Space Security Challenge


As a follow up to previous post, the Space Security Challenge or Hack A Sat (HaS) has a website. Although DEFCON 28 will be virtual this year (DEFCON Safe Mode), the Final event / challenge (“Hack a Sat Capture The Flag” hosted by the virtual Aerospace Village) will happen in August and the qualification phase is ongoing (registration closes May 24 and qualification event starts May 22).

Workshops on satellite will also be organized in August.

Rules edited by the Air Force Research Lab are availble (pdf) :

The top 10 teams will be requested to submit a “Qualification Event Technical Paper” describing the solutions for 5 challenges solved during the qualification. Papers will be reviewed by the organizer before a formal invitation to the Final Event (online) is sent to the team. 8 teams will participe, 2 will be on standby.

The Final event is composed of a new CTF (FlatSat) followed by an On-orbit challenge for teams with all the FlatSat challenges solved. A technical papers will also be requested at the end.

Each entrant must include at least one U.S. citizen or permanent resident. Official Government entities are not eligible (that makes two reasons preventing foreign space agencies to participate to this U.S. challenge).

I like the disqualification rules :

– Utilizing or engaging in Denial of service against other competitors is strictly forbidden
– All patches to open-source software must be made available according to open source license guidelines
– Any vulnerabilities discovered in open-source software must be made available to the public via a public disclosure process
– No physical coercion or intimidation is allowed
– Any acts of sabotage, tampering, misuse, attacks, or use without consent of the contest organizers property, contest infrastructure, equipment, software, or items that pertain to the contest that are outside of the contest environment are expressly forbidden

Of course, the usual disclaimer alerting participants of monitoring and interception are in the document. Publicity (disclosure) will also be part of the deal.





Content from HackASat published with permission.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.