In this episode of Redefining CyberSecurity we discuss the history and evolution of the Hack-A-Sat program and the Moonlighter CTF challenge, which aims to bridge the gap between the cybersecurity and aerospace communities and showcase the capabilities of extreme programming and hacking to secure space systems.
Guests:
Logan Finch, Principal Engineer at Cromulence [@cromulencellc]
On Linkedin | https://www.linkedin.com/in/logan-finch/
On Twitter | https://twitter.com/hack_a_sat
Jason Williams, Co-Founder and CEO of Cromulence [@cromulencellc]
On Linkedin | https://www.linkedin.com/in/jason-williams-5858c3
On Twitter | https://twitter.com/hack_a_sat
Aaron Myrick, Project Leader at The Aerospace Corporation [@AerospaceCorp]
On Linkedin | https://www.linkedin.com/in/aaron-myrick-677b8474/
____________________________
Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]
On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin
____________________________
This Episode’s Sponsors
Imperva | https://itspm.ag/imperva277117988
Pentera | https://itspm.ag/penteri67a
___________________________
Episode Notes
In this episode of Redefining CyberSecurity with Sean Martin, Logan Finch, Jason Williams, Aaron Myrick discuss the history and evolution of the Hack-A-Sat program, which aims to bridge the gap between the cybersecurity and aerospace communities and showcase the capabilities of extreme programming and hacking to secure space systems. The Moonlighter CTF challenge is a key part of the program, which emulates real-world attacks on space systems, and the guests share insights on the different disciplines involved in securing space systems.
This episode also explores the ethical considerations of hacking and cybersecurity, the importance of diversity in the space and cybersecurity industries, and the need for collaboration between the different communities to create a holistic approach to securing space and satellite systems. The group highlights the importance of a new mindset and approach to securing these systems, which are critical to our lives and the economy, and showcases the capabilities of the cybersecurity and aerospace communities.
____________________________
Watch this and other videos on ITSPmagazine's YouTube Channel
Redefining CyberSecurity Podcast with Sean Martin, CISSP playlist:
📺 https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq
ITSPmagazine YouTube Channel:
📺 https://www.youtube.com/@itspmagazine
Be sure to share and subscribe!
____________________________
Resources
Hack-a-Sat CTF Website: https://hackasat.com/
____________________________
To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-cybersecurity-podcast
Are you interested in sponsoring an ITSPmagazine Channel?
👉 https://www.itspmagazine.com/sponsor-the-itspmagazine-podcast-network
Please note that this transcript was created using AI technology and may contain inaccuracies or deviations from the original audio file. The transcript is provided for informational purposes only and should not be relied upon as a substitute for the original recording as errors may exist. At this time we provide it “as it is” and we hope it can be useful for our audience.
_________________________________________
voiceover00:15
Welcome to the intersection of technology, cybersecurity and society. Welcome to ITSPmagazine You're listening to a new redefining Security Podcast? Have you ever thought that we are selling cybersecurity insincerely buying it indiscriminately and deploying it ineffectively? Perhaps we are. So let's look at how we can organize a successful InfoSec program that integrates people process technology and culture to drive growth and protect business value. Knowledge is power. Now, more than ever.
sponsor message00:53
Imperva is the cybersecurity leader whose mission is to protect data and all paths to it with a suite of integrated application and data security solutions. Learn more@imperva.com
voiceover01:10
and Tara, the leader in automation, security validation allows organizations to continuously test the integrity of all cybersecurity layers by emulating real world attacks at scale to pinpoint the exploitable vulnerabilities and prioritize remediation towards business impact. Learn more at pin tara.io.
Sean Martin 01:38
All right, here we are, you're very welcome to new redefining cybersecurity podcast episode on ITSPmagazine. And here's where we get to talk about all things cyber as it relates to business. But of course, not every business looks the same, right? A lot of a lot of security technologies are aimed at financial institutions and retail operations and logistics and, and perhaps even manufacturing. But when we start talking about space, and satellites, and aerospace, which is not on a new topic here on ITSPmagazine, things tend to look a little different. And the systems look different. The communications look different, the knowledge required looks different to deploy and also secure these systems. And we're going to talk a bit about that today and in the program and a capture the flag of CTF that that the team does called the Hakka SATs, where they'll describe it much more eloquently than I but people get to come together and have fun banging on satellite technologies and see what they can break. So that's my, my lame and layman's term of what's going on. We're gonna get the real story here from Aaron Logan and Jason. I'm going to start by asking each of you to share a few few bits about yourself, who you are, what your role is, in in life and or in your career. And then how that connects to the ACA SAP program, which I know is is a group of folks that come together to pull this off, right? Many more than three of you, but you the three of you get to get a lot of this stuff to work on. So I'll start with you, Erin, a few things about yourself.
Aaron Myrick03:29
So yeah, I'm Erin Myrick, I'm from the Aerospace Corporation. I've been in the space industry for 17 years now. primarily working at the Aerospace Corporation supporting a number of DOD department defense programs, a number of NASA programs, a number of tests and experimental programs for hackers that I am the project lead for Moonlighter, which we'll talk about today, which is the object of our game for hackers set for and we're also planning on using it to do a number of cybersecurity research related tasks. So with that, I'll pass it on to Logan for his intro.
Logan Finch04:18
Sure. My name is Logan Finch. I work for a cybersecurity company called Cromulent. I'm a Principal Engineer building the the hacker said game that's going to be running on on the Moonlighter spacecraft. I've been involved in hacking set, despite third year working on the CTF. So kind of built up from one of the earlier games to you know now finally being able to run things on a on a satellite in space on moonlight and we're all very excited. Both to build it and hopefully see everything go off without a hitch.
Sean Martin 04:53
Just like any true space program. Jason,
Jason Williams04:58
I'm Jason Williams CEO Both Cromulent engineer, hacker entrepreneur, self professed space nerd at this point, been involved in hackathons since the very beginning. And really looking forward to this year, it's been a long journey and everything the team has accomplished. It's just been one fantastic competition and seeing it grow into what it is today and seeing it, you know, moving up in the rankings and CTF time and other things, and how many people just absolutely love this conversation? It's been just what an incredible ride to see it and looking forward to, you know, come August at DEF CON, to see what the teams will bring and how things will go.
Sean Martin 05:41
Bring it, bring it and so I can, I can venture a guess that hacker stat is at least three years old, because involved at least three years. Give me a little history and background on how it started, why it started with maybe what the goals and objectives are in, start with you, Jason and the others kind of jump in and fill in the details. Yeah, so
Jason Williams06:05
I mean, how Cassat has been, it started as just an idea by a person named Frank pound. And and folks within Air Force Research Laboratory back in 2019, and convinced some folks high up in the government to spend some money. And we all got together and Wallops Island and early 2020, and kind of sketched out the game. It started in year one with a very, I wouldn't say simple game, but it was, you know, we started with a carousel, and an upstairs facility at Cromulent is office. And year two is kind of this hybrid design, where we had a digital twin of the physics simulation, and we had these hardware flat sets. And then year three, we went all digital, a completely all digital game where we had incorporated, you know, the flat sets of the ground stations all together, and each year was moving in complexity, you know, to what we're seeing today, where we're actually built a satellite launched a satellite, this point and going to be running a whole competition in space, which is quite an incredible achievement.
Sean Martin 07:17
And Logan, how, how has why you came into it three years ago. So I'm wondering, did you follow up prior to that, and you wanted to jump in? I don't know if you have any, any, any. And
Logan Finch07:29
yeah, he kind of followed it the first year. One of the guys who brought me to Crimeans was somebody who had worked on worked with before at my previous company. So you know, I'd seen kind of where things were, and he gave me that, you know, the feel that the oh, there's something really cool to work on. And I gave it a chance and came to cry, Melanson really, you know, started to really enjoy working on on these sorts of problems, there's a lot of freedom to you know, build a, build the solutions from the ground up and build, you know, fun, fun software to simulate a whole space system, you know, from end to end, we'll also you know, building some hardware. So we've built flat sets, so you know, small standards for for a satellite that we can use for these cybersecurity exercises, we use a custom one and hack a set and hacker set to an off the shelf one and hacker set one and then and then hacker set three and four, we're all kind of leading up to this, our hack, step three was leading up to our launch of Moonlighter. So we built a fully digital version on those early analog to what will be running on the actual Moonlighter spacecraft. So it's a lot of fun to you know, build these things and work kind of outside the confines of what you'd see in a in a normal aerospace application. So that's my background is, you know, working for defense contractors, you know, building big ground systems for large space programs. So that's this is certainly a lot more dynamic and fun an opportunity in a lot of ways.
Sean Martin 09:05
So So for somebody like me, that that doesn't have that experience, which would be cool to have a little jealous if I'm honest. There's a lot to these environments, right? I don't know if if one of you can kind of paint a picture of what's involved I can I can picture a data center control room connected to that some cloud stuff through satellites, doing some communications to a device, or spacecraft or a satellite or something. But there must be much more to it than that. So what what are you What's that look like in real life? And how does Hakka SAP perhaps emulate how much of that gets emulated in what you're putting together?
Aaron Myrick09:52
So, what we do in real space systems is we typically have three traditional So we call them segments. So three different things that we're trying to build. So we have a ground segment, which is the the command and control the communication to the to and from the vehicle. So that's where you're doing a lot of your, your mission planning. You're tasking the vehicle, you're getting data back from the vehicle, and you're disseminating that data in whatever form it may be for that mission. Then you have your Link segment, which is the part that talks between your ground segment and your space vehicle. So this is traditionally like an RF link of one form or another, you may have like a high speed link, or a low speed link, depending on what kind of state your vehicles in. And those can take the form of radio or optical, optical beam laser communications. And then you have your your space segment, and that's the that's the vehicle that's your sensor. That's sort of what this whole mission has built itself for. And this is the reason why you're going into space, whether that's to do Earth imaging, for you know, a climate research or whether that's providing SATCOM or some other mission GPS is another great example. And so that's, that's the space segment. So each of these are sort of specialized fields, where you have engineers that that look at all, so your ground segment, there's a lot of software development that happens there. That can be take the form of databases, web gooeys, your mission planning tools, you have a lot of, you know, math, people working that problem. On the space vehicle side, it's more of an embedded systems problem where you, you have to have these actuators and sensors kind of cooperating and controlling the vehicle in a way that makes the mission happen. So broadly speaking, that's kind of what goes into a space system. But there's also a fourth segment that we often don't talk about, or don't, we should, and that's the user segment, the user segment, everyone probably listened to this podcast is part of a user segment for GPS, because they directly receive signals from the vehicle, and they process those and determine their, their position on the earth and also get time from GPs
Sean Martin 12:40
are really interesting. And as you're talking in describing that scenario, I'm just wondering, are there? Are there many laser traffic sniffing tools out there and people that are experts in using? Because let's let's be real, I mean, these systems are really expensive, right? And, and oftentimes, if well, if they're delivering people to space or important things to space, you don't want to, you don't want to jeopardize life, right, or the delivery. So a lot of risk involved there. So security is important, which is what we're here to talk about today. Right? So securing these systems. And I don't know, our I don't know if many laser communications in an enterprise IT environment. But there may be some enterprise IT environment type stuff and the space systems. So where, where does the knowledge set come from? When we're looking to understand the exposure that these systems have the risk, aka exploitability of them, and there, and then the final point of identifying controls and other mitigations to protect them as they're being built and running out of people can gain those skills in general. And then more importantly, how does hackers that help to bring some of those skills to bear?
Logan Finch14:08
So actually, that's, that's a good one. So I think Aaron's description of the different segments of Space Systems is actually a really good place to start there. So for the ground system, that's usually you know, terrestrial networks, just like any other network system. So the types of skills for defending that are, you know, usually pretty similar to any other network based system. So, you know, there's, there's a lot of people that can do that. That's usually the easiest part of like a cybersecurity defense on the space side. Historically, it's been security through obscurity. And, you know, this isn't space, you know, there's nothing, you know, there's no, nobody can get into our command like our telemetry like so you know, it's safe, but they're, it's an embedded system. So, you know, like any other embedded system, there's, you know, there's all sorts of security practices you can apply. And a lot of those things have been, you know, pioneered and the state of the art has been pushed forward for, you know, all sorts of other embedded applications in terms of how to, you know, handle firmware security, data security, and transit between different components, all that kind of stuff. And, you know, overall, the space community has been a little bit slow to adopt a lot of those things. For a variety of reasons, but, you know, I think, you know, going forward, that's kind of our goal on Hacker side is to, you know, show that, yes, we can secure the ground, but we also need to, you know, think about space systems, you know, as a whole, holistic entity, and, you know, make sure we're thinking about all the different parts, from a security standpoint to make sure that, you know, we're not missing things that, you know, that might be might even seem obvious, but, you know, historically, I've just been, you know, not addressed
Jason Williams16:02
yet, and hackers, that was, one of the reasons for hack set was to bridge these communities like the cybersecurity community, and the aerospace community. And, and, you know, one, one interesting thing about it, to me was just how little I think the cybersecurity community knew about these systems, you know, and how little the aerospace community knew about kind of like the capabilities of the cybersecurity community. And when these two came together, we saw some incredible things happening and hackers that we saw, you know, teams that were, like performing space operations, and like creating operations, dashboards and stuff like that, in the competition, developing these these tools, and employing these tools at speeds that I think folks in the aerospace community just never thought possible. Like they were just like, mind blown. I remember actually, as it hackers, that too, I think we were, we were all there was a screenshot posted, I think it was on Twitter, from one of the teams and it looked very similar to our internal operations dashboard that we had. And we were like, did we get hacked, you know, like, no, no, this team had created this dashboard. During the competition, during the competition, we're talking less than a week, you know, just two days really. And they were automating a lot of their, their, their operations, their ability to throw exploits, where they were getting telemetry from the other team satellites, and they were, they were looking at, they knew the battery levels of the other team satellites, from their telemetry streams. And they were graphing that in these dashboards. And we were all super impressed. And it was a brief moment, we had a panic attack. But, you know, it really showed us the capabilities of these people like extreme programming these hackers to do this. But conversely, we also saw a team, that was a bunch of hackers struggle on the space operation side, and they thought, well, who cares? Like, you know, we're gonna, we're hackers, we'll figure it out. And they, they didn't pay attention to their satellite and maintaining power levels, and pointing and attitude control and all these other things. And hackers had, I really think the best teams merge those two disciplines, those two groups together and created like a super team, if you will, of folks and that was just all inspiring for me to see and occur. And, and for us to put together a competition where that was able, you know, we were able to get that kind of like camaraderie and that spirit together and two disciplines to really start working together. And, and hopefully, that continues and industry and government and so forth. Where people realize that that's how you help secure the systems in the future. And we're talking systems that are going to be around like a lot of these spacecraft systems, you know, they get deployed, and they stay around for decades, in some cases. And so like, that's a, that's a hard problem. From a cybersecurity perspective, we're used to up upgrading our windows, you know, operating system or something like that every, you know, couple of years, right? And on a spacecraft, you know, are you going to upgrade the operating system, you know, of your spacecraft, or the firmware like that, like constantly do that. They're very risk averse in that kind of environment. And so, you know, those kinds of concepts don't make sense. And so you really have to think about, you know, what the attack vectors are, and how to secure the systems and it's a different way of thinking, you know, it definitely something very challenging because there's a lot more pressure in the design and operation side than there is kind of on these terrestrial systems on these traditional ground networks. Right, that you don't, that you have in spacecraft system, where it's like I, I spent 10s of millions 100 million dollars building this craft, and it's an orbit now, how do I maintain like the security of that system, right, and do that in an economical fashion? So it's a challenge for sure.
Sean Martin 19:40
And, Aaron, I want your thoughts here because I had the fortune of working with a lot of military companies that required terrestrial network security from the company that I was working for at the time. And their, their delivery models were extremely complex. An extremely long, right, so they had to think of a lot of, of these scenarios upfront and build systems that could last for a long time. And then the approval process and, and the checklists that vendors had to go through to be part of the the, the final delivery that would last few years before that whole thing went through again. And it couldn't be updated. By the way, once it was signed off on a very different mindset than from, I'm a hacker, I have no rules, I'm gonna go for this. I can stay up 24 hours, I don't care, I have my my caffeine, caffeinated drink on the ready. And all bets are off, right? I can do whatever I want. I don't care if the system's up for a day or 10 years, if I can access it. So how does how did those two mindsets come together? And maybe this is a good time to talk about how you create the hack Assad environment? I don't know if if you want to start getting into some of the Moonlighter things and how you create that. And maybe how those two mindsets come together as you put this program together?
Aaron Myrick21:06
Yeah, so yeah, I mean, you're right about, you know, once we deliver things, it's really hard to change things in operations. So we, you know, one of the things that we should start thinking about doing and we are starting to do is start drawing those lines in the sand of cyber compliance versus cyber operations. So compliance is, you know, making sure you do your vulnerability assessments, your, your your reporting is is done, you're logging all the data, cyber operations is, you know, what do you do in the event that something goes wrong. And we need to be able to build systems that can recover from cyber events, not only detect and identify, but recover from those things. Because for our space systems, we, we don't get a chance to launch a new one very often. And they're expensive, they're the least the on the defense side, those vehicles are, you know, they're few and far between, and they take a long time to build, there's a lot of engineering behind them. So we can't have it. So you know, this small things trip us up. And so that kind of led us into what we wanted to do with with Moonlighter. Because, you know, I was there with Jason and Wallops back in 2019. And we, we wanted to do something on our bit, and we kind of had to constrain that quite significantly. Because when we're doing a cyber activity or cyber exercise with another mission system, it's potentially putting that mission system at risk. Right. So that's really hard for people to bite off on. So what we will be said early on, is that in order to do this, right, in order to have a proper environment where we can do this kind of research, and kind of understand the problem a little bit better, is to build something from the ground up. So we have we bring the cyber people into the room in the design process, and say, Hey, we want to build a vehicle to do XY and Z, how would you guys go about attacking it. And so then, from that, we started building in either protections, mitigations alternate paths of doing things that that we would need to do for recovery of the vehicle. And that's sort of how we ended up with with Moonlighter as it is, as it is now by bringing cyber people into the room and bringing them along with the design process.
Sean Martin 23:52
I love that. And I want Logan and Jason's input on this as well. Because I mean, all too often we build something, toss it over the fence or toss it into the market more appropriately, and hope for the best. And then we get alerted when when there's something wrong. I love that you brought the the analysis part upfront into the design. Which I think even just even just analyzing a system in the real world, it's hard to do with space. I don't remember the last time me I found a spacecraft available on eBay for me to buy and hack so, so having an opportunity to be part of this part of the program is super cool as well. So I'm a little bit Jason, any, any additional thoughts on on this?
Logan Finch24:39
Yeah, so I mean that Jason and I are both involved actually, in the some of the design work that went into building Moonlighter. And, you know, we were able to influence certain aspects of the design to hopefully make it look like you know what we've both built before and make something that's flexible that we can Uh, you know, both build a, and run a cyber competition on, but also something that, you know, can can, you know, act as a testbed for this kind of research going forward. It's it's a, you know, a very unique platform to be able to, you know, set up and and do this do you know, a cybersecurity evaluations on orbit? You know, we wanted to make sure we thought about, you know, what would we want there? And what sort of what sort of system would we want to provide to the end user? That would be you know, using the platform?
Sean Martin 25:40
Can I can I, maybe Jason, your thoughts in general, but also, without giving anything away? Of course, changes in in how something was built or designed? Did you all this, this communication channel is rife with weakness? Or are the or this or this operating system where this particular particular piece of hardware is, is vulnerable to exploit or whatever? I'm making stuff up? Because I don't know. What can you share with us that doesn't give the CTF a way that says, being part of this early on, we were able to create a much more resilient system.
Jason Williams26:22
Yeah, I think, yeah, later, yeah, it's not gonna give anything away. But, you know, one of the I mean, it's a challenge, right? You know, we're going to invite hackers, we're going to let them on the spacecraft, right? And we're going to, we're going to let them do what they want, like in this in this, you know, protected domain, and we think it's protected, right, we want it to be protected, right. And that's actually, you know, normally you protect at a different perimeter, right, like you would protect at the ground station level, you know, and you can, like Aaron said earlier in that architecture, but here, we're putting them right onto the vehicle and putting the some of the world's best hackers, I'll say that they surely are on to this vehicle. And so there was a lot of design challenges, you know, from, I would go back to organizing CTFs, I was part of a legitimate business syndicate for DEFCON CTF, you know, and look at it from an organizer perspective, and, you know, things can and do go wrong, right. And as an organizer, you know, there's a lot of challenges. Now, we have to talk to a spacecraft and as the organizers and so you know, our view of the world is through these contact windows, just kind of like the team's view of the spacecraft is and so there's, there's an in number of challenges that we had to overcome and risks and things like that we had to incorporate in the design of the spacecraft, I think those are things you can learn, actually and apply. Maybe when you take this posture as a designer of spacecraft like, Okay, if, if, what if the worst case scenario came true? And and a threat actor managed to get onto my spacecraft get onto my command and control network? And what what if they were able to take over some component on the spacecraft? You know, how do I know that I can get them off and get that system to be resilient? Because like, like Aaron said, Are you going to relaunch your satellites are you going to go up there and capture them and forensically analyze and try to provably remove the threat actor, you know, code. And obviously, you have a mission that you're trying to accomplish. And so it's a very dynamic environment with very limited access that you have and introspection that system, these download these links, they're precious, right? Like, you know, the, we still haven't mastered the way to make data links better, you know, you know, they're, they're getting better, but we don't have like your 10 Gigabit Ethernet connection, right? We don't have that Ethernet connection to your satellite. And so these were all aspects we had to incorporate in the design, in our dynamic of the game and designing it, and it's, you know, I truly think is one of those really challenging things, and the team has come up with, you know, something really cool and creative. And, you know, there's always there's room for innovation for sure. And this, this domain, and I hope, you know, this kind of competition continues to go on because it really is challenging a lot of disciplines, a lot of engineering, cybersecurity, you know, concerns and that sort of thing.
Sean Martin 29:20
And I'm gonna get to the the actual event, DEF CON and the second logon, I'm gonna back to you, and maybe you're in if you want to chime in as well. But if I'm not mistaken, from what I heard, this isn't take a system and virtualize it or replicate it in an environment that can be hacked. This is you're creating a research platform or development platform that you hope to use for real that you've designed with security people to be part of that upfront. And now you're letting them play in this environment. That is maybe Not not on maybe it is commercial, but destined to be commercial, in some sense, open to play with. Now attacker said that I captured that correctly.
Logan Finch30:10
I think that sounds good, I think kind of, you know, our, our philosophy was to have a sandbox for cybersecurity and space, you know, a area where, where the resiliency of the system is, you know, hopefully, well defined, and that we know, you know, know how to recover things, but, but able to still provide, you know, something that, that, that were meaningful, you know, research and interactions can occur. So, we can, you know, both, you know, see what, what, what some of these teams end up doing, and hopefully learn from them. And also, you know, just by designing and building this, we're learning about, you know, what would it take to actually, you know, incorporate this sort of design principle into into other systems as well.
Sean Martin 31:01
Because that's the key, right, Aaron, is, it's not just to have fun, and bring these communities together, it's actually makes me safer.
Aaron Myrick31:11
Yeah. So you know, one of the interesting trends that we're sort of seeing in this space, really, at least that I've, that I've been seeing is, you know, as the cost of launch has been driven down. Satellite Systems are much more open to taking on commodity hardware, and we're so we're talking like industrial grade components, or automotive grade components, because they, at least at the low earth orbit, they can survive those environments still, so the, the, the processing power that's in the automotive, the automotive community, with their, you know, automation, self driving cars, is actually driving some of the software that we're putting into some of our space vehicles. So some of their real time operating systems I've started to see move over into the space community. So the cost of launch has been driven out, but also the access to hardware and software that people have at their fingertips now is much more open. So it's not boutique anymore, you don't need to understand how to code an ADA or, or Fortran to understand flight software anymore. So it's, it's, it's very interesting. And so one of the things that I enjoy from hackers is understanding how different teams approach the same problem. And, and, and the things that we can learn from their approaches, the things that they build. Sometimes the the actions that they throw against the vehicle are also interesting as well, because then we can take that in kind of understanding more, extract it a little bit. And then we can sort of postulate Okay, well, what if this is successful on a real for the vehicle? What do we do now? How do we, how do we have the appropriate tactics, techniques and procedures from the defenders side to detect and mitigate? Or if it were to be successful? How do we recover from that? And so that's, you know, things that have often been studied in labs, but have not been played out to their full end to end scenario in a Live platform. And so there's always things in simulations and simulations where it's, it's not quite the same as when you do something on orbit on a live system.
Sean Martin 33:39
I love it. So, let's talk about the actual event now. So the is a CTF that runs for a period of time it's all of DEF CON, I presume, is their stuff before DEF CON people can get involved with so talk to me about today. We're early June. And all through August at DEF CON and beyond if it does, what can people expect? Who can get involved? What's required? What what share? Sure, absolutely don't reveal that
Logan Finch34:11
stuff. So perhaps set for the qualification event was took place in early April. That's already happened. So the the qualifying teams for the final event at DEF CON are already chosen. And already we're in the process of getting everything finalized there. So those teams are, you know, selected at this point. So we know who's going to be playing at the actual conference. We're going to have two full days of competition. I believe it's on the Friday and the Saturday of the DEF CON conference week. To get involved. If you're at the DEF CON conference, come and visit the aerospace Village. We're going to have a presence there that competition is going to be happening live on the conference floor in the aerospace Village. So you can come say hi to the, to members of the tech team, there'll be people there to do outreach and answer questions. And you can kind of see what's going on, we're going to have screens up with status. And you know how the competition is going, hopefully other interesting visuals as well, to kind of set the scene. And then to also be a live stream, that should be going over to the AFRL. So Air Force Research Lab, YouTube account, that will also have updates and other information kind of going on throughout throughout the conference.
Aaron Myrick35:39
So another thing that, you know, I just will, I'll take Collins as hard a little bit here, they've actually released all of the, the previous qualifying challenges that were done for hackers, one, two, and three. So they have the on a GitHub repo, you can go and, and do some of the challenges that people did for for hackers, if qualifications and the finals, I believe, for one and two are up there, along with some of the reporting that the teams do, like how they solve things, how they did things, during those events. So that's all hosted online.
Sean Martin 36:21
Jason, anything else?
Jason Williams36:23
Yeah, I think it's interesting to me, because, you know, what's going on behind the scenes with the infrastructure team, and our team is incredible, right now, you know, we got a satellite, that's when does it go and get, you know, launch from the ISS, I guess. And then it you know, it's a real satellite. So it's got to go through all the standard things to kind of go through checkout, comms check, it's got to, you know, we got to check the health state safety of the vehicle, we've got to do all these things, before the game. So So from our perspective, it's this, this kind of, there's a lot going on, from the team's perspective, you know, they're there, they're preparing, they're building their tools, some might be some, some might not, I would imagine the teams that want to win, they're there, they're kind of gearing up for this. And they're looking back and piecing together all the previous games and everything that worked for them and building up kind of their tool chains and, and getting their logistics figured out. And their their plan to go to Vegas, you know, because they were it's an in person, you know, this is the first time actually, for hackers, that first time we've done an in person competition, it's gonna be really cool, it'd be out in Vegas, packing their bags and flying out to Vegas, and then you know, we're going to have some, you know, like we always do, we're going to release data before the game, and then you know, game time, they're going to come into the room, and then they're going to connect to our infrastructure, and then it's going to be go, it's going to be go once that 10 o'clock starts. And so a lot goes on on our end, you know, just like the team so so we're working really hard.
Sean Martin 37:49
It sounds like and before we, before we started, you said your your efforts are probably a lot of teams. They may not think that of course when they're when they're doing their thing. But yeah, just like sounds like any any space program. There's a lot to all to get on here. Well, listen, hopefully, hopefully, we'll get a chance to see you in the aerospace Village. We're huge fans of that, and Steve luzinski and the whole crew there and love what they're doing. And glad to hear you have this competition going live within that as part of DEF CON, aerospace village there. And with any luck, we'll get get to chat with you live from from the events. Of course, following DEF CON recording rules, we're not going to not going to break any privacy things there. We know the PR teams, we try to be friendly in that respect. But yeah, so we wish you the best on that for sure. And finally, for those that aren't participating how I guess the question for them would be outside of the grander aerospace village experience and what they can gain from that. What what can they do to watch or participate? Or at least at least watch the live CTF? What can they do that screens and what else? You guys are going to be there to chat with them as well, right?
Aaron Myrick39:16
Yeah, I would say that it follow hack us at Twitter, because they're going to probably they're going to put out all the links for all the streams or YouTube events that they do. So that that would probably be the best source of information for the current happenings of of hackers at. And then, you know, if you go on to hackers that.com You'll find a link in the players corner of the GitHub repos that I was talking about earlier.
Sean Martin 39:48
Love it. All right. Well, Aaron Logan, Jason. Hey, yeah,
Jason Williams39:54
I got one more thing to add to the United States Space Force and Air Force Research Laboratory. They, you know, they made this possible. And so, you know, it's been an incredible journey. I think everybody appreciates, you know, what they've done what the US government's done for this. In the aerospace community, I've certainly know that we have. And so I just want to recognize that.
Sean Martin 40:15
Yeah, absolutely. And I appreciate that call out as well. And yeah, kind of alluded to at the beginning. But, I mean, it's a whole group of you, that three of you are here representing. And I'm grateful for that. But there's a big team that helps pull this all together. And yeah, shout out to all them on on your behalf for me to make this possible. So yep, good luck. With everything. Hopefully the mission is a success, and that the learnings are deep and meaningful. And that everybody has fun as they get together in person for the first time. attack us out for. So thanks, guys.
Aaron Myrick40:57
Thank you. Thank you.
Sean Martin 41:00
Thanks. Thanks. Thanks, everybody, for listening to this episode of redefining cybersecurity. And, of course, there'll be a slew of links in the show notes to the things we talked about today and, and our guests profiles if you want to reach out to them, and connect with them as well. So thanks for listening, watching, sharing, subscribing, keep on everybody, obviously.
voiceover41:27
Pin Tara, the leader in automation security validation allows organizations to continuously test the integrity of all cybersecurity layers by emulating real world attacks at scale to pinpoint the exploitable vulnerabilities and prioritize remediation towards business impact. Learn more@pantera.io.
sponsor message41:53
Imperva is the cybersecurity leader whose mission is to protect data and all paths to it with a suite of integrated application and data security solutions. Learn more@imperva.com
voiceover42:11
We hope you enjoyed this episode of redefining security podcast if you learned something new and this podcast made you think then share itspmagazine.com with your friends, family and colleagues. If you represent a company and wish to associate your brand with our conversations sponsor, one or more of our podcast channels, we hope you will come back for more stories and follow us on our journey. You can always find us at the intersection of technology, cybersecurity, and society