[00:00:00] Frank: I want to say that I really do, but I'm afraid to say that

we missed security, big time.

Physics kind of changes. When you get past the heliosphere,

there's literally a Knight in shining armor at the very top of this tower,

they decided to use this new language called Java script.

I think we need to introduce this whole idea of adversarial thinking into the space community.

And then somebody said, you know what? We should commercialize this.

[00:01:01] Dave: welcome to security voices. Hundreds of inexpensive satellites are now regularly launched in space suits. Space X is small set rideshare program and others. Some of these are sophisticated and commercial. Others are DIY and very much experimental. They share a space with now over 3000 other artificial satellites orbiting the earth.

When it comes to cyber attacks, what could possibly go wrong? Frank lb joins us for a conversation to answer exactly this question of how hacked proof satellites really are and why it matters. Starting with the Hackensack competition. Hakka sat as an intensive capture, the flag sale competition currently in its second year, where teams square off against one.

To break into and defend satellite tech. And along the way, we learned that doing so requires encounters with strange software, funky hardware and not a small amount of hard math, the most known visible satellite hack dates back to the 1980s and involves a broadcast takeover around Thanksgiving from a max headroom mask wearing man, which ended in this spanking, but no real harm done.

We explore the attack service satellites with Frank to find out when the next attack happens, where it's likely to be. And along the way, we discovered a dirty secret about the Hubble telescope and the naughty technology line deep inside its belly throughout the hour long conversation with Frank, we get the impression that we're still very much in the early days of satellite hacking.

However, the breakneck pace of satellites being launched today and their considerable potential vulnerability to cyber attacks pointing the direction of a lot more than simply max headroom, interruptions and GPS woopsies in the field. Jack, and I hope you enjoy this episode of security voices. Frank, welcome to security voices.

This is our mega recording week. We're closing out the week with you. It's also, I think the first time Jack and I have seen each other twice in a week, since long ago before the pandemic. Yeah, many, many, many moons ago when people still got together in person. I think we probably were hanging in Culver city or something.

[00:03:08] Frank: Yeah. That's over city. Wow. Okay. Where are you based out of Frank? So Northern Virginia right here in Fairfax, city of Fairfax. 

[00:03:19] Dave: I remember it. Well. All right. So we got introduced to you, I think a little circuitous, but predominantly through Melanie and sign, who we add on before. And she said, would you be interested in talking to a person involved with Hackensack program?

And so. And when she said that, I didn't realize that the idea came from you. This is actually your baby. Is it 

[00:03:41] Frank: not? I'm not going to claim 100% ownership of the idea. I was certainly super excited about doing something in this space, in cyber space. We can actually break those terms out now that, uh, but yeah, when I was at DARPA, the defense advanced research projects agency, I was doing a lot of traditional cybersecurity work there for the government.

And while I was at DARPA, I kept seeing this new space environment and economy growing by leaps and bounds. And having grown up right next to Kennedy space center, I was always a huge fan of the space program. I was born right before the last couple of moon landings. Although I don't remember them, the buzz, all that was still super fresh as I was growing up.

And then the space shuttle program and all the really cool things that came out of that. So I saw this happening, like the space industry was just growing by leaps and bounds. There was a lot of new technology going into it, a lot of democratized technology, meaning that people were starting to build rockets that could land on barges.

Elon Musk, people were building 3d printed, rocket motors, cube, SATs were approachable now by high schools and universities. And they could get them launched on things like rideshare, where you put 60 cube sets into a shared launch and then share the costs or economy of scale. So all this stuff was happening.

And I started to think about, oh my God, you know, what are we going to do about cyber security with all this new stuff? Being at DARPA, you get to learn the history of DARPA and DARPA used to be called ARPA. All the old internet geezers will remember that the ARPANET was like the first incantation of what became the internet.

And it was started at RPI with a bunch of universities, Sri being, you know, one of the more popular universities that was one of the original nodes on the internet back in the early seventies. So I started thinking to myself, you know, when the internet was first created, it was built for sort of this small group of nations and universities to use as sort of this research tool.

And it grew and grew and grew. And then somebody said, you know what? We should commercialize this. We should get it out in the open and let people start to use it for commercialization. And that's when the.com boom happened. But the original design of the internet did not account for that commercial. And alongside all the great things that we're doing with the internet right now, there was a lot of bad stuff that happened too.

And we were sort of rushing to go fix all those gaps in security, and we're still rushing to fix all those gaps in security. And I thought to myself, here we are, there's this rapid change in space? What are we going to do about all of these new technologies that are going into orbit, by the way, we're putting up more and more and more satellites.

Every day, space X puts up 60 at a time, sometimes twice a week. And they're not the only ones building a constellation. Other nations are doing that as well. So it's not just us, it's other people. And with all of that new technology, there's lots of software. People are writing. New code. People are putting faster processors into space.

They're starting to put these high performance GPU's into space to do a lot of processing on orbit. So they don't have to download so much data to the ground. Communications is still sort of a challenge. High bandwidth is still a challenge. So they're thinking about doing a lot of computation in space.

So now we have supercomputers in space doing all this interesting stuff and what drives all that software. And, you know, I'm a software guy and I know a lot about how terrible software can be because I spent a ton of my career looking for bugs and software and doing bad things with that stuff for good people.

And so that's kind of where the idea for Hackensack came from the fusion of those two ideas together. So when I left the government, I started Astro SAC, which is my company, and I was doing some consulting for space force in the air force. And I mentioned to a guy named John Marks. I said, you know what, we should do something.

At Def con if there's interest and John is like a buzzsaw in terms of making contacts and tracking people down who are interested in doing things like this. And so he immediately got in touch with a guy named will Roper, who was sort of that head of acquisition for the entire air force and will, was super excited about this.

He's like, yeah, this is exactly the right time to do something like this. So Def con 2019 before COVID they went out there and they started talking about it and started generating the buzz for doing something like Hackensack. And there was a lot of interest. And so we immediately followed that up with the secret meeting we had in Wallops island, in Virginia.

So Wallops is home to NASA and Noah, Noah has a huge ground station there and that's where the world's biggest weather satellites send their data called guts. And they also manage all these other fuller missions called pose pose and goes, goes, it's a big geosynchronous satellites. So anyway, we had this, it's a small facility, nobody knows it's there.

It's not really secret. Noah is unclassified and it's a global sort of organization that works with all sorts of other countries and managing the world's weather or trying to manage the world's weather. And so we thought, because it was so far away from everything else, it was away from the beltway. It was away from everybody's home office.

We could get there and we could meet it now and really do this fully immersive. What is space? Because we had all of these cybersecurity experts come with us that hadn't really been exposed to space that much. And we wanted to show them everything. We wanted to show them the ground stations. We wanted to show them the software.

We wanted to show them the data links and the giant antennas that are there and think about where are the potential cybersecurity vulnerabilities. And how might somebody get after those, if they're an adversary, right. And it was like the perfect place to do this. 

[00:09:32] Dave: I'm actually looking at it here. Wallops island looks like it's just barely in Virginia.

It's almost actually Delaware, right? Yep. Right on 

[00:09:41] Frank: there. Because it's like, you know, when you go to Maine, they say, you can't get there from here. But words I shot from where I am in Fairfax. It's not that far, but you can't drive directly there. You have to go around all of these waterways. And it's really an interesting place.

In fact, some of the guys who work there, they work two jobs. So their primary jobs are working at NOAA, managing satellites, these $500 million satellite. But they also have an oyster bed in their backyard, in the water. They sell oysters. Right. It's just the craziest thing ever. It's just this club like atmosphere there, these guys.

So we come here, all these crazy cybersecurity guys and we're poking in and around and looking at things. And we're like, did you know, that was plugged into that. What's that doing there? What kind of security are you running on this? And, you know, and they were like, whoa, you know, who are you guys?

Yeah. So, but I think they were super appreciative that somebody was finally starting to pay attention to that stuff. We met down in the basement, they had a big basement meeting room and we drew up all this stuff on the board about what were some of the topics be that we would cover for this potential Hackensack contest that we would host in Vegas the next day.

And so we came up with, we would probably follow along in the same vein as a capture, the flag contest. Therefore we would need to have a qualification round sometime in the spring. And we're looking at our watches and we're like, oh my God, it's already November. We're going to have to quickly generate all of these challenges and figure out what qualifications and topics and things like that are going to be, we're going to have to get the word out.

And by the way, what are we going to use for targets? You know, what are these guys going to hack? And we quickly thought to ourselves, well, if we build a satellite, that's going to take forever. And we started Googling, you know, are there any educational satellites out there that we could use that universities use?

And so in the end we finally settled on sort of a hybrid approach. We found an educational site. And we took delivery of some of these, and one of the teammates that was principally involved in developing the Hackensack challenges, a company named actually did the hard work of getting this educational satellite.

It's a small cube set into a shape and form where it was robust and resilient enough to stand up under the efforts of some of the best hackers on the planet. That was a huge challenge and endeavor a lot of things that we did were mistakes because we were working so fast, but also a lot of things that we did were wildly successful.

So anyway, so we came up with the original designs on how this was going to work. We came up with some of the topic areas for the qualification round. We got to calls in the spring time. I think there was over 8,000 folks that signed up or 8,000 teams. Right. Which could have been composed of even more.

Yeah. Working in the background. Cause it was, you know, no holds bar do whatever it takes to solve. Some of these things 

[00:12:32] Dave: sounds like a massive number of people like 8,000 teams with what, two to three people on a team. 

[00:12:38] Frank: That's right. When we got to the actual qualification round, not quite as many people played.

I think a lot of times people will sign up multiple teams just in case so they can answer questions and if they get them wrong, they can put the answers in for the other team. There's all sorts of gamification going on with how people do that for calls, hackers, 

[00:12:56] Jack: play games. 

[00:12:58] Frank: Yes they do. Oh yes they do. So we went over calls over the weekend.

I can't remember the exact dates. I think it was in either April or may sometime, but it was fantastic. We had some of the categories involved, orbital dynamics, one of the challenges involved locating a specific spot on the ground based on the location of a satellite at a point in time and space. So people had to learn some of these really hard.

Three body motion problems learned physics, and also combine that with their cybersecurity skills. And so what we were trying to do, we were trying to find people that were both experts in cybersecurity and hacking, but also experts in spacecraft and designing spacecrafts, writing software for spacecraft and orbital dynamics and the physics of computing orbit transition from one orbit to another.

So that was interesting to see the culmination of all that. I actually got to write a challenge. I wrote the Apollo 11 guidance computer challenge that turned out to be actually a little difficult for people. So they rated it as a 500 level challenge, but the idea was, and I got the ideas for this from a guy who actually translated the Apollo 11 guidance, computer printouts, these fan full printouts that had been scanned in somebody taking the time to scan all these things in.

Scanned all those Zen did. The OCR corrected them. He wrote a compiler for this strange eight bit computer and he built all the compiler tools needed to write programs for it. And it was on GitHub. And I was like, you know, this is really cool. He wrote an emulator for it, the whole nine yards. So you could actually run an Apollo 11 guidance computer on your desktop, in a virtual machine.

I was like, this is kind of interesting. I think I can write a challenge to support something we want to do in calls. And so what I did was I was like, you know what? I bet there's some hard coded values for doing orbital dynamics. Like the value of PI that has to be in here somewhere. And so lo and behold, I found, uh, one of the source code files with all these hard coded values.

And I'm like, okay, so here's the challenge. The challenge is going to be, you have to hack into the Apollo 11 guidance computer, and then you have to change the value of PI and you have to know where it is in memory. And so this architecture was so obscure and so. Strange that, you know, I thought nobody's going to really be able to do this very easily.

It turned out it was actually a really hard, one of the harder points was queering the memory of the Apollo 11 guidance computer using the built-in protocol that they had designed for the key pads. So there's this key pad that the astronauts had to type in like peek and poke. If they wanted to change a value in memory, they had to poke that.

And if they wanted to read memory out, they had to peak it. And that's literally how this thing works is the astronauts are literally doing Pekin Pokemons. And so the idea was that the contestants had to read memory out and they had to look for something that looked like pie, and they had to do the eight-bit conversion to regular numbers.

And it was a strange version of floating point as well. It wasn't a AAA floating point. It was some. Custom version of floating point because they had such limited space. Anyway, it turns out there was a couple of teams that actually solve that and they got a big kick out of it. And then some of the other challenges involved, traditional packing and buffer, overflows, and weaponizing, those two leak the flags out of memory and things like that.

So quals really did its job. It got some really solid teams from across the globe. Like we had a couple teams from Europe, we have some of the best teams from the U S also that made it out of calls. So moving into CTF over the summer, what we did is if you remember back to the educational satellite that I talked about, so about that time chromium had finished getting the educational satellite re-engineered with some proper components to support deaf content.

And we shipped out eight of these, we call them flat sets to the contestants. And so they can familiarize themselves with what is a satellite, you know, what are the components in it? So what is an attitude, determination and control system. What is a onboard computer look like? What is a satellite bus network and how do the sensors communicate and how do I keep this thing in orbit?

And so also we delivered to them a ground station software suite that hooked up over an ethernet network to the flat side. And that was actually great because it provided that extra layer of realism. If you were a competitor, you received a fully functional ground station and you received a fully functional satellite that sat on your desktop and it actually had an air bearing too.

So when you sent the correct telemetry commands to the satellite to cause a slew, it would actually turn on the air bearing. It was really neat. So the teams had that all summer to, like I said, a climatize themselves. Orbital dynamics and how to control the satellite, understand the software so they can instrument it and get ready for the CTF, which occurred in August.

Oh, by the way, we had to do all this with a sudden onset of COVID. Right. And so it just completely threw things in temporary disarray, but the cool thing about Def con and the cool thing about quals and everything that we're doing is work all computer nerds. And so we know how to do stuff over networks and remotely.

So even though it was really annoying, we were able to really not be affected too much by COVID because everybody just kinda kept going. We just didn't meet in person as much. So as terrible as COVID was, I think the Devcon community really did a good job managing that disaster 

[00:18:34] Dave: was 20, 19, 20 20, who won.

And did multiple teams win or how did it end? Yeah. So 

[00:18:42] Frank: only one team won and it was kind of dramatic. Yeah. The way it turned out, it was not a team on team competition. Like a lot of CTS are where one team is defending against another team and it's sort of a free for all. And this one, we set it up so that they had to solve these specific challenges on their way to this final culmination of pointing the sensor that was on board, the satellite, which was an imager and point that at a photograph of a moon and take that picture and then download it to the ground station.

But they had to defeat all of these laws and the system. We threw a wrench into that, though, what we did is I think about 18 hours into the competition. We told everybody, Hey, you have to solve this extra challenge, which we didn't tell them about before you can move on and actually try to win. And so that extra challenge was really cool because we worked with the air force.

To get some time on a real satellite, that was an orbit. And the idea was that we give the contestants a stripped down version of the telecom and language to control that satellite strip down enough, such that you really couldn't do anything bad if you wrote the wrong telecom mans. And they had an air force team that was monitoring this stuff very closely, they would look at the commands that the teams built and then send them up to the satellite.

But the challenge was, it was the same challenge as in the Hackensack CTF, but instead of taking a picture of the moon that was on the wall in the competition space, they were going to take a picture of the real moon in space with a real satellite and get that downloaded. And so that really threw a lot of the teams for a loop because they had to drop everything.

They had to learn this new telecom and language, which was different than the language of the flat set that we had given. And compute the correct orbit and slew the imager just at the right time to pick up the moon as it was an orbit, because it was a low earth orbit, satellite and low earth orbit satellites.

They'd go around the earth every 90 minutes and you don't have much time or many chances to do what they needed to do. So it was sort of like a nail biter. So in the answer, what happened is there was a couple of teams that were in contention for first place. And because they didn't get that challenge, they kind of got knocked out of the running in the end.

There was a U S team that plays first and there was a, I think it was a Polish team that got second, but it was really, it was great. I can't say it with you, the drama and everybody was solving these challenges right up to the last minute. In fact, there was, I think one of the third or fourth place teams they would have maybe gotten first, their photograph of the moon was downloading as the clock ended as the contest ended.

So we had a team monitoring the network and they could see the JV. Of the moon going through the packet capture, but it didn't end up in the ground station software and they cut the network off right at that second. So that was, that was it. 

[00:21:33] Dave: Oh yes, that was, uh, 

[00:21:37] Frank: so that was really cool. So that's kind of Hackensack.

The challenges were my goodness. They were incredibly difficult, cybersecurity alone. They were super hard challenges, stuff that you would see at a traditional CTF, but you combine the orbital dynamics requirements and understanding how to do the mathematical calculations. And you have to do this very quickly because you have basically two days to go through all these challenges.

The FIM of the whole thing was really it's your satellite. Somebody has gotten into it, an adversary's gotten into it and they've done all these bad things to it. So you have to undo all those things that they did. It was really fantastic. 

[00:22:14] Dave: Cool. So the new hacker set is on now. It's kind of early qualifying rounds.

I understand there is like jeopardy style questions just to. Winnowed down the teams and so forth. What are the notable changes from last year? And when does the whole thing conclude? When will we have a new winner? And I think the prize money is starts around 10,000, goes up to like $50,000 or so doesn't it like it's decent prize money.

[00:22:39] Frank: Yeah. It's no joke. The big differences from last year. So last year, like I said, we had put these sort of adversarial issues into the satellite that they had to undo. It's almost like you are ransomware, so you need to undo all the things the ransomware people did this year. It's going to be a more traditional force on force CTF, where the eight teams are actually going to be trying to pack into the other team's satellite.

And at the same time that you're trying to throw your whole day at the other team, you need to make sure that you try to patch that stuff. Vulnerability that you found to not let the other teams in, but the challenge with that is there's some kind of a service or some sort of function that needs to be kept alive.

So you can't just turn that functionality off with that flaw in it to keep the other teams out because your satellite has to perform this function. You have to very carefully understand exactly where the code flaws are. Patched those very carefully. The other problem too, is that you don't want to reveal the nature of that vulnerability through your patch.

So there's a lot of really interesting nuances here. Cause if you reveal the nuances of your patch to the other teams, well, they're going to turn that into a weapon and use that on you, right? So there's this really a theme of extreme strategy involved. When should I use this floss? Should I use it now?

Or should I use it later? Should I wait until somebody else starts using. Then I'll queue up all mine and use them, but it's very similar to a traditional CTF. If you guys have seen those 

[00:24:08] Dave: opening at Def con around Devcon, or what's the timing like for the exciting conclusion here, 

[00:24:14] Frank: the hacker set to contest is going to take place at this really cool.

It's called the national space defense laboratory. It's in El Segundo, California, and it's going to be sponsored by the space force. So they will have the competition there. It's going to be held host Def con in December, leading up to it just had quals. We've got the teams that have been selected. And then at Def con there's going to be the aerospace village where we'll have some showcase some of the contestants and also showcase sort of a preview of some of the challenges that they're going to face at the NSDs and also get into.

Yeah, 

[00:24:48] Dave: Alsigando is right down the street from me. I actually, the first project I ever did. And cybersecurity was that huge space and communications back back in 96. 

[00:25:00] Frank: Oh, wow. Yeah. And 

[00:25:01] Dave: it's an interesting that history and aerospace for a long time, LA just didn't seem to have a whole lot going on. It was seemingly kind of slow here and then space X came into Hawthorne and I'll tell you, like there isn't a startup program around here.

I'm pretty well tied into the startup community in many ways here in LA. And there isn't an accelerator or a program here now that doesn't have an aerospace company in it where there isn't someone who'd worked at space X somehow related to space X and so forth. So it's pretty interesting to see all this fresh new energy in life coming into Los Angeles, going to was just down the street from me here.

It's the unloved home of lax. So appropriate place for it. Yeah. Interesting. And you know, you said three body problem. It's funny to hear that mentioned the only other context I've heard, three body problem mentioned was shisha and Lou's books. So, you know, I, there was some things where there, where you went clearly past me, which is great.

I'm sure there's other people get it. And we're kind of an apologetically deep at times on this call. So awesome. I was like, Ooh, I recognize one. And I get that. The only reason I get it is because I was reading Saifai but awesome. 

[00:26:14] Frank: Nice. Yeah. Also again, does a fantastic place and Hawthorne for space X's I visited space X a few times, so it's just an, it's an interesting culture and area in and around the space X facility.

And I remember the first time I went there, I think Elon was working on his tunneling machine, right. He's building a tunnel and with the excess dirt and material that they were moving from the tunnel, they turned those into bricks and they built this big tower kind of like a Coppola on a castle. So I'm walking into the building.

I turned around to look at it and there's literally a Knight in shining armor at the very top of this tower. It's like real life Minecraft. And I'm like only at space X headquarters. Would you see something like this? And I met my friend at the door and I'm like, is that really a suit of armor at the top of that tower?

He's like, yeah. And he's like, you know what, there's bullet holes in it. And I'm like, what? 

[00:27:13] Dave: It's like, 

[00:27:13] Frank: yeah. Somebody took up a pot shot, you see all kinds of stuff, but it was 

[00:27:19] Dave: probably Ilan to be honest, like there's a pretty good chance of it. His biography by Ashley Vance is it's really good. You get a real sense of the flawed character that he is.

And also like the intellectual Titan and so forth. He's got guts for miles and yeah. And yes, he's, he's 

[00:27:40] Frank: out there, man. Massive guts. Yeah. 

[00:27:43] Dave: Yeah. Yeah. There's, there's an epic part in the book where he can either fund Tesla or he can fund space X and I mean, you own your business and, or at least you're founder of astrocyte, I've got open Raven and so forth and jackass besides I just, I can't imagine having to be in that situation where you've got two things and choosing between the two and everything else.

I mean, he makes it through which of course we all know, but I don't think people realize how harrowing each one of these successes are. I mean, even on my side, I think back to CrowdStrike, which is just a jug or not now, and what a debacle we were for a period of time, the startup mayhem, like I was dealing with right before this, it's such a natural, that entropy is such a natural part of the process.

Whether you're Elon Musk who ushers in a new era of aerospace inside LA or whether it's the heroin early days of, besides with Jack has many stories about, so it's a part of the creation. Yeah. Near brushes with 

[00:28:51] Frank: death. His financial decisions are several orders of magnitude different than mine. 

[00:28:58] Dave: Just, just a little, just a little.

Yeah. Yeah. Yeah. And this is usually the point where like, Jack reminds us that besides as a nonprofit, but nonetheless, you guys do nonprofits to deal with a lot of money. Nonetheless, don't you? 

[00:29:12] Jack: Yeah. Just dealing with a fraud alert from a purchase for besides Vegas right now. Yeah. Yeah. Did you buy it's like, well, we're hackers.

We buy some weird stuff that one's okay. 

[00:29:29] Frank: Ali Baba. Frank 

[00:29:31] Dave: let's dig a little deeper. Like I'm curious, coming back to Hagestad it begs the question of what software is on the newer satellites. I know that we've got so just for fun, I went out and doing my research for this there's let's see, it's over 3000.

Let's get a specific number. Last I checked this past weekend. There are 3,372 active artificial satellites orbiting the earth. As of the start of this year, about 1900 of them belong to the U S largest number by far of any single country, nearest competitor. China had 412. So there's a hell of a lot of satellites out there, like you were saying.

And there's some that were launched in the fifties. And then there's a whole bunch of new stuff as well. Talk to us a little about the technology behind it. I'm assuming the old ones were designed. There was some ancient stuff out there that was designed well before security was a concern and then the newer.

Talk to us about the old stack versus the new stack. Give us a little bit of a chronology of the technology development behind it. So 

[00:30:38] Frank: those that you were talking about, those are all operational satellites, like still functioning. Yeah. I think there's a glove that NORAD is tracking and astronauts glove.

That's an orbit around, obviously there's 

[00:30:49] Dave: not a lot of soft, tremendously useful. 

[00:30:52] Frank: There's not a lot of software in that glove. I don't think maybe they have strangely some sort of embedded system in that glove. I don't, I don't think so though, but yeah, there's a huge difference. If you look at the modern satellites that are up there, especially think about Starlink, right?

Starlink is probably the most modern and most sophisticated satellite up in space right now, per pound, I would say, and not counting Hubbell. Hubbell's also very extreme, you know, extremely common. So let's talk about Hubble for a second. This is an interesting fact about Hubble. We all know that the debacle with the lenses on Hubble and the repair mission to save the mirrors and install new computers to fix for the fact that the mirrors more perfectly ground correctly.

But the software on Hubble is interesting. I stumbled across this. I was doing some consulting work with NASA, and I stumbled across this paper about the command and control language used to control the telescope itself back in the late nineties, uh, when they were sort of setting all the requirements for that commanding language, they decided to use this new language called Java script at the time.

Right?

I'm not, I'm not, 

[00:32:04] Dave: wow, what could possibly go wrong? Right. 

[00:32:10] Frank: And so. Part of Hubble. I don't know if it's used for orbit maintenance or anything like that, but I do know there's a control language and Hubble that was at least partially based on an ancient version of JavaScript. And the way space works, at least legacy space works is that once you make an engineering decision and you decide on to implement something or put some technology into a spacecraft, that's it, you're not changing it because everybody's already signed off on it.

It's been tested, validated, and checked off. And then the other groups do their design risk, mitigations, get their things checked off and it's all sort of comes together in a critical design review. You have these requirements reviews, you have preliminary requirements review, you have critical design review.

This stuff is locked in. You cannot change it. And so somewhere in some place in memory and the Hubble space, telescope is a version of JavaScript from like the late nineties.

Yup. So, so that's that, that was an interesting story. I like to bring that up every once in a while. Cause it's a, it's a cool piece of trivia. Now. I think that software is probably maintained and they probably have a contractor. NASA does that has the original source code for this ancient version of JavaScript.

And they probably update it as much as they can. Right. Because they can't change the spec. You know, if there's horrible flaws in it, they can probably change those. And there's probably a contractor out there somewhere that's sole job is to maintain this ancient version of JavaScript. No kidding. And that's kind of how it works for all these old spacecraft.

You think about the operational, what is it? Pioneer and Voyager spacecraft. I don't know if we've lost contact with tinier, but I think Voyager we're still communicating with, with the deep space network and some people out of Caltech and JPL. I think they still are able to communicate with it. They have to send that.

Updates because physics kind of changes when you get past the heliosphere and the heliosphere is where the maximum pressure of the sun's wind meets up against interstellar space. And it's basically nothing left. And so Voyager has gone way past the heliosphere and physics. As we know physics here on earth.

Maybe changed a little bit. So they need to send little updates to it, to account for the strangeness that they're experiencing. And it takes hours and hours and hours to get these tiny little chunks of code up there to update its understanding of how to operate. So that kind of stuff is taking place too.

And it's probably some sort of eight bit ancient, not much different than that Apollo guidance computer that I was messing around with for the Hackensack calls, challenges. And then you have everything in between you have on the space shuttle. I think everybody's heard that they had several computers that sort of did this voting paradigm to determine what best action to take when there was a decision or some sort of conditional in flight.

Those computers were 3 86. And I think they did eventually upgrade them to Pentiums or something like that way back in the 2012 timeframe when the last shuttle flew. But the upgrade path is super, super slow, right? And like I said, you have to go through all these design review boards and software review boards.

And it's really this legacy of robustness for hardware designs, where early on, you know, they quickly realized we need to really control how we're evolving and developing this hardware. Because if we make any mistakes, it's going to fall apart. 

[00:35:36] Dave: I mean, that was one of the things that struck me as I was kind of reading up and researching.

This is, it's not like the satellites have been designed irresponsibly in any way, shape or form. It's simply that a lot of the attention is not put on software resiliency, but it's put on hardware resiliency because it's dealing with extreme conditions, extreme temperatures, crazy radiation and everything else.

The concept of hardening a satellite is actually ages old. The conscious of hardening it for a cyber space attacks is understandably newer fare. 

[00:36:13] Frank: Absolutely. In fact, talking to folks in the space community, that's a really cool conference out there. I recommend if people can attend it, it's called the space symposium.

That's in Colorado Springs and it sort of follows Devcon. Another, another really good one is small set, which occurs at the university of Utah every year. And that's a fantastic conference too. In fact, the small set conference, you'll see. The sort of maker type folks that are involved in the small set community.

It's more of a maker hacker type community in terms of satellites, right? But not so much software, but they sort of share the same values as people in the, in the hacker community. So you have space symposium where you have the big, massive telecommunications companies or companies that are building satellites for them like Boeing, Lockheed Martin, Intelsat, SES, huge companies that provide all of the great communication mechanisms that we have today.

Like, you know, the Olympics, right? Everybody's getting 4k, HD Olympics live streaming. How has that made possible while these massive leap capitalized companies build these huge, super expensive satellites that just work they're super robust. They never failed, hardly ever fail. And they sit up there in geosynchronous.

And man the most robust things you've ever seen the software though, that's a completely different story. Like you're saying, because of the legacy space industry just has not really experienced the wrath of the internet. Like we all have going back to the.com boom. When the internet was first commercialized, it was just hack after hack, after hack, after hack.

Yeah. Then we got into the browser disasters. You remember it all started with a ping of death, right? Remember that one? 

[00:37:52] Dave: So I'm looking at the website here and at the speakers. Some of it's what you'd expect. Like as soon as someone from BA systems and astrophysicist, Harvard Smithsonian center, Booz Allen, Hamilton, McKinsey, and then you've got this guy, who's the Azure space, Microsoft like, whoa, hello, public cloud and space.

I'm not saying that's like Java script and satellite, but it's an interesting combination on the less it's an amalgamation of. Many different humans and very international. Here's a guy who's head of agency of Ukraine, of space for Ukraine and so forth. It's an interesting crowd, probably a little more diverse than Blackhat will be next week.

Just going to say it speaks volumes that they put their event in Colorado as opposed to Vegas in the middle of summer. So there's some wisdom there that we don't have in the cyber security community. 

[00:38:48] Frank: Yeah. Well, it's hosted at this place called the Broadmore. It's this hotel that's been around for over a hundred years.

First time I went there, I went down to the basement to check my email and sort of a quiet area down there. And along the walls, they have all of these booze bottles that are empty. Thousands of them. I asked one of the people that work there, I'm like, what are all these booze bottles here? And they're like, oh, during prohibition, this is where all of the congressmen and presidents and everybody else would bring their booze by the train.

To keep during prohibition. It's just an unusual fact about this hotel, uh, how famous it is and what kind of people showed up there. But this is where space symposium is held. Also just interesting place. Super interesting. So the year I went, Richard Branson was right there in the lobby, 10 feet away from me, Jim Bryden Stein, the head of NASA at the time was right there.

Everyone is so approachable. It's a really interesting place to make a lot of contexts. You hear some inside baseball stories about what's going on in the industry and things like that. But you're also starting to see the influx with a lot of folks from the new space economy who were showing up and starting to ask those questions like you're asking, 

[00:39:58] Dave: let's come back to it.

What type of operating system is running on a satellite? Is it a specialized satellite? O S is it a variety of operating systems? And what are the programming languages that people write things on top of it. And is it, I'm assuming it's a blend of custom and commercial and so on. Yeah. Give us a sense of what the stack is on top.

The satellite 

[00:40:21] Frank: number one, there's almost zero uniformity. Everything is bespoke. I'll tell you that right now that's changing, but right now it's all custom. You may see a little bit of uniformity. People may go out and buy wind river VxWorks as their base OOS, but in the end it becomes highly customized because the hardware's customized and the hardware is also non-uniform and bespoke.

And so therefore you have the base OOS, even if they buy that commercial version of wind rivers VX works, or if they use embedded Linux or something like. They're still going to have tons of customization. They're going to have a custom board support package, which basically binds the Colonel to the custom device drivers, which make the memory manager work and all those sorts of things.

Not to mention the custom communication devices that allow the different components on the satellite to talk to each other. And that's done over, what's known as a satellite bus, which is a network. Basically. The other thing I should mention too, is that there's this horrible name collision in satellite engineering with bus.

So bus means two things. One it's the electrical network by which all these components talk to each other, it could be canvas like you have an automobile. And the other definition of bus is the actual cage that the satellite components sit in as they're going around orbit like the big dude. So that's also the bus.

So it's a, it's interesting. I see a lot of people when they first get involved in space and people start talking about space buses. They're like, oh yeah, it's either net or cannabis or space wire. And they're like, no, no, no, no. This is the structure where, you know, it's kind of funny to see it all kind of play out.

Cause you know, that confusion is going to happen. But yeah, so there's no uniformity. Some people are working on it. There are a couple of companies out there. I'm going to mention one in particular, a company called K U B O S, who is actually building a satellite operating system. And it's specifically designed for you as a satellite builder to be able to write code for your satellite in a sort of uniform way.

And so they have a well-documented set of API APIs for Cubas and they've designed this app store model where you can write apps for the defense payloads. Oh my 

[00:42:30] Dave: God. All right. So everything else about looking into this space, hasn't felt very like Silicon valley esque and the rest of it. But if you go to dot com.

It feels just like a standard valley company, SAS, and they called their platform. Do you know what they call their platform? You should know this. I haven't checked it out lately, but what right. You'll love this. They named it major, Tom. Yo. Yes. 

[00:42:54] Frank: Yeah. That's third ground station component, 

[00:42:57] Dave: cloud based mission control.

The name of the platform has major Tom. Oh, Kubo. Sweet. See what you did there? Well, somewhere, I don't know if David Bowie is smiling or vomiting in his mouth. Like I can't tell which so 

[00:43:11] Frank: Cuba was actually, they're one of the first companies that I ran into. That's actually trying to grapple with that problem that you're describing where everything is kind of all over the place.

And we have no way to really build a good set of cybersecurity tools. And they actually came to me a couple of years ago and we worked on some things together. To do some security evaluations of Cuba's Coupa's itself is the software that goes on the satellite. And then major Tom is the component that they use for the ground station to process the telecom mans that make the satellite do things and get the imagery back or whatever it is that the satellite is doing.

So, yeah, Cuba is probably one of the first companies. There's other companies out there too that are doing sort of the same thing, but probably not as early on as Cuba was doing now, I would say too, that some of the small cube set companies that are out there like pumpkin, they are also sensitive to this kind of chaotic world of all the hardware components that are out there.

They're also sort of moving into this more uniform, more predictable design pattern, where it takes the burden off the person wanting to throw a satellite in space. Wrangling with all these different hardware designs where they can just go one, stop shopping to a company like pumpkin, and they can buy the components, screw them all together, write some software, maybe even use for it and reduce that load quite a bit.

So remember back in the seventies, when everybody was building their own custom personal computers, it was just crazy, right? There was no uniformity whatsoever. And you had all, it was like a zoo of all these different eight bit and 16 bit CPM based computers. And then Ms. Dos was really sort of the driver that drove everybody to say, wait a minute, let's kind of zero in on the 80, 86 platform.

And we got there right now. Security is another thing, right? Nobody was thinking about security back then people were thinking about profits. And so we missed security, big time back in those days. And there's evidence there with cubes, right? So they reached out to me and we did some security things and did some pen testing and stuff on their flight software.

And it's different than what it used to be back in the eighties, in the seventies when nobody was thinking about security whatsoever. So you can definitely see there's some things going on in this new space economy where small shops like that are certainly concerned about it. Now, the big question though, is how do you break into those bigger markets with these big guys and sensitize them to the pitfalls and the dangers of having this sort of legacy design model affecting what they're doing.

They're still going to want to use their old buses. Right? Some of their old flight computers are still based on like Xilinx Spartan, six FPG, which doesn't have some of the new advanced security features like bitstream encryption or certificate signing for the software that makes them operate. Or the way the chips are networks, where they don't have the ability to secure some of the traffic, if it's going from component to component on board the computer, but there are new options for them, but they don't want to change it.

Right. They don't want to change it because, oh my God, that's going to cost us money. We're going to have to go back through redesign. We're going to have to have another preliminary design review, blah, blah, blah. Right. That introduces risk to them because if they get this $500 million satellite in orbit and they, some wizard said, oh, we should use this cool new Microsemi FPGA with all these security features.

And it fails. It's like, see, I told you, so we should have never done that. Screw cybersecurity. 

[00:46:25] Dave: Let's talk about specifically about what the threats look like today. And let's start with, have there been any seminal hacks of a satellite, any big events that people kind of point. You know, the Melissa virus of the satellite world, or, you know, any kind of big, what I mean is any large events, not necessarily a self-propagating worm or anything like that.

I'm pretty sure that it hasn't been satellite malware maybe, but what are the events that have already happened if there are any, and if not, what are the things that we worry about when we talk about defending satellites? 

[00:47:03] Frank: It's funny, you brought up the Melissa virus going back early, early on some of the earliest, I guess, hacks that you could talk about in terms of satellites, are those people that would take over feeds.

And so back in the eighties, I think we started to see this because there was this explosion of people with their own big 10 foot C-band satellite dishes. And some people back in those days were pretty smart with electronics and they were able to manipulate the feeds. It wasn't really hacking as you.

And I know it today, you know, with software and that sort of thing, but it was, it was hacking. Um, and it was doing things that weren't really supposed to be done with electronics and manipulating technology for malice. And so one of the most famous ones that I can remember is this guy overlaid a picture of max headroom, that if you remember max headroom from MTV back.

So he took over a couple of feeds. I think it was in Chicago and he would do it like every week. And he would take over a feed on like primetime and for 20 or 30 seconds, he would just say this crazy stuff. I don't know if he ever did anything bad. I don't think he ever hurt anybody, but it's the first big one.

I remember just because it was max headroom and it was crazy, you know, it was kind of interesting. I think you can actually find people, uh, captured it on VHS and put it on YouTube later on. They're still up there. Okay. So moving fast forward. So what are people doing today? Well, people are still hijacking feeds and things like that.

Satellites have obviously changed since the eighties and it's no longer sort of this un-encrypted bent pipe where it's super easy to do. There's new protocols today. There's one protocol called was a DVB S two. So S two is basically the, the protocol used for dish net TV. You have all these channels, you have this little tiny dish on your roof, and that broadcast medium uses DVS two is the protocol.

And I think you can do internet over that as well. Some people use their dishes for internet. So there's the community of people out there who are building their own satellite receivers for DVPs to software defined radios in receive only mode. But there's also people who are doing the same thing with transmit and messing around in that area.

You do some Googling and see what people are doing with that. And so I think it's only a matter of time before that kind of gets mainstream enough for the cybersecurity community to take a vested interest and maybe being concerned about in the broadcast television markets. 

[00:49:26] Dave: This is a little too good to ignore.

So I found it it's called the max headroom signal hijacking incident on Wikipedia. Yes, it happened in the heady days of 1987, November 22nd. So people were about ready to set down for the Thanksgiving dinner and the guy got on and said spoke throughout the intrusion and made references to max had rooms, endorsement of Coca Cola, a whole bunch of weird stuff.

And the video ended with a person's exposed buttocks being spiked by a woman with a flyswatter before normal programming resumed.

You can't make this stuff. You just can't make it up. 

[00:50:10] Frank: Wow. Yeah, I had forgotten about that part, but yeah, it was, that's why I remembered it. Cause it was crazy. It was just crazy stuff, you know? 

[00:50:18] Dave: Yeah. And it's a shame we haven't had more of it given it's like, wow. So I'm assuming. So I think we'd be remiss that, bring it back to something more serious.

It could be wrong with this, but I want to assert that GPS is probably the biggest service that affects everyone that's provided by satellites. Would you agree with that offer a different explanation? 

[00:50:41] Frank: Yeah. So my prior life I was in the Marines. I was in the Marines for awhile, served some time in Iraq as a reserve as to when I first joined the Marines.

One of the things we had to learn, how to do was land navigation. We had to use a compass. Everybody remembers what a compass is. It was called a Lindsey Zadek compass. You know, we had to learn how to do terrain navigating. Learn where the mountain tops were and triangulate our position and all that stuff, using a compass and a contour map, you know, get the map out and figure out where you were now at that same time as a young Marine, we saw these other Marines walking around with these big square devices that they would hold up and they didn't need campuses.

And we're like, what are those things? And they're like, oh, this is a tremble, trimmed pack GPS system. I'm like, what the hell is that? And they're like, well, there's satellites up there and they will help you figure out where you are. And we're like, why can't we use those? And they're like, well, you guys need to learn how to do beautiful fashion land navigation first, before you're allowed to use that stuff.

And so this was like 1990. And so that's really when we started to move away and move all in to satellite based GPS, I'm going to say like around 1990, we've become more dependent on it ever since then. The other thing about my old career in the Marines was we used to also use radio navigator. For figuring out where we are.

And there was these high-frequency HF transmission stations around the globe that would transmit these signals. And if you had the right kind of antenna based on the timing, and when the signals are received, you could figure out where you were with this HF navigation system worldwide. Right. And anybody could use it.

And when I was in Hawaii, they had one of these really big ones, huge antennas, HF requires very long antennas. And it was sort of stretched across these two mountain tops. I was in Hawaii for four years. And by the time I left, they had taken that down. It was mothballed in disrepair because of GPS. So all these old legacy systems are going away.

And so now we're all in with GPS and it just becomes more and more and more. What 

[00:52:36] Dave: happens if someone messes with GPS? I mean, presumably someone could be, feel like they're going in the right location and go into the right place and end up some place. Very bad, no good that they didn't want to be. But is that the worst of it or what happens if play out some of the scenarios here with GPS.

What happens beyond that? Can you crash a satellite into the international space station? Can you take out other satellites, take us through what some of the scenarios are here and let's focus on the stuff that's more real versus hypothetical and hyperbolic. Yeah. 

[00:53:11] Frank: So I would say yes, GPS is required for performing timing on things that you want to do with the spacecraft.

So if you need to make an orbital adjustment at a certain specific time point, well, if your source of time is GPS and somebody spoofing the GPS signal that you're getting, you're going to perform your thrust at the wrong time. But satellite builders are very much interested in resilience. And so not necessarily from.

But because of radio interference, interference is like a big thing to be sensitive to. And so what they've done is they've come up with these ideas for things called ensemble clocks. And so they'll use GPS a lot. They rely on it a lot, but they'll also have a Caesium time source too, as a backup. And so they'll combine all these multiple times sources to make sure that not one of them is too far out of line before they do something crazy, like change their orbit and crash into the ISS, like you're saying.

So that is probably highly unlikely unless somebody designed a really bad satellite that only relied on GPS for timing, but then you kind of get scared. So it sounds like 

[00:54:23] Dave: GPS while it could be hacked at the end of the day, for the most part, due to redundancy and reasonable design, it wouldn't be such a big deal.

What do you worry about with respect to real attack surface on the satellites and where could it possibly go? 

[00:54:40] Frank: So my big worry is it's really supply chain. It's like, where do all these components come from? That we're putting into our satellites. We've got some big time dependencies with our supply chain too.

In fact, I think that affected the automobile industry this year because of the lack of Silicon. It just showed where our dependencies were and where things are coming from. I think that's a big concern. How do we make sure that everything that's going into those pieces of Silicon, the logic that's been put in that Silicon is correct and proper.

And also there's a lot of software too, that comes with a lot of these components, not so much in the government, but I would think in the commercial sector where it's, how fast can I get my satellite bill? How fast can I get my payload bill and get them into orbit, right? Maybe there's not as much introspection into the original source of it.

Binary library that I linked into my software to make the payload do this certain thing, like perform some sort of filtering on some of this data or perform some sort of clustering or machine learning algorithm on this data that I'm collecting from space. And what decisions are going to be made based on the results of those computations.

Are they life safety decisions or are they just stock futures for props that I'm looking at, trying to estimate, how are the crops doing well? Are they dying off because of lack of water, supply chain is a big one. I'm 

[00:56:02] Dave: assuming part of that is open source and there's probably a generous use of open source inside satellites.

[00:56:11] Frank: Absolutely. which we talked about before uses Lennox in large part, he uses you boot to bring up the embedded system you boot, and a lot of embedded systems use that stack of software for bring up it's a non-commercial way to bring up embedded systems that works really great. It's ubiquitous in the community to do that.

It's not free of flow. Now I would say with open-source software, Google and Microsoft have contributed a lot of effort and resources to helping the open-source community funds their software, like find flaws in it with bad inputs. So they have these online fuzzing systems to do that. I would hesitate to say that open source software is the chief source of badness.

I would say that it's more of the electronics and some of the Silicon that's coming from other places that could be bad. Some of the boards that are also integrating some of that as well. Yeah. And 

[00:57:00] Dave: doing the research. There was a guy who stated, and his last name is P a V U or Pavar. I'll probably butcher it, but he said, the problem with satellites is they're not built for any level of security.

There's no dark magic and exploiting a satellite. It's just a matter of downloading a couple of open source or freely available tools and plugging all the equipment together to face it at a satellite. Do you agree with that? I 

[00:57:22] Frank: would say that for maybe some non-government satellite. That could potentially be the case for sure.

And so when you think about it, so satellites, they need to communicate for at least two reasons. One is command and control to make sure the satellite stays in the right orbit to make sure that it's reporting its health and status to the ground station. That's running out of fuel. Or if it's running out of power, it's not pointing the right way.

They'll have to send Tel commands to make sure that happens, because what happens over time as the satellite ages or micrometeorites will hit the solar panels and damage them over time. And so they have to make adjustments for that. And so that communication medium is usually done over what's called S band, and it's very limited in bandwidth and sometimes it's not encrypted and that's bad, right.

If you know where the satellite is, Which all satellites are known. No rad keeps track of them and all of the information they call it. Two line elements. Getting into that three body problem. Two line elements are all published online. You can download them. And if you have some satellite plotting software, you can find any satellite undetermined exactly where it is in space at any given time.

Now, the problem for the hacker, it's not really a problem, but like that guy said that you were just reading is with a software defined radio. They can build a system to try to start in, communicate over those. Some of those satellites use S band and try to figure out what the command and control protocol is.

Right? Which may not be too hard because they can listen in and decode some of that stuff. And if they're able to decode it, then they can figure out what the proper commands are to maybe do something bad to that satellite. So that's sort of a scary thing. I would say, if anybody is doing anything.

Monetizing their platform in space or making money or doing something significant for the government. Those are going to be encrypted and that's going to be really hard to do what I was just saying. It's not impossible. And there may be some flaws too, because many times when you implement encryption, maybe you didn't implement it perfectly.

Maybe it goes into the stackup mode where there is no encryption. It sounds 

[00:59:20] Dave: like, sorry to jump in, but it sounds like what he's talking about is since anybody can get a satellite up in space and it's, it is like comically easy when Nilu and I were working on our surveillance state presentation for RSA, one of the enlightening things was going to space X as website.

And just seeing how easy it is to get an estimate to send any crappy satellite you want up in space. Like you're saying, it sounds like there's folks who could send really lousy, unprotected satellites up, and it wouldn't take much anymore. Like you can quickly make bad decisions, just like social media.

And then however, having said that, you know, the more serious. Outfits and so forth and more serious commercial endeavors. You're just not going to have that level of attack surface in most instances. Does that sound about right? 

[01:00:09] Frank: I want to say that I really do, but I'm afraid to say that because something tells me that somewhere someplace, there's this terrible flaw.

Yeah. It's just, I think what we need to do and it's like pulling teeth, but I think we need to introduce this whole idea of adversarial thinking into the space community. And that kind of goes back to what Hackensack was all about, right? It's like, what can an adversary do to this platform, to this space architecture and at the same time, what can I do as defender to defend against it?

And that's just not happening. Especially in the legacy space community, but think about it, you know, think if the big satellite vendors out there like Boeing and Lockheed Martin Intelsat SES, and some of these big global telecommunications companies think if they brought their bus, you know, their big satellite bus to Def con and said, Hey, we're going to offer a $50,000 bug bounty to the first hacker that gains control of our onboard computer and is able to issue commands to our reaction wheels.

The reaction wheels are the things that make the satellite move or our thrusters. That's the game changer, right? If you can get into my satellite and pivot over to my thruster control boards, I'll give you $50,000. If you show me how you did that, right. That's not happening. They're not doing that. 

[01:01:32] Dave: It's largely unknown.

Yep. Exactly. The sensor itself is a struggle. The shoulder shoulders. Go ahead, Jack. I don't 

[01:01:39] Jack: want it to happen, but yeah. Solar winds and colonial pipeline have gotten some attention in places where, for those of us who actually care, there's no satisfaction in the, I told you so's and I mean, this goes back decades to my first forays into security as a, as a network admin.

There's no satisfaction in the, I told you so's, but it's the consequences of you can't have gas on the east coast. We have a whole bunch of people, including healthcare facilities that can't take care of people. I just don't want to think about what the worst case scenario is. I guess one approach is the, um, something really bad, but eventually recoverable with no catastrophic failures could get some attention, but sadly, that has been over the decades, but what it takes sometimes, and to get into worst case scenarios as a Mariner, one of the things that has always been in the back of my head for decades, since I first learned of it, What happens?

Cause it happens every so often. What happens when the magnetic poles start wobbling and flip? Well, best case scenario is we trust GPS like, okay. The really expensive thing in the middle of my sailboat spins and tells me lies, but my iPhone will actually get me home safely. That'd be awesome. Now, if you tell me, you know, it was a mirror, you can't trust your compass and you can't trust your electronics.

That's a different thing. We have line of sight. If you happen to be in the air in aviation or in a military setting where you, you know, things are airborne that are going to come down and do stuff. You want that to be accurate. You want the landing gear to touch the right runway at the right time. You want the things that go, boom.

They need to go boom, where they're supposed to. That's part of my hacker mindset is worst case scenarios. What's the worst. Oh, I guess I'm not sleeping tonight again. I 

[01:03:43] Dave: think, Hm. What we could use here is a whole lot more max headroom incidents. Like let's just, let's hope that it takes that shape and it's just kind of like an eyesore and a little funny and cringy, but a lot less crashy let's so for that, yeah, 

[01:04:02] Jack: yeah, yeah.

Started taking viruses, uh, seriously, like you said, Melissa, I, you know, I love you virus. So it's like as an admin, that was great. Cause it pulled all those MP3s that shouldn't have been off the work computers off the mini way. And I had backups for the things that mattered. Right. It's like, ah, all right.

We, we can now do some stuff. Um, but the consequences of ransom. Can't miss them. What happens if somebody ransomwares the 

[01:04:32] Frank: huddle? Yeah, 

[01:04:34] Dave: let's do this. We'll end that segment. The normal segment on that provocative and timely question. Let's do a modified speed round here. So Frank, we normally ask people what they've last thing they read that that really impacted them.

I'm going to ask you instead, what would you recommend someone read? Who's a newbie to this space. Let's say someone listened to all of this and said, aha. I'd like to learn more. What would you recommend? Where would you point them to begin in their exploration? 

[01:05:06] Frank: There's some dry things. They could read something 

[01:05:09] Dave: fun.

Let's assume it's in a moose. Boosh, if you will. Yeah. So there's 

[01:05:14] Frank: a great science fiction book I read in 2019 and God I'm drawing a blank on the name of the book. I'm going to take a second and I'm going to go get the name of the book. The reason I think it's cool is because it's really focused on what space is going to be like in the next 30 to 40 years.

And I agree that it's going to be like this, and it's focused on space exploration for resources in asteroid, mining and mining the moon for critical resources like water and other rare earths and things like that. And it mixes in heavy commercialization of that environment. And there's this one scene in the book, one chapter in the book where the company that built the spacecraft that sent all these people on their mining mission, didn't really tell them that the backup plan in case something happened was that there was no backup.

And so the knowledge of what was going on was being sort of spoofed. Like the crew had no idea what reality was, and didn't know the fact that there wasn't enough oxygen to get back to earth. And they were going to send out some space tugs to tug the ship full of railroads and things like that back to earth with a dead crew.

And so they figured out what was going on and they hacked the onboard computers on their spaceship. And they figured out that all of the information that they were being told was a huge lie. And so I really liked this book because I really think that there's going to be this huge rush to commercialize space for resources.

And also it kind of touched on the ubiquitous use of computers and networks and how vulnerable we are with those dependencies. If we don't start thinking about protecting them and thinking about what is the adversary potentially going to do is first name's David Goodstein, reinstalling, Kendall. Okay.

Thank you. See, that's one of the things, just, you get all these nice updates from apple, right? And they, re-install your, uh, your apps for you to, as you, as you go to use them, 

[01:07:25] Dave: we normally ask people what gives them hope for what's going for, because security is such a dark place, but it actually sounds like honestly, there isn't a lot of, there's no grim Reaper standing over the commercial space industry.

If anything, there's a lot of excitement on the satellite side, there's a ton more satellites. There's a ton more promise. There's a bunch of interesting things happen. You know, there's really, if anything, there's some dark clouds that are out there, but they ain't so dark and there's a lot more excitement and hope and optimism.

Is that a fair characterization? 

[01:08:01] Frank: I think so. You know, I think you're spot on with that. I think there's a lot of like everything, anything technology-based, there's a good side and there's a bad side. I think the upside is much better than the downsides for sure. And we see this all the time, the power and the great things that have come from the internet.

I remember the first time that I was able to see a library catalog on a dial up modem of a library in, I think it was a library in Israel. I was on a 2,400 baud modem and I was able to get to the card catalog in a university in Israel. I was like, this is amazing. That kind of stuff. That was enabled by the creation of the internet far outweighs the bad stuff.

Although the bad stuff that can be super, super bad at times like this whole solar winds thing, I like Jack was talking about solar winds. Goodness gracious. You know, the thing that you trust that you install on your network to help you defend your network is actually the thing that takes your network down.

We really need to think harder about this. Okay. So the book, the book is called Delta V and it's asteroid mining. It gets us to space and the author is Daniel Suarez. All right. If you want to get into space and understand where we're going in space and also with the sprinkles of cybersecurity, this is a great book to read.

It's sort of riveting and it's believable too. Like you can actually see a lot of this stuff coming up. With some of these big commercial oligarchies that could potentially come to be in the, in the next 50 

[01:09:31] Dave: years, that's a great place to end on. And, you know, I think we need to have you back when all this stuff plays itself out a little more.

And when this has become a bigger thing in about like five to 10 years and when you become cynical, it'll be far more fun to talk.

[01:09:50] Jack: Yeah, this was great. Thank you so much for joining. 

[01:09:54] Frank: Absolutely. I appreciate it. It was, it's always fun to talk about this stuff. There's so many interesting avenues and angles and nuances about it. It'll be fun to see where it all turns out. 

[01:10:04] Dave: Awesome. All right. Brilliant. 

[01:10:06] Jack: Thanks again, Frank. Thank you. Thanks guys.

Thanks for joining us for this episode of security voices. After previewing the episode, Frank asked us to mention a few things. The winning team, and the first hack of set competition was indeed PFS from the United States. Second place was the Polish team. Poland can into space. The team that ran away with the competition, but failed to command the on orbit spacecraft was solar wine from Belgium, France, and Switzerland.

It was a very tough loss for them and hard to see it happen. But rules are rules. Also, Frank wanted to clarify that the small set conference is hosted by Utah state university at Logan. If you'd like to hear other episodes of security voices or learn more about our guests, check out our website@securityvoices.org and subscribe to the podcast on your pod.

Catcher of choice. If you have comments, questions, or feedback, please reach out to us@infoatsecurityvoices.org until next time. Thanks for listening. .