World’s top security researchers qualify for Hack-A-Sat 2 Finals

ROME, N.Y. – The Department of the Air Force, in collaboration with the security research community, returned for the second year in a row this month, inviting a global community of researchers to hack in an open and collaborative online environment with the goal of improving the security and resilience of next generation space systems.

Over 1,000 teams of security researchers from around the world took part in a 30-hour online qualification challenge event June 26-27 for entry in the Hack-A-Sat 2 final event. Hack-A-Sat 2 is a Capture the Flag (CTF) cybersecurity challenge geared toward those security researchers who have more advanced technical knowledge on space systems.

The CTF consist of two events – an online qualification round, and a final round for the top eight teams finishing in the qualification round.

“We embrace external experts to help us build and sustain more secure and resilient satellite systems,” said Maj. Gen. Heather Pringle, Air Force Research Laboratory commander. “With a growing global dependence on space systems, we must be forward thinking in how we partner with creative, non-traditional communities and efforts like Hack-A-Sat, which have proven to build a community of interest toward a common goal.”

Leading teams during the qualification round were equipped with a diverse set of skills from both the cyber and space domains. This prize competition is meant to create a two-way bridge between traditional cyber security professionals who are accustomed to categories like reverse engineering, forensics, cryptography, binaries, protocols, satellite design, two-line element set (TLEs), quaternions, and two-body problems.

Of the more than 1,000 teams that participated in the qualification round, the top contenders included a number of returning champions from last year’s Hack-A-Sat event. Last year’s winning team of the on-orbit challenge, ‘Poland Can Into Space’ took first place in the qualification round this year, along with a number of other highly skilled teams from around the world. The final scores can be found on hackasat.com.

The top 10 highest scoring teams will receive a Qualification Event cash prize of $10,000 per team. In addition, the top 40 highest scoring teams will receive non-cash prizes.

The 48-hour virtual final round of the Hack-A-Sat 2 CTF starts Sept. 17, 2021 at 6 p.m. EDT.

The Final Event will be an “attack/defend” style CTF that occurs using a simulated space system to include a virtualized ground station, a communications subsystem, and physical satellite hardware called a flat-sat. Like a more traditional attack/defend CTF, teams will have their own vulnerable system to operate and defend, while attacking opposing teams’ identical systems. A number of exploitable vulnerabilities exist in the systems and teams must patch or otherwise mitigate their own vulnerabilities to protect from exploitation attacks, while keeping the system functioning normally. The organizers regularly poll each team system to ensure its services are responding appropriately.

The Final Event will award cash prizes to the top three placed teams as follows: $50,000 first place, $30,000 second place, $20,000 third place. In addition, all eight finalist teams will receive a commemorative flat-sat prize trophy for their participation in the Final Event. To receive a cash prize or a flat-sat prize trophy, finalist teams must submit an acceptable technical paper within three weeks of the conclusion of the Final Event to claim their prize.

DEF CON 29

Hack-A-Sat organizers are working in close coordination with DEF CON’s Aerospace Village to realize a shared vision, which is to build a diverse community committed to promoting and developing aerospace cybersecurity expertise and knowledge through positive collaboration.

While the Hack-A-Sat CTF is not taking place at the same time as DEF CON this year, Hack-A-Sat organizers have submitted a mixture of workshops, talks and demonstrations to contribute to the Aerospace Village at DEF CON from Aug. 6-8, 2021 in Las Vegas, Nevada. These contributions are intended to support and generate budding interest across the aerospace security domain.

The Top Ten finishers in the qualification round of the Hack-A-Sat 2 competition. (Courtesy graphic)