we were just walking through the contest
area and we have
the craziest setup right now it is
hackasat and i'm guessing that means
hack a
satellite yes that's correct hack a
satellite i did have somebody come by
yesterday and say
what is this hacked saturday
i mean you have satellites set up i
didn't even know like this was a thing
i'm looking at the screens behind us
like
this is insane like this is can we all
acknowledge
hacking a satellite is beyond web
application little network like this is
into some pretty crazy stuff
so what can you just briefly describe
and it's a ctf it's a competition right
it's more than just a competition this
you know we do have a ctf
for those hackers that are very advanced
but we also brought here to defcon
this weekend the hands-on education
and bringing some of the novice
researchers interested
up to speed so they can maybe someday
participate in the ctf
and compete oh so it's it's not just a
it's not a like you have to be an expert
to compete it's
anyone can do it yeah so that's uh
that's exactly right so
what we wanted to do is bring the whole
awareness of what it takes to
cyber resiliency cyber resilient if
that's a verb
a satellite from the get-go right so
designing it
through launching it to operating it so
what you're looking at here
this is a good example a visual of like
a virtual machine so before the
satellite even gets into the hardware
components
these software tools will allow you to
figure out
okay how should we orient the stuff
inside the satellite what kind of
mission is the satellite going to do
what kind of architecture should we go
for so you can do a lot of
troubleshooting here
which is obviously a huge cost saver but
then
from here go on to the okay we're gonna
actually start putting these things
together right
so when you hear buzzwords about like
digital engineering and things like that
that's that's an example of what this
is so bringing that awareness of hey
satellite development they just don't
magically get up there
so like how do we start from the get-go
what does it look like to present
and develop one and then also how can we
bake in resiliency
from the virtual machine all the way
through to launching the satellite
what's so crazy to me is like everything
you just said like there are like other
there's other ctf competitions and
there's like you know
cap capture packet and some of them like
take on this like almost like
or like hack fortress is a good example
i love hack fortress
but it takes on this like gamification
where it's like
a caesar cipher or something like that
which doesn't really you don't
come across those in the real world so
with this
you're you're like this is simulating a
real world satellite it's not like a
gamified version
yeah and i also did want to hit on it
too as far as the ctf
uh for our final event coming up in
december it's a little more than that
right so
each each team in our final event eight
of them they're going to have their own
you know copy of this right so they're
going to be able to practice and
for this year it's going to be an attack
defend so they're going to
win points by taking out other
competitors satellites taking that down
while also having to defend their own so
it's a little more than this
structured ctf you know that's very
traditional
we're taking it kind of you know given
them a path and they can do how they
want with it
it's totally like an attack defense game
as well
now on a technical level how does that
kind of work like
everyone's remote i'm guessing there's a
lot of complications like that
does it communicate more like like more
like virtual systems or
have you like simulated like if this was
out there like these are
actually how they would communicate so
yeah it's going to be virtual remote not
to get any competential sensitive
information or whatever but yeah
so it's gonna feel very much like i was
talking about when you're doing these
sort of things with these virtual
machines it feels very real
so the operators they're gonna the
operators aka the participants
they're gonna be at their home station
you know with their teams
and they're gonna be remoted in because
when you think about space operations
with a real satellite
that's remote anyway because the
satellite's in space and you're on the
ground so to them it's going to feel
very similar to what actual space
operations feels like
all right so question with spit you say
it's going to feel like really like
space operations
and again don't you don't have to repeal
anything confidential
but how bad is the latency like have you
had that
baked into some of the communication
where you push a change and
how long does it normally take for a
change circuit
yeah so when you talk about commanding
space vehicles and talking to space
vehicles that's something that we're
definitely baking in
with the the shout out to cromulance
who's building our challenges like world
class right
so when you're talking to a satellite
for example a satellite in like low
earth orbit
you may get you know a couple contacts a
day and those contacts could be just
like you know
10 to 30 minutes so or even shorter so
when you talk about latency when you're
in view of the satellite the latency
isn't terrible but you also have a very
narrow pipe
so you can't push too much information
but then you got to wait for that sucker
to orbit the earth before you can come
back and talk to it again
i think what you meant is not pipe but
it's it's the tubes right the tubes
might slow down no i'm just kidding
so one question i have is like a lot of
so much of this
type of thing i've never hacked a
satellite i can imagine most people at
home has never had to sally
what type of like vulnerabilities are we
talking about is it like
trying to crash the satellite into the
atmosphere and light it on fire
or is it delays or communication or can
we not talk about any of this
well we're looking at a number of
different services that the satellite
provides and the different components
that are within the satellite so uh
the vulnerabilities can vary i could i
could talk a little bit about last year
some of the competition challenges that
we had
like comms and um
you know payload different different
components of the satellite that we
would be examining for vulnerabilities
so like what was the if you can talk
about last year what was the
most like the most incredible
vulnerability that was found last year
maybe even when that was unexpected i
don't know if i have a good answer
i can i can hit on that a little bit
nothing specific on the vulnerability
but
kind of to showcase what is actually
possible last year uh the winning team
actually took control
of the satellite we had a we had a flat
sat on an orbital
and uh for the wind to win the
competition uh they were able to
actually manipulate the satellite
to take a simulated um a picture of a
simulated moon so they were actually
able to get in and start controlling and
adjusting the satellite for how they
wanted to
so you can imagine yeah and then
they also were able to submit commands
to a real satellite and take the picture
of the real moon
so if you go back and search hackasat
and look at our stuff last year
the winning team they have a tweet with
their team name and the picture of the
moon
that the commands they submitted ran on
the real satellite
you're not they're no joke i'm i'm
looking at gallery and he's
nodding that's that's insane
like i'm assuming they patched this
thing right
so i don't want to get into too much of
how they did it just for the sake but
what like the whole point right driving
back as to why we're here
so you have the barrier to enter from an
economic perspective of space is
lowering constantly by all these people
that are putting up stuff right so
if you've got all these private citizens
these schools these small companies able
to put up satellites
how do we know that they are also being
as
forthcoming and cyber resilient minded
as we are right because space is a
global thing
we all share it so if you've got one guy
who's haphazardly throwing up stuff
it's a threat to everybody so we're
really here to just like make sure that
hey like
you need to think about cyber security
and oh also like best cyber security
folks in the world here at defcon so
like let's get them thinking about it
and like how can we together make sure
that space is protected right because we
need space every day
whether you're a fan of like the
government or whatever or not you still
need to go to an atm you still need to
use your bank card you still need to you
know use your cell phone all of that is
reliant on our space systems and if we
lose those we're screwed
that is incredible hey i know there's
incredible amount to talk
about here but thank you so much for
your time this is an incredible
competition it's not
often like you see competitions where
like you can get an eip overflow in your
basement and it it's kind of exciting
but seeing like the satellite move
taking pictures like
having the virtualized environment is
absolutely
incredible thank you so much for sharing
thanks for watching and hack on
all right one quick thing that we forgot
to mention is how do you get involved
whether it's twitter whether it's a
website and whether or not you want to
look at previous competitions so
where can they find you on twitter yeah
so
tweet uh just search uh hackasat and
it'll be at hackasat and then go to
hackasat.com
that's probably the easiest way to get
connected we have all the links there to
include our github link
that has all of the previous challenge
to include the challenges and the
solutions for them right so if you are a
team or you want to start a team
go there learn and then be prepared to
come play