.280 --> 12:09.600] of like we've prerecorded some videos with explainers for some of these challenges. And so [12:09.600 --> 12:14.700] let's take a look at the Iron Bank Challenge. Here, if I can play it right. [12:14.700 --> 12:19.780] 17,500 miles an hour. Five miles per second. [12:23.260 --> 12:28.260] Challenge. Players get access to a binary for a script security service called Iron Bank. This [12:28.260 --> 12:32.440] service also contains a flag and if players can hack the service then they can trigger a download [12:32.440 --> 12:33.460] of the flag. [12:40.130 --> 12:43.950] That was the short version. Yeah, there's a little more details in the other one. That's okay. [12:44.210 --> 12:48.210] Thankfully, though, we have the author and some of the those that like wrote solution scripts and [12:48.210 --> 12:53.290] play tested this challenge that we can ask them a little bit more about it. So I think Mike, [12:53.290 --> 12:57.190] this was this was your challenge, correct? Yeah. Why don't you describe kind of the the goal of [12:57.190 --> 13:02.370] this challenge and leave it on. It's fine. You're good. You're good. They'll all meet you. Yep. Just [13:02.370 --> 13:05.990] let us know like what the service was, what the teams kind of like we're told about it. [13:05.990 --> 13:10.910] All right. Yeah. So on the satellite, there was a service called Iron Bank. And we actually use [13:10.910 --> 13:18.430] this service to move the team scripts from a quote unquote safe area to an area where we ran it in [13:18.430 --> 13:27.590] isolation. And this script required you to do a challenge and MD5 authorization scheme so that it [13:27.590 --> 13:32.470] couldn't be, you know, used by unauthorized people like the player. However, we expose the UDP [13:32.470 --> 13:37.850] port through RE to the players. And the players would have also noticed there was a very obvious [13:37.850 --> 13:43.550] timing bug. We considered making the timing bug harder. But then we were like, this is in space. [13:43.550 --> 13:49.850] It's hard enough already. We'll just make it really easy to see. So if you could conduct a [13:49.850 --> 13:55.910] timing attack from your scripts against Iron Bank, you could actually crack the MD5 that you [13:55.910 --> 13:59.950] needed to authorize without actually knowing the secret key. And that would allow you to download [13:59.950 --> 14:04.710] the flag. And if the game had been a little bit longer, we actually would have also seen it gave [14:04.710 --> 14:09.790] you the ability to steal other people's scripts. But over two days, we just weren't able to get to [14:09.790 --> 14:12.950] the point where teams were doing that. But after you got the flag, you would have been able to [14:13.430 --> 14:15.630] grab somebody else's script and set it up for download. [14:15.630 --> 14:19.070] I didn't even know about the stealing a script one. That's one I actually hadn't heard. That's [14:19.070 --> 14:23.070] cool. So again, like you could do like this kind of a challenge. There was like a verification [14:23.070 --> 14:28.690] step that has like a secret key. You don't have the secret key. But if you could extract it [14:28.690 --> 14:31.950] somehow, and again, if you remember that scoreboard, this is the one that really propelled [14:31.950 --> 14:35.310] Macaroni into the lead, because they were the only team that successfully solved this. And I [14:35.310 --> 14:39.110] think we saw them kind of working on this even on the first day, right? This is something that [14:39.110 --> 14:42.870] they were attempting very early. So we weren't sort of surprised that they were the ones to do [14:42.870 --> 14:47.090] it. Jason, like when you kind of saw them, like what was that look like watching them, you know, [14:47.090 --> 14:47.850] attempt this? [14:48.130 --> 14:52.790] Yeah, so every team, eventually, I think most teams figured out the bug. It was a fairly obvious [14:52.790 --> 14:59.730] bug, basically, when you were essentially a naive check function, where it was not a constant [14:59.730 --> 15:04.350] time function. So every time you checked a single byte, it would exit early. And by doing [15:04.350 --> 15:09.850] that, you could guess one byte at a time, which allowed you to pass that authentication check. [15:09.970 --> 15:15.290] And initially, teams tried a first round, where they didn't do a trial, they didn't do any [15:15.290 --> 15:20.550] statistical collection of that data, which they wouldn't be able to successfully do it because [15:20.550 --> 15:24.350] the timing data isn't perfect, right? There's some statistical noise, there's noise with [15:24.350 --> 15:28.250] interrupts and things like that on the satellite. And then we noticed teams figure that out, and [15:28.250 --> 15:32.690] they started refining that. And, you know, macaroni was the one that was able to build the [15:32.690 --> 15:37.890] best solver for that. And they were able to get that pull that off right, right at the end, [15:37.890 --> 15:40.190] basically, I think that was within the last contact window. [15:40.490 --> 15:44.170] And you had actually tested this internally. So you were like, you know, when you as a CTF, [15:44.170 --> 15:47.630] like, you know, creator, you always have other people on your team who are solving your [15:47.630 --> 15:51.190] challenges to make sure you're solving, just the author can't be the only one that actually [15:51.190 --> 15:55.550] solves it. And so you we actually have a recording of your, your solution script. So we can see [15:55.550 --> 16:01.890] it kind of running. We did sort of slow it down just so you could see it on the video. You had [16:01.890 --> 16:05.210] like a sleep, a little bit of sleep just so we could see it. But again, it's very visual. I love [16:05.210 --> 16:09.770] these kinds of challenges. These are like real world challenges, right? Like the fact that you [16:09.770 --> 16:16.510] can actually have timing attacks on a verification that is if it's not a constant time, you know, [16:16.950 --> 16:21.630] comparison. In other words, if I have like a secret, and I can, you can ask me, is it this? Is [16:21.630 --> 16:25.990] it this? Is it this? And it takes you longer because you check each byte at a time. That's [16:25.990 --> 16:29.750] essentially what's happening here, right? And so you can actually see it. It's just trying every [16:29.750 --> 16:33.130] possible byte here. It's just like the movies. It's literally like in the movies when you watch [16:33.130 --> 16:37.430] password cracking in the movies, how that clicks through it. But that's really how this kind of a [16:37.430 --> 16:41.730] challenge works. So Jason, how long did your, like, if we, if we take out the sleep, so we took [16:41.730 --> 16:45.550] out the prints and the debug, like, how long was your solution on your laptop able to run? [16:46.010 --> 16:51.270] Yeah, I mean, on the laptop on NX86, it can run fairly quickly. But on the satellite, it takes [16:51.270 --> 16:56.810] about two to three minutes, possibly. This solver actually, it'll guess and then it'll detect if it [16:56.810 --> 17:00.230] made a bad guess, and it'll go back. So when you actually look at the video, you can see the [17:00.230 --> 17:05.750] solver go back a byte and re-guess. And it does that because once it made a bad guess, there's no [17:05.750 --> 17:09.430] timing variances for the future guesses. And I didn't see any of the teams implement that [17:09.430 --> 17:15.910] algorithm. You should have. But it allows you're basically more robust implementation. [17:15.910 --> 17:19.170] So tell me a little bit about the timing, because I know there was some some conversation where [17:19.170 --> 17:23.470] teams had very, very few attempts. Again, those windows were super limited right in the whole [17:23.470 --> 17:27.190] event. And this is just an incredible, it's hard, not only for the teams, but also even the [17:27.190 --> 17:32.450] organizers. But because they had such few attempts, like, you know, you only get a certain [17:32.450 --> 17:34.910] amount of like signal and noise. And so how did you kind of deal with that when you're... [17:34.910 --> 17:39.330] Yeah, so that's, that's the basically algorithm detecting that you can see it, it'll step [17:39.330 --> 17:45.030] back, I think, you know, makes a bad get right there. And then it then it retries. And so [17:45.030 --> 17:48.490] that's how you could deal with that in this environment, we had very limited number of [17:48.490 --> 17:52.470] contacts, you didn't know what was going on, you can add a little bit of resiliency in that. [17:52.470 --> 17:56.850] And the teams, you know, I think they did that by increasing their trial count. So making a [17:56.850 --> 18:01.030] statistically higher number of tries and just trying over and over and over. [18:01.030 --> 18:05.970] Even in the challenge design, the first version of it, I think had less of a signal in the [18:05.970 --> 18:09.350] timing, right? So you even had to, as you're playtesting, you tried it, and you're like, you [18:09.350 --> 18:13.490] know, there's not enough signal here, they would have to run 1000s or millions, it still would be [18:13.490 --> 18:16.810] doable if they had much more time to figure it out, right? [18:16.810 --> 18:20.610] Yeah, especially because they had very limited feedback from the satellite itself. [18:20.610 --> 18:24.070] Yeah. Yeah. So because every one of these attempts that they got, they were throwing up [18:24.070 --> 18:28.170] there, you know, it takes a while, you got a delay, and you get your results. And it's the [18:28.170 --> 18:31.330] time delay, as well as the like, you know, there's less windows left. [18:31.410 --> 18:34.730] We knew this would be one of the harder challenges. And it was very hard for us to tune. [18:34.730 --> 18:38.830] But, you know, everybody, I think, you know, did a really good job on this one. [18:39.070 --> 18:44.570] Yeah. So again, congrats to Macaroni for solving that one. The other challenge that we hadn't [18:44.570 --> 18:50.710] seen worked on yet was called Christmas in August. And who came up with the name for this [18:50.710 --> 18:51.710] one, by the way? [18:53.230 --> 18:57.570] So a lot of the naming for Christmas in August comes from me. But this was a team effort [18:57.570 --> 19:01.670] challenge. And this kind of fell out really quickly as a way to hint at some of the other [19:01.670 --> 19:02.910] challenges in play. [19:02.910 --> 19:05.990] So yeah, tell me about like, hold on, we do have the video. Let's see if we got the short [19:05.990 --> 19:07.230] video, the long video. [19:10.790 --> 19:20.790] Challenge. Moonlighter is in a known orbit with an inclination of 51.6 degrees. That [19:20.790 --> 19:25.890] means its latitude will always be between plus or minus 51.6 degrees. If they are able [19:25.890 --> 19:28.870] to get Moonlighter above 80 degrees, they will get a flag. [19:31.590 --> 19:35.870] And there was some mention of cookies at some point, I think, too. What was that about? [19:35.870 --> 19:40.170] So the cookies thing is mostly because that's what I, you know, pair with Santa Claus. So [19:40.170 --> 19:44.350] the goal of this challenge is to make the satellite think it is, you know, beyond its [19:44.350 --> 19:48.830] regular orbit, you know, at 80 degrees north latitude, very close to the North Pole. The [19:48.830 --> 19:53.750] problem is the satellite doesn't really have propulsion on board. Like you can't, you [19:53.750 --> 19:57.870] know, do a battery trick and like vent it and set it off in some weird direction. So [19:57.870 --> 20:04.070] what instead you have to do is like yell at me if I'm completely misstating this, but [20:04.070 --> 20:08.750] the solve is basically you lie to the GPS module about the calibration, something like [20:08.750 --> 20:09.330] that? [20:09.450 --> 20:10.630] Let's hear from the space guy. [20:10.630 --> 20:15.330] That's not it. So from the scripting engine, and everybody saw this, so the teams all know, [20:15.330 --> 20:22.150] we allowed them to send a partial bit of a message to the GPS receiver, and we appended [20:22.550 --> 20:26.290] the start and end of that message, and that allowed you to do a script injection to the [20:26.290 --> 20:30.630] GPS receiver. So, you know, instead of, and then we didn't really validate that that [20:30.630 --> 20:34.690] was only one command or even really a valid command, so we just kind of let you do almost [20:34.690 --> 20:41.110] whatever you wanted. Now, the GPS user manual has like, I don't know, 200 commands or something [20:41.110 --> 20:46.830] really painful in it, but if you look in there, there's a couple commands. One was called [20:46.830 --> 20:52.750] user datum, and that let you apply an arbitrary coordinate frame rotation. So basically you [20:52.750 --> 20:57.350] could just rotate your coordinate frame of your solution, which would let you go wherever [20:57.350 --> 21:01.790] you want, basically. But you all actually found one that I didn't see, because I just [21:01.790 --> 21:06.010] found the first one that could possibly solve it. There was one called fix that just let [21:06.010 --> 21:11.150] you put any arbitrary position in. So that's what, that's pretty much what you all came [21:11.150 --> 21:14.990] to and did, right, is you all said, okay, fix will work, and we'll just go to 89 degrees [21:15.770 --> 21:20.830] immediately, and as long as you waited for the GPS receiver to reboot, you could do that. [21:21.350 --> 21:25.430] And then similarly on the back side, we didn't, even if you did that, you might start seeing [21:25.430 --> 21:29.950] errors, like, oh, this solution is weird, we don't understand. But we didn't do any [21:29.950 --> 21:34.590] validity checking, because I mean, why would we misconfigure the GPS receiver? We would [21:34.590 --> 21:35.630] never do that, right? [21:35.630 --> 21:41.990] So the solution that the teams came up with was better. It's often the case, though, I [21:41.990 --> 21:45.770] feel like, that you don't, once you know it's solvable in a reasonable time, like you're [21:45.770 --> 21:48.490] done as a challenge author, and you're like, yeah, there could be other solutions, but [21:48.490 --> 21:52.470] in this case, yeah, so good on the teams for finding the better command. [21:52.610 --> 21:57.070] We were also pretty sure there might be some way to do it by messing with the receiver's [21:57.070 --> 22:02.030] time, but nobody successfully did that, but we liked the solution the teams came up with. [22:02.030 --> 22:05.630] Yeah, once you found the easiest, simplest thing. Now, did that make the math easier or [22:05.630 --> 22:08.590] harder than as well, too? Because a lot of this is like trying to figure out the math of like [22:08.590 --> 22:09.950] where it is, right? [22:10.050 --> 22:14.130] My solution required space math, and I was hoping that I would be mean to you guys, but [22:14.130 --> 22:17.350] you found a way to not do space math, so good on you for that. [22:17.350 --> 22:22.310] For that particular one. All right, so speaking of space math, then, on the challenges where [22:22.310 --> 22:29.050] they had pointing, right? One of the windows we saw overnight, we have this red bar there. [22:29.050 --> 22:34.810] That's during the ACS sort of section of the competition where teams were able to actually [22:34.810 --> 22:41.430] point and orient the moonlighter, and so during that phase, that's where teams could actually [22:41.430 --> 22:45.490] try for a couple of specific objectives, such as the Shutterbug Challenge, which we [22:45.490 --> 22:50.130] unfortunately didn't see any solves for, that required them to point and take a picture of a [22:50.130 --> 22:54.430] number of specific locations. So it was a bunch of spots all over the globe. Who wants to tell [22:54.430 --> 23:00.890] me more about that particular challenge, what the constraints were, and yeah, how it would [23:00.890 --> 23:03.570] have been solved, and what we think, you know, kind of happened? [23:03.570 --> 23:07.770] Yeah, so for that one, it actually does, you know, you had to go, it was sort of like last year we [23:07.890 --> 23:11.710] had a challenge where you had to point at planets and, you know, take pictures of them, or I think [23:11.710 --> 23:17.010] we just called it an exposure. This year we wanted you to do a real image of a location on the ground, [23:18.210 --> 23:21.870] and a lot of the quaternions actually that you issued looked pretty good. [23:23.090 --> 23:27.350] You know, one of the things with imaging is it takes a long time, you know, usually a couple [23:27.350 --> 23:31.030] months of operation to really understand how your satellite works with timing and everything, and [23:31.030 --> 23:37.310] calibrate things correctly. So the constraint we set up before the game was about 100 kilometers, [23:37.310 --> 23:44.690] and we did have some teams within like 150 and 170, I think 250 kilometers. A lot of teams got [23:44.690 --> 23:50.670] pretty close on this. We think it was just a little too hard with the constraints [23:50.670 --> 23:56.350] we set up, with the timing constraints between our processor and the camera that [23:56.350 --> 24:00.550] caused that issue. So, you know, unfortunately it was just a little bit too hard, you know, [24:00.550 --> 24:05.210] ideally we would have had more time to really nail that down, you know, [24:05.750 --> 24:09.550] with like a month of more commissioning we might be able to get it really, really, really tight on [24:09.550 --> 24:12.770] the time. I think that was something that surprised me is, yeah, I didn't realize how much it's sort of [24:12.770 --> 24:17.670] like this learning process is almost analog process where you're learning the constraints, [24:17.670 --> 24:21.470] even with things like the orientation, the access, there's a lot of that that kind of goes into [24:21.870 --> 24:25.190] satellites where you're just sort of used to your computer. It either works or it doesn't. [24:25.190 --> 24:32.290] It's not a question of like tuning and timing. Yeah, I think we at one point put a message in [24:32.290 --> 24:38.470] the channel that you weren't operating on a 3 gigahertz x86 processor. It was only a quad core [24:38.470 --> 24:43.410] 100 megahertz RISC-V processor. So, some of the teams thought they could run their scripts all [24:43.410 --> 24:47.790] the time and they would complete in like seconds and that wasn't the case. So, Logan, you've been [24:47.790 --> 24:51.710] doing a lot of the satellite operations. Do you have time to kind of answer some questions now [24:51.710 --> 24:59.210] about kind of how it was interacting with the satellite? Yeah, sure. So, I'm sure you guys [24:59.210 --> 25:05.830] realized from the Cosmos definitions that we posted that we were using OpenC3 Cosmos to do [25:05.830 --> 25:10.450] all of our satellite communications. So, that's an open source tool that lets you build up these [25:10.450 --> 25:14.750] command and telemetry definitions and all of the interactions that we had with the satellite during [25:14.750 --> 25:20.370] the game were scripted out. So, for each contact, we would have a command load, which was all those [25:20.370 --> 25:25.470] out-of-view commands, all the tasks you guys scheduled. We would start running them, we would [25:25.470 --> 25:29.530] upload that to the vehicle, stage all the scripts that you guys built into the correct locations [25:29.530 --> 25:35.390] and then at that point, we just wait. We sit there and wait until any of the out-of-view commands hit [25:35.390 --> 25:39.330] the time when they're supposed to execute. We execute all of them all the way until the next [25:39.330 --> 25:46.010] contact and then we save all the data that we would want and then in that next contact, we just [25:46.010 --> 25:51.930] keep repeating that. Speaking of contacts, when is our next contact? It's in about 30 seconds. Oh, [25:51.930 --> 25:56.510] hey, do you guys want to see us talk to a satellite? Yeah, we're gonna do it live. So, we actually, this [25:56.510 --> 26:02.930] morning, we're trying to stage all the images that you guys downloaded or that you guys took. So, we [26:02.930 --> 26:07.630] set up a plan this morning to hopefully download them from the camera to the actual flight processor. [26:07.750 --> 26:13.850] The camera itself has a gigabyte of actually flash memory, so we didn't move a lot of them to our [26:13.850 --> 26:18.610] flight processor because we only have a little bit of NOR flash. So, we stage them there and then we [26:18.610 --> 26:24.270] download them from there over the S-band downlink. So, we're gonna see what we get. We're not really [26:24.270 --> 26:30.050] sure what's gonna happen, but we expect to get at least a couple images here. You want to plug it in? [26:30.050 --> 26:54.820] Yeah. Let's do it. We didn't test this beforehand. This was very much a let's do it live moment, so [26:54.820 --> 27:00.760] we'll see if this works. And it literally is. Yeah, the suspense music for this because [27:00.760 --> 27:07.540] this is a live window. We're gonna see if we can get this going. [27:07.920 --> 27:14.080] So, we're gonna be taking a pass over Minjanu, Western Austria, and the transmit antenna doesn't [27:14.080 --> 27:20.200] turn on until about five degrees above the horizon, which we just hit. And so, right now, we're [27:20.200 --> 27:28.700] trying to establish a link with the vehicle. So, the links on these windows, right? [27:28.700 --> 27:32.200] I've been hearing you guys talk a lot about there are about 10 minutes, give or take. [27:32.200 --> 27:37.400] Can you describe kind of what a window looks like? You said there's upload, there's download, [27:37.400 --> 27:42.560] there's command, there's... how does the overall shape there? Yeah, so for most of the game, we were [27:42.560 --> 27:49.640] prioritizing sending data to the vehicle so you guys could execute your schedules. And then [27:49.640 --> 27:55.600] bonus time after that, we would try to download telemetry and then generate the scores. [27:56.060 --> 27:59.480] So, that was like overnight windows too, right? Where there's multiple, the teams don't have new [27:59.480 --> 28:05.400] commands, let you kind of catch up, I assume, and gather things off the... Right, so I think on the [28:05.400 --> 28:13.260] first night before we did ACS, we had a double pass over Chile and South Africa and we downloaded [28:13.940 --> 28:20.520] somewhere around 19 megabytes between those two. Yeah, it was basically all the telemetry [28:20.520 --> 28:27.420] through the first day was in that double pass. And then, as you guys know, quite frustratingly, [28:27.420 --> 28:34.960] we weren't able to get any at all until last night after the game, which, you know, very [28:34.960 --> 28:43.100] frustrating for us as well. Same with last night at 2.30, we got zero contact at all with Moonlighter [28:43.100 --> 28:46.720] when we were going to try and move some more images and have them ready for you beforehand. [28:50.520 --> 28:56.660] So, we're still trying to establish link and sometimes we've seen this with this radio where [28:56.660 --> 29:05.000] we don't quite link up until the top of the pass. So, this is looking like one of those situations. [29:05.000 --> 29:08.520] Yeah, and that's, I learned that you were just kind of describing earlier, it sounds like a lot [29:08.520 --> 29:12.300] of the ground stations have sort of better or worse like sort of profiles for the orbit and [29:12.300 --> 29:15.300] you would get better, you know, some ground stations worked a little better, some of them, [29:15.300 --> 29:19.420] you know, was it just because the path wasn't right over it or just because of the station itself? [29:19.420 --> 29:28.680] Right, so we've been having, some passes are really great, like you have, you know, directly [29:28.680 --> 29:34.340] overhead, some passes are pretty low elevation and your signal-to-noise ratio isn't necessarily [29:34.340 --> 29:41.280] as good in those situations. It's hard to talk when people are talking to my ear. [29:44.240 --> 29:49.120] They've got, more than the team is involved in this here, so we've got like remote communications [29:49.120 --> 29:55.280] are trying to coordinate with folks. Yeah, so right now we're probably 30 seconds away from [29:55.280 --> 29:59.600] hitting the top of the pass. Is it with the azimuth, as you call it, or what's the... [29:59.600 --> 30:02.640] A zenith. A zenith, the zenith, right, the zenith of the pass, but it's like [30:02.640 --> 30:06.860] the best, the best point where it's like slowest relative speed and like... [30:06.860 --> 30:13.720] Right, and we've been seeing that that's about where it crosses the the doppler zero, [30:13.720 --> 30:17.980] which is where we kind of link in pretty good usually, so. [30:17.980 --> 30:21.480] That makes sense, and so that, you know, if you don't get that connection until then, you just [30:21.480 --> 30:25.980] have a kind of narrower time to be able to download and upload as well. So this one, it [30:25.980 --> 30:30.600] sounds like the command to to queue up the images for download was sent during the last window around [30:30.600 --> 30:35.800] 10 30, and so we're hoping there's images ready to go. If we're lucky, yeah, they even said we [30:35.800 --> 30:41.840] have no idea if this will work, but we can try it. So this might be, you know, might be a success. [30:41.840 --> 30:53.070] Might not be. Depends on things that we can't control. I like the music. [30:54.870 --> 31:01.670] Not stressful at all. So did the evacuation last night actually, like, you guys were, [31:01.670 --> 31:04.410] it's because these windows, you had to hit the windows, and so when you're evacuating, you're [31:04.410 --> 31:09.410] like running with like, I think you said like the evacuation happened when you were like a minute [31:09.410 --> 31:14.070] or two away from one of these contact windows? We had about somewhere between like five and ten [31:14.070 --> 31:19.930] minutes to go, so we, and you know, they were they were pushing us out pretty fast, so we relocated [31:19.930 --> 31:24.610] just outside the building and got set up, and then right as the satellite was rising, they kind of [31:24.610 --> 31:30.850] pushed us further out, and we found that at that stairwell. We just got contact. So we just linked [31:30.850 --> 31:47.420] up, and now we can do setups. So unfortunately, like, this isn't like super interesting to watch, [31:47.420 --> 31:51.300] but what we usually watch during these during these passes is that we actually have watched a [31:51.300 --> 31:58.940] wire shark plot of the data as it comes down, so we can see these big spikes, sorry, we can see [31:58.940 --> 32:01.820] these big spikes where we're, you know, we're downloading, you know, each of these images [32:01.820 --> 32:05.760] are somewhere probably in the two to three hundred kilobytes range, so that's what we're expecting [32:05.760 --> 32:11.060] to see. Looks like we got something for the first one that didn't error out, so if we had hit an [32:11.060 --> 32:14.780] error, like the file didn't exist or something like that, we wouldn't have gotten past that the first [32:14.780 --> 32:19.800] line. So whatever that first one was, we got it. Now we got the second one. So as we watch through [32:19.800 --> 32:24.120] this, we're going to get through, and then at the bottom, we just have a loop to see what else is on [32:24.120 --> 32:29.320] that we're able to pull off the camera. So we decided to do, you know, one image for each team, [32:29.320 --> 32:36.460] and then just loop over whatever's left. And in particular, I know that there was, you had [32:36.460 --> 32:40.440] some idea for how sort of close, again, none of the teams were successfully scoring points for [32:40.440 --> 32:45.020] Shutterbug, because they weren't within that 100 mile radius that they had to be from the [32:45.560 --> 32:52.040] bore site target. It's 25 degrees falling. So it's 25 degrees is what it ends up. So, but these were, I [32:52.040 --> 32:56.180] think, at one point I heard you say, these were the, in order, at least the first two, were the closest [32:56.180 --> 33:01.140] two to the correct images. So hopefully the closest to what we wanted. We're pretty sure, [33:01.140 --> 33:07.800] unless Macaroni and Poland overwrote them later. So we'll find out. We could also, [33:07.800 --> 33:14.680] we might, we think we got the right ones. 20 degrees. So the pass usually goes until, [33:14.680 --> 33:18.260] you know, as long as we have good signal-to-noise ratio, we'll go to... Can you bring the mic closer [33:18.440 --> 33:23.420] a little bit? Sorry. So the pass, a lot of times, and as long as we have good SNR and we're not [33:23.420 --> 33:27.440] dropping into a null on the antenna, we should go all the way down to five degrees on the pass, [33:27.440 --> 33:33.960] and we're at 17 right now. So we probably got another... We just aired out on the one, [33:33.960 --> 33:39.860] the script download, right? So we should have gotten those other images correct. Does that [33:39.860 --> 33:48.060] mean they're on your... Try to rerun it. If it doesn't work, it's just like your computer at [33:48.060 --> 33:55.820] home. Maybe reboot it to satellite. It's fine, right? It'll be okay. Can we pull up the other [33:55.820 --> 34:04.500] images that did download already? We're at 13 degrees. So we expect it to go kind of out of [34:04.500 --> 34:19.940] communication pretty soon here. We're on the tail end of it. It's 11 degrees right there. And of [34:19.940 --> 34:23.680] course, we'll make sure to share all these these images with the teams, and I'm sure they'll be [34:23.680 --> 34:44.950] out on the website as well later. Nothing like doing it live. Eight degrees. [34:45.850 --> 35:20.790] Oh, that's five degrees right there. That's in the past. [35:22.830 --> 35:24.810] Is that a lens cap? [35:30.570 --> 35:34.150] That's beautiful. That was awesome. [35:42.250 --> 35:46.150] I know the teams want that in Discord. We'll get that. We'll get that to the teams. [35:51.300 --> 35:56.060] So yeah, as you guys can see, we did it live and we got some really cool pictures down. [35:56.580 --> 35:59.820] At the end of this contact, we also probably pulled a couple more. So we'll see what else we [35:59.820 --> 36:04.560] got. But this was the first five that we pulled down. The one that said Cromulons, that was our [36:04.560 --> 36:08.440] picture that we took during game testing a couple days ago. So we wanted to grab that because we [36:08.440 --> 36:13.600] actually never got a chance to download it because we ran out of time. So yeah, just to give you guys [36:13.600 --> 36:19.920] the whole flow. Friday morning, this was about 5 a.m., we finished uploading the final flight [36:19.920 --> 36:25.560] sat4 builds of the vehicle that we guys ran for the game. So we were really pushing it to the last [36:25.560 --> 36:29.040] minute to get the software up to make sure we could play the game and everything would work as [36:29.040 --> 36:34.140] expected. And we were able to actually store all the telemetry in non-volatile memory. We actually [36:34.140 --> 36:38.780] made a pretty late-breaking change due to game testing where we were originally going to store a [36:38.780 --> 36:44.940] lot more stuff just in a temp file system because we have space there. On this thing we had maybe [36:44.940 --> 36:51.120] about four megabytes of non-volatile flash memory that we could put extra stuff in. But we decided [36:51.120 --> 36:55.700] might as well just try to put as much there as we can to save stuff. And I think it actually ended [36:55.700 --> 37:02.340] up saving us, right? We actually, I guess it would have been last night between the second-to-last [37:02.340 --> 37:07.400] and the last out-of-view window, we actually had another vehicle fault that caused a bunch of [37:07.400 --> 37:14.380] things to happen. At that point there's a processor that we connect to that kind of bridges between us [37:14.380 --> 37:19.060] and the other sensor devices like the GPS and it started to become non-responsive. So at that point [37:19.060 --> 37:24.540] anything that went to the GPS just didn't go. And to get out of that we actually had to do a full [37:24.540 --> 37:30.320] reset of that processor. And that also reset us because we're an FPGA that's basically a daughter [37:30.320 --> 37:35.940] card on that board. And because of this change we were able to save almost two days of telemetry [37:35.940 --> 37:40.840] and able to actually score you guys and make it work. So we've been putting in a lot of work [37:40.840 --> 37:45.240] over the last few weeks to get this all in. The whole team has done a really good job. [37:45.460 --> 37:48.880] Yeah, we would have lost a lot of telemetry without that change. [37:49.360 --> 37:53.120] Can we get a round of applause for CrimeLens? Just a great job they did running this game. It's fantastic. [38:04.860 --> 38:08.340] And the Aerospace Village. We've got a bunch of other people to thank as well too. [38:09.020 --> 38:13.000] Just the fact that we were able to be here with the Aerospace Village to be a part of this, to be [38:13.000 --> 38:19.160] back here at DEF CON in person, to have all of the teams, it's been fantastic. We've got [38:19.600 --> 38:25.600] time I think for some more discussion. So let's talk a little bit more. I had a lot of questions [38:25.600 --> 38:29.200] because again I'm like a capture the flag nerd. So I was asking the team like how much data do [38:29.200 --> 38:33.620] you actually get? You heard that 19 megabytes over two windows was like a lot of data. There's [38:33.620 --> 38:37.740] actually not much communication right on the satellite kind of each one of these passes. [38:38.160 --> 38:42.560] So how do you like prioritize? How do you choose what you upload, what you download, [38:42.560 --> 38:45.740] how much you're uploading, how much you're downloading, like what goes into that calculation? [38:46.000 --> 38:51.340] So we actually operated the game almost in reverse of how you would really operate a [38:51.340 --> 38:56.000] satellite. We, like Aaron was saying earlier, we prioritize getting your command loads up to the [38:56.000 --> 39:00.120] vehicle because you'd be pretty mad at us if we were like well we got some telemetry down but [39:00.120 --> 39:05.340] like you can't operate the satellite for four more hours. That would be pretty not cool. Normally [39:05.340 --> 39:09.980] you'd prioritize the health and safety data of the satellite and make you know always make sure [39:09.980 --> 39:14.120] that your satellite is okay before you ask it to do something else. We flipped that and we always [39:14.120 --> 39:21.520] prioritized your commands and then we prioritized challenge and sensor data and then we actually [39:21.520 --> 39:26.580] like very last we prioritized like our logging and stuff that would let us really deep dive. [39:26.600 --> 39:32.360] So we almost flipped the script, you know, a full 180 degrees and did things backwards for the [39:32.360 --> 39:38.080] purposes of the game. And that's why you saw some of the dropout, you know, the big blackouts of [39:38.080 --> 39:42.620] telemetry not coming down is because we actually were we were prioritizing your commands first and [39:42.620 --> 39:47.020] you know when some of these passes go, you know, only start at the top, we only get like five [39:47.020 --> 39:51.260] minutes of contact. So there's just not a lot of time. Aaron calls it 10 minutes of terror every [39:51.260 --> 39:56.880] time we contact the satellite. Yeah, to like to continue there, like we had a couple passes during [39:56.880 --> 40:01.480] the game where, you know, we have one chance to get your guys' command loads up. If we fail like we did [40:01.480 --> 40:06.960] on one of the passes early on, it just doesn't happen, right? And we don't want that to happen. [40:06.960 --> 40:12.000] So we tried to, you know, practice that whole set of things as much as we could. But at the end of the day, [40:12.000 --> 40:17.940] we only had maybe, what, two weeks of operations? And less than that where we had, you know, [40:17.940 --> 40:21.900] something that was really close to our final play software build that we could test all of this. So [40:22.380 --> 40:26.560] it was a real challenge to get everything actually integrated and working and make [40:26.560 --> 40:30.940] make sure we could actually, you know, pull off the execution side of the game that was [40:30.940 --> 40:35.280] transparent to what the teams worked on. But very important and, you know, the whole thing doesn't [40:35.280 --> 40:41.680] work without it. Yeah, so, I mean, just to give you guys an idea. So we deployed the vehicle from the [40:41.680 --> 40:51.220] space station a month and, you know, like not that long ago. And so usually when we do deployment [40:51.220 --> 40:58.600] and do checkout operations, it takes several months to do, to make sure your sensors are aligned, [40:58.600 --> 41:05.000] to make sure your vehicle is performing within family. And we didn't quite have that time to do [41:05.000 --> 41:11.020] that. But we spent a lot of late nights trying to make everything possible for this. [41:11.420 --> 41:16.660] Was there anything that surprised you in terms of the teams and how they solve things? Obviously, [41:16.660 --> 41:20.960] we know that the one GPS solution was not the quite expected. It was a little bit better [41:20.960 --> 41:25.860] and cleaner. Was it was the solution for, for example, Iron Bank similar to the one that we [41:25.860 --> 41:31.040] expected? Or they're still geeking out over the pictures over here. They can't get over it. It's [41:31.040 --> 41:36.980] really just impressed by the team's resiliency. And everybody I talked to, you know, on the team, [41:36.980 --> 41:41.200] they said they were having a lot of fun. And you know, it's, I said, somebody, somebody told me, [41:41.200 --> 41:46.260] it's like, it's like a CTF with a really shitty connection. And I'm like, oversimplification. [41:46.260 --> 41:51.660] Yeah. But you know, it's, it's definitely a challenging CTF for us, the organizers and for [41:51.660 --> 41:55.360] the teams. And I was just really impressed by all the teams and everything they did and how [41:55.960 --> 41:59.320] they were just, you know, rolling with the situation. And then and that's how it works [41:59.320 --> 42:03.740] with a satellite. You deal with what you got. And that's like true of real operations. And [42:04.260 --> 42:07.900] thanks to all the teams for playing the game and doing a job well done. [42:07.900 --> 42:11.800] And at least it was, it was equally painful for the organizers as it was for the players. So like, [42:11.800 --> 42:14.580] normally, you know, like the organizers, like may not give all the information out. Well, [42:14.580 --> 42:18.300] in this case, the organizers didn't have all the information either. They were at the mercies of [42:18.300 --> 42:22.460] like the windows and connections being dropped and all that stuff as well. And playing with so [42:22.460 --> 42:26.580] yeah, every everybody involved had to really kind of be flexible. So we've got one more image, [42:26.580 --> 42:33.800] coming in here may take a second. Let's see what's up. This is pretty nice. So another [42:33.800 --> 42:37.020] crowd set one of these ice caps that we're looking at, or is this clouds or [42:39.560 --> 42:44.160] it's probably clouds in the ground and a little bit of slew. So there's a little bit of blur. [42:45.740 --> 42:49.860] Some water there as well. Yeah, it's definitely pointing at the earth, [42:49.860 --> 42:54.600] which you know, as you can tell from some of those pictures, they are pointed at probably space. [42:56.720 --> 42:59.740] Nice. So one more there. Awesome. All right. Well, thanks, everybody. We're gonna go ahead [42:59.740 --> 43:05.840] and bring Rachel up to finish us out. And thanks, everybody, for coming in here. [43:07.160 --> 43:13.680] Okay, so for the last time for DEF CON 31, again, we cannot thank everybody enough. The teams, [43:13.680 --> 43:17.840] you guys are all amazing. Thank you for your hard work. Everybody who has followed along, [43:17.840 --> 43:22.860] who participated in years past and quals this year, it's literally not possible without that [43:22.860 --> 43:27.840] type of involvement. To the Aerospace Village, we've had four years of amazing relationship that [43:27.840 --> 43:33.580] we want to continue to grow. Of course, DEF CON graciously accommodating everything that we've [43:33.580 --> 43:39.120] brought to this year. I mean, it's pretty spectacular what we have out there. And lastly, [43:39.120 --> 43:45.040] I cannot thank all of our team enough. The Cromulence folks, Aerospace Corporation, [43:45.040 --> 43:50.940] the difference. When I tell you this is only possible with an amazing team of people, [43:50.940 --> 43:56.080] from the bottom of my heart, I thank them all. We are the best team, quite literally, in the world. [43:56.100 --> 44:02.140] We pulled off the world's first CTF, and that's a wrap on HackASAP 4. Thank you. [44:21.640 --> 44:23.860] Isn't it obvious, huh? I said, isn't it obvious?