LAS VEGAS — “Can we scoot that away from the edge?”
A replica of the Moonlighter satellite at DEF CON 31 in Las Vegas. The Moonlighter satellite was deployed to LEO, July 5, 2023 as part of the first on-orbit hacking competition. (Source: Kratos/Robert McClellan)
The fragile-looking device was resting precariously inside its plexiglass case, imager pointed skyward. The array of black solar cells covering the body of the engineering copy of the now-orbiting Moonlighter satellite reflected the blue and pink LED lights while the DEF CON Aerospace village personnel tried to find the perfect angle. Someone had pushed the whole thing to the edge of the narrow table overlooking the five teams of hackers on display together in the convention space at DEF CON 31.
The competitors were conversing in hushed voices or concentrating over their open laptops, set out on shallow tables strewn with ethernet cables and empty coffee cups and—later in the day—pizza boxes.
For the last three years of the Hack-A-Sat event, the battle lines of hundreds of teams across the world have crossed in this capture-the-flag-style war games event with a focus on space. From first blood to the final score, the battle is fought and won in the abstract realm of knowledge, code and lateral thinking. The games this year are based on a cumulative team score with certain Jeopardy-style challenges awarding different levels of points. The Italian team mHACKeroni scored the most points and ultimately won the competition over the weekend of Aug. 11-12. Last year’s winners “Poland Can Into Space” took second place and “jmp fs: [rcx]” won third place.
When the competition got underway, there was a sustained tension among the competitors matched only by the curiosity of the observers. Government personnel, reporters and a milling sea of hackers—aspiring and otherwise—wandered about the competition area watching while the clock ticked down to the next contact window with Moonlighter.
Up until this year, the Hack-A-Sat finals have all been conducted on terrestrial-bound simulations. This was the first competition with an on-orbit aspect. What happens when the digital battlefield shifts to the final frontier—space itself?
In the finals for Hack-A-Sat 3, seven teams were given control of their own simulated satellite, creating an ideal verisimilitude of the on-orbit battlefield that the Hack-A-Sat founders have envisioned since the start. Teams were responsible for attacking, operating and defending their hyper-realistic satellite with all the battery micromanagement and positioning hurdles that entails.
For Hack-A-Sat 4, there was a single satellite instead of the seven simulations. The five teams—reduced in number because of bandwidth and other operational concerns—had to share this one device. Rather than allow the teams full control over Moonlighter, the operations aspect was handled by the organizers to keep the satellite operational over the course of the event. Furthermore, because of the limitations of ground station availability, there were only a handful of contact windows the teams all had to make use of.
“Up to a week before the contest, we had no idea when these windows would be,” explained Space Force Capt. Kevin Bernert. “It definitely impacted the design of the [competition].”
Finally, the window came. Commands had been submitted for review by the operations team well before the window. It was the moment of truth. After the uplink and downlinks came back teams celebrated their newly won points. After the moment passed, they were left to ponder and plan, waiting again for the next window. In a community accustomed to instant communication, this delay fostered element of patience, strategy and anticipation.
Hack-A-Sat 4 winning team “mHACKeroni” displays their banner and shows off their award for capturing first place during the two-day competition, Aug. 11-12 in the Aerospace Village at DEF CON 31 in Las Vegas. (Source: Space Systems Command)
There is no doubt that Moonlighter is a grand accomplishment. Integrated into a SpaceX vehicle, and in cooperation with Air Force Research Laboratory, Space Systems Command and the ISS National Laboratory, Moonlighter was launched by the Aerospace Corporation during a resupply mission to the International Space Station where it was later deployed. It has garnered a lot of attention as the centerpiece of this unconventional Capture the Flag competition. But though it’s likely to be around for the 2024 Hack-A-Sat 5 competition Moonlighter will not stay in orbit forever. “In about a year and a half, Moonlighter becomes a shooting star,” Bernert confirmed.
It remains to be seen what the next steps will be for this educational outreach program. The Hack-A-Sat organizer’s vision of an on-orbit battleground has been only partially achieved. Perhaps a second launch for the next competition can bring them closer to this goal. Or perhaps, Moonlighter will make another solo debut at next year’s competition.
About the Author:
Robert McClellan, director of cyber services, leads the offensive security team as part of the Kratos cyber team. With a master’s degree in cybersecurity, a background as a penetration tester, and over a decade of leadership experience, Robert has gained unique insights by participating in the knowledge community and by enabling businesses and agencies to solve emerging challenges in information security.
Explore More:
Analysis of Thales’ Successful Compromise of ESA OPS-SAT Experiment
Steps Toward Securitizing Commercial Space Networks
Podcast: AI, Maintaining Cybersecurity in LEO and a Future of 50,000 Satellites
