Those attending Defcon this August will have a unique opportunity to see firsthand how well today’s satellites can defend themselves. While the conference typically invites security professionals and hobby hackers to test cars, cloud services, Wi-Fi networks, and other everyday technologies, this summer’s event will be the first to involve something that orbits Earth.
The competition is called Hack-a-Sat, and it’s technically the fourth of its kind (though this is the first to occur at Defcon). Designed and managed by the US Air Force, the competition’s goal is to create an environment where cybersecurity threats to space equipment can be safely tested. Previous Hack-a-Sat events have had competitors attack real satellites that weren’t in orbit, but this year’s event will feature a target in space.
Earlier this month, SpaceX launched a 3U CubeSat on behalf of the US Space Force to create a Hack-a-Sat target. The small satellite, Moonlighter, was a Space Force, Air Force Research Laboratory, and The Aerospace Corporation collaborative project that will serve as "the world's first and only hacking sandbox in space." In 72 hours, teams will attempt to penetrate the satellite’s defenses in a capture-the-flag-style challenge, revealing holes in the government’s defensive cyber operations. Of course, several obstacles will be in place. The satellite contains a dedicated cyber payload with a firewall isolating its subsystem, making it a more realistic target. Hackers won’t be able to change Moonlighter’s orbit, and ground controllers can kick out intruders and reboot whenever they please.
“We’re really trying to wrap our heads around cybersecurity operations and how we do cyber operations on a system that is starting to have a lot more commoditized hardware and software, but it’s also extremely remote,” Aaron Myrick, senior project engineer at The Aerospace Corporation, told Cyberscoop after Moonlighter was deployed. “We can’t just go up there and flip the power switch or change a hard drive…it’s quite a challenging problem.”
More than 380 teams competed in April’s qualification rounds, which ultimately narrowed the pool to five teams. Competitors from Australia, Germany, Italy, Poland, and the US will convene at Defcon in Las Vegas for the final round.
